@go-to-k/cdkd 0.291.18 → 0.291.20

package/dist/{deploy-engine-BwDlgFRs.js → deploy-engine-CkF6PyFY.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-CJkb2usU.js";
+import { t as getCdkdVersion } from "./version-BYrVI73L.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4120,6 +4120,109 @@ var ContextStore = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ambient-client-defaults.ts
+/**
+* Client config for an SDK client built OUTSIDE `AwsClients` (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)).
+*
+* `awsClientDefaults()` alone carries the ambient ENVIRONMENT — `AWS_PROFILE`,
+* a published `--role-arn` role, the proxy handler, a stack scope's region — but
+* not an explicit `AwsClientConfig.credentials` object, which has no
+* environment path at all. A LIBRARY caller that installs
+* `new AwsClients({ credentials })` (`AwsClients` / `setAwsClients` are public
+* exports) therefore had every client a provider, context provider,
+* asset publisher or the cross-account STS hop built for itself signing with
+* the default credential chain: a different identity from the one it
+* configured. {@link ambientClientDefaults} closes that for every site at once
+* by reading the ACTIVE clients' {@link AwsClients.credentialConfig}.
+*
+* BOUND: a site that caches its client (every SDK provider's lazy
+* `getClient()`) captures the identity active at its FIRST call. cdkd builds a
+* provider registry per stack inside that stack's scope, so this is the stack's
+* identity; a library caller that reuses one registry across `setAwsClients`
+* switches keeps the first identity's clients.
+*
+* SPREAD IT FIRST, exactly where `awsClientDefaults()` was spread:
+*
+* `new GlueClient({ ...ambientClientDefaults(), ...(region && { region }) })`
+*
+* The site's own keys still win, so a site that names its own `region` or its
+* own `credentials` keeps them. `scripts/check-aws-client-defaults.ts` accepts
+* this helper as the defaults spread (it calls `awsClientDefaults` afresh per
+* call, so each client still gets its own routing agent), and
+* `tests/unit/utils/ambient-client-defaults-fence.test.ts` refuses a new
+* `awsClientDefaults()`-only construction under `src/**`.
+*
+* Its own module rather than a member of `aws-clients.ts` so that a test which
+* `vi.mock`s `aws-clients.js` with a `getAwsClients` double still reaches this
+* code and degrades, instead of losing the export. It is deliberately OUTSIDE
+* the literal-`.ts` closure `scripts/audit-provider-coverage.ts` resolves
+* (nothing in that closure imports it), and neither module it imports imports
+* it back, so there is no cycle.
+*/
+/**
+* The ACTIVE clients' credential configuration: the stack scope's
+* `AwsClients` inside `runWithStackAwsClients`, else the process-global one.
+*
+* `{}` when those clients carry none (every CLI run passes no explicit
+* `credentials`, and `--profile` alone yields `{ profile }`), and also for a
+* test double that has no `credentialConfig` getter — degrading to the plain
+* `awsClientDefaults()` answer rather than throwing.
+*
+* Read through `getAwsClients()`, which creates an unconfigured global on first
+* use when nothing installed one. That is side-effect free here: its service
+* clients are lazy, no production call passes `getAwsClients(config)` (so no
+* later configuration is shadowed), and `setAwsClients` replaces it.
+*/
+function ambientCredentialConfig() {
+	return getAwsClients()?.credentialConfig ?? {};
+}
+/**
+* `awsClientDefaults(...)` plus `credentialConfig`, in `AwsClients.clientOptions`'
+* spread order: the defaults FIRST, so an explicit `credentials` outranks a
+* published `--role-arn` role, then `profile`, then `credentials`.
+*
+* Takes the configuration as an argument for the callers that must key a cache
+* on the SAME reading they build from ({@link credentialFingerprint}); every
+* other site calls {@link ambientClientDefaults}.
+*/
+function clientDefaultsFor(credentialConfig) {
+	return {
+		...awsClientDefaults({ profile: credentialConfig.profile }),
+		...credentialConfig.profile && { profile: credentialConfig.profile },
+		...credentialConfig.credentials && { credentials: { ...credentialConfig.credentials } }
+	};
+}
+/**
+* The config every SDK client built outside `AwsClients` spreads first: the
+* proxy / role / scope-region defaults plus the ACTIVE clients' profile and
+* explicit credentials.
+*/
+function ambientClientDefaults() {
+	return clientDefaultsFor(ambientCredentialConfig());
+}
+/**
+* A cache-key component naming WHICH identity a credential configuration
+* selects, for a cache that holds a client (or credentials) built from it.
+*
+* `profile` plus the explicit credentials' ACCESS KEY ID — never the secret
+* key or the session token. The access key id is an identifier rather than a
+* secret (`expected-bucket-owner.ts` already keys its account cache on it), and
+* STS issues a distinct one per session, so two different explicit bags are
+* told apart. The one collision is two bags sharing an access key id with
+* different secrets, at most one of which can be valid.
+*
+* What it does NOT carry, because it is PROCESS-WIDE rather than per
+* configuration: a published `--role-arn` role (set once, refused a second
+* time), the proxy, and `AWS_PROFILE` / the environment chain. Two readings
+* with equal fingerprints within one process therefore resolve to the same
+* identity. Do not log it.
+*/
+function credentialFingerprint(credentialConfig) {
+	return JSON.stringify([credentialConfig.profile ?? null, credentialConfig.credentials?.accessKeyId ?? null]);
+}
+
 //#endregion
 //#region src/synthesis/context-providers/az-provider.ts
 /**
@@ -4138,7 +4241,7 @@ var AZContextProvider = class {
 		const region = props["region"] || this.awsConfig?.region;
 		this.logger.debug(`Fetching availability zones for region: ${region}`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4171,7 +4274,7 @@ var SSMContextProvider = class {
 		if (!parameterName) throw new Error("SSM context provider requires parameterName property");
 		this.logger.debug(`Reading SSM parameter: ${parameterName} (region: ${region})`);
 		const client = new SSMClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4213,7 +4316,7 @@ var HostedZoneContextProvider = class {
 		if (!domainName) throw new Error("Hosted zone context provider requires domainName property");
 		this.logger.debug(`Looking up hosted zone: ${domainName} (private: ${privateZone})`);
 		const client = new Route53Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4267,7 +4370,7 @@ var VpcContextProvider = class {
 		const returnVpnGateways = props["returnVpnGateways"];
 		this.logger.debug(`Looking up VPC (region: ${region}, filter: ${JSON.stringify(filter)})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4433,7 +4536,7 @@ var CcApiContextProvider = class {
 		if (!typeName) throw new Error("CC API context provider requires typeName property");
 		this.logger.debug(`CC API lookup: ${typeName}${exactIdentifier ? ` (id: ${exactIdentifier})` : ""} (region: ${region})`);
 		const client = new CloudControlClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4560,7 +4663,7 @@ var AmiContextProvider = class {
 		const filters = props["filters"];
 		this.logger.debug(`Looking up AMI (region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4603,7 +4706,7 @@ var SecurityGroupContextProvider = class {
 		const vpcId = props["vpcId"];
 		this.logger.debug(`Looking up security group (id: ${securityGroupId}, name: ${securityGroupName}, region: ${region})`);
 		const client = new EC2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4657,7 +4760,7 @@ var LoadBalancerContextProvider = class {
 		const loadBalancerType = props["loadBalancerType"];
 		this.logger.debug(`Looking up load balancer (arn: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4699,7 +4802,7 @@ var LoadBalancerListenerContextProvider = class {
 		const listenerProtocol = props["listenerProtocol"];
 		this.logger.debug(`Looking up load balancer listener (arn: ${listenerArn}, lb: ${loadBalancerArn}, region: ${region})`);
 		const client = new ElasticLoadBalancingV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -4743,7 +4846,7 @@ var KeyContextProvider = class {
 		if (!aliasName) throw new Error("Key context provider requires aliasName property");
 		this.logger.debug(`Looking up KMS key by alias: ${aliasName} (region: ${region})`);
 		const client = new KMSClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...region && { region }
 		});
 		try {
@@ -6647,7 +6750,7 @@ async function expandMacrosAttempt(template, opts, logger) {
 		const parameters = buildParameterValues(template, logger);
 		ownsClient = opts.cfnClient === void 0;
 		cfn = opts.cfnClient ?? new CloudFormationClient({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			region
 		});
 		let templateInput;
@@ -7778,7 +7881,7 @@ var FileAssetPublisher = class {
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
 			this.logger.debug(`Publishing file asset ${asset.displayName || assetHash} → s3://${bucketName}/${objectKey}`);
 			const client = new S3Client({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9694,20 +9797,31 @@ function buildDockerBuildCommand(source, tag, platformOverride) {
 function ecrUrlSuffix(region) {
 	return derivePartitionAndUrlSuffix(region).urlSuffix;
 }
+/** An AWS account id: exactly twelve digits. */
+const ACCOUNT_ID = /^\d{12}$/;
 /**
-* Registries this process has already logged in to, keyed by registry host
-* (`<accountId>.dkr.ecr.<region>.<urlSuffix>`, which uniquely encodes the
-* account + region credential context). ECR authorization tokens are valid
-* for ~12h and a deploy process is short-lived, so a successful login is
-* reused for the process lifetime — mirroring `cdk-assets`, which skips
-* re-login on repeat publishes. Keyed per registry (NOT globally) so that
-* cross-account / cross-region assets each get their own login.
+* The DNS-label charset a region id is drawn from (a trailing hyphen is not
+* refused; the host stays under the AWS-owned suffix either way).
+* `src/utils/ecr-uri.ts` holds the same class for the pull side.
+*/
+const REGION_LABEL = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
+/**
+* The ECR registry host an asset is pushed to. The push URI AND the
+* `docker login` endpoint are both built from this one value, so the login
+* always targets the host the push uses (issue #3681).
 *
-* Module-level (not an instance field) because the deploy pipeline may
-* construct more than one `DockerAssetPublisher` per run (e.g. one per
-* WorkGraph asset-publish node), and the login is genuinely process-wide.
+* The region comes from the asset manifest, and the ECR password is sent to
+* this host, so both halves are charset-gated HERE: a region like
+* `x.example.com/` would otherwise name a host AWS does not own. The suffix is
+* the AWS-owned one `derivePartitionAndUrlSuffix` returns. A known-region
+* check is deliberately absent, so a region cdkd has not heard of yet still
+* publishes.
 */
-const loggedInRegistries = /* @__PURE__ */ new Set();
+function ecrRegistryHost(accountId, region) {
+	if (typeof accountId !== "string" || !ACCOUNT_ID.test(accountId)) throw new AssetError(`Refusing to publish a Docker image asset: ${displayIdent(accountId)} is not a 12-digit AWS account id`);
+	if (typeof region !== "string" || region.length > 63 || !REGION_LABEL.test(region)) throw new AssetError(`Refusing to publish a Docker image asset: the destination region ${displayIdent(region)} is not a valid AWS region id`);
+	return `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+}
 /**
 * Whether a `docker push` failure looks like an ECR authentication failure
 * (missing / stale / expired credential) rather than a network / repo / other
@@ -9737,10 +9851,11 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
+			const registryHost = ecrRegistryHost(accountId, destRegion);
+			const ecrUri = `${registryHost}/${repositoryName}:${imageTag}`;
 			this.logger.debug(`Publishing Docker image ${asset.displayName || assetHash} → ${ecrUri}`);
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9750,7 +9865,7 @@ var DockerAssetPublisher = class {
 				}
 				const localTag = `cdkd-asset-${assetHash}`;
 				await this.buildImage(asset, cdkOutputDir, localTag, cdkOutputDir);
-				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, registryHost);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -9777,9 +9892,10 @@ var DockerAssetPublisher = class {
 			const repositoryName = this.resolvePlaceholders(dest.repositoryName, accountId, region);
 			const imageTag = this.resolvePlaceholders(dest.imageTag, accountId, region);
 			const destRegion = dest.region ? this.resolvePlaceholders(dest.region, accountId, region) : region;
-			const ecrUri = `${accountId}.dkr.ecr.${destRegion}.${ecrUrlSuffix(destRegion)}/${repositoryName}:${imageTag}`;
+			const registryHost = ecrRegistryHost(accountId, destRegion);
+			const ecrUri = `${registryHost}/${repositoryName}:${imageTag}`;
 			const client = new ECRClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region: destRegion
 			});
 			try {
@@ -9787,7 +9903,7 @@ var DockerAssetPublisher = class {
 					this.logger.debug(`Image already exists, skipping: ${ecrUri}`);
 					continue;
 				}
-				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, accountId, destRegion);
+				await this.tagAndPushWithLazyLogin(client, localTag, ecrUri, registryHost);
 				this.logger.debug(`✅ Published: ${ecrUri}`);
 			} finally {
 				client.destroy();
@@ -9854,18 +9970,17 @@ var DockerAssetPublisher = class {
 	* round-trip (~3.3s saved). We attempt the push FIRST and only pay the login
 	* when it is actually needed:
 	*
-	*   1. If this PROCESS already logged into the registry (issue #1184 cache),
-	*      push directly — still self-healing: a mid-process token expiry falls
-	*      into the same auth-failure retry below.
-	*   2. Otherwise push optimistically. On a NON-auth failure (network,
-	*      repo-not-found, etc.) surface the error unchanged. On an auth failure
-	*      (no pre-existing cred, OR a stale/expired cred), run a forced ECR
-	*      login and retry the push ONCE.
+	*   1. Push optimistically. A login earlier in this process (or session)
+	*      left a credential in docker's store, so a repeat push to the same
+	*      registry needs no new login — docker's store is the only login cache.
+	*   2. On a NON-auth failure (network, repo-not-found, etc.) surface the
+	*      error unchanged. On an auth failure (no pre-existing cred, OR a
+	*      stale/expired cred), log in to ECR and retry the push ONCE.
 	*
 	* A stale cred and a missing cred take the SAME branch, so cdkd never
 	* fail-hard on an expired credential — it re-logs in and retries.
 	*/
-	async tagAndPushWithLazyLogin(client, localTag, fullUri, accountId, region) {
+	async tagAndPushWithLazyLogin(client, localTag, fullUri, registryHost) {
 		await this.tagImage(localTag, fullUri);
 		try {
 			await this.pushImage(fullUri);
@@ -9875,34 +9990,23 @@ var DockerAssetPublisher = class {
 			if (!isDockerAuthFailure(e.stderr || e.message || String(err))) throw err;
 			this.logger.debug(`Docker push to ${fullUri} failed with an auth error; logging in to ECR and retrying`);
 		}
-		await this.ecrLogin(client, accountId, region, { force: true });
+		await this.ecrLogin(client, registryHost);
 		await this.pushImage(fullUri);
 	}
 	/**
-	* Authenticate with ECR via `docker login --password-stdin`.
+	* Authenticate with ECR via `docker login --password-stdin`, against
+	* `registryHost` — the host the push targets (`ecrRegistryHost`).
 	*
-	* The login is cached per registry (`<accountId>.dkr.ecr.<region>.<urlSuffix>`) for the
-	* process lifetime: a repeat publish to the same registry returns early
-	* without the `GetAuthorizationToken` call or the `docker login` subprocess
-	* (mirrors `cdk-assets`). ECR tokens are valid ~12h and a deploy process is
-	* short-lived, so this is safe. Keyed per registry so cross-account /
-	* cross-region assets each get their own login.
-	*
-	* `force: true` bypasses the per-process cache short-circuit — used by the
-	* lazy-login retry after a push fails auth, where the cached entry may hold a
-	* token that AWS has already expired.
+	* Called only after a push failed auth, so it always logs in: a repeat push
+	* to a registry already logged in to succeeds on the credential docker
+	* stored and never reaches here (#1193).
 	*/
-	async ecrLogin(client, accountId, region, options = {}) {
-		const registryKey = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
-		if (!options.force && loggedInRegistries.has(registryKey)) {
-			this.logger.debug(`Reusing cached ECR login for ${registryKey}`);
-			return;
-		}
+	async ecrLogin(client, registryHost) {
 		const authData = (await client.send(new GetAuthorizationTokenCommand({}))).authorizationData?.[0];
 		if (!authData?.authorizationToken) throw new AssetError("Failed to get ECR authorization token");
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
-		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+		const endpoint = `https://${registryHost}`;
 		const loginArgs = [
 			"login",
 			"--username",
@@ -9912,7 +10016,6 @@ var DockerAssetPublisher = class {
 		];
 		try {
 			await runDockerStreaming(loginArgs, { input: password });
-			loggedInRegistries.add(registryKey);
 		} catch (err) {
 			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`, redactedDockerCause(err, loginArgs));
 		}
@@ -11322,7 +11425,7 @@ var AssetPublisher = class {
 			if (!accountId) {
 				const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 				const stsClient = new STSClient({
-					...awsClientDefaults(),
+					...ambientClientDefaults(),
 					region
 				});
 				accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -26557,7 +26660,8 @@ function applyCallerIdentityCredentials(env) {
 //#endregion
 //#region src/utils/role-arn.ts
 /**
-* Process-lifetime cache of assumed credentials keyed by RoleArn.
+* Process-lifetime cache of assumed credentials keyed by RoleArn AND the
+* SOURCE identity the `sts:AssumeRole` hop runs as.
 *
 * Storing the in-flight `Promise` (rather than the resolved value) collapses
 * concurrent first-time callers into a single `sts:AssumeRole` request. After
@@ -26565,10 +26669,19 @@ function applyCallerIdentityCredentials(env) {
 * stack that references the same producer N times via `Fn::GetStackOutput`
 * only pays the STS hop once.
 *
-* The cache is keyed by RoleArn alone (not RoleArn + region) because STS
-* credentials are global — assumed credentials work against any region's
-* service endpoint. The downstream S3 client built from these credentials
-* picks its own region via `GetBucketLocation`.
+* Not keyed by region, because STS credentials are global — assumed
+* credentials work against any region's service endpoint. The downstream S3
+* client built from these credentials picks its own region via
+* `GetBucketLocation`.
+*
+* KEYED BY THE SOURCE IDENTITY TOO (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)): the hop runs as the
+* ACTIVE `AwsClients`' credential configuration, and a library caller can
+* install (`setAwsClients`) two different explicit credentials in one process,
+* as can cdkd's own per-stack scopes. Keyed by RoleArn alone, the second would be handed
+* credentials the FIRST identity obtained — a role the second one may not even
+* be trusted to assume. The source half is `credentialFingerprint`'s (profile +
+* access key id, never secret material).
 *
 * **Expiration handling**: on every cache hit, the cached credentials'
 * `expiration` is compared against `Date.now()` with a 60-second safety
@@ -26628,7 +26741,7 @@ function parseIamRoleArn(roleArn) {
 * the consumer account's normal credentials). Threading the credentials
 * through a fresh `S3Client` via this helper keeps the scope narrow.
 *
-* **Why cache per-RoleArn for the process lifetime.** A multi-resource
+* **Why cache per RoleArn (and source identity) for the process lifetime.** A multi-resource
 * stack typically references `Fn::GetStackOutput` from many template sites
 * (every IAM policy / Lambda env / ALB listener that pulls a shared VPC ID
 * from a platform stack). Assuming the role once per deploy is sufficient;
@@ -26651,17 +26764,19 @@ function parseIamRoleArn(roleArn) {
 * uniformly), but the next caller after rejection gets a clean slate.
 */
 async function assumeRoleForCrossAccountStateRead(roleArn) {
-	const cached = crossAccountCredentialsCache.get(roleArn);
+	const sourceConfig = ambientCredentialConfig();
+	const cacheKey = JSON.stringify([credentialFingerprint(sourceConfig), roleArn]);
+	const cached = crossAccountCredentialsCache.get(cacheKey);
 	if (cached) {
 		const cachedCreds = await cached;
 		if (!cachedCreds.expiration || Date.now() < cachedCreds.expiration.getTime() - CRED_EXPIRY_SAFETY_MS) return cachedCreds;
-		crossAccountCredentialsCache.delete(roleArn);
+		crossAccountCredentialsCache.delete(cacheKey);
 	}
 	const promise = (async () => {
 		const logger = getLogger().child("role-arn");
 		const displayRoleArn = displayIdent(roleArn, { maxCodePoints: 613 });
 		logger.debug(`Assuming role for cross-account state read: ${displayRoleArn}`);
-		const sts = new STSClient({ ...awsClientDefaults() });
+		const sts = new STSClient({ ...clientDefaultsFor(sourceConfig) });
 		try {
 			let response;
 			try {
@@ -26688,10 +26803,10 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 			sts.destroy();
 		}
 	})().catch((err) => {
-		if (crossAccountCredentialsCache.get(roleArn) === promise) crossAccountCredentialsCache.delete(roleArn);
+		if (crossAccountCredentialsCache.get(cacheKey) === promise) crossAccountCredentialsCache.delete(cacheKey);
 		throw err;
 	});
-	crossAccountCredentialsCache.set(roleArn, promise);
+	crossAccountCredentialsCache.set(cacheKey, promise);
 	return promise;
 }
 /**
@@ -27485,6 +27600,88 @@ function mergeHealedAttributes(recorded, healed, isStaleValue) {
 	return merged ?? recorded;
 }
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -28588,7 +28785,7 @@ var WAFv2WebACLProvider = class {
 	])]]);
 	getClient() {
 		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client({
-			...awsClientDefaults(),
+			...ambientClientDefaults(),
 			...this.providerRegion ? { region: this.providerRegion } : {}
 		});
 		return this.wafv2Client;
@@ -28626,13 +28823,23 @@ var WAFv2WebACLProvider = class {
 			}))).Summary;
 			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
 			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
+			let labelNamespace;
+			try {
+				labelNamespace = (await this.getClient().send(new GetWebACLCommand({
+					Id: summary.Id,
+					Name: name,
+					Scope: scope
+				}))).WebACL?.LabelNamespace;
+			} catch (readError) {
+				this.logger.debug(`Could not read the label namespace of ${logicalId} after create: ${describeAwsFailure(readError).detail}`);
+			}
 			return {
 				physicalId: summary.ARN,
-				attributes: {
+				attributes: definedAttributes({
 					Arn: summary.ARN,
 					Id: summary.Id,
-					LabelNamespace: summary["LabelNamespace"]
-				}
+					LabelNamespace: labelNamespace
+				})
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -28830,19 +29037,33 @@ var WAFv2WebACLProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `GetWebACL` (parses
-	*     Name/Id/Scope back out of the ARN).
+	*     Name/Id/Scope back out of the ARN). CloudFormation's compound
+	*     `name|id|scope` physical id — what `--migrate-from-cloudformation`
+	*     passes — is accepted too and recorded under the ARN (issue #3627).
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
-			const { id, name, scope } = parseWebACLArn(input.knownPhysicalId);
-			await this.getClient().send(new GetWebACLCommand({
+			const compound = /^([^|]+)\|([^|]+)\|(REGIONAL|CLOUDFRONT)$/.exec(input.knownPhysicalId);
+			const { id, name, scope } = compound ? {
+				name: compound[1],
+				id: compound[2],
+				scope: compound[3]
+			} : parseWebACLArn(input.knownPhysicalId);
+			if (!id || !name) return null;
+			const resp = await this.getClient().send(new GetWebACLCommand({
 				Id: id,
 				Name: name,
 				Scope: scope
 			}));
+			const arn = resp.WebACL?.ARN;
+			if (!arn) return null;
 			return {
-				physicalId: input.knownPhysicalId,
-				attributes: {}
+				physicalId: arn,
+				attributes: definedAttributes({
+					Arn: arn,
+					Id: resp.WebACL?.Id,
+					LabelNamespace: resp.WebACL?.LabelNamespace
+				})
 			};
 		} catch (err) {
 			if (err instanceof WAFNonexistentItemException) return null;
@@ -30012,6 +30233,18 @@ async function allSettledKeepingFirstRejection(promises, onAbandoned) {
 	}
 }
 /**
+* The key for the resolver's per-region SDK client caches ({@link
+* IntrinsicFunctionResolver}'s `cfnClients`, `regionScopedClients` and
+* `serviceDiscoveryClients`): the region PLUS the credential fingerprint of the
+* configuration the cached client was built from (issue
+* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). Encoded through
+* {@link injectiveKey}, so no region or profile spelling can forge another
+* pair's key.
+*/
+function clientCacheKey(region, credentialConfig) {
+	return injectiveKey(region, credentialFingerprint(credentialConfig));
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -30493,15 +30726,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* foreign region per resolver, versus the ambient clients which are already
 	* created and destroyed per stack by `deploy.ts`.
 	*
-	* KEYED BY REGION ALONE, which means an entry also pins the CREDENTIAL
-	* configuration of whichever ambient instance was current at the first
-	* mismatch for that region. That is sound today because the credential half
-	* is process-wide rather than per-stack: `--profile` comes from one CLI
-	* option and `--role-arn` lands in `process.env`, so every ambient instance
-	* a run installs carries the same one. Widen the key to include
-	* {@link AwsClients.credentialConfig} the moment that stops being true —
-	* per-stack credentials would otherwise let one stack's lookups run under
-	* another's identity, which is a worse bug than the one this cache serves.
+	* KEYED BY REGION AND CREDENTIAL FINGERPRINT ({@link clientCacheKey}, issue
+	* [#3588](https://github.com/go-to-k/cdkd/issues/3588)). An entry pins the
+	* credential configuration of the ambient instance it was derived from, and
+	* that half is process-wide only for the CLI (one `--profile`, one
+	* `--role-arn`): a LIBRARY caller can drive one resolver across two
+	* `setAwsClients` installs (or cdkd's per-stack scopes) with different
+	* explicit credentials, and keyed by region alone the second's lookups ran under the first's
+	* identity. {@link cfnClients} and {@link serviceDiscoveryClients} share the
+	* key for the same reason, and the two CloudFormation fallback memos
+	* ({@link cfnExportsPromises}, {@link cfnStackOutputsCache}) carry the
+	* fingerprint too.
+	*
+	* THE CLIENT HALF IS CLOSED, NOT THE WHOLE CLASS: {@link cachedDynamicReferences}
+	* (keyed by the expression alone) and the PROCESS-GLOBAL account identity
+	* behind `getAccountInfo` still assume one identity per resolver and per
+	* process respectively — a value one identity read is served to the next.
 	*/
 	regionScopedClients = /* @__PURE__ */ new Map();
 	/**
@@ -30568,9 +30808,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/**
 	* Per-region CloudFormation clients for the cross-stack fallback
 	* lookups (issue #1697). Keyed by region because `Fn::GetStackOutput`
-	* may target a region different from the consumer's deploy region.
+	* may target a region different from the consumer's deploy region, and by
+	* the credential fingerprint for {@link regionScopedClients}' reason.
 	*/
-	cfnClients = {};
+	cfnClients = /* @__PURE__ */ new Map();
 	/**
 	* Memoized full `ListExports` listing for the `Fn::ImportValue`
 	* fallback (issue #1697 review). Without it, EVERY cdkd-miss import
@@ -30582,14 +30823,18 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* deploys. FAILED fetches are not cached (the rejection handler
 	* clears the slot) so a transient throttle does not poison the rest
 	* of the deploy's lookups.
+	*
+	* Keyed by the credential fingerprint (issue #3588): a listing is an answer
+	* one identity was allowed to read, so it is never handed to another.
 	*/
-	cfnExportsPromise;
+	cfnExportsPromises = /* @__PURE__ */ new Map();
 	/**
 	* Memoized per-(region, stack) `DescribeStacks` outputs for the
 	* `Fn::GetStackOutput` fallback (issue #1697 review) — a stack
 	* referencing the same CFn producer N times pays one call. Successful
 	* lookups (including the definitive "stack does not exist" miss) are
-	* cached; lookup FAILURES are evicted so they are retried.
+	* cached; lookup FAILURES are evicted so they are retried. Keyed by the
+	* credential fingerprint as well, for {@link cfnExportsPromises}' reason.
 	*/
 	cfnStackOutputsCache = /* @__PURE__ */ new Map();
 	/**
@@ -30821,11 +31066,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
 		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${displaySafe(stripControlChars(loggedTarget)).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
-		const cached = this.regionScopedClients.get(target);
+		const cacheKey = clientCacheKey(target, ambient.credentialConfig ?? {});
+		const cached = this.regionScopedClients.get(cacheKey);
 		if (cached) return cached;
 		if (canonicalizeRegion(ambient.configuredRegion) === target) return ambient;
 		const scoped = ambient.withRegion(target);
-		this.regionScopedClients.set(target, scoped);
+		this.regionScopedClients.set(cacheKey, scoped);
 		this.logger.debug(`Using region-scoped AWS clients for ${displaySafe(loggedTarget)}`);
 		return scoped;
 	}
@@ -30856,21 +31102,21 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `getAccountInfo`'s in-flight promise and reach here one at a time, which
 	* the case says out loud. A REJECTED import is evicted
 	* so a transient failure does not poison the rest of the deploy, mirroring
-	* `cfnExportsPromise`. Lifetime is the resolver's own, like
+	* `cfnExportsPromises`. Lifetime is the resolver's own, like
 	* {@link regionScopedClients} and {@link cfnClients}: at most one per region
 	* per resolver, versus the one-per-CALL this replaces.
 	*/
 	async serviceDiscoveryClient() {
 		const scoped = this.clientsForRegion(this.explicitRegion);
 		const region = scoped.configuredRegion;
-		const key = region ?? "";
+		const credentialConfig = scoped.credentialConfig ?? {};
+		const key = clientCacheKey(region ?? "", credentialConfig);
 		const cached = this.serviceDiscoveryClients.get(key);
 		if (cached) return cached;
 		const building = (async () => {
 			const { ServiceDiscoveryClient } = await import("@aws-sdk/client-servicediscovery");
 			return new ServiceDiscoveryClient({
-				...awsClientDefaults({ profile: scoped.credentialConfig?.profile }),
-				...scoped.credentialConfig ?? {},
+				...clientDefaultsFor(credentialConfig),
 				...region ? { region } : {}
 			});
 		})();
@@ -33276,12 +33522,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the same not-found error anyway.
 	*/
 	async lookupCfnExport(exportName, context) {
-		let listing = this.cfnExportsPromise;
+		const listingKey = credentialFingerprint(ambientCredentialConfig());
+		let listing = this.cfnExportsPromises.get(listingKey);
 		if (!listing) {
-			listing = this.fetchAllCfnExports();
-			this.cfnExportsPromise = listing;
-			listing.catch(() => {
-				if (this.cfnExportsPromise === listing) this.cfnExportsPromise = void 0;
+			const fetched = this.fetchAllCfnExports();
+			listing = fetched;
+			this.cfnExportsPromises.set(listingKey, fetched);
+			fetched.catch(() => {
+				if (this.cfnExportsPromises.get(listingKey) === fetched) this.cfnExportsPromises.delete(listingKey);
 			});
 		}
 		try {
@@ -33351,7 +33599,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* contract as {@link lookupCfnExport}.
 	*/
 	async lookupCfnStackOutputs(stackName, region, context, loggedRegionText) {
-		const cacheKey = injectiveKey(region, stackName);
+		const cacheKey = injectiveKey(region, stackName, credentialFingerprint(ambientCredentialConfig()));
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
 			fetch = this.fetchCfnStackOutputs(stackName, region);
@@ -33402,19 +33650,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Not routed through {@link clientsForRegion}: the region here is always
 	* the one the caller named, never the ambient's, and a test double without
 	* `credentialConfig` degrades to the default chain rather than throwing.
-	* Keyed by region alone for the reason {@link regionScopedClients} gives:
-	* the credential half is process-wide.
+	* Keyed by region AND credential fingerprint for the reason
+	* {@link regionScopedClients} gives (issue #3588).
 	*/
 	getCfnClient(region) {
-		let client = this.cfnClients[region];
+		const credentialConfig = ambientCredentialConfig();
+		const key = clientCacheKey(region, credentialConfig);
+		let client = this.cfnClients.get(key);
 		if (!client) {
-			const credentialConfig = getAwsClients().credentialConfig ?? {};
 			client = new CloudFormationClient({
-				...awsClientDefaults({ profile: credentialConfig.profile }),
-				...credentialConfig,
+				...clientDefaultsFor(credentialConfig),
 				region
 			});
-			this.cfnClients[region] = client;
+			this.cfnClients.set(key, client);
 		}
 		return client;
 	}
@@ -36756,7 +37004,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DR5gOGbi.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C0qLsIu5.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -37306,7 +37554,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBCluster":
 				try {
-					const cluster = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
+					const cluster = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBClustersCommand({ DBClusterIdentifier: physicalId }))).DBClusters?.[0];
 					if (cluster) {
 						if (cluster.Endpoint) enriched["Endpoint.Address"] = cluster.Endpoint;
 						if (cluster.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Port);
@@ -37321,7 +37569,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::RDS::DBInstance":
 				try {
-					const inst = (await new RDSClient({ ...awsClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
+					const inst = (await new RDSClient({ ...ambientClientDefaults() }).send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: physicalId }))).DBInstances?.[0];
 					if (inst) {
 						if (inst.Endpoint?.Address) enriched["Endpoint.Address"] = inst.Endpoint.Address;
 						if (inst.Endpoint?.Port !== void 0) enriched["Endpoint.Port"] = String(inst.Endpoint.Port);
@@ -37475,7 +37723,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::ElastiCache::ReplicationGroup":
 				try {
-					const rg = (await new ElastiCacheClient({ ...awsClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
+					const rg = (await new ElastiCacheClient({ ...ambientClientDefaults() }).send(new DescribeReplicationGroupsCommand({ ReplicationGroupId: physicalId }))).ReplicationGroups?.[0];
 					if (rg) {
 						const primaryNode = rg.NodeGroups?.[0];
 						if (primaryNode?.PrimaryEndpoint?.Address) enriched["PrimaryEndPoint.Address"] = primaryNode.PrimaryEndpoint.Address;
@@ -37497,7 +37745,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::Redshift::Cluster":
 				try {
-					const cluster = (await new RedshiftClient({ ...awsClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
+					const cluster = (await new RedshiftClient({ ...ambientClientDefaults() }).send(new DescribeClustersCommand({ ClusterIdentifier: physicalId }))).Clusters?.[0];
 					if (cluster?.Endpoint) {
 						if (cluster.Endpoint.Address) enriched["Endpoint.Address"] = cluster.Endpoint.Address;
 						if (cluster.Endpoint.Port !== void 0) enriched["Endpoint.Port"] = String(cluster.Endpoint.Port);
@@ -37509,7 +37757,7 @@ var CloudControlProvider = class {
 				break;
 			case "AWS::OpenSearchService::Domain":
 				try {
-					const domain = (await new OpenSearchClient({ ...awsClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
+					const domain = (await new OpenSearchClient({ ...ambientClientDefaults() }).send(new DescribeDomainCommand({ DomainName: physicalId }))).DomainStatus;
 					if (domain) {
 						const endpoint = domain.Endpoint ?? domain.Endpoints?.["vpc"];
 						if (endpoint) enriched["DomainEndpoint"] = endpoint;
@@ -42359,88 +42607,6 @@ function isCustomResource(resourceType) {
 	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
-/**
-* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
-* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
-* shape `docs/provider-development.md` forbids under "Never store an
-* empty-string placeholder"):
-*
-*   an attribute cdkd could not read back is ABSENT from the map — never
-*   recorded as the empty string, and never as a present-but-`undefined` key.
-*
-* The consumers of `ResourceState.attributes` all key off exactly that
-* distinction, and a sentinel puts every one of them on the wrong branch:
-*
-*  - the deploy engine persists the map as-is, so `''` becomes the recorded
-*    value of a field AWS never assigned;
-*  - the intrinsic resolver serves a stored attribute whenever it is not
-*    `undefined`, so `''` shadows `constructAttribute` forever — the
-*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
-*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
-*    only on a MISS;
-*  - the Outputs export pass publishes whatever the resolver returned, so a
-*    stored `''` is exported to every `Fn::ImportValue` consumer.
-*
-* It exists as a MODULE rather than a per-provider idiom because the rule was
-* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
-* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
-* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
-* that DROPS the key is the one form a provider cannot spell wrong by habit.
-*
-* Two values are treated as "not read back":
-*
-*  - `undefined`: the SDK's spelling of an unassigned optional member.
-*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
-*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
-*    like `''` does.
-*
-* Every other value is kept verbatim — INCLUDING an empty string AWS itself
-* reported (`false`, `0`, an empty array and an object likewise). The helper
-* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
-* off the wire is a known value with a meaning the provider owns. The EC2
-* Instance provider is where that distinction is load-bearing: a `running`
-* instance with no public address is described with `PublicDnsName: ''` and
-* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
-* empty, recorded as such so a reference does not degrade to the instance id
-* on every resolution — while the same `''` on a `pending` instance means
-* "not yet", which that provider maps to `undefined` BEFORE calling this
-* helper (its `describedInstanceAttributes`). A caller that knows a `''`
-* means "unknown" is the one that must say so; this helper cannot tell.
-*
-* Deliberately NOT a general "compact this record" utility: it is scoped to
-* attribute maps. A property bag keeps its `undefined`-valued keys out by other
-* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
-* than setting it to `undefined`").
-*
-* A LEAF module (imports nothing) so every provider can take it without adding
-* an edge to the provider import ring.
-*/
-/**
-* Build an attribute map from read-back values, omitting every key whose value
-* is `undefined` or `null`.
-*/
-function definedAttributes(entries) {
-	const out = {};
-	for (const [key, value] of Object.entries(entries)) {
-		if (value === void 0 || value === null) continue;
-		out[key] = value;
-	}
-	return out;
-}
-/**
-* `String(value)` for a numeric read-back whose CloudFormation attribute is a
-* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
-* `definedAttributes` drops the key instead of recording the literal
-* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
-* `?? ''` is merely deleted.
-*/
-function stringifyIfAssigned(value) {
-	if (value === void 0 || value === null) return void 0;
-	return String(value);
-}
-
 //#endregion
 //#region src/provisioning/update-removal.ts
 /**
@@ -44746,8 +44912,11 @@ async function planOrphanAdoption(params) {
 	const claims = async () => siblingClaims ??= await params.readSiblingClaims();
 	for (const record of params.records) {
 		const { logicalId, state } = record;
+		const shownId = displayIdent(logicalId);
+		const shownType = displayIdent(state.resourceType);
+		const shownPhysicalId = displaySafe(state.physicalId);
 		if (params.managedLogicalIds.has(logicalId)) {
-			params.logger.debug(`orphan ${logicalId}: already present in state.resources — dropping the stale record`);
+			params.logger.debug(`orphan ${shownId}: already present in state.resources — dropping the stale record`);
 			continue;
 		}
 		let provider;
@@ -44755,12 +44924,12 @@ async function planOrphanAdoption(params) {
 			provider = params.getProvider(state.resourceType, state.provisionedBy);
 		} catch (error) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback, but this build cannot route that type (${error instanceof Error ? error.message : String(error)}) — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback, but this build cannot route that type (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — cdkd is not adopting it.`);
 			continue;
 		}
 		if (!provider.import) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) was left in AWS by an earlier rollback as ${state.physicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
+			outcome.notices.push(`${shownId} (${shownType}) was left in AWS by an earlier rollback as ${shownPhysicalId}, but its provider cannot verify it — cdkd is not adopting it.`);
 			continue;
 		}
 		let found;
@@ -44774,32 +44943,32 @@ async function planOrphanAdoption(params) {
 				knownPhysicalId: state.physicalId
 			});
 		} catch (error) {
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is recorded as left in AWS as ${state.physicalId}, but cdkd could not confirm it exists (${error instanceof Error ? error.message : String(error)}) — keeping the record and not adopting it this run.`);
+			outcome.notices.push(`${shownId} (${shownType}) is recorded as left in AWS as ${shownPhysicalId}, but cdkd could not confirm it exists (${displayAwsMessage(error instanceof Error ? error.message : String(error))}) — keeping the record and not adopting it this run.`);
 			outcome.remaining.push(record);
 			continue;
 		}
 		if (found !== null && found.physicalId !== state.physicalId) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}): cdkd asked about ${state.physicalId} and its provider answered for ${found.physicalId} — not adopting.`);
+			outcome.notices.push(`${shownId} (${shownType}): cdkd asked about ${shownPhysicalId} and its provider answered for ${displaySafe(found.physicalId)} — not adopting.`);
 			continue;
 		}
 		if (found === null) {
-			params.logger.debug(`orphan ${logicalId}: ${state.physicalId} no longer exists in AWS — dropping the record`);
+			params.logger.debug(`orphan ${shownId}: ${shownPhysicalId} no longer exists in AWS — dropping the record`);
 			continue;
 		}
 		if (params.nameProperties(state.resourceType).length === 0 || ADOPTION_REFUSED_TYPES.has(state.resourceType)) {
 			outcome.remaining.push(record);
 			const why = ADOPTION_REFUSED_TYPES.has(state.resourceType) ? "a new deploy of it mints a new resource rather than colliding, and cdkd cannot update one in place — so adopting it would end in a replacement that destroys what DeletionPolicy: Retain preserved" : "cdkd does not derive that resource's physical name, so a new deploy mints a new resource instead of colliding";
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. cdkd does not re-adopt this type: ${why}. Delete it yourself when you no longer need it.`);
 			continue;
 		}
 		if (!templateStillDeclares(params.template, record, params.nameProperties(state.resourceType))) {
 			outcome.remaining.push(record);
-			outcome.notices.push(`${logicalId} (${state.resourceType}) is still in AWS as ${state.physicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
+			outcome.notices.push(`${shownId} (${shownType}) is still in AWS as ${shownPhysicalId} from an earlier rollback. This deploy does not create it under that name, so cdkd is leaving it alone.`);
 			continue;
 		}
 		if ((await claims()).has(state.physicalId)) {
-			outcome.refusals.push(`${logicalId}: ${state.physicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
+			outcome.refusals.push(`${shownId}: ${shownPhysicalId} is already recorded by another cdkd stack. cdkd will not adopt a resource another stack manages.`);
 			outcome.remaining.push(record);
 			continue;
 		}
@@ -44852,7 +45021,7 @@ function makeSiblingClaimReader(params) {
 		try {
 			refs = await stateBackend.listStacks();
 		} catch (error) {
-			logger.debug(`orphan adoption: could not list sibling stacks — ${error instanceof Error ? error.message : String(error)}`);
+			logger.debug(`orphan adoption: could not list sibling stacks — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			return claimed;
 		}
 		for (const ref of refs) {
@@ -44862,7 +45031,7 @@ function makeSiblingClaimReader(params) {
 				const sibling = await stateBackend.getState(ref.stackName, ref.region);
 				for (const record of Object.values(sibling?.state.resources ?? {})) claimed.add(record.physicalId);
 			} catch (error) {
-				logger.debug(`orphan adoption: skipping unreadable state for ${ref.stackName} — ${error instanceof Error ? error.message : String(error)}`);
+				logger.debug(`orphan adoption: skipping unreadable state for ${displayStackName(ref.stackName)} — ${displayAwsMessage(error instanceof Error ? error.message : String(error))}`);
 			}
 		}
 		return claimed;
@@ -50785,7 +50954,7 @@ var DeployEngine = class DeployEngine {
 		if (plan.refusals.length > 0) throw new Error(`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot safely re-adopt:\n  ${plan.refusals.join("\n  ")}`);
 		for (const [logicalId, record] of Object.entries(plan.adopted)) {
 			currentState.resources[logicalId] = record;
-			this.logger.info(`Adopting ${logicalId} (${record.resourceType}) left in AWS by an earlier rollback as ${record.physicalId}`);
+			this.logger.info(`Adopting ${displayIdent(logicalId)} (${displayIdent(record.resourceType)}) left in AWS by an earlier rollback as ${displaySafe(record.physicalId)}`);
 		}
 		if (records.length > 0) currentState.orphans = plan.remaining;
 		return plan;
@@ -52252,5 +52421,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, NestedStackChildDirectDestroyError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, readConfigString as $t, createPreDeleteFinalSnapshot as A, absoluteAssemblyPathEscape as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, disableInstanceApiTermination as At, isStatefulRecreateTargetSync as B, setAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, isUnboundTemplateParameter as Bt, namesAnyDeclaredParameter as C, globMatches as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, __exportAll as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, CloudControlProvider as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasPlainPrototype$1 as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, deleteIndeterminateGuards as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, hasOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, UNSPECIFIED_SKIP_REASON as Et, extractDeploymentEventError as F, resolveBucketRegion as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, cfnRefValueFromPhysicalId as Ft, toCfnInteger as G, DependencyError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, normalizeAwsTagsToCfn as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, refStateLookupFromResource as Ht, makeSiblingClaimReader as I, AwsClients as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, coerceParameterTypedValue as It, bold as J, IntrinsicResolutionRefusalError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, coerceCfnBoolean as Jt, toFiniteNumber as K, DeployCancelledError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, resolveExplicitPhysicalId as Kt, planOrphanAdoption as L, getAwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, getAccountInfo as Lt, refusesFinalSnapshot as M, renderAssemblyPathEscape as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, IntrinsicFunctionResolver as Mt, unsupportedFinalSnapshotError as N, resolveAssemblyPath as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, carriesDynamicReference as Nt, buildFinalSnapshotIdentifier as O, nullPrototypeRecord as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, deleteSkipReason as Ot, makeCanonicalizePropertiesFn as P, clearBucketRegionCache as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, carriesFetchableDynamicReference as Pt, red as Q, MalformedProducerRecordRefusalError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, configStringRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, resetAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isImpossibleEmptyStoredAttribute as Rt, computeParameterTaint as S, failedStageNote as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, safeStringify$1 as So, STATE_SOURCED_BASELINE_RULES as Sr, startInterruptWatch as St, resourcesNamingDeclaredParameter as T, defineOwnKey as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, ccProtectionRegistryTypes as Tt, coerceWarmThroughput as U, ConfigError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, isSettledInstanceState as Ut, renderStatefulReason as V, AssetError as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, parameterTypeMayLoseSecretIdentity as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, WAFv2WebACLProvider as Wt, gray as X, LocalStartServiceError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configBooleanRefusal as Xt, cyan as Y, LocalInvokeBuildError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, coerceCfnInteger as Yt, green as Z, LockError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, configIntegerRefusal as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isTransientServerError as _o, findSilentDropProperties as _r, maskerOrIdentity as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackTerminationProtectionError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, retryClassificationText as bo, DagBuilder as br, interruptWatchListenerCount as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, formatError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, withErrorHandling as do, repairMalformedResourcesForReadOnly as dr, definedAttributes as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, replayWarn as en, PartialFailureError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, pasteableCommand as fo, safeRegion as fr, stringifyIfAssigned as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isThrottlingError as go, findActionableSilentDrops as gr, maskDeep as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isRetryableTransientError as ho, unreadableOrphanRecords as hr, createMaskedRetryLogger as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, StackHasActiveImportsError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, displayAssemblyPath as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, isTerminationProtectionPropagationError as jt, ccRoutedFinalSnapshotError as k, ownValue as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isWaitAbandonedError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, isCdkdError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, isMarkedNonRetryable as mo, unpreviewableOrphanRecords as mr, wouldReturnToSdkProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, requireConfigObject as nn, ResourceTimeoutError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StateError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, shellQuote as po, safeStackName as pr, ProviderRegistry as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, assertRegionMatch as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, requireConfigString as rn, ResourceUpdateNotSupportedError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, SynthesisError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigArray as tn, ProvisioningError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, normalizeAwsError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, markNonRetryable as vo, describeTypeWithThrottleRetry as vr, beginCommandInterruptScope as vt, reachableDivergentParameters as w, processStackMessages as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, STATE_SOURCED_READBACK_RULES as wr, slowCcOperationTimeoutMs as wt, bindingSkippedOutputs as x, AssemblyReader as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, describeAwsFailure as xo, TemplateParser as xr, isInterruptedWaitError as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markRedactedCause as yo, withRetry as yr, endCommandInterruptScope as yt, isStatefulRecreateTargetForReplace as z, runWithStackAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, isNamelessDynamicReferenceError as zt };
-//# sourceMappingURL=deploy-engine-BwDlgFRs.js.map
+export { yellow as $, MalformedProducerRecordRefusalError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, requireConfigArray as $t, createPreDeleteFinalSnapshot as A, ownValue as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, IntrinsicFunctionResolver as At, isStatefulRecreateTargetSync as B, runWithStackAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, refStateLookupFromResource as Bt, namesAnyDeclaredParameter as C, failedStageNote as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, safeStringify$1 as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, ccProtectionRegistryTypes as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasOwnKey as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, isWaitAbandonedError as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, defineOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, getAccountInfo as Ft, toCfnInteger as G, CrossAccountSecretRefusalError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, assertRegionMatch as Gt, WARM_THROUGHPUT_MEMBERS as H, AssetError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, WAFv2WebACLProvider as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, isImpossibleEmptyStoredAttribute as It, bold as J, DynamicReferenceRegionAmbiguousError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, configBooleanRefusal as Jt, toFiniteNumber as K, DependencyError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, coerceCfnBoolean as Kt, planOrphanAdoption as L, AwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, isNamelessDynamicReferenceError as Lt, refusesFinalSnapshot as M, displayAssemblyPath as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, carriesFetchableDynamicReference as Mt, unsupportedFinalSnapshotError as N, renderAssemblyPathEscape as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, cfnRefValueFromPhysicalId as Nt, buildFinalSnapshotIdentifier as O, hasPlainPrototype$1 as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, disableInstanceApiTermination as Ot, makeCanonicalizePropertiesFn as P, resolveAssemblyPath as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, coerceParameterTypedValue as Pt, red as Q, LockError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, replayWarn as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isUnboundTemplateParameter as Rt, computeParameterTaint as S, AssemblyReader as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, describeAwsFailure as So, STATE_SOURCED_BASELINE_RULES as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, processStackMessages as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, CdkdError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, normalizeAwsTagsToCfn as Ut, renderStatefulReason as V, setAwsClients as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, isSettledInstanceState as Vt, isWarmThroughputDecrease as W, ConfigError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, resolveExplicitPhysicalId as Wt, gray as X, LocalInvokeBuildError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configStringRefusal as Xt, cyan as Y, IntrinsicResolutionRefusalError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, configIntegerRefusal as Yt, green as Z, LocalStartServiceError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, readConfigString as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isThrottlingError as _o, findSilentDropProperties as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackHasActiveImportsError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, markRedactedCause as bo, DagBuilder as br, startInterruptWatch as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, SynthesisError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, normalizeAwsError as do, repairMalformedResourcesForReadOnly as dr, ProviderRegistry as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, requireConfigObject as en, NestedStackChildDirectDestroyError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, withErrorHandling as fo, safeRegion as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isRetryableTransientError as go, findActionableSilentDrops as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isMarkedNonRetryable as ho, unreadableOrphanRecords as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, ResourceUpdateNotSupportedError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, absoluteAssemblyPathEscape as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, carriesDynamicReference as jt, ccRoutedFinalSnapshotError as k, nullPrototypeRecord as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isTerminationProtectionPropagationError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, formatError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, shellQuote as mo, unpreviewableOrphanRecords as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, definedAttributes as nn, ProvisioningError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StackTerminationProtectionError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, pasteableCommand as po, safeStackName as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DeployCancelledError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, coerceCfnInteger as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, stringifyIfAssigned as rn, ResourceTimeoutError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, StateError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigString as tn, PartialFailureError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, isCdkdError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, isTransientServerError as vo, describeTypeWithThrottleRetry as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, globMatches as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, __exportAll as wo, STATE_SOURCED_READBACK_RULES as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, ambientClientDefaults as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, retryClassificationText as xo, TemplateParser as xr, CloudControlProvider as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markNonRetryable as yo, withRetry as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, parameterTypeMayLoseSecretIdentity as zt };
+//# sourceMappingURL=deploy-engine-CkF6PyFY.js.map