@go-to-k/cdkd 0.291.22 → 0.291.23

package/dist/{deploy-engine-DGV6XNWO.js → deploy-engine-CCvNP_dA.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-Bt0RGDfb.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BuD41yiK.js";
+import { t as getCdkdVersion } from "./version-BLo_Pzd-.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7389,7 +7389,7 @@ var Synthesizer = class {
 		let accountId;
 		try {
 			const stsClient = new STSClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				...region && { region }
 			});
 			accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -7485,7 +7485,7 @@ var Synthesizer = class {
 		let accountId = resolved?.accountId;
 		if (resolved === void 0 && !options.stateBucket) try {
 			const stsClient = new STSClient({
-				...awsClientDefaults(),
+				...ambientClientDefaults(),
 				region
 			});
 			accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -16238,13 +16238,14 @@ const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
 * no bag can equal, which refuses it exactly as the scan did.
 *
 * The branch is HARD to reach from the resolver — one resolver's
-* `cachedDynamicReferences` yields one plaintext per expression, so a single
-* pass cannot produce two — but it is no longer unreachable from there since
-* that cache became per-resolver (issue #1933): two resolvers in two regions
-* legitimately resolve one expression to two different plaintexts, and a caller
-* merging their maps lands exactly here. It is reachable through this module's
-* API regardless, and it is FENCED, by the "recorded against MORE THAN ONE
-* plaintext" case. An earlier draft of this comment claimed the divergence was
+* `cachedDynamicReferences` yields one plaintext per expression and credential
+* identity (issue #3660), so a single pass cannot produce two — but it is no
+* longer unreachable from there since that cache became per-resolver (issue
+* #1933): two resolvers in two regions legitimately resolve one expression to
+* two different plaintexts, and a caller merging their maps lands exactly here.
+* It is reachable through this module's API regardless, and it is FENCED, by
+* the "recorded against MORE THAN ONE plaintext" case. An earlier draft of
+* this comment claimed the divergence was
 * unobservable, reasoning that `plaintextOf[E] === bag` implies
 * `secrets.get(bag) === E` so accepting and falling back agree. That misses the
 * case where a SECOND candidate also matches: accepting `E` then makes it two
@@ -29809,11 +29810,26 @@ function isDeliberateResolutionRefusal(err) {
 	if (errorCauseChain(err).some((link) => link instanceof IntrinsicResolutionRefusalError)) return true;
 	return isNamelessDynamicReferenceError(err);
 }
-let cachedAccountIdentity = null;
 /**
-* Cache for availability zones per region
+* The real (non-fabricated) account identity, per CREDENTIAL IDENTITY: keyed by
+* {@link credentialFingerprint} of the active `AwsClients`' credential
+* configuration (issue [#3660](https://github.com/go-to-k/cdkd/issues/3660)).
+*
+* Process-wide, and a CLI run has one identity, so for the CLI this holds one
+* entry. A LIBRARY caller can install `AwsClients` for account A, deploy, then
+* install account B's in the same process (or run both in per-stack scopes);
+* keyed by nothing, B's `AWS::AccountId` and every ARN built from it resolved
+* as A's. The fabricated window and the in-flight slot below share the key.
+*/
+const cachedAccountIdentities = /* @__PURE__ */ new Map();
+/**
+* Availability-zone names per (credential identity, region): keyed by
+* `injectiveKey(credentialFingerprint, region)` (issue
+* [#3660](https://github.com/go-to-k/cdkd/issues/3660)). The zone list is an
+* ACCOUNT's answer — an opt-in or restricted zone is visible to one account and
+* not another — so a region-only key served one identity's list to the next.
 */
-const cachedAvailabilityZones = {};
+const cachedAvailabilityZones = /* @__PURE__ */ new Map();
 /**
 * The `{{resolve:...}}` expressions this process has PROVEN resolve to a
 * SECRET, reached through `secret-redaction.ts`'s `recordedSecretExpressions`
@@ -30288,9 +30304,12 @@ function isClientSafeRegion(region) {
 }
 /** Test seam for {@link FABRICATED_ACCOUNT_INFO_TTL_MS} expiry. */
 const accountInfoClock = { now: () => Date.now() };
-let fabricatedAccountIdentity = null;
+/** The bounded fabricated-answer window, per credential identity (see {@link cachedAccountIdentities}). */
+const fabricatedAccountIdentities = /* @__PURE__ */ new Map();
 /**
-* The single in-flight lookup, so N concurrent callers share ONE round trip.
+* The single in-flight lookup PER CREDENTIAL IDENTITY, so N concurrent callers
+* of one identity share ONE round trip, and a second identity never joins the
+* first's (issue #3660).
 *
 * The TTL above collapses SEQUENTIAL callers; this collapses PARALLEL ones
 * (PR review). `cdkd deploy --concurrency 10` resolves ten resources' intrinsics
@@ -30298,34 +30317,43 @@ let fabricatedAccountIdentity = null;
 * each with the SDK's own 3-attempt retry — and ten identical warnings per
 * window. Cleared in a `finally` so a failure cannot wedge it.
 */
-let accountInfoInFlight = null;
+const accountInfoInFlight = /* @__PURE__ */ new Map();
 /**
 * Bumped by {@link resetAccountInfoCache}, so a lookup that was already in
 * flight cannot write the cache it was asked to forget.
 *
 * Without it the reset only cleared the SETTLED caches: an in-flight resolve
-* would land afterwards and re-populate `cachedAccountIdentity`, so the next
+* would land afterwards and re-populate `cachedAccountIdentities`, so the next
 * caller read the pre-reset account. That is the `*Once`-leak shape one layer
 * down — a later test silently inheriting an earlier one's answer — and the
 * reset's own comment already claimed to forget it.
 */
 let accountInfoGeneration = 0;
 /**
-* Get AWS account information from STS
+* Get AWS account information from STS, for the ACTIVE credential identity.
+*
+* `identityKey` is read FIRST and synchronously, and `resolveAccountIdentity`
+* reads `getAwsClients().sts` before its first `await`, so the key and the
+* client that answers come from ONE reading of the active clients (issue
+* #3660). Never log the key.
 */
 async function getAccountInfo(overrideRegion) {
-	if (cachedAccountIdentity) return accountInfoFor(cachedAccountIdentity, overrideRegion);
-	if (fabricatedAccountIdentity && accountInfoClock.now() < fabricatedAccountIdentity.expiresAt) return accountInfoFor(fabricatedAccountIdentity.identity, overrideRegion);
-	if (accountInfoInFlight) return accountInfoFor(await accountInfoInFlight, overrideRegion);
-	const inFlight = resolveAccountIdentity();
-	accountInfoInFlight = inFlight;
+	const identityKey = credentialFingerprint(ambientCredentialConfig());
+	const cached = cachedAccountIdentities.get(identityKey);
+	if (cached) return accountInfoFor(cached, overrideRegion);
+	const fabricated = fabricatedAccountIdentities.get(identityKey);
+	if (fabricated && accountInfoClock.now() < fabricated.expiresAt) return accountInfoFor(fabricated.identity, overrideRegion);
+	const pending = accountInfoInFlight.get(identityKey);
+	if (pending) return accountInfoFor(await pending, overrideRegion);
+	const inFlight = resolveAccountIdentity(identityKey);
+	accountInfoInFlight.set(identityKey, inFlight);
 	try {
 		return accountInfoFor(await inFlight, overrideRegion);
 	} finally {
-		if (accountInfoInFlight === inFlight) accountInfoInFlight = null;
+		if (accountInfoInFlight.get(identityKey) === inFlight) accountInfoInFlight.delete(identityKey);
 	}
 }
-async function resolveAccountIdentity() {
+async function resolveAccountIdentity(identityKey) {
 	const generation = accountInfoGeneration;
 	const stillCurrent = () => generation === accountInfoGeneration;
 	const logger = getLogger().child("IntrinsicFunctionResolver");
@@ -30337,13 +30365,13 @@ async function resolveAccountIdentity() {
 			accountId,
 			...response.Account ? {} : { fabricated: true }
 		};
-		if (!stillCurrent()) {} else if (resolved.fabricated) fabricatedAccountIdentity = {
+		if (!stillCurrent()) {} else if (resolved.fabricated) fabricatedAccountIdentities.set(identityKey, {
 			identity: resolved,
 			expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
-		};
+		});
 		else {
-			cachedAccountIdentity = resolved;
-			fabricatedAccountIdentity = null;
+			cachedAccountIdentities.set(identityKey, resolved);
+			fabricatedAccountIdentities.delete(identityKey);
 		}
 		logger.debug(`Retrieved AWS account info: ${accountId}`);
 		return resolved;
@@ -30355,13 +30383,13 @@ async function resolveAccountIdentity() {
 		};
 		if (!stillCurrent()) return fallback;
 		if (fallback.fabricated) {
-			if (!cachedAccountIdentity) fabricatedAccountIdentity = {
+			if (!cachedAccountIdentities.has(identityKey)) fabricatedAccountIdentities.set(identityKey, {
 				identity: fallback,
 				expiresAt: accountInfoClock.now() + FABRICATED_ACCOUNT_INFO_TTL_MS
-			};
+			});
 		} else {
-			cachedAccountIdentity = fallback;
-			fabricatedAccountIdentity = null;
+			cachedAccountIdentities.set(identityKey, fallback);
+			fabricatedAccountIdentities.delete(identityKey);
 		}
 		return fallback;
 	}
@@ -30738,10 +30766,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* ({@link cfnExportsPromises}, {@link cfnStackOutputsCache}) carry the
 	* fingerprint too.
 	*
-	* THE CLIENT HALF IS CLOSED, NOT THE WHOLE CLASS: {@link cachedDynamicReferences}
-	* (keyed by the expression alone) and the PROCESS-GLOBAL account identity
-	* behind `getAccountInfo` still assume one identity per resolver and per
-	* process respectively — a value one identity read is served to the next.
+	* The VALUE caches carry the fingerprint as well (issue
+	* [#3660](https://github.com/go-to-k/cdkd/issues/3660)):
+	* {@link cachedDynamicReferences}, and the process-global account identity
+	* behind `getAccountInfo` and `cachedAvailabilityZones`.
 	*/
 	regionScopedClients = /* @__PURE__ */ new Map();
 	/**
@@ -30759,9 +30787,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* A whole resolver rather than a client bag, because what has to be
 	* region-scoped is not only the lookup but the VALUE CACHE behind it:
-	* {@link cachedDynamicReferences} is keyed by the expression alone and is
-	* sound only because one resolver stands for one stack in one region (issue
-	* #1933). Resolving a producer's expression inside THIS resolver would put a
+	* {@link cachedDynamicReferences} is keyed by the expression (plus the
+	* credential identity, issue #3660) and is sound only because one resolver
+	* stands for one stack in one region (issue #1933). Resolving a producer's expression inside THIS resolver would put a
 	* foreign region's answer under a key the consumer's own lookups read — the
 	* exact cross-region leak that field's instance scope closed. A separate
 	* resolver per producer region keeps that invariant by construction.
@@ -30858,7 +30886,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	physicalIdFallbackCount = 0;
 	/**
 	* Resolved `{{resolve:secretsmanager:...}}` / `{{resolve:ssm:...}}` values,
-	* keyed by the full expression — INSTANCE-scoped, which closes the CACHE half
+	* keyed by the full expression and the credential identity that read it
+	* (`injectiveKey(credentialFingerprint, expression)`, issue
+	* [#3660](https://github.com/go-to-k/cdkd/issues/3660): a library caller can
+	* drive one resolver under two `AwsClients` identities, and the same NAME
+	* read by two accounts is two values) — INSTANCE-scoped, which closes the CACHE half
 	* of issue [#1933](https://github.com/go-to-k/cdkd/issues/1933). The issue is
 	* only PARTIALLY addressed by this field: see "what this does NOT settle"
 	* below.
@@ -34124,7 +34156,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			region = (await getAccountInfo(this.resolverRegion)).region;
 			clientRegion = this.explicitRegion;
 		}
-		const cached = cachedAvailabilityZones[region];
+		const azCacheKey = injectiveKey(credentialFingerprint(ambientCredentialConfig()), region);
+		const cached = cachedAvailabilityZones.get(azCacheKey);
 		if (cached) {
 			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
@@ -34145,7 +34178,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${loggedRegion}': ${masks.text(error instanceof Error ? error.message : String(error))}`);
 		}
 		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.displayMasked(loggedRegionText ?? region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
-		cachedAvailabilityZones[region] = azNames;
+		cachedAvailabilityZones.set(azCacheKey, azNames);
 		this.logger.debug(`Resolved Fn::GetAZs: ${this.displayMasked(loggedRegionText ?? region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
@@ -34860,7 +34893,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					if (!foreign.complete || foreign.substitutions.length !== 1) complete = false;
 					continue;
 				}
-				const cached = this.cachedDynamicReferences.get(fullMatch);
+				const dynamicReferenceCacheKey = injectiveKey(credentialFingerprint(ambientCredentialConfig()), fullMatch);
+				const cached = this.cachedDynamicReferences.get(dynamicReferenceCacheKey);
 				if (cached) {
 					if (cached.secret && cached.value) {
 						context?.recordedSecretValues?.set(cached.value, fullMatch);
@@ -34917,7 +34951,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					complete = false;
 					continue;
 				}
-				if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
+				if (cacheable) this.cachedDynamicReferences.set(dynamicReferenceCacheKey, {
 					value: resolved,
 					secret: isSecret
 				});
@@ -35900,6 +35934,454 @@ function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
+//#endregion
+//#region src/provisioning/masked-retry-logger.ts
+/**
+* The masker a caller supplied, or the identity function when it supplied
+* none.
+*
+* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
+* mandates — `create()` / `update()` are also reached from the import path,
+* from `cdkd drift --revert`, and from tests, and a provider must not care
+* which caller it got. Centralised here so no call site re-spells the `??`
+* and accidentally makes the capability required.
+*/
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+/**
+* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
+*
+* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
+* and dropping it would silence the give-up summary on the calling path only —
+* trading a disclosure for the reporting hole issue #2018 closed. It goes
+* through the SAME mask as `debug` precisely because it is the line that
+* survives a run without `--verbose`; forwarding it unmasked would defeat the
+* fence at a HIGHER log level than the one the fence was written for.
+*
+* `logger` is typed structurally rather than as the concrete `Logger` so this
+* module stays a leaf and a test can pass two spies. That matches the
+* precedent already in the tree (`buildMfaConfigRequest` in
+* `cognito-provider.ts` takes an injected `logger?: { warn }`).
+*/
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+/**
+* Depth cap for {@link maskDeep}.
+*
+* What it actually bounds is unbounded WORK on a pathologically deep bag — see
+* the rationale at the cap itself, which is the authority. It is NOT primarily
+* a cycle guard: a template-derived bag cannot be cyclic, so that justification
+* over-claims (issue #2176 security review). It does still terminate one, which
+* is why the walk is safe to share with a caller that might hand it something
+* other than a template bag.
+*
+* Deliberately generous. Every shape these warnings exist to describe is a
+* scalar, a list of scalars, or a small record, so the walk does not reach
+* depth 2 in practice.
+*/
+const MASK_WALK_MAX_DEPTH = 8;
+/**
+* What {@link maskDeep} substitutes for a subtree it declines to descend into.
+*
+* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
+* spelled here rather than imported so this module keeps its single-import leaf
+* property (see the module note above); the two are fenced against drift by a
+* test that imports both.
+*/
+const MASK_WALK_DEPTH_CAP_MARKER = "***";
+/**
+* Mask every string LEAF and KEY of an arbitrary value, returning a structure
+* safe to `JSON.stringify` into a log line or an error message (issue
+* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
+*
+* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
+* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
+*
+*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
+*     containing any of them no longer OCCURS in the stringified text and a
+*     mask applied afterwards cannot find it. That is not an exotic case — it
+*     is every Secrets Manager JSON document, the commonest real secret shape.
+*     Measured on the pre-fix tree for #2176: a plaintext of
+*     `{"user":"admin","pw":"hunter2"}` interpolated as
+*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
+*     unchanged, while masking the leaves first rendered it `"***"`.
+*  2. LENGTH. A finished message is always longer than the value inside it, so
+*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
+*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
+*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
+*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
+*
+* Neither pass subsumes the other, so providers do BOTH — this walk on the
+* value, and the assembled message through the masker as well. The masker is
+* idempotent, so the overlap is free.
+*
+* Keys are masked as well as values: `JSON.stringify` renders them into the
+* same line, so a resolved secret used as a map key would otherwise escape.
+*
+* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
+* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
+* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
+* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
+* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
+* the point at which this should move into `../masked-retry-logger.ts` ... and
+* all three converge on it". That trigger had fired and been missed twice over,
+* and the copies had already diverged exactly as predicted: FOUR of the six
+* carried NO depth cap at all.
+*
+* Worth recording how the last two were nearly missed AGAIN, because it is the
+* same failure one level up: the first sweep for this issue grepped for
+* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
+* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
+* constant. Grep for the SHAPE, not the name. These copies encode a security
+* contract, and a hardening applied to one silently leaves the others behind.
+*/
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= 8) return "***";
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+
+//#endregion
+//#region src/provisioning/composite-id.ts
+/**
+* Refuse a composite physicalId whose segments would make it ambiguous
+* (issue [#1672](https://github.com/go-to-k/cdkd/issues/1672)).
+*
+* ## Why a composite id exists at all
+*
+* `ResourceProvider` passes a SINGLE `physicalId: string` as a resource's
+* identity, while CloudFormation keeps the physical id and its containing
+* scope as separate values. So every provider whose type needs more than one
+* value to address the resource PACKS them into one string joined by
+* {@link COMPOSITE_ID_SEPARATOR} — `<databaseName>|<tableName>` for
+* `AWS::Glue::Table`, `<apiId>|<typeName>|<fieldName>` for
+* `AWS::AppSync::Resolver`, and so on.
+*
+* ## Why it has to be guarded
+*
+* The separator is NOT escaped, so a segment that itself contains a `|`
+* produces an id with the wrong arity. Every decode site splits the stored id
+* back apart and the extra segment shifts everything — for a Glue table named
+* `a|b` in database `mydb` the recorded id `mydb|a|b` decodes to database
+* `mydb`, table `a`. Both halves are non-empty, so every existing
+* "is this id well-formed?" guard passes and the deploy SUCCEEDS. What breaks
+* is everything afterwards: `cdkd destroy` deletes the WRONG resource if one
+* exists under the decoded pair (or warn-and-skips, reporting success while
+* the real resource stays alive and billing), and `cdkd drift` reads back
+* `undefined` forever.
+*
+* AWS itself accepts such a name — verified live us-east-1 2026-08-12,
+* `glue:CreateTable` with `TableInput.Name: 'a|b'` succeeds — and
+* CloudFormation manages the resource fine. The limitation is cdkd's own, so
+* the honest answer is to REFUSE at deploy time with a message that says so,
+* rather than to record an id that silently names something else. Escaping the
+* separator, or dropping the packing where the decode sites already receive
+* the properties bag, are the two real fixes and both remain open on #1672;
+* this guard is what closes the data-loss path in the meantime.
+*
+* ## Two entry points, mirroring `config-shape.ts`
+*
+* {@link packCompositeId} is the ACTION (throw, or warn-and-pack under the
+* replay downgrade) and {@link compositeIdSeparatorRefusal} is the bare
+* PREDICATE, for a caller whose response is neither — the `import()` paths
+* warn and return `null` (`skipped-not-found`), which is the idiom those
+* methods already use for every other unusable id. Both share one message
+* builder so the two can never drift.
+*
+* ## Where to place the call
+*
+* Prefer computing the id BEFORE the create call rather than after it. The
+* refusal is a pre-flight check, and a throw placed after the AWS mutation has
+* already committed would leave an orphan resource behind with no state
+* record. Only where a segment is derived from the create RESPONSE (an
+* AWS-generated id) does the call have to sit after it — and those segments
+* are structurally incapable of carrying a `|` anyway. A post-call site must
+* also sit OUTSIDE the `try` whose `catch` re-wraps as
+* `ProvisioningError('Failed to create …')`, or a refusal would be
+* mis-reported as an AWS creation failure.
+*
+* ## What this does NOT cover
+*
+* The claim is "every composite packer this change reaches", not "every `|`
+* join in the tree". One deliberate exclusion, recorded so the scope is not
+* read as wider than it is:
+*
+* - **`intrinsic-function-resolver.ts`'s `|` joins** (the WAFv2 and
+*   `AWS::Events::Rule` arms) are out of scope by KIND, not by ownership: they
+*   build a `Ref` VALUE for the template resolver, never a physicalId cdkd
+*   records and later splits. Nothing decodes them, so an ambiguous join has
+*   no decode site to go wrong at.
+*
+* ## Guarding the PACKERS is not the whole story
+*
+* A packer that refuses ambiguity does nothing about an id an EARLIER binary
+* already recorded, or one an `import` was handed — and a type whose decoder is
+* loose will mis-decode both. Issue #1711 is where that was learned:
+* `AWS::Route53::RecordSet`'s `parseRecordSetCompositeId` accepts any three
+* NON-EMPTY segments, so a record name carrying two pipes decoded to a
+* DIFFERENT hosted zone at three sites this helper never sees — an `import`
+* early accept, an identity-resolution short-circuit, and `delete`'s own parse,
+* where `cdkd destroy` then reported success over a live record. When adopting
+* this guard for a new type, audit its DECODE sites in the same change and make
+* each one cross-check the parsed segments against something it can verify them
+* with (Route 53 uses the template's own `Name` / `Type`).
+*/
+/** The character every composite physicalId in this codebase joins segments with. */
+const COMPOSITE_ID_SEPARATOR = "|";
+/** The issue tracking the real fix (escaping, or not packing at all). */
+const COMPOSITE_ID_ISSUE_URL = "https://github.com/go-to-k/cdkd/issues/1672";
+/** Render `<a>|<b>|<c>` from the segment names. */
+function idShape(segments) {
+	return segments.map((segment) => `<${segment.name}>`).join("|");
+}
+/**
+* The refusal sentence for a composite id whose segments carry the separator,
+* or `undefined` when the id is unambiguous.
+*
+* Every offending segment is named, not just the first: a template that
+* mis-names one value frequently mis-names its sibling too, and reporting them
+* one deploy at a time is the shape of remedy nobody finishes.
+*/
+function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
+	const offending = segments.filter((segment) => String(segment.value).includes("|"));
+	if (offending.length === 0) return void 0;
+	const mask = maskerOrIdentity(maskSecrets);
+	return `${resourceType} ${logicalId}: ${offending.map((segment) => `${segment.name} '${mask(String(segment.value))}'`).join(" and ")} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. AWS accepts the name and CloudFormation manages such a resource fine; this is a cdkd limitation tracked in ${COMPOSITE_ID_ISSUE_URL}. Rename the resource so no segment contains '${"|"}', or manage it outside cdkd.`;
+}
+/**
+* Join the segments into a composite physicalId, REFUSING one that would be
+* ambiguous.
+*
+* @throws ProvisioningError when a segment contains {@link COMPOSITE_ID_SEPARATOR},
+*   unless `options.onRefusal` is supplied — under which the message is handed
+*   to the callback and the ambiguous id is returned, keeping the pre-guard
+*   behavior.
+*/
+function packCompositeId(resourceType, logicalId, segments, options) {
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
+	if (refusal !== void 0) {
+		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
+		else throw new ProvisioningError(refusal, resourceType, logicalId);
+	}
+	return segments.map((segment) => String(segment.value)).join("|");
+}
+/** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
+function formatShape(segments) {
+	return segments.map((segment) => `<${segment}>`).join("|");
+}
+/**
+* The message EVERY malformed-composite-id decode site emits (issue
+* [#1657](https://github.com/go-to-k/cdkd/issues/1657)).
+*
+* ## Why one builder
+*
+* Roughly half the decode sites stated the expected shape and half only echoed
+* the value back, and the format is documented nowhere else — so on the silent
+* half the message was the user's only possible route to the answer and it did
+* not carry it. Routing the sites that already got it right through the same
+* builder is what stops them drifting back.
+*
+* ## This is a WORDING fix, not an acceptance change
+*
+* Each caller keeps its own split-and-guard exactly as it was. The arities
+* genuinely differ (some sites accept AT LEAST N segments, some destructure the
+* first N and tolerate extras — the #1672 ambiguity, tracked separately), and
+* folding them into one predicate here would silently change which ids deploy.
+*
+* ## The `skipping` variant
+*
+* On the DELETE path the established policy is warn-and-continue, so a
+* malformed record leaves the AWS resource ALIVE. That policy is unchanged —
+* the warning says what the skip costs, because an orphan the user is never
+* told about is one they cannot go and delete.
+*
+* Since issue [#1752](https://github.com/go-to-k/cdkd/issues/1752) the ACCOUNTING
+* around it is no longer a lie: an arm emitting this message must also return
+* `{ outcome: 'skipped', reason: COMPOSITE_ID_SKIP_REASON }` so `cdkd destroy`
+* prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
+* `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
+* wording here changed accordingly — it used to promise unconditionally that
+* cdkd "will report this delete as successful", which is no longer true on
+* either path. Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762) then
+* taught the deploy engine to consume the outcome too, so the message no longer
+* warns that deploy drops the record: the template-removal DELETE keeps it,
+* exactly like destroy. What it DOES still distinguish is the replacement /
+* rollback delete, which fails the resource and can leave the old one
+* untracked — there "drop the record with 'cdkd state orphan'" is not the
+* remedy, deleting the resource by hand is.
+*/
+function compositeIdFormatMessage(format, logicalId, physicalId, options) {
+	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
+	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
+	if (!options?.skipping) return head;
+	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy (which re-attempts it on the next deploy). So repair the id in state.json and re-run, or delete the resource by hand and drop the record with 'cdkd state orphan'. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so delete it by hand.`;
+}
+/**
+* The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
+* skip reports (issue [#1752](https://github.com/go-to-k/cdkd/issues/1752)).
+*
+* Deliberately short and IDENTICAL across the five arms: it is rendered inline
+* on the per-resource status line (`⚠ MyTable (AWS::Glue::Table) skipped
+* (malformed physicalId in state — no delete issued)`), where the full
+* remediation sentence built by {@link compositeIdFormatMessage} would not fit.
+* The full text is still emitted, as the `logger.warn` right beside it.
+*
+* A shared constant rather than five literals so the five arms cannot drift and
+* a grep for the wording finds all of them.
+*/
+const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
+/**
+* The `ResourceDeleteResult` a malformed-composite-id DELETE arm returns.
+*
+* Pairs with the `{ skipping: true }` warning: emit the warning, return this.
+* Providers call it as `return compositeIdSkipResult();` so the arm reads as
+* the deliberate skip it is rather than as the bare `return;` that made issue
+* #1752's mis-accounting possible.
+*/
+function compositeIdSkipResult() {
+	return {
+		outcome: "skipped",
+		reason: COMPOSITE_ID_SKIP_REASON
+	};
+}
+
+//#endregion
+//#region src/provisioning/cc-import-identifier.ts
+/**
+* Map the physical id `cdkd import` hands `CloudControlProvider.import()` onto
+* the identifier Cloud Control's `GetResource` accepts (issue
+* [#3672](https://github.com/go-to-k/cdkd/issues/3672)).
+*
+* ## The mismatch
+*
+* Cloud Control identifies a resource whose schema `primaryIdentifier` has more
+* than one field by the field VALUES joined with `|`, in schema order. That
+* joined string is also what cdkd records as the physical id of every resource
+* it creates through Cloud Control. CloudFormation's `PhysicalResourceId` for
+* the same resource is often ONE of those values only — `AWS::EC2::VPCCidrBlock`
+* reports the bare `vpc-cidr-assoc-…` association id, while Cloud Control wants
+* `<Id>|<VpcId>`. `cdkd import --migrate-from-cloudformation` passes
+* CloudFormation's value through as `knownPhysicalId`, so `GetResource` failed,
+* the resource was not adopted, and retiring the stack orphaned it.
+*
+* ## The rule — schema-driven, not a per-type table
+*
+* The composite types that reach this path are exactly the ones with no SDK
+* provider, and the committed schema fixtures (`tests/fixtures/cfn-schemas/`)
+* cover SDK-provider types only, so no committed source enumerates them. The
+* registry schema is read at run time instead (`cloudformation:DescribeType`,
+* one call per type, cached), and a bare id is completed from the template:
+*
+* - every identifier field the template declares as a literal string — after
+*   `cdkd import`'s `Ref` pre-substitution, so `VpcId: {Ref: Vpc}` arrives as
+*   `vpc-…` under `--migrate-from-cloudformation` — takes that value;
+* - EXACTLY ONE field left over takes the supplied id;
+* - NO field left over means the template alone names the resource, and that
+*   composite is used.
+*
+* Everything else is REFUSED with the composite shape to pass instead, rather
+* than guessed: two or more fields the template cannot supply, or a supplied id
+* equal to a value the template already gave another field (it cannot then be
+* told which field it is). A refused import is reported `failed` with that
+* remedy. It does NOT stop `--migrate-from-cloudformation` from retiring the
+* stack: `import.ts` counts it among the not-imported resources, warns that
+* they stay in AWS unmanaged, and retires anyway — the same outcome an
+* unresolvable id had before this module, now with the value to re-import by.
+*
+* Template values are read as literal strings, numbers or booleans (a
+* `RuleNumber: 100` renders `100`, as Cloud Control joins it); anything else —
+* an unresolved intrinsic, an object, a blank string — counts as unknown.
+*
+* An id that already carries the full arity, a single-field type, and a type
+* whose schema cannot be read are passed through UNCHANGED — the behaviour
+* before this module existed.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only (same discipline as
+* `read-only-properties.ts`): the stored promise is the recovered one, and a
+* failure deletes its own entry so a later call retries.
+*/
+const primaryIdentifierCache = /* @__PURE__ */ new Map();
+/**
+* The type's schema `primaryIdentifier` as top-level property names, in schema
+* order — the order Cloud Control joins them in.
+*
+* `undefined` when the schema could not be read, declares no identifier, or
+* names a NESTED pointer (`/properties/A/B`), which no template property maps
+* onto. Never throws.
+*/
+function getPrimaryIdentifierFields(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
+	const cached = primaryIdentifierCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchPrimaryIdentifierFields(resourceType).catch((error) => {
+		primaryIdentifierCache.delete(resourceType);
+		getLogger().child("CcImportIdentifier").debug(`Failed to resolve the primary identifier for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${describeAwsFailure(error).detail}); the import id is passed to Cloud Control unchanged.`);
+	});
+	primaryIdentifierCache.set(resourceType, entry);
+	return entry;
+}
+async function fetchPrimaryIdentifierFields(resourceType) {
+	const response = await describeTypeWithThrottleRetry(resourceType);
+	if (!response.Schema) return void 0;
+	const primary = JSON.parse(response.Schema).primaryIdentifier;
+	if (!Array.isArray(primary) || primary.length === 0) return void 0;
+	const fields = [];
+	for (const pointer of primary) {
+		if (typeof pointer !== "string") return void 0;
+		const match = /^\/properties\/([^/]+)$/.exec(pointer);
+		if (!match?.[1]) return void 0;
+		fields.push(match[1].replace(/~1/g, "/").replace(/~0/g, "~"));
+	}
+	return fields;
+}
+/**
+* The identifier to send to Cloud Control `GetResource` — and to record as the
+* physical id, since it is the value every later Cloud Control call on the
+* resource needs. Pure; see the module header for the rule.
+*
+* @throws Error when the id cannot be completed unambiguously. The message names
+*   the composite shape `--resource` accepts.
+*/
+function toCloudControlIdentifier(input) {
+	const { resourceType, logicalId, physicalId, properties, fields } = input;
+	if (fields === void 0 || fields.length < 2) return physicalId;
+	if (physicalId.split("|").length === fields.length) return physicalId;
+	if (physicalId.trimStart().startsWith("{")) return physicalId;
+	const safeType = displaySafe(resourceType, { asciiOnly: true });
+	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+	const safeId = displaySafe(physicalId, { asciiOnly: true });
+	const shape = fields.map((field) => `<${field}>`).join("|");
+	const remedy = `Pass the Cloud Control identifier instead: --resource '${safeLogicalId}=${shape}'.`;
+	if (physicalId.includes("|")) throw new Error(`${safeType} ${safeLogicalId}: '${safeId}' has ${physicalId.split("|").length} '${"|"}'-separated segments, but Cloud Control identifies this type by ${fields.length} (${shape}). ${remedy}`);
+	const values = fields.map((field) => {
+		const value = Object.hasOwn(properties, field) ? properties[field] : void 0;
+		if (typeof value === "number" || typeof value === "boolean") return String(value);
+		return typeof value === "string" && value.trim() !== "" ? value : void 0;
+	});
+	const missing = fields.filter((_, index) => values[index] === void 0);
+	if (missing.length > 1) throw new Error(`${safeType} ${safeLogicalId}: Cloud Control identifies this type by ${shape}, and the template supplies no literal value for ${missing.join(" or ")}, so '${safeId}' cannot be placed. ${remedy}`);
+	if (missing.length === 1 && values.includes(physicalId)) throw new Error(`${safeType} ${safeLogicalId}: '${safeId}' equals a value the template already gives another field of the identifier ${shape}, so it cannot be told which field it is. ${remedy}`);
+	const completed = values.map((value) => value ?? physicalId);
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, fields.map((name, index) => ({
+		name,
+		value: completed[index]
+	})));
+	if (refusal !== void 0) throw new Error(refusal);
+	const identifier = completed.join("|");
+	if (missing.length === 0 && !values.includes(physicalId)) getLogger().child("CcImportIdentifier").debug(`${safeType} ${safeLogicalId}: the template supplies every field of the Cloud Control identifier ${shape}, so '${displaySafe(identifier, { asciiOnly: true })}' is looked up and the supplied id '${safeId}' is not used.`);
+	getLogger().child("CcImportIdentifier").debug(`${safeType} ${safeLogicalId}: completed '${safeId}' to the Cloud Control identifier '${displaySafe(identifier, { asciiOnly: true })}' (${shape}) from the template.`);
+	return identifier;
+}
+
 //#endregion
 //#region src/provisioning/cc-protection-properties.ts
 const CC_PROTECTION_PROPERTIES = {
@@ -37004,7 +37486,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B5acrjOr.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-ChgXLoRA.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -37999,7 +38481,9 @@ var CloudControlProvider = class {
 	*     parse `ResourceModel` (returned as a JSON string by CC API), and
 	*     return the ATTRIBUTE keys as `attributes` — see
 	*     {@link maskUncertifiedModelValues} for what "attribute" means here and
-	*     why every other key comes back MASKED rather than dropped.
+	*     why every other key comes back MASKED rather than dropped. A bare id
+	*     for a type with a COMPOSITE primary identifier is first completed from
+	*     the template (`cc-import-identifier.ts`, issue #3672).
 	*   - Without `knownPhysicalId`: return `null`. CC API has no efficient
 	*     `aws:cdk:path`-tag lookup — `ListResources` returns identifiers
 	*     only, so tag lookup would require one `GetResource` per resource
@@ -38115,13 +38599,20 @@ var CloudControlProvider = class {
 	*/
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
+		const identifier = toCloudControlIdentifier({
+			resourceType: input.resourceType,
+			logicalId: input.logicalId,
+			physicalId: input.knownPhysicalId,
+			properties: input.properties,
+			fields: await getPrimaryIdentifierFields(input.resourceType)
+		});
 		try {
 			const resp = await this.cloudControlClient.send(new GetResourceCommand({
 				TypeName: input.resourceType,
-				Identifier: input.knownPhysicalId
+				Identifier: identifier
 			}));
 			const safeType = displaySafe(input.resourceType, { asciiOnly: true });
-			const safeId = displaySafe(input.knownPhysicalId, { asciiOnly: true });
+			const safeId = displaySafe(identifier, { asciiOnly: true });
 			let parsedModel;
 			const raw = resp.ResourceDescription?.Properties;
 			if (typeof raw === "string" && raw.length > 0) try {
@@ -38134,10 +38625,9 @@ var CloudControlProvider = class {
 			} catch (parseErr) {
 				this.logger.warn(`Failed to parse CC API ResourceModel for ${safeType}/${safeId}: ${parseErr instanceof Error ? parseErr.name : typeof parseErr}. Recording no attributes for it; an Fn::GetAtt against this resource will fall back to a value constructed from its physical id.`);
 			}
-			const attributes = parsedModel === void 0 ? {} : await this.maskUncertifiedModelValues(parsedModel, input.resourceType, input.knownPhysicalId);
 			return {
-				physicalId: input.knownPhysicalId,
-				attributes
+				physicalId: identifier,
+				attributes: parsedModel === void 0 ? {} : await this.maskUncertifiedModelValues(parsedModel, input.resourceType, identifier)
 			};
 		} catch (error) {
 			if (error.name === "ResourceNotFoundException") return null;
@@ -38547,121 +39037,6 @@ function interruptWatchListenerCount() {
 	return sharedSigintHandler === void 0 ? 0 : 1;
 }
 
-//#endregion
-//#region src/provisioning/masked-retry-logger.ts
-/**
-* The masker a caller supplied, or the identity function when it supplied
-* none.
-*
-* ABSENT MEANS UNMASKED, and that is the back-compatible default the contract
-* mandates — `create()` / `update()` are also reached from the import path,
-* from `cdkd drift --revert`, and from tests, and a provider must not care
-* which caller it got. Centralised here so no call site re-spells the `??`
-* and accidentally makes the capability required.
-*/
-function maskerOrIdentity(maskSecrets) {
-	return maskSecrets ?? ((text) => text);
-}
-/**
-* A {@link RetryLogger} whose every line is routed through `maskSecrets`.
-*
-* `warn` is ALWAYS provided, never omitted. It is optional on `RetryLogger`,
-* and dropping it would silence the give-up summary on the calling path only —
-* trading a disclosure for the reporting hole issue #2018 closed. It goes
-* through the SAME mask as `debug` precisely because it is the line that
-* survives a run without `--verbose`; forwarding it unmasked would defeat the
-* fence at a HIGHER log level than the one the fence was written for.
-*
-* `logger` is typed structurally rather than as the concrete `Logger` so this
-* module stays a leaf and a test can pass two spies. That matches the
-* precedent already in the tree (`buildMfaConfigRequest` in
-* `cognito-provider.ts` takes an injected `logger?: { warn }`).
-*/
-function createMaskedRetryLogger(logger, maskSecrets) {
-	const mask = maskerOrIdentity(maskSecrets);
-	return {
-		debug: (message) => logger.debug(mask(message)),
-		warn: (message) => logger.warn(mask(message))
-	};
-}
-/**
-* Depth cap for {@link maskDeep}.
-*
-* What it actually bounds is unbounded WORK on a pathologically deep bag — see
-* the rationale at the cap itself, which is the authority. It is NOT primarily
-* a cycle guard: a template-derived bag cannot be cyclic, so that justification
-* over-claims (issue #2176 security review). It does still terminate one, which
-* is why the walk is safe to share with a caller that might hand it something
-* other than a template bag.
-*
-* Deliberately generous. Every shape these warnings exist to describe is a
-* scalar, a list of scalars, or a small record, so the walk does not reach
-* depth 2 in practice.
-*/
-const MASK_WALK_MAX_DEPTH = 8;
-/**
-* What {@link maskDeep} substitutes for a subtree it declines to descend into.
-*
-* MUST equal `SECRET_MASK` in `src/deployment/secret-redaction.ts`. It is
-* spelled here rather than imported so this module keeps its single-import leaf
-* property (see the module note above); the two are fenced against drift by a
-* test that imports both.
-*/
-const MASK_WALK_DEPTH_CAP_MARKER = "***";
-/**
-* Mask every string LEAF and KEY of an arbitrary value, returning a structure
-* safe to `JSON.stringify` into a log line or an error message (issue
-* [#2176](https://github.com/go-to-k/cdkd/issues/2176)).
-*
-* THE ORDERING IS THE WHOLE POINT, and it is why masking the finished message
-* is not a substitute. `maskSecretsInText` matches by literal occurrence, so:
-*
-*  1. ESCAPING. `JSON.stringify` escapes `"`, `\` and newlines, so a secret
-*     containing any of them no longer OCCURS in the stringified text and a
-*     mask applied afterwards cannot find it. That is not an exotic case — it
-*     is every Secrets Manager JSON document, the commonest real secret shape.
-*     Measured on the pre-fix tree for #2176: a plaintext of
-*     `{"user":"admin","pw":"hunter2"}` interpolated as
-*     `${JSON.stringify(value)}` came through a message-level mask COMPLETELY
-*     unchanged, while masking the leaves first rendered it `"***"`.
-*  2. LENGTH. A finished message is always longer than the value inside it, so
-*     it can only ever reach `maskSecretsInText`'s SUBSTRING arm, which ignores
-*     needles below `MIN_NEEDLE_LENGTH` (4). Handing the masker each RAW leaf
-*     reaches the WHOLE-VALUE arm, which has no floor. Measured the same way: a
-*     3-character secret survived `Value 'abc' at 'pin' failed ...` intact.
-*
-* Neither pass subsumes the other, so providers do BOTH — this walk on the
-* value, and the assembled message through the masker as well. The masker is
-* idempotent, so the overlap is free.
-*
-* Keys are masked as well as values: `JSON.stringify` renders them into the
-* same line, so a resolved secret used as a map key would otherwise escape.
-*
-* WHY THIS LIVES HERE rather than as a private walk per provider. SIX
-* hand-rolled copies had already accumulated — `elbv2-provider.ts`,
-* `cognito-provider.ts`, `sns-topic-provider.ts`, `dynamodb-table-provider.ts`,
-* `dynamodb-globaltable-provider.ts` and `apigatewayv2-provider.ts` — and
-* `elbv2-provider.ts` carried the standing instruction that "a THIRD site is
-* the point at which this should move into `../masked-retry-logger.ts` ... and
-* all three converge on it". That trigger had fired and been missed twice over,
-* and the copies had already diverged exactly as predicted: FOUR of the six
-* carried NO depth cap at all.
-*
-* Worth recording how the last two were nearly missed AGAIN, because it is the
-* same failure one level up: the first sweep for this issue grepped for
-* `maskDeep` / `MASK_WALK_MAX_DEPTH` — the SPELLINGS the known copies used —
-* and the two survivors spell it `maskLeaf` / `maskLeafValue` with no named
-* constant. Grep for the SHAPE, not the name. These copies encode a security
-* contract, and a hardening applied to one silently leaves the others behind.
-*/
-function maskDeep(value, mask, depth = 0) {
-	if (typeof value === "string") return mask(value);
-	if (depth >= 8) return "***";
-	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
-	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
-	return value;
-}
-
 //#endregion
 //#region src/provisioning/providers/custom-resource-provider.ts
 /**
@@ -52421,5 +52796,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, MalformedProducerRecordRefusalError as $a, resolveSkipPrefix as $i, refuseMalformedOutputsForDestroy as $n, hasReadableExportSet as $r, requireConfigArray as $t, createPreDeleteFinalSnapshot as A, ownValue as Aa, describeDockerFailure as Ai, malformedExportSourceWarning as An, identityKeyFor as Ar, IntrinsicFunctionResolver as At, isStatefulRecreateTargetSync as B, runWithStackAwsClients as Ba, runDockerStreaming as Bi, malformedResourceEntriesWarning as Bn, redactSecretsForState as Br, refStateLookupFromResource as Bt, namesAnyDeclaredParameter as C, failedStageNote as Ca, validateAssetBucketName as Ci, displayLogicalId as Cn, safeStringify$1 as Co, STATE_SOURCED_CROSS_GENERATION_RULES as Cr, ccProtectionRegistryTypes as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, hasOwnKey as Da, resolveDockerContextDirectory as Di, isReadableOrphanRecord as Dn, createSecretMasker as Dr, isWaitAbandonedError as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, defineOwnKey as Ea, buildDockerImage as Ei, hasReadableResources as En, carriesSecretMask as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fa, isDockerClientEnvKey as Fi, malformedOrphansRefusalMessage as Fn, maskSecretsInText as Fr, getAccountInfo as Ft, toCfnInteger as G, CrossAccountSecretRefusalError as Ga, getDockerImageBySourceHash as Gi, refuseDivergentRecordRegionForDestroy as Gn, UNREPRODUCIBLE_LOCK_CLAUSE as Gr, assertRegionMatch as Gt, WARM_THROUGHPUT_MEMBERS as H, AssetError as Ha, escapeRegExp$1 as Hi, malformedResourcesWarning as Hn, LockManager as Hr, WAFv2WebACLProvider as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ia, isMalformedEnvKey as Ii, malformedOrphansWarning as In, pathCrossesDottedKey as Ir, isImpossibleEmptyStoredAttribute as It, bold as J, DynamicReferenceRegionAmbiguousError as Ja, getDefaultStateBucketName as Ji, refuseMalformedOrphanRecordsForDestroy as Jn, forceQuitRecoveryClause as Jr, configBooleanRefusal as Jt, toFiniteNumber as K, DependencyError as Ka, Synthesizer as Ki, refuseMalformedNestedChildOutputs as Kn, buildForceUnlockCommand as Kr, coerceCfnBoolean as Kt, planOrphanAdoption as L, AwsClients as La, partitionSensitiveEnv as Li, malformedOutputsRefusalMessage as Ln, recordMaskOnlyValue as Lr, isNamelessDynamicReferenceError as Lt, refusesFinalSnapshot as M, displayAssemblyPath as Ma, finchSecretArgvRefusal as Mi, malformedOrphanRecordsRefusalMessage as Mn, isUncertifiedBaselineMaskPosition as Mr, carriesFetchableDynamicReference as Mt, unsupportedFinalSnapshotError as N, renderAssemblyPathEscape as Na, formatDockerLoginError as Ni, malformedOrphanRecordsWarning as Nn, markSameGenerationBag as Nr, cfnRefValueFromPhysicalId as Nt, buildFinalSnapshotIdentifier as O, hasPlainPrototype$1 as Oa, describeDockerCapturedOutput as Oi, isReadableResourceEntry as On, dynamicReferenceTokens as Or, disableInstanceApiTermination as Ot, makeCanonicalizePropertiesFn as P, resolveAssemblyPath as Pa, getDockerCmd as Pi, malformedOrphanRowsKeptWarning as Pn, maskSecretsInError as Pr, coerceParameterTypedValue as Pt, red as Q, LockError as Qa, resolveCaptureObservedState as Qi, refuseMalformedOutputs as Qn, exportNamesCarriedFrom as Qr, replayWarn as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ra, redactDockerArgvValues as Ri, malformedOutputsWarning as Rn, recordMaskOnlyValuesIn as Rr, isUnboundTemplateParameter as Rt, computeParameterTaint as S, AssemblyReader as Sa, readBootstrapMarkerBody as Si, deployRefusesOrphanRowsReason as Sn, describeAwsFailure as So, STATE_SOURCED_BASELINE_RULES as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, processStackMessages as Ta, buildDenyExternalAccessPolicy as Ti, hasReadableOutputs as Tn, TEMPLATE_SOURCED_RULES as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, CdkdError as Ua, stripControlChars as Ui, malformedStateRefusalMessage as Un, S3StateBackend as Ur, normalizeAwsTagsToCfn as Ut, renderStatefulReason as V, setAwsClients as Va, warnFinchArgvExposure as Vi, malformedResourcePropertiesWarning as Vn, scrubResourceRecord as Vr, isSettledInstanceState as Vt, isWarmThroughputDecrease as W, ConfigError as Wa, AssetManifestLoader as Wi, previewableOrphanRecords as Wn, rebuildClientForBucketRegion as Wr, resolveExplicitPhysicalId as Wt, gray as X, LocalInvokeBuildError as Xa, resolveApp as Xi, refuseMalformedOrphansForDestroy as Xn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Xr, configStringRefusal as Xt, cyan as Y, IntrinsicResolutionRefusalError as Ya, getLegacyStateBucketName as Yi, refuseMalformedOrphans as Yn, formatLockExpiry as Yr, configIntegerRefusal as Yt, green as Z, LocalStartServiceError as Za, resolveAutoAssetStorage as Zi, refuseMalformedOrphansForOrphan as Zn, DEFAULT_STATE_PREFIX as Zr, readConfigString as Zt, bagHoldsSecretExpression as _, expectedOwnerParam as _a, assertAssetBucketRegion as _i, DiffCalculator as _n, isThrottlingError as _o, findSilentDropProperties as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, ssmResolvedValueType as aa, orphansAfterRollback as ai, producerRegionsFromState as an, StackHasActiveImportsError as ao, refuseMalformedState as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, derivePartitionAndUrlSuffix as ba, isCrossRegionRedirect as bi, UNREADABLE_ORPHANS_CONTAINER_ROW as bn, markRedactedCause as bo, DagBuilder as br, startInterruptWatch as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ca, AssetPublisher as ci, s3BucketDomainName as cn, SynthesisError as co, repairMalformedOutputsForReadOnly as cr, IAMRoleProvider as ct, updatePartialMessage as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as da, buildAssetRedirectMap as di, s3BucketWebsiteUrl as dn, normalizeAwsError as do, repairMalformedResourcesForReadOnly as dr, ProviderRegistry as dt, resolveStateBucketWithDefault as ea, hasReasonlessBaselineRefusal as ei, requireConfigObject as en, NestedStackChildDirectDestroyError as eo, refuseMalformedResourceAttributesForOrphan as er, collectDeclaredOutputNames as et, updatePartialReason as f, injectiveKey as fa, createAssetRedirectResolver as fi, applyRoleArnIfSet as fn, withErrorHandling as fo, safeRegion as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, decodeListingKey as ga, BOOTSTRAP_MARKER_PREFIX as gi, envCredentialsAreAssumedRole as gn, isRetryableTransientError as go, findActionableSilentDrops as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, producerRecordKey as ha, AssetModeResolver as hi, callerEnvCredentials as hn, isMarkedNonRetryable as ho, unreadableOrphanRecords as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, warnDeprecatedNoPrefixCliFlag as ia, isReadableBag as ii, classifyReplaySecretRegion as in, ResourceUpdateNotSupportedError as io, refuseMalformedResourcesForDestroy as ir, secretBearing as it, isFinalSnapshotError as j, absoluteAssemblyPathEscape as ja, dockerSpawnEnvWithSensitive as ji, malformedLocalOutputsWarning as jn, isSingleDynamicReferenceToken as jr, carriesDynamicReference as jt, ccRoutedFinalSnapshotError as k, nullPrototypeRecord as ka, describeDockerExecFailure as ki, malformedExportNamesWarning as kn, errorCauseChain as kr, isTerminationProtectionPropagationError as kt, replayRollback as l, findLargeInlineResources as la, stringifyValue as li, s3BucketDualStackDomainName as ln, formatError as lo, repairMalformedResourceEntriesForReadOnly as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, producerCoordinateKey as ma, rewriteTemplateAssetReferences as mi, applyCallerIdentityCredentials as mn, shellQuote as mo, unpreviewableOrphanRecords as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveUseCdkBootstrapAssets as na, importableOutputKeys as ni, definedAttributes as nn, ProvisioningError as no, refuseMalformedResourceEntriesForOrphan as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oa, orphansCarriedFrom as oi, withSharedDrainBudget as on, StackTerminationProtectionError as oo, repairMalformedOrphanRecordsForReadOnly as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, injectiveKeyPrefix as pa, loadPublishableAssetManifest as pi, AWS_CREDENTIAL_ENV_KEYS as pn, pasteableCommand as po, safeStackName as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DeployCancelledError as qa, synthesisStatusMessage as qi, refuseMalformedOrphanRecords as qn, buildLockContentionMessage as qr, coerceCfnInteger as qt, DeployEngine as r, stateBucketExistenceConfirmed as ra, importableOutputs as ri, stringifyIfAssigned as rn, ResourceTimeoutError as ro, refuseMalformedResourcePropertiesForOrphan as rr, isExportAliasCollision as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sa, shouldRetainResource as si, s3BucketArn as sn, StateError as so, repairMalformedOrphansForReadOnly as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as ta, hasUnverifiableParameterRefusal as ti, requireConfigString as tn, PartialFailureError as to, refuseMalformedResourceEntries as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, uploadCfnTemplate as ua, WorkGraph as ui, s3BucketRegionalDomainName as un, isCdkdError as uo, repairMalformedResourcePropertiesForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, PARTITION_TABLE as va, ensureAssetStorage as vi, INTRINSIC_KEYS as vn, isTransientServerError as vo, describeTypeWithThrottleRetry as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, globMatches as wa, validateContainerRepoName as wi, hasReadableOrphans as wn, __exportAll as wo, STATE_SOURCED_READBACK_RULES as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, ambientClientDefaults as xa, parseBootstrapMarker as xi, UNREADABLE_RESOURCES_MAP_ROW as xn, retryClassificationText as xo, TemplateParser as xr, CloudControlProvider as xt, keptWholeReasonText as y, canonicalizeRegion as ya, getBootstrapMarkerKey as yi, STATE_RESOURCES_MALFORMED as yn, markNonRetryable as yo, withRetry as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as za, runDockerForeground as zi, malformedRenderedContainersWarning as zn, recoverMaskedOutput as zr, parameterTypeMayLoseSecretIdentity as zt };
-//# sourceMappingURL=deploy-engine-DGV6XNWO.js.map
+export { yellow as $, DependencyError as $a, getLegacyStateBucketName as $i, refuseMalformedOrphans as $n, formatLockExpiry as $r, configIntegerRefusal as $t, createPreDeleteFinalSnapshot as A, failedStageNote as Aa, buildDockerImage as Ai, hasReadableResources as An, safeStringify$1 as Ao, carriesSecretMask as Ar, deleteSkipReason as At, isStatefulRecreateTargetSync as B, renderAssemblyPathEscape as Ba, isMalformedEnvKey as Bi, malformedOrphansWarning as Bn, pathCrossesDottedKey as Br, isImpossibleEmptyStoredAttribute as Bt, namesAnyDeclaredParameter as C, canonicalizeRegion as Ca, getBootstrapMarkerKey as Ci, STATE_RESOURCES_MALFORMED as Cn, isRetryableTransientError as Co, withRetry as Cr, compositeIdSkipResult as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, clientDefaultsFor as Da, validateAssetBucketName as Di, displayLogicalId as Dn, markRedactedCause as Do, STATE_SOURCED_CROSS_GENERATION_RULES as Dr, maskerOrIdentity as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, ambientCredentialConfig as Ea, readBootstrapMarkerBody as Ei, deployRefusesOrphanRowsReason as En, markNonRetryable as Eo, STATE_SOURCED_BASELINE_RULES as Er, maskDeep as Et, extractDeploymentEventError as F, hasPlainPrototype$1 as Fa, dockerSpawnEnvWithSensitive as Fi, malformedLocalOutputsWarning as Fn, isSingleDynamicReferenceToken as Fr, carriesDynamicReference as Ft, toCfnInteger as G, getAwsClients as Ga, warnFinchArgvExposure as Gi, malformedResourcePropertiesWarning as Gn, scrubResourceRecord as Gr, isSettledInstanceState as Gt, WARM_THROUGHPUT_MEMBERS as H, clearBucketRegionCache as Ha, redactDockerArgvValues as Hi, malformedOutputsWarning as Hn, recordMaskOnlyValuesIn as Hr, isUnboundTemplateParameter as Ht, makeSiblingClaimReader as I, nullPrototypeRecord as Ia, finchSecretArgvRefusal as Ii, malformedOrphanRecordsRefusalMessage as In, isUncertifiedBaselineMaskPosition as Ir, carriesFetchableDynamicReference as It, bold as J, setAwsClients as Ja, AssetManifestLoader as Ji, previewableOrphanRecords as Jn, rebuildClientForBucketRegion as Jr, resolveExplicitPhysicalId as Jt, toFiniteNumber as K, resetAwsClients as Ka, escapeRegExp$1 as Ki, malformedResourcesWarning as Kn, LockManager as Kr, WAFv2WebACLProvider as Kt, planOrphanAdoption as L, ownValue as La, formatDockerLoginError as Li, malformedOrphanRecordsWarning as Ln, markSameGenerationBag as Lr, cfnRefValueFromPhysicalId as Lt, refusesFinalSnapshot as M, processStackMessages as Ma, describeDockerCapturedOutput as Mi, isReadableResourceEntry as Mn, dynamicReferenceTokens as Mr, disableInstanceApiTermination as Mt, unsupportedFinalSnapshotError as N, defineOwnKey as Na, describeDockerExecFailure as Ni, malformedExportNamesWarning as Nn, errorCauseChain as Nr, isTerminationProtectionPropagationError as Nt, buildFinalSnapshotIdentifier as O, credentialFingerprint as Oa, validateContainerRepoName as Oi, hasReadableOrphans as On, retryClassificationText as Oo, STATE_SOURCED_READBACK_RULES as Or, UNSPECIFIED_SKIP_REASON as Ot, makeCanonicalizePropertiesFn as P, hasOwnKey as Pa, describeDockerFailure as Pi, malformedExportSourceWarning as Pn, identityKeyFor as Pr, IntrinsicFunctionResolver as Pt, red as Q, CrossAccountSecretRefusalError as Qa, getDefaultStateBucketName as Qi, refuseMalformedOrphanRecordsForDestroy as Qn, forceQuitRecoveryClause as Qr, configBooleanRefusal as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, absoluteAssemblyPathEscape as Ra, getDockerCmd as Ri, malformedOrphanRowsKeptWarning as Rn, maskSecretsInError as Rr, coerceParameterTypedValue as Rt, computeParameterTaint as S, PARTITION_TABLE as Sa, ensureAssetStorage as Si, INTRINSIC_KEYS as Sn, isMarkedNonRetryable as So, describeTypeWithThrottleRetry as Sr, compositeIdSeparatorRefusal as St, resourcesNamingDeclaredParameter as T, ambientClientDefaults as Ta, parseBootstrapMarker as Ti, UNREADABLE_RESOURCES_MAP_ROW as Tn, isTransientServerError as To, TemplateParser as Tr, createMaskedRetryLogger as Tt, coerceWarmThroughput as U, resolveBucketRegion as Ua, runDockerForeground as Ui, malformedRenderedContainersWarning as Un, recoverMaskedOutput as Ur, parameterTypeMayLoseSecretIdentity as Ut, renderStatefulReason as V, resolveAssemblyPath as Va, partitionSensitiveEnv as Vi, malformedOutputsRefusalMessage as Vn, recordMaskOnlyValue as Vr, isNamelessDynamicReferenceError as Vt, isWarmThroughputDecrease as W, AwsClients as Wa, runDockerStreaming as Wi, malformedResourceEntriesWarning as Wn, redactSecretsForState as Wr, refStateLookupFromResource as Wt, gray as X, CdkdError as Xa, Synthesizer as Xi, refuseMalformedNestedChildOutputs as Xn, buildForceUnlockCommand as Xr, coerceCfnBoolean as Xt, cyan as Y, AssetError as Ya, getDockerImageBySourceHash as Yi, refuseDivergentRecordRegionForDestroy as Yn, UNREPRODUCIBLE_LOCK_CLAUSE as Yr, assertRegionMatch as Yt, green as Z, ConfigError as Za, synthesisStatusMessage as Zi, refuseMalformedOrphanRecords as Zn, buildLockContentionMessage as Zr, coerceCfnInteger as Zt, bagHoldsSecretExpression as _, injectiveKeyPrefix as _a, loadPublishableAssetManifest as _i, AWS_CREDENTIAL_ENV_KEYS as _n, isCdkdError as _o, safeStackName as _r, startInterruptWatch as _t, DeploymentEventsStore as a, resolveStateBucketWithDefaultAndSource as aa, hasUnverifiableParameterRefusal as ai, requireConfigString as an, LockError as ao, refuseMalformedResourceEntries as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, decodeListingKey as ba, BOOTSTRAP_MARKER_PREFIX as bi, envCredentialsAreAssumedRole as bn, pasteableCommand as bo, findActionableSilentDrops as br, ccProtectionRegistryTypes as bt, replayFailedOperations as c, warnDeprecatedNoPrefixCliFlag as ca, isReadableBag as ci, classifyReplaySecretRegion as cn, PartialFailureError as co, refuseMalformedResourcesForDestroy as cr, IAMRoleProvider as ct, updatePartialMessage as d, CFN_TEMPLATE_URL_LIMIT as da, shouldRetainResource as di, s3BucketArn as dn, ResourceUpdateNotSupportedError as do, repairMalformedOrphansForReadOnly as dr, ProviderRegistry as dt, resolveApp as ea, CUSTOM_RESOURCE_RESPONSE_PREFIX as ei, configStringRefusal as en, DeployCancelledError as eo, refuseMalformedOrphansForDestroy as er, collectDeclaredOutputNames as et, updatePartialReason as f, MIGRATE_TMP_PREFIX as fa, AssetPublisher as fi, s3BucketDomainName as fn, StackHasActiveImportsError as fo, repairMalformedOutputsForReadOnly as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, injectiveKey as ga, createAssetRedirectResolver as gi, applyRoleArnIfSet as gn, formatError as go, safeRegion as gr, isInterruptedWaitError as gt, IMPLICIT_DELETE_DEPENDENCIES as h, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ha, buildAssetRedirectMap as hi, s3BucketWebsiteUrl as hn, SynthesisError as ho, repairMalformedResourcesForReadOnly as hr, interruptWatchListenerCount as ht, DeploymentEventsReader as i, resolveStateBucketWithDefault as ia, hasReasonlessBaselineRefusal as ii, requireConfigObject as in, LocalStartServiceError as io, refuseMalformedResourceAttributesForOrphan as ir, secretBearing as it, isFinalSnapshotError as j, globMatches as ja, resolveDockerContextDirectory as ji, isReadableOrphanRecord as jn, __exportAll as jo, createSecretMasker as jr, isWaitAbandonedError as jt, ccRoutedFinalSnapshotError as k, AssemblyReader as ka, buildDenyExternalAccessPolicy as ki, hasReadableOutputs as kn, describeAwsFailure as ko, TEMPLATE_SOURCED_RULES as kr, deleteIndeterminateGuards as kt, replayRollback as l, ssmResolvedValueType as la, orphansAfterRollback as li, producerRegionsFromState as ln, ProvisioningError as lo, refuseMalformedState as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, uploadCfnTemplate as ma, WorkGraph as mi, s3BucketRegionalDomainName as mn, StateError as mo, repairMalformedResourcePropertiesForReadOnly as mr, endCommandInterruptScope as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveCaptureObservedState as na, exportNamesCarriedFrom as ni, replayWarn as nn, IntrinsicResolutionRefusalError as no, refuseMalformedOutputs as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, resolveUseCdkBootstrapAssets as oa, importableOutputKeys as oi, definedAttributes as on, MalformedProducerRecordRefusalError as oo, refuseMalformedResourceEntriesForOrphan as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, findLargeInlineResources as pa, stringifyValue as pi, s3BucketDualStackDomainName as pn, StackTerminationProtectionError as po, repairMalformedResourceEntriesForReadOnly as pr, beginCommandInterruptScope as pt, formatResourceLine as q, runWithStackAwsClients as qa, stripControlChars as qi, malformedStateRefusalMessage as qn, S3StateBackend as qr, normalizeAwsTagsToCfn as qt, DeployEngine as r, resolveSkipPrefix as ra, hasReadableExportSet as ri, requireConfigArray as rn, LocalInvokeBuildError as ro, refuseMalformedOutputsForDestroy as rr, isExportAliasCollision as rt, planRollback as s, stateBucketExistenceConfirmed as sa, importableOutputs as si, stringifyIfAssigned as sn, NestedStackChildDirectDestroyError as so, refuseMalformedResourcePropertiesForOrphan as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveAutoAssetStorage as ta, DEFAULT_STATE_PREFIX as ti, readConfigString as tn, DynamicReferenceRegionAmbiguousError as to, refuseMalformedOrphansForOrphan as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, CFN_TEMPLATE_BODY_LIMIT as ua, orphansCarriedFrom as ui, withSharedDrainBudget as un, ResourceTimeoutError as uo, repairMalformedOrphanRecordsForReadOnly as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, producerCoordinateKey as va, rewriteTemplateAssetReferences as vi, applyCallerIdentityCredentials as vn, normalizeAwsError as vo, unpreviewableOrphanRecords as vr, CloudControlProvider as vt, reachableDivergentParameters as w, derivePartitionAndUrlSuffix as wa, isCrossRegionRedirect as wi, UNREADABLE_ORPHANS_CONTAINER_ROW as wn, isThrottlingError as wo, DagBuilder as wr, packCompositeId as wt, bindingSkippedOutputs as x, expectedOwnerParam as xa, assertAssetBucketRegion as xi, DiffCalculator as xn, shellQuote as xo, findSilentDropProperties as xr, compositeIdFormatMessage as xt, keptWholeReasonText as y, producerRecordKey as ya, AssetModeResolver as yi, callerEnvCredentials as yn, withErrorHandling as yo, unreadableOrphanRecords as yr, slowCcOperationTimeoutMs as yt, isStatefulRecreateTargetForReplace as z, displayAssemblyPath as za, isDockerClientEnvKey as zi, malformedOrphansRefusalMessage as zn, maskSecretsInText as zr, getAccountInfo as zt };
+//# sourceMappingURL=deploy-engine-CCvNP_dA.js.map