@go-to-k/cdkd 0.255.0 → 0.256.0

package/dist/{deploy-engine-CFUNbwD1.js → deploy-engine-vUgwldVH.js}

@@ -8917,8 +8917,37 @@ function collectReferencedParameterNames(template) {
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
-	constructor(region) {
+	strictGetAtt;
+	/**
+	* Number of unknown-attribute resolutions that fell back to the physical
+	* ID (the warn path) since construction / the last
+	* {@link resetPhysicalIdFallbackCount}. Counting semantics (issue #1111
+	* item 3): the deploy engine resets this at the start of each `deploy()`
+	* run AND again right before provisioning on the change path — the diff
+	* phase resolves through this same counted resolver, so without the
+	* second reset a fallback site on a to-be-updated resource would count
+	* once during diff and again during provisioning (~2x distinct sites in
+	* the summary). Each distinct fallback site therefore counts once per
+	* run: the surfaced summary covers provisioning + output resolution on
+	* the change path, diff + output resolution on the no-change path, and
+	* diff only under --dry-run. Instance-scoped, so parallel stacks (each
+	* with their own engine + resolver) never share a counter; for the same
+	* reason a nested-stack CHILD engine's fallbacks are counted by the
+	* child's own resolver and are NOT aggregated into the parent stack's
+	* deploy summary.
+	*/
+	physicalIdFallbackCount = 0;
+	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
+		this.strictGetAtt = options?.strictGetAtt ?? false;
+	}
+	/** Unknown-attribute physicalId fallbacks recorded since the last reset. */
+	getPhysicalIdFallbackCount() {
+		return this.physicalIdFallbackCount;
+	}
+	/** Reset the per-run fallback counter (called at the start of each deploy). */
+	resetPhysicalIdFallbackCount() {
+		this.physicalIdFallbackCount = 0;
 	}
 	/**
 	* Resolve parameter values from template Parameters section
@@ -9210,19 +9239,19 @@ var IntrinsicFunctionResolver = class {
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3:::${physicalId}`;
 			case "DomainName": return `${physicalId}.s3.amazonaws.com`;
 			case "RegionalDomainName": return `${physicalId}.s3.${region}.amazonaws.com`;
 			case "WebsiteURL": return `http://${physicalId}.s3-website-${region}.amazonaws.com`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -9252,37 +9281,38 @@ var IntrinsicFunctionResolver = class {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
-			default: return physicalId;
+			case "UserPoolId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -9292,36 +9322,36 @@ var IntrinsicFunctionResolver = class {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -9333,38 +9363,38 @@ var IntrinsicFunctionResolver = class {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -9376,25 +9406,26 @@ var IntrinsicFunctionResolver = class {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return physicalId;
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
-			default: return physicalId;
+			case "TopicName": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.amazonaws.com/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -9407,18 +9438,30 @@ var IntrinsicFunctionResolver = class {
 				if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
 				return physicalId;
 			}
-			default: return physicalId;
+			case "ServiceArn": {
+				const pipeIdx = physicalId.indexOf("|");
+				if (pipeIdx < 0) return physicalId;
+				const left = physicalId.substring(0, pipeIdx);
+				if (left.includes(":service/")) return left;
+				const clusterIdx = left.indexOf(":cluster/");
+				if (clusterIdx < 0) return physicalId;
+				const clusterName = left.substring(clusterIdx + 9);
+				const serviceName = physicalId.substring(pipeIdx + 1);
+				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
+			}
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
+			case "InstanceId": return physicalId;
 			case "PrivateIp":
 			case "PublicIp":
 			case "PrivateDnsName":
@@ -9457,7 +9500,7 @@ var IntrinsicFunctionResolver = class {
 				}
 				return physicalId;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -9470,11 +9513,44 @@ var IntrinsicFunctionResolver = class {
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
-			return physicalId;
+			if (attributeName === "LaunchTemplateId") return physicalId;
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+	}
+	/**
+	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
+	*
+	* Applied by BOTH the final unknown-type fallback of
+	* {@link constructAttribute} and every per-type handler's
+	* `default:`-for-an-unknown-attribute branch:
+	*
+	* - An attribute name ending in `Arn` whose fallback value is not
+	*   ARN-shaped (or ending in `Url` whose fallback is not an http(s) URL)
+	*   cannot be what CloudFormation would return — hard-fail. The #1103
+	*   incident shipped four resource NAMES into stack Outputs where ARNs
+	*   were requested, with a green deploy. A physicalId that already IS an
+	*   ARN / URL passes the shape check and remains a valid fallback.
+	* - Under `--strict-getatt`, EVERY unknown-attribute fallback (any
+	*   suffix) is a hard error.
+	* - Otherwise: `Alias` / `Endpoint` and every other suffix keep the
+	*   warn-and-return behavior (an alias or endpoint is
+	*   shape-indistinguishable from a plain name, so a hard-fail there
+	*   would risk failing correct deploys — false positives are
+	*   unacceptable). Each warn-and-return increments the per-run fallback
+	*   counter surfaced in the deploy summary.
+	*
+	* A `return physicalId` that is the CORRECT value for a KNOWN attribute
+	* (e.g. `AWS::KMS::Key.KeyId`, `AWS::SNS::Topic.TopicName`) must NOT
+	* route through this helper — those are explicit `case`s in the
+	* per-type handlers.
+	*/
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (this.strictGetAtt) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
@@ -10878,7 +10954,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BPtdM67j.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DbIC4hWG.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -16280,7 +16356,7 @@ var DeployEngine = class {
 		this.options = options;
 		this.stackRegion = stackRegion;
 		this.exportIndexStore = exportIndexStore;
-		this.resolver = new IntrinsicFunctionResolver(stackRegion);
+		this.resolver = new IntrinsicFunctionResolver(stackRegion, { strictGetAtt: options.strictGetAtt ?? false });
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
 		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
@@ -16295,6 +16371,7 @@ var DeployEngine = class {
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
+		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
 	/**
@@ -16611,7 +16688,8 @@ var DeployEngine = class {
 					deleted: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
-					outputs: this.buildDisplayOutputs(template, persistedOutputs)
+					outputs: this.buildDisplayOutputs(template, persistedOutputs),
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
 			const createChanges = this.diffCalculator.filterByType(changes, "CREATE");
@@ -16626,9 +16704,11 @@ var DeployEngine = class {
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
-					durationMs: Date.now() - startTime
+					durationMs: Date.now() - startTime,
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
+			this.resolver.resetPhysicalIdFallbackCount();
 			const progress = {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
@@ -16647,7 +16727,8 @@ var DeployEngine = class {
 				deleted: actualCounts.deleted,
 				unchanged: unchangedCount,
 				durationMs,
-				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {})
+				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
+				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		} finally {
 			renderer.stop();
@@ -16861,7 +16942,13 @@ var DeployEngine = class {
 			}
 			throw error;
 		}
-		const outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		let outputs;
+		try {
+			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		} catch (outputError) {
+			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
+			throw outputError;
+		}
 		return {
 			state: {
 				version: 8,
@@ -16877,6 +16964,58 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* Persist state after provisioning fully succeeded but output resolution
+	* threw (only reachable under `--strict-getatt`, whose promotion fires
+	* AFTER the rollback catch block). The persisted shape mirrors the
+	* success-path state EXCEPT for outputs:
+	*
+	* - `resources`: this run's provisioning result (`newResources`) — every
+	*   create/update/delete landed in AWS, so state must record it.
+	* - `imports` / `outputReads`: this run's `recordedImports` /
+	*   `recordedOutputReads` (the provisioning that produced them succeeded;
+	*   dropping them would desync the strong-reference records from AWS —
+	*   matters on the update-deploy path where the pre-deploy snapshot may
+	*   be stale).
+	* - `outputs`: the PREVIOUSLY persisted map — resolveOutputs threw before
+	*   producing a new one, mirroring what a resource-failure persist keeps.
+	*   The exports index is deliberately NOT updated (it stays consistent
+	*   with the old outputs that remain in state).
+	*
+	* ETag handling mirrors the post-rollback save: expected-ETag first (or
+	* unconditional when `pendingMigration` — same as the per-resource save),
+	* then a fresh-ETag retry, then warn. Best-effort: the deploy error being
+	* rethrown is the primary signal; a failed save only warns.
+	*/
+	async persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
+		const buildState = () => ({
+			version: 8,
+			region: this.stackRegion,
+			stackName: currentState.stackName,
+			resources: newResources,
+			outputs: currentState.outputs,
+			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
+			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
+			lastModified: Date.now()
+		});
+		try {
+			const expectedEtag = pendingMigration ? void 0 : currentEtag;
+			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), {
+				...expectedEtag !== void 0 && { expectedEtag },
+				migrateLegacy: pendingMigration
+			});
+			this.logger.debug("State saved after output resolution failure");
+		} catch (saveError) {
+			this.logger.debug(`Retrying state save after output resolution failure (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			try {
+				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
+				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
+				this.logger.debug("State saved after output resolution failure (retry succeeded)");
+			} catch (retryError) {
+				this.logger.warn(`Failed to save state after output resolution failure: ${retryError instanceof Error ? retryError.message : String(retryError)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			}
+		}
+	}
+	/**
 	* Perform best-effort rollback of completed operations respecting dependencies
 	*
 	* - CREATE → delete the newly created resource (in reverse dependency order)
@@ -17624,6 +17763,7 @@ var DeployEngine = class {
 					if (typeof exportName === "string") outputs[exportName] = value;
 				}
 			} catch (error) {
+				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`);
 				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
 				outputs[outputKey] = void 0;
 			}
@@ -17643,4 +17783,4 @@ var DeployEngine = class {
 
 //#endregion
 export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, refStateLookupFromResource as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, ProviderRegistry as C, warnDeprecatedNoPrefixCliFlag as Ct, isTerminationProtectionPropagationError as D, findLargeInlineResources as Dt, disableInstanceApiTermination as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, IntrinsicFunctionResolver as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, isRetryableTransientError as S, resolveUseCdkBootstrapAssets as St, CloudControlProvider as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, importTagWalk as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, WAFv2WebACLProvider as j, clearBucketRegionCache as jt, cfnRefValueFromPhysicalId as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, findActionableSilentDrops as w, CFN_TEMPLATE_BODY_LIMIT as wt, withRetry as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
-//# sourceMappingURL=deploy-engine-CFUNbwD1.js.map
+//# sourceMappingURL=deploy-engine-vUgwldVH.js.map