@go-to-k/cdkd 0.283.23 → 0.283.25

package/dist/{deploy-engine-CQXpKq7o.js → deploy-engine-MHqWGHl9.js}

@@ -9821,6 +9821,81 @@ function s3BucketWebsiteUrl(bucketName, region) {
 /** Fixed marker substituted for a secret value in log / error output. */
 const SECRET_MASK = "***";
 /**
+* Every `{{resolve:...}}` expression this process has PROVEN resolves to a
+* secret, as a SET — uncollapsed by resolved value (issue #1910).
+*
+* This is the piece {@link RecordedSecretValues} structurally cannot supply.
+* That map is keyed by the resolved PLAINTEXT, so when two expressions resolve
+* to the same value it keeps only the last, and asking it whether the LOSING
+* expression was a secret answers "no" — for precisely the pair the path-based
+* redaction exists to separate. The losing leaf then falls through to the value
+* scan and is persisted holding its SIBLING's expression: a permanent spurious
+* UPDATE, and on the rollback-journal replay path a re-resolution of the wrong
+* reference against the live resource.
+*
+* EVERY secret expression is recorded, not only the `ssm` ones (issue
+* [#1916](https://github.com/go-to-k/cdkd/issues/1916)). Only `ssm` needs an
+* entry to answer "is this secret?" — a `secretsmanager` reference is secret by
+* SPELLING (see {@link isKnownSecretExpression}), decidable with no lookup and
+* no memory, while an `ssm` one is secret only when its parameter is a
+* `SecureString`, knowable only from the `GetParameter` response. But this set
+* answers a SECOND question: it is the CANDIDATE LIST
+* {@link positionByIntrinsicSkeleton} matches an intrinsic source leaf against,
+* and there the losing member of a collapsed
+* secretsmanager/secretsmanager pair must be nameable too. Holding only the ssm
+* half made the set's name a lie and left that pair unpositionable.
+*
+* One kind is deliberately still absent: an `ssm` reference whose `Type` came
+* back unclassifiable is treated as secret for THAT resolution but not pinned,
+* so the next pass re-asks AWS rather than inheriting a transient answer
+* (issue #1901). Recording it here would pin it for the process.
+*
+* It lives in THIS module rather than in the resolver even though the resolver
+* is its only writer, for two reasons. This module is the LEAF — the resolver
+* already imports it, so the store is reachable from the writer without adding
+* an edge, while the reverse (a leaf importing the resolver) would close a
+* cycle. And the READER is {@link isKnownSecretExpression} right here, so
+* homing it here means no call site has to thread it: the four sibling writers
+* #1910 fixes pass a position SOURCE and nothing else.
+*
+* Its lifetime matches the resolver's `cachedDynamicReferences` — the resolver
+* clears both together, and that shared lifetime is the point: this set IS the
+* resolver's own SecureString verdict store, which already had exactly this
+* scope, so nothing is widened by homing it here.
+*
+* Process-wide is therefore INHERITED, not claimed to be ideal. It is not
+* strictly sound across regions or accounts in one run — the same expression
+* can name a `SecureString` in one region and a plain `String` in another — but
+* `cachedDynamicReferences` caches the resolved VALUE under the same
+* assumption, so a per-region store here would fix nothing on its own. Note
+* which way the imprecision points: an entry only ever GRANTS "persist the
+* source leaf verbatim", and the leaf is the resource's own template
+* expression, so the failure mode is a public reference stored as an expression
+* (a spurious UPDATE, issue #1901's class), never a secret stored as plaintext.
+*/
+const recordedSecretExpressions$1 = /* @__PURE__ */ new Set();
+/** Remember that `expression` resolves to a secret. Called by the resolver. */
+function recordSecretExpression(expression) {
+	recordedSecretExpressions$1.add(expression);
+}
+/**
+* Forget a previously recorded expression — the resolver's `SecureString`
+* verdict going the other way (an ssm parameter that turns out to be a plain
+* `String` / `StringList`, i.e. public config that must stay RESOLVED in
+* state).
+*/
+function forgetSecretExpression(expression) {
+	recordedSecretExpressions$1.delete(expression);
+}
+/** Has `expression` been PROVEN to resolve to a secret this process? */
+function isRecordedSecretExpression(expression) {
+	return recordedSecretExpressions$1.has(expression);
+}
+/** Drop every remembered verdict. Paired with the resolver's cache reset. */
+function clearRecordedSecretExpressions() {
+	recordedSecretExpressions$1.clear();
+}
+/**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
 * a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
 * match incidental characters everywhere and mangle unrelated state. Such a
@@ -9842,6 +9917,382 @@ function buildNeedleRegex(values) {
 	if (needles.length === 0) return void 0;
 	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
 }
+/** The bag was produced by resolving the source: same shape, template source. */
+const TEMPLATE_DERIVED_RULES = {
+	descendArrays: true,
+	trustAnyExpression: false
+};
+/** An AWS readback projected from a persisted STATE bag. */
+const STATE_SOURCED_READBACK_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true
+};
+/** An AWS readback projected from the TEMPLATE: neither relaxation applies. */
+const TEMPLATE_SOURCED_READBACK_RULES = {
+	descendArrays: false,
+	trustAnyExpression: false
+};
+/**
+* The bag was produced by resolving a STATE source — both relaxations apply.
+*
+* The rollback replay is the case (issue #1910): `resolveReplayProps` resolves
+* the JOURNALED bag and the provider's `effectiveProperties` come back from
+* that, so the two have identical structure and positional array descent is
+* sound exactly as it is for a template-derived bag. And the source is a
+* persisted record, which holds no PUBLIC expressions — a `String` ssm
+* reference is stored resolved — so any `{{resolve:...}}` in it is by
+* construction a secret.
+*
+* Using `STATE_SOURCED_READBACK_RULES` here instead would be wrong in the
+* quiet direction: it turns array descent OFF, so a secret nested in a
+* `Tags[]` / ECS `secrets[]` element falls to the value scan and a colliding
+* pair still collapses there.
+*/
+const STATE_DERIVED_RULES = {
+	descendArrays: true,
+	trustAnyExpression: true
+};
+function isDynamicReferenceString(value) {
+	return typeof value === "string" && value.includes("{{resolve:");
+}
+/**
+* Is this template expression one whose resolved value is a SECRET?
+*
+* Two independent answers, and both are needed:
+*
+* - A `secretsmanager` reference is secret BY DEFINITION, so spelling settles
+*   it with no lookup. This arm is what makes the #1904 fix work at all: when
+*   two expressions resolve to the same value the value-keyed map keeps only the
+*   last, so asking the map whether the LOSING expression was a secret answers
+*   "no" — precisely for the pair the fix exists to separate.
+* - An `ssm` reference is secret only when its parameter is a `SecureString`
+*   (issue #1901), which is not derivable from the string, so that arm consults
+*   what the resolver actually recorded.
+*
+* `secretExpressions` is what closes the ssm/ssm case (issue #1910). Derived
+* from the value-keyed map it is useless for exactly this question — the map
+* already collapsed the pair, so the losing expression is absent from
+* `secrets.values()` — which is why callers pass the resolver's own SET of
+* secret expressions instead. Callers that pass nothing fall back to the map's
+* values, i.e. to the pre-#1910 behavior: the pair still collapses, but nothing
+* leaks (both leaves are redacted, just onto one expression).
+*/
+function isKnownSecretExpression(expression, secretExpressions) {
+	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression) || isRecordedSecretExpression(expression);
+}
+/**
+* Is this source leaf a SINGLE complete `{{resolve:...}}` token and nothing
+* else?
+*
+* Whole-leaf substitution is only correct for that shape. A MIXED leaf --
+* `pre{{resolve:ssm:/public}}-{{resolve:secretsmanager:x}}post`, i.e. anything
+* the resolver substituted INTO rather than replaced -- must fall to the value
+* scan, which rewrites just the secret substring. Substituting the whole leaf
+* there would re-introduce every other token in it, including a public ssm
+* reference the resolver deliberately left resolved (issue #1901).
+*/
+function isSingleDynamicReferenceToken(value) {
+	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+}
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Stands in for a source part the skeleton cannot know — an `Fn::Join` element
+* that is itself an intrinsic, or an `Fn::Sub` `${...}` variable.
+*
+* `[^}]*` rather than `.*` because a recorded expression's INNER text never
+* contains `}`: the resolver matches them with `/\{\{resolve:([^}]+)\}\}/`, so
+* the first `}` after `{{resolve:` is already the terminator. Excluding it
+* means a wildcard can never swallow one token's terminator and run into the
+* next, so a skeleton for ONE reference cannot match a candidate built from a
+* different one.
+*/
+const SKELETON_WILDCARD = "[^}]*";
+/**
+* More wildcards than this and the skeleton is REFUSED outright.
+*
+* The bound is what actually closes the backtracking class; the collapse below
+* only closes one ARRANGEMENT of it. A skeleton with N wildcards makes a
+* FAILING match exponential in N — and failing is the common case, since the
+* pattern is tried against every recorded expression that is NOT this leaf's.
+* The collapse merges ADJACENT wildcards, so `${a}${b}${c}` becomes one; but
+* wildcards separated by a literal cannot merge and backtrack identically.
+* Measured against a failing candidate: `Fn::Sub '${a}x${b}x…'` at 6 wildcards
+* 17.7s and at 8 did not finish in two minutes, and a realistic
+* `Fn::Join['-', 9 x {Ref}]` against a hyphen-rich secret ARN took 855ms per
+* candidate. So the producer is the wildcard COUNT, not adjacency.
+*
+* What refusing costs is worth stating plainly rather than waving away, because
+* it is the SAME cost this module's residual note describes: a refused leaf
+* falls to the value scan, and for a colliding pair that means state holds the
+* SIBLING's reference, which `resolveReplayProps` re-resolves and applies. A
+* four-wildcard join carrying substantive literals CAN position uniquely, so
+* the bound does give something up. It is set where it is because the dominant
+* CDK shape carries exactly ONE wildcard (the secret ARN's `{Ref}`) and two or
+* three covers an account plus a region — and because the alternative at the
+* top of that trade is not "slightly better redaction" but a deploy that hangs
+* after its AWS mutations.
+*/
+const MAX_SKELETON_WILDCARDS = 3;
+/**
+* A candidate longer than this REFUSES the whole positioning pass.
+*
+* The wildcard cap bounds the EXPONENT; this bounds the BASE. Cost at the cap
+* is polynomial in the candidate's length (~cubic, measured: 200 chars 4.9ms,
+* 1000 chars 192ms, and an adversarial all-separator 3000-char candidate 4.1s),
+* and candidate length is template-authored — `[^}]*` never crosses a `}`, so
+* the whole expression is one backtracking run. A real `{{resolve:...}}` is
+* 100-250 characters even with a full ARN and a JSON key, so this only excludes
+* the pathological.
+*
+* The whole pass is refused rather than that one candidate being SKIPPED, and
+* the difference is load-bearing: skipping shrinks the candidate set, so a
+* second match could go unseen and condition 2's "exactly one" would be decided
+* over a filtered list — turning a bound meant for speed into a silent
+* weakening of the fence. Refusing degrades to the value scan like every other
+* refusal here.
+*/
+const MAX_SKELETON_CANDIDATE_LENGTH = 512;
+/**
+* Concatenate skeleton segments, dropping an empty one and COLLAPSING a run of
+* consecutive wildcards into one — then REFUSE (return `undefined`) when more
+* than {@link MAX_SKELETON_WILDCARDS} survive.
+*
+* The collapse is a correctness fix, not tidiness: `[^}]*[^}]*` is semantically
+* identical to `[^}]*`, but the engine has to try every split of the input
+* between them. Measured on a ~120-char candidate, before the collapse:
+* 4 adjacent wildcards 39ms, 5 ~1s, 6 20s, 8 did not finish in two minutes. Two
+* legal CFn shapes CDK can emit produce ADJACENT ones — an `Fn::Join` with an
+* EMPTY delimiter and consecutive non-string parts, and an `Fn::Sub` with
+* adjacent `${a}${b}` variables — and the collapse takes both to a single
+* wildcard. It does NOT close the class, which is why the cap exists beside it.
+*
+* This runs on the state-persist choke point, i.e. AFTER the AWS mutations and
+* BEFORE state is written, so a hang there strands real resources.
+*
+* An empty segment is dropped rather than appended because an empty DELIMITER
+* would otherwise sit between two wildcards and defeat the collapse. A
+* non-empty literal between two wildcards is what anchors the match, and those
+* are left exactly as they are — and counted.
+*/
+function joinSkeletonSegments(segments) {
+	const out = [];
+	let wildcards = 0;
+	for (const segment of segments) {
+		if (segment === "") continue;
+		if (segment === SKELETON_WILDCARD) {
+			if (out[out.length - 1] === SKELETON_WILDCARD) continue;
+			wildcards += 1;
+			if (wildcards > MAX_SKELETON_WILDCARDS) return void 0;
+		}
+		out.push(segment);
+	}
+	return out.join("");
+}
+/**
+* Build an anchored pattern describing what a `{{resolve:...}}` expression at
+* this INTRINSIC source leaf must look like — literal parts kept verbatim,
+* unknowable parts wildcarded (issue #1916).
+*
+* The dominant CDK shape is an `Fn::Join`, because `secret.secretValueFromJson(...)`
+* renders the secret's ARN as a `Ref` and CDK joins the pieces:
+*
+* ```json
+* {"Fn::Join": ["", ["{{resolve:secretsmanager:my-secret-", {"Ref": "AWS::AccountId"},
+*                    ":SecretString:password}}"]]}
+* ```
+*
+* which yields `^\{\{resolve:secretsmanager:my\-secret\-[^}]*:SecretString:password\}\}$`
+* — enough to tell that leaf's expression from its `:AWSCURRENT`-suffixed
+* sibling, which is precisely what the value map cannot do once the two
+* resolve to the same plaintext. `Fn::Sub` has the same shape via its literal
+* template string.
+*
+* Returns `undefined` for any source this cannot describe (a delimiter that is
+* itself an intrinsic, a non-array `Fn::Join`, a non-string `Fn::Sub`
+* template, an object that is not a single-key intrinsic at all), and the
+* caller then falls back to the value scan — i.e. to the pre-#1916 behavior.
+*
+* Exported for its TEST only. The reason is now CONVENIENCE rather than
+* necessity, and the distinction is worth keeping straight: before the wildcard
+* cap existed, driving the collapse through `redactSecretsForState` did not
+* fail on a timeout — catastrophic backtracking is SYNCHRONOUS, so it wedged
+* the vitest worker and the run never ended, which is a worse CI outcome than
+* the defect and indistinguishable from a slow machine. With the cap, dropping
+* the collapse turns that same input into a REFUSAL, so the behavior IS
+* observable through the public entry point. Asserting on the returned
+* pattern's shape is still the better fence — it names the invariant (how many
+* unknown spans survived) instead of a downstream consequence — but it is a
+* choice, not the only option.
+*/
+function intrinsicSkeletonPattern(source) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	if (key === "Fn::Join") {
+		const args = source[key];
+		if (!Array.isArray(args) || args.length !== 2) return void 0;
+		const [delimiter, parts] = args;
+		if (typeof delimiter !== "string" || !Array.isArray(parts)) return void 0;
+		const separator = escapeRegExp(delimiter);
+		const segments = [];
+		parts.forEach((part, index) => {
+			if (index > 0) segments.push(separator);
+			segments.push(typeof part === "string" ? escapeRegExp(part) : SKELETON_WILDCARD);
+		});
+		const body = joinSkeletonSegments(segments);
+		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+	}
+	if (key === "Fn::Sub") {
+		const args = source[key];
+		const template = typeof args === "string" ? args : Array.isArray(args) ? args[0] : void 0;
+		if (typeof template !== "string") return void 0;
+		const segments = [];
+		let cursor = 0;
+		const variable = /\$\{([^}]*)\}/g;
+		let hit;
+		while ((hit = variable.exec(template)) !== null) {
+			segments.push(escapeRegExp(template.slice(cursor, hit.index)));
+			const inner = hit[1];
+			segments.push(inner.startsWith("!") ? escapeRegExp(`\${${inner.slice(1)}}`) : SKELETON_WILDCARD);
+			cursor = hit.index + hit[0].length;
+		}
+		segments.push(escapeRegExp(template.slice(cursor)));
+		const body = joinSkeletonSegments(segments);
+		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+	}
+}
+/**
+* Position a leaf whose SOURCE is an intrinsic OBJECT, by matching the shape of
+* that intrinsic against the expressions this process recorded as secrets
+* (issue #1916).
+*
+* This is the residual {@link redactByPath} left behind. Its plain-string arm
+* persists the source leaf VERBATIM, which needs a source string to copy; when
+* the source leaf is an `Fn::Join` / `Fn::Sub` there is none, so the leaf fell
+* to the value scan — and the value map is keyed by the resolved PLAINTEXT, so
+* a colliding pair collapses there exactly as it did before #1904. That is the
+* DOMINANT CDK shape rather than an edge case: any secret reached through an L2
+* token renders the secret ARN as a `Ref`, hence an `Fn::Join`.
+*
+* Three conditions must ALL hold before an expression is persisted, and each
+* removes a different way of being wrong:
+*
+* 1. The bag leaf's WHOLE value is a recorded secret plaintext. The skeleton
+*    describes ONE complete `{{resolve:...}}` token, so a leaf that merely
+*    EMBEDS a secret (a join with surrounding text) is not this shape at all
+*    and must keep going to the value scan, which rewrites just the substring.
+* 2. EXACTLY ONE candidate matches. Two matching candidates mean the skeleton
+*    genuinely cannot separate them (`{Ref}` in the position that differs), and
+*    guessing would be the collapse this fix exists to remove, one step over.
+* 3. The match is not DEMONSTRABLY another value's expression. The pass's own
+*    map holds each surviving expression against the plaintext it resolved to,
+*    so a candidate recorded there under a DIFFERENT plaintext is refused. That
+*    is what fences a bag/source misalignment: a shape-plausible expression is
+*    rejected outright when the pass can see it resolved to something else. A
+*    candidate absent from that map is a collapsed LOSER, which is the case
+*    this whole function exists to serve, so it is accepted.
+*
+* Every rejection degrades to the value scan, i.e. to today's behavior, so no
+* case gets worse than it is without this pass.
+*
+* One residual is worth naming rather than leaving to be rediscovered: a single
+* WRONG candidate can win only when this leaf's own expression is in NEITHER
+* store — which is exactly an `ssm` reference whose `Type` came back
+* unclassifiable (deliberately unpinned per #1901) and which then lost the
+* value collapse. `recordedSecretExpressions` is process-wide, so the winner
+* could in principle come from another resource, and condition 3 cannot refuse
+* one the pass never recorded.
+*
+* **What that costs is a WRONG REFERENCE in state, not merely a noisy diff.**
+* Persisting another leaf's expression is the pre-#1904 failure exactly:
+* `resolveReplayProps` RE-RESOLVES the persisted expression against AWS and
+* hands the result to `provider.update`, so a rollback replays the wrong secret
+* — immediately, if the two references already resolve to different values. It
+* is narrow (unclassifiable-`ssm` leaves only) but it is not cosmetic, and an
+* earlier draft of this paragraph called it "a spurious UPDATE rather than a
+* disclosure", which understated it.
+*
+* There is deliberately NO {@link isKnownSecretExpression} check here, and the
+* asymmetry with {@link redactByPath}'s plain-string arm is principled rather
+* than an oversight. That arm's candidate is the SOURCE LEAF itself — arbitrary
+* template text, which genuinely can be a PUBLIC ssm reference that must stay
+* resolved in state (issue #1901), so it has to be tested. Here the candidates
+* come only from {@link recordedSecretExpressions} and from the values of a
+* {@link RecordedSecretValues} map, both of which the resolver populates ONLY
+* on a proven-secret verdict — so the test could never answer `false`, and an
+* unfalsifiable guard reads as protection while fencing nothing. Widening
+* either candidate source is what would make it necessary again.
+*/
+function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
+	if (bag === "" || !secrets.has(bag)) return void 0;
+	const pattern = intrinsicSkeletonPattern(source);
+	if (!pattern) return void 0;
+	const CONFLICTING = Symbol("conflicting plaintext");
+	const plaintextOf = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING : plaintext);
+	let matched;
+	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions$1])) {
+		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
+		if (!pattern.test(candidate)) continue;
+		const recordedPlaintext = plaintextOf.get(candidate);
+		if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) continue;
+		if (matched !== void 0) return void 0;
+		matched = candidate;
+	}
+	return matched;
+}
+/**
+* PATH-based redaction: walk `bag` alongside a SOURCE bag that still carries the
+* unresolved `{{resolve:...}}` expressions, and wherever the source leaf is such
+* a string, persist THAT string verbatim.
+*
+* This exists because value-keyed redaction cannot answer the question at all
+* when two expressions share one resolved value (issue #1904): the map is keyed
+* by the plaintext, so the two collapse and every site is rewritten to whichever
+* expression was recorded last — state then holds an expression the template
+* does not have at that leaf, and the stack takes a permanent spurious UPDATE.
+* Position is the only disambiguator, and the source bag supplies it.
+*
+* It also covers the case where there is no secrets map to consult at all
+* (issue #1900): an UNCHANGED resource is never resolved during a deploy, so its
+* `perResourceSecrets` entry is empty, and a live readback that echoes a secret
+* would be persisted in plaintext. Projecting from the resource's OWN state
+* record — which already holds the expressions — redacts it with no secret
+* fetch and no value matching.
+*
+* A source leaf that is an intrinsic OBJECT (`Fn::Join` / `Fn::Sub`) has no
+* string to copy, so it goes through {@link positionByIntrinsicSkeleton} first
+* (issue #1916): when the intrinsic's literal parts describe exactly one of the
+* recorded secret expressions, THAT is persisted. This is the dominant CDK
+* shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
+*
+* The value scan is still applied wherever neither can answer: a leaf that
+* merely EMBEDS a secret inside surrounding text, an intrinsic whose skeleton
+* matches zero or several candidates, a diverged shape, a key the source lacks.
+* So the passes are complementary rather than alternatives — path where
+* position is knowable, skeleton where the position is an intrinsic, value
+* where neither is.
+*/
+function redactByPath(bag, source, secrets, rules, secretExpressions) {
+	if (typeof bag === "string" && isSingleDynamicReferenceToken(bag)) return bag;
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) return source;
+		return redactSecretsForState(bag, secrets);
+	}
+	if (typeof bag === "string" && isPlainObject$2(source)) {
+		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
+		if (positioned !== void 0) return positioned;
+	}
+	if (rules.descendArrays && Array.isArray(bag) && Array.isArray(source) && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+		const out = {};
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
+		return out;
+	}
+	return redactSecretsForState(bag, secrets);
+}
 /**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
 * the unresolved `{{resolve:...}}` expression it came from. A string whose WHOLE
@@ -9851,8 +10302,9 @@ function buildNeedleRegex(values) {
 * is nothing to redact, so callers can persist the original object unchanged in
 * the common no-secret case.
 */
-function redactSecretsForState(bag, secrets) {
-	if (secrets.size === 0) return bag;
+function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
+	if (secrets.size === 0 && source === void 0) return bag;
+	if (source !== void 0) return redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
 	const walk = (value) => {
@@ -9883,12 +10335,12 @@ function redactSecretsForState(bag, secrets) {
 * detect a no-op cheaply. Shared by the deploy engine's save choke point and
 * the `cdkd scrub` command so both scrub the same three fields identically.
 */
-function scrubResourceRecord(record, secrets) {
-	if (secrets.size === 0) return record;
+function scrubResourceRecord(record, secrets, sourceProperties) {
+	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
-	next.properties = redactSecretsForState(record.properties, secrets);
+	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets);
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_READBACK_RULES);
 	return next;
 }
 /**
@@ -11494,28 +11946,51 @@ const cachedAvailabilityZones = {};
 */
 const cachedDynamicReferences = {};
 /**
-* The `{{resolve:ssm:...}}` expressions this process has PROVEN point at a
-* `SecureString` parameter (issue #1901).
-*
-* A plain `ssm` reference is not a secret by SPELLING the way `secretsmanager`
-* is — whether it resolves to public config or to a decrypted secret depends on
-* the parameter's `Type`, which is only knowable from the `GetParameter`
-* response. So secret-ness is discovered on the first resolution and remembered
-* here, keyed by the full `{{resolve:...}}` expression, for the same lifetime as
-* {@link cachedDynamicReferences}.
-*
-* Two consumers need it AFTER the lookup that populated it: the cache-hit arm
-* (which must re-record the value as a secret for the current resolution pass)
-* and the diff / no-op path (which must leave a SecureString reference
-* unresolved without paying a lookup at all once the type is known). A
-* reference NOT in this set is only "not known to be secure" — never "proven
-* public" — so every arm that would leak still asks AWS for the type first.
-*
-* Only the TYPE is remembered, never the decrypted value: on the diff path the
-* lookup is made with `WithDecryption: false`, so the plaintext is never
-* fetched at all there.
-*/
-const secureStringSsmReferences = /* @__PURE__ */ new Set();
+* The `{{resolve:...}}` expressions this process has PROVEN resolve to a
+* SECRET, reached through `secret-redaction.ts`'s `recordedSecretExpressions`
+* store. Lifetime is {@link cachedDynamicReferences}'s — `resetAccountInfoCache`
+* clears both, so a stale verdict can never decide secret-ness for a reference
+* whose resolved value that call just asked to forget.
+*
+* `ssm` is the kind that NEEDS the memory (issue #1901). A plain `ssm`
+* reference is not a secret by SPELLING the way `secretsmanager` is — whether
+* it resolves to public config or to a decrypted secret depends on the
+* parameter's `Type`, which is only knowable from the `GetParameter` response.
+* So secret-ness is discovered on the first resolution and remembered, keyed by
+* the full `{{resolve:...}}` expression. Two consumers need it AFTER the lookup
+* that populated it: the cache-hit arm (which must re-record the value as a
+* secret for the current resolution pass) and the diff / no-op path (which must
+* leave a SecureString reference unresolved without paying a lookup at all once
+* the type is known). A reference NOT in the set is only "not known to be
+* secure" — never "proven public" — so every arm that would leak still asks AWS
+* for the type first. Only the TYPE is remembered, never the decrypted value:
+* on the diff path the lookup is made with `WithDecryption: false`, so the
+* plaintext is never fetched at all there.
+*
+* A `secretsmanager` reference is recorded TOO, and that is issue
+* [#1916](https://github.com/go-to-k/cdkd/issues/1916). It needed no memory
+* while the only question asked of the set was "is this expression secret?",
+* which its spelling settles — but the set is ALSO the candidate list the
+* redaction path matches an INTRINSIC source leaf against
+* ({@link secret-redaction.redactSecretsForState}), and a list holding only the
+* ssm half cannot name the losing member of a collapsed
+* secretsmanager/secretsmanager pair. Recording every kind is what makes the
+* set mean what its name says. It changes no verdict here: every arm that reads
+* it for secret-ness already answers `true` on a `secretsmanager` spelling
+* before consulting it.
+*
+* The store lives in `secret-redaction.ts` rather than here (issue
+* [#1910](https://github.com/go-to-k/cdkd/issues/1910)) because the redaction
+* path is the other consumer: one set in the LEAF module means the redactor can
+* answer with no caller threading it, and the resolver reaches it along an
+* import edge it already has — the reverse would close a cycle.
+*/
+const recordedSecretExpressions = {
+	has: (expression) => isRecordedSecretExpression(expression),
+	add: (expression) => recordSecretExpression(expression),
+	delete: (expression) => forgetSecretExpression(expression),
+	clear: () => clearRecordedSecretExpressions()
+};
 /**
 * Cache for EC2 instance attributes that require a live DescribeInstances
 * lookup (PrivateIp / PublicIp / PrivateDnsName / PublicDnsName /
@@ -13327,7 +13802,7 @@ var IntrinsicFunctionResolver = class {
 		});
 		for (const { fullMatch, inner } of matches) {
 			const service = inner.split(":")[0];
-			const isKnownSecret = service === "secretsmanager" || secureStringSsmReferences.has(fullMatch);
+			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			if (fullMatch in cachedDynamicReferences) {
 				const cached = cachedDynamicReferences[fullMatch];
@@ -13342,8 +13817,8 @@ var IntrinsicFunctionResolver = class {
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
 				const param = await this.resolveSSMReference(parts, decrypt);
-				if (param.type === "SecureString") secureStringSsmReferences.add(fullMatch);
-				else if (!param.secure) secureStringSsmReferences.delete(fullMatch);
+				if (param.type === "SecureString") recordedSecretExpressions.add(fullMatch);
+				else if (!param.secure) recordedSecretExpressions.delete(fullMatch);
 				isSecret = param.secure;
 				if (param.secure) {
 					if (!decrypt) continue;
@@ -13354,7 +13829,10 @@ var IntrinsicFunctionResolver = class {
 				continue;
 			}
 			cachedDynamicReferences[fullMatch] = resolved;
-			if (isSecret && resolved) context?.recordedSecretValues?.set(resolved, fullMatch);
+			if (isSecret && resolved) {
+				context?.recordedSecretValues?.set(resolved, fullMatch);
+				if (service === "secretsmanager") recordedSecretExpressions.add(fullMatch);
+			}
 			result = result.replace(fullMatch, () => resolved);
 		}
 		return result;
@@ -14409,7 +14887,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BKIOy3_q.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BqKgMaXN.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -21030,10 +21508,35 @@ async function resolveReplayProps(props, resolver, secrets) {
 * (GHSA fix). The record's `properties` may be the provider's
 * `effectiveProperties`, which can echo the value we just resolved for the
 * provider call — so scrub it with the same per-op secrets map before it is
-* persisted. No-op when the op resolved no secret.
-*/
-function redactRollbackRecord(record, secrets) {
-	return secrets.size > 0 ? scrubResourceRecord(record, secrets) : record;
+* persisted.
+*
+* `journaledProps` is the POSITION source (issue #1910): the JOURNALED previous
+* properties, whose leaves still carry the unresolved `{{resolve:...}}`
+* expressions this replay resolved FROM. Without it two expressions sharing one
+* resolved value collapse onto whichever the replay recorded last, so the state
+* this rollback writes disagrees with the template at one leaf and the next
+* deploy reports a change that never converges — the same defect the four
+* deploy-side writers had, arriving here through the replay instead.
+*
+* It takes `STATE_DERIVED_RULES`, which is BOTH relaxations. The source is a
+* persisted record, so it holds no PUBLIC expressions (a `String` ssm reference
+* is stored resolved) and any `{{resolve:...}}` in it is by construction a
+* secret — that is `trustAnyExpression`. And the bag WAS produced by resolving
+* that source (`resolveReplayProps` -> the provider's `effectiveProperties`),
+* so the two have identical structure and positional array descent is sound —
+* that is `descendArrays`. Using `STATE_SOURCED_READBACK_RULES` here reads
+* plausible and is wrong in the quiet direction: it turns array descent off, so
+* a secret nested in a `Tags[]` / ECS `secrets[]` element would still collapse
+* on the replay path.
+*
+* No-op when the op resolved no secret.
+*/
+function redactRollbackRecord(record, secrets, journaledProps) {
+	if (secrets.size === 0) return record;
+	return scrubResourceRecord(journaledProps === void 0 ? record : {
+		...record,
+		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
+	}, secrets);
 }
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted) {
 	if (provider.disableOuterRetry) return await provider.update(...args);
@@ -21279,7 +21782,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					physicalId: createResult.physicalId,
 					attributes: createResult.attributes ?? {},
 					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
-				}, secrets);
+				}, secrets, prevRecord.properties);
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
@@ -21330,7 +21833,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					desiredProps ?? {},
 					currentProps ?? {}
 				], op.logicalId, logger, isInterrupted);
-				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets);
+				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets, previousState.properties);
 				logger.info(`  Rollback: ${op.logicalId} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
@@ -21470,7 +21973,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						desiredProps ?? {},
 						attemptedProps ?? {}
 					], op.logicalId, logger, options.isInterrupted);
-					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets);
+					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties);
 					logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -21596,7 +22099,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.23";
+	return "0.283.25";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22210,6 +22713,17 @@ var DeployEngine = class {
 	*/
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	/**
+	* PER-RESOURCE unresolved TEMPLATE properties, keyed by logicalId (issues
+	* #1904 / #1900). The redaction choke point uses this as the POSITION source:
+	* wherever the template leaf is a `{{resolve:...}}` string, state persists
+	* that string verbatim instead of asking the value-keyed map which expression
+	* a plaintext came from — a question that map cannot answer when two
+	* expressions resolve to the same value. Captured at the same two sites that
+	* populate `perResourceSecrets`, where the unresolved bag is already in hand.
+	* Reset per `deploy()`.
+	*/
+	perResourceTemplateProps = /* @__PURE__ */ new Map();
+	/**
 	* Resolved secrets recorded while resolving the stack OUTPUTS (a `CfnOutput`
 	* whose Value resolves a `{{resolve:...}}` reference). Separate from the
 	* per-resource maps for the same anti-cross-contamination reason. Reset per
@@ -22217,6 +22731,15 @@ var DeployEngine = class {
 	*/
 	outputSecrets = /* @__PURE__ */ new Map();
 	/**
+	* UNRESOLVED template `Outputs` values, keyed by output name (issue #1910) —
+	* the outputs' POSITION source, the sibling of `perResourceTemplateProps` for
+	* the bag `resolveOutputs` produces. Without it two outputs resolving one
+	* secret collapse onto whichever expression was recorded last, exactly as two
+	* resource properties did before #1904. Captured in `resolveOutputs` at the
+	* same point `outputSecrets` is accumulated. Reset per `deploy()`.
+	*/
+	outputsTemplateSource = {};
+	/**
 	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
 	* each CREATE / UPDATE attempted (issue #1198). Written just before the
 	* provider call; read only when the op FAILS, to journal the failed op's
@@ -22258,7 +22781,9 @@ var DeployEngine = class {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
+		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
+		this.outputsTemplateSource = {};
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -22290,13 +22815,19 @@ var DeployEngine = class {
 	* un-redacted resolved bag; only the persisted copy is rewritten.
 	*/
 	/**
-	* Bag-level redaction of a single properties bag against a specific secrets
-	* map (GHSA fix). Used by the UPDATE no-op re-check so a resolved-plaintext
-	* bag is compared against the expression-bearing stored bag on equal footing.
+	* Redact the resolved stack OUTPUTS bag, positioned by the unresolved
+	* template `Outputs` values (issue #1910).
+	*
+	* A single entry point because THREE call sites redact this same bag — the
+	* state-persist choke point, the no-change re-check, and the post-deploy
+	* publish that feeds the exports index / deploy summary — and before this
+	* they each spelled the value-only redaction separately. Two outputs
+	* resolving one secret collapsed onto whichever expression was recorded last
+	* at all three.
 	*/
-	redactPropsWith(props, secrets) {
-		if (secrets.size === 0) return props;
-		return redactSecretsForState(props, secrets);
+	redactOutputs(outputs) {
+		if (this.outputSecrets.size === 0) return outputs;
+		return redactSecretsForState(outputs, this.outputSecrets, this.outputsTemplateSource);
 	}
 	/**
 	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
@@ -22307,21 +22838,34 @@ var DeployEngine = class {
 	* whole-secret value from one resource cannot rewrite another's literal.
 	* Preserves ops that carry none of those fields, or whose resource recorded
 	* no secret.
+	*
+	* The POSITION source matters MORE here than anywhere else (issue #1910).
+	* This journal is not just persisted, it is REPLAYED to AWS by the rollback
+	* executor's `resolveReplayProps`, so a leaf redacted onto a SIBLING's
+	* expression — which is what the value-keyed map does when two expressions
+	* resolve to one value — re-resolves at replay time to the wrong reference.
+	* For two `:AWSCURRENT` / `:AWSPREVIOUS` stages of one secret that is the
+	* wrong VERSION shipped to the live resource the moment the two diverge.
+	*
+	* The two SIDES take different sources, and conflating them would be a fresh
+	* defect rather than a simplification: `properties` / `attemptedProperties`
+	* are this deploy's DESIRED bags, produced by resolving the CURRENT template,
+	* so the template bag positions them. `previousState` is a record read back
+	* from STATE, whose leaves already hold expressions from whenever it was
+	* written — the current template is not its source and may not even have the
+	* same shape — so it is redacted against ITSELF via `scrubResourceRecord`,
+	* the same #1900 fallback an UNCHANGED resource takes.
 	*/
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
 			const secrets = this.perResourceSecrets.get(op.logicalId);
-			if (!secrets || secrets.size === 0) return op;
+			const templateProps = this.perResourceTemplateProps.get(op.logicalId);
+			if ((!secrets || secrets.size === 0) && !op.previousState) return op;
+			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 			const next = { ...op };
-			if (next.properties) next.properties = redactSecretsForState(next.properties, secrets);
-			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(next.attemptedProperties, secrets);
-			if (next.previousState) {
-				const prev = { ...next.previousState };
-				prev.properties = redactSecretsForState(prev.properties, secrets);
-				if (prev.attributes) prev.attributes = redactSecretsForState(prev.attributes, secrets);
-				if (prev.observedProperties) prev.observedProperties = redactSecretsForState(prev.observedProperties, secrets);
-				next.previousState = prev;
-			}
+			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
+			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(next.attemptedProperties, ownSecrets, templateProps);
+			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
 			return next;
 		});
 	}
@@ -22329,12 +22873,13 @@ var DeployEngine = class {
 		const resources = {};
 		for (const [logicalId, record] of Object.entries(state.resources)) {
 			const secrets = this.perResourceSecrets.get(logicalId);
-			resources[logicalId] = secrets ? scrubResourceRecord(record, secrets) : record;
+			const templateProps = this.perResourceTemplateProps.get(logicalId);
+			resources[logicalId] = scrubResourceRecord(record, secrets ?? /* @__PURE__ */ new Map(), templateProps);
 		}
 		return {
 			...state,
 			resources,
-			outputs: this.outputSecrets.size > 0 ? redactSecretsForState(state.outputs, this.outputSecrets) : state.outputs
+			outputs: this.redactOutputs(state.outputs)
 		};
 	}
 	/**
@@ -22619,7 +23164,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactPropsWith(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions), this.outputSecrets);
+					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
@@ -22947,7 +23492,7 @@ var DeployEngine = class {
 		let outputs;
 		try {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
-			outputs = this.redactPropsWith(outputs, this.outputSecrets);
+			outputs = this.redactOutputs(outputs);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", currentEtag === void 0);
@@ -23343,6 +23888,7 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
@@ -23387,9 +23933,10 @@ var DeployEngine = class {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
+				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
-				if (JSON.stringify(this.redactPropsWith(resolvedProps, updateSecrets)) === JSON.stringify(currentProps)) {
+				if (JSON.stringify(redactSecretsForState(resolvedProps, updateSecrets, desiredProps)) === JSON.stringify(currentProps)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -23907,7 +24454,10 @@ var DeployEngine = class {
 				outputs[outputKey] = value;
 				if (output.Export?.Name) {
 					const exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, context);
-					if (typeof exportName === "string") outputs[exportName] = value;
+					if (typeof exportName === "string") {
+						outputs[exportName] = value;
+						this.outputsTemplateSource[exportName] = output.Value;
+					}
 				}
 			} catch (error) {
 				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
@@ -23916,6 +24466,7 @@ var DeployEngine = class {
 			}
 		}
 		if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+		for (const [outputKey, output] of Object.entries(template.Outputs)) this.outputsTemplateSource[outputKey] = output.Value;
 		return outputs;
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -23930,5 +24481,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, resolveCaptureObservedState as $t, cyan as A, LocalStartServiceError as An, rewriteTemplateAssetReferences as At, findSilentDropProperties as B, StateError as Bn, buildDockerImage as Bt, makeCanonicalizePropertiesFn as C, AssetError as Cn, shouldRetainResource as Ct, renderStatefulReason as D, DeployCancelledError as Dn, buildAssetRedirectMap as Dt, isStatefulRecreateTargetSync as E, DependencyError as En, WorkGraph as Et, IAMRoleProvider as F, ProvisioningError as Fn, getBootstrapMarkerKey as Ft, IntrinsicFunctionResolver as G, withErrorHandling as Gn, AssetManifestLoader as Gt, slowCcOperationTimeoutMs as H, formatError as Hn, getDockerCmd as Ht, collectInlinePolicyNamesManagedBySiblings as I, ResourceTimeoutError as In, parseBootstrapMarker as It, refStateLookupFromResource as J, isThrottlingError as Jn, synthesisStatusMessage as Jt, cfnRefValueFromPhysicalId as K, isMarkedNonRetryable as Kn, getDockerImageBySourceHash as Kt, clearOnUpdateRemoval as L, ResourceUpdateNotSupportedError as Ln, validateAssetBucketName as Lt, green as M, MissingCdkCliError as Mn, AssetModeResolver as Mt, red as N, NestedStackChildDirectDestroyError as Nn, BOOTSTRAP_MARKER_PREFIX as Nt, formatResourceLine as O, LocalInvokeBuildError as On, createAssetRedirectResolver as Ot, yellow as P, PartialFailureError as Pn, ensureAssetStorage as Pt, assertRegionMatch as Q, resolveAutoAssetStorage as Qt, ProviderRegistry as R, StackHasActiveImportsError as Rn, validateContainerRepoName as Rt, unsupportedFinalSnapshotError as S, setAwsClients as Sn, rebuildClientForBucketRegion as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, ConfigError as Tn, stringifyValue as Tt, disableInstanceApiTermination as U, isCdkdError as Un, runDockerForeground as Ut, CloudControlProvider as V, SynthesisError as Vn, formatDockerLoginError as Vt, isTerminationProtectionPropagationError as W, normalizeAwsError as Wn, runDockerStreaming as Wt, normalizeAwsTagsToCfn as X, __exportAll as Xn, getLegacyStateBucketName as Xt, WAFv2WebACLProvider as Y, markNonRetryable as Yn, getDefaultStateBucketName as Yt, resolveExplicitPhysicalId as Z, resolveApp as Zt, buildFinalSnapshotIdentifier as _, clearBucketRegionCache as _n, withRetry as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as an, requireConfigObject as at, isFinalSnapshotError as b, getAwsClients as bn, LockManager as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as cn, scrubResourceRecord as ct, deleteSkipReason as d, expectedOwnerParam as dn, s3BucketDualStackDomainName as dt, resolveSkipPrefix as en, configBooleanRefusal as et, withResourceDeadline as f, PARTITION_TABLE as fn, s3BucketRegionalDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, processStackMessages as gn, describeTypeWithThrottleRetry as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, AssemblyReader as hn, DiffCalculator as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as in, requireConfigArray as it, gray as j, LockError as jn, escapeRegExp$1 as jt, bold as k, LocalMigrateError as kn, loadPublishableAssetManifest as kt, replayRollback as l, findLargeInlineResources as ln, s3BucketArn as lt, computeImplicitDeleteEdges as m, derivePartitionAndUrlSuffix as mn, applyRoleArnIfSet as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefaultAndSource as nn, readConfigString as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, canonicalizeRegion as pn, s3BucketWebsiteUrl as pt, getAccountInfo as q, isRetryableTransientError as qn, Synthesizer as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sn, redactSecretsForState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefault as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, uploadCfnTemplate as un, s3BucketDomainName as ut, ccRoutedFinalSnapshotError as v, resolveBucketRegion as vn, DagBuilder as vt, extractDeploymentEventError as w, CdkdError as wn, AssetPublisher as wt, refusesFinalSnapshot as x, resetAwsClients as xn, S3StateBackend as xt, createPreDeleteFinalSnapshot as y, AwsClients as yn, TemplateParser as yt, findActionableSilentDrops as z, StackTerminationProtectionError as zn, buildDenyExternalAccessPolicy as zt };
-//# sourceMappingURL=deploy-engine-CQXpKq7o.js.map
+export { coerceCfnBoolean as $, resolveAutoAssetStorage as $t, cyan as A, LocalMigrateError as An, loadPublishableAssetManifest as At, findSilentDropProperties as B, StackTerminationProtectionError as Bn, buildDenyExternalAccessPolicy as Bt, makeCanonicalizePropertiesFn as C, setAwsClients as Cn, rebuildClientForBucketRegion as Ct, renderStatefulReason as D, DependencyError as Dn, WorkGraph as Dt, isStatefulRecreateTargetSync as E, ConfigError as En, stringifyValue as Et, IAMRoleProvider as F, PartialFailureError as Fn, ensureAssetStorage as Ft, IntrinsicFunctionResolver as G, normalizeAwsError as Gn, runDockerStreaming as Gt, slowCcOperationTimeoutMs as H, SynthesisError as Hn, formatDockerLoginError as Ht, collectInlinePolicyNamesManagedBySiblings as I, ProvisioningError as In, getBootstrapMarkerKey as It, refStateLookupFromResource as J, isRetryableTransientError as Jn, Synthesizer as Jt, cfnRefValueFromPhysicalId as K, withErrorHandling as Kn, AssetManifestLoader as Kt, clearOnUpdateRemoval as L, ResourceTimeoutError as Ln, parseBootstrapMarker as Lt, green as M, LockError as Mn, escapeRegExp$1 as Mt, red as N, MissingCdkCliError as Nn, AssetModeResolver as Nt, formatResourceLine as O, DeployCancelledError as On, buildAssetRedirectMap as Ot, yellow as P, NestedStackChildDirectDestroyError as Pn, BOOTSTRAP_MARKER_PREFIX as Pt, assertRegionMatch as Q, resolveApp as Qt, ProviderRegistry as R, ResourceUpdateNotSupportedError as Rn, validateAssetBucketName as Rt, unsupportedFinalSnapshotError as S, resetAwsClients as Sn, S3StateBackend as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, CdkdError as Tn, AssetPublisher as Tt, disableInstanceApiTermination as U, formatError as Un, getDockerCmd as Ut, CloudControlProvider as V, StateError as Vn, buildDockerImage as Vt, isTerminationProtectionPropagationError as W, isCdkdError as Wn, runDockerForeground as Wt, normalizeAwsTagsToCfn as X, markNonRetryable as Xn, getDefaultStateBucketName as Xt, WAFv2WebACLProvider as Y, isThrottlingError as Yn, synthesisStatusMessage as Yt, resolveExplicitPhysicalId as Z, __exportAll as Zn, getLegacyStateBucketName as Zt, buildFinalSnapshotIdentifier as _, processStackMessages as _n, describeTypeWithThrottleRetry as _t, DeploymentEventsStore as a, stateBucketExistenceConfirmed as an, requireConfigObject as at, isFinalSnapshotError as b, AwsClients as bn, TemplateParser as bt, replayFailedOperations as c, CFN_TEMPLATE_URL_LIMIT as cn, redactSecretsForState as ct, deleteSkipReason as d, uploadCfnTemplate as dn, s3BucketDomainName as dt, resolveCaptureObservedState as en, configBooleanRefusal as et, withResourceDeadline as f, expectedOwnerParam as fn, s3BucketDualStackDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, AssemblyReader as gn, DiffCalculator as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, derivePartitionAndUrlSuffix as hn, applyRoleArnIfSet as ht, DeploymentEventsReader as i, resolveUseCdkBootstrapAssets as in, requireConfigArray as it, gray as j, LocalStartServiceError as jn, rewriteTemplateAssetReferences as jt, bold as k, LocalInvokeBuildError as kn, createAssetRedirectResolver as kt, replayRollback as l, MIGRATE_TMP_PREFIX as ln, scrubResourceRecord as lt, computeImplicitDeleteEdges as m, canonicalizeRegion as mn, s3BucketWebsiteUrl as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefault as nn, readConfigString as nt, planFailedOps as o, warnDeprecatedNoPrefixCliFlag as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, PARTITION_TABLE as pn, s3BucketRegionalDomainName as pt, getAccountInfo as q, isMarkedNonRetryable as qn, getDockerImageBySourceHash as qt, DeployEngine as r, resolveStateBucketWithDefaultAndSource as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_BODY_LIMIT as sn, TEMPLATE_SOURCED_READBACK_RULES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveSkipPrefix as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, findLargeInlineResources as un, s3BucketArn as ut, ccRoutedFinalSnapshotError as v, clearBucketRegionCache as vn, withRetry as vt, extractDeploymentEventError as w, AssetError as wn, shouldRetainResource as wt, refusesFinalSnapshot as x, getAwsClients as xn, LockManager as xt, createPreDeleteFinalSnapshot as y, resolveBucketRegion as yn, DagBuilder as yt, findActionableSilentDrops as z, StackHasActiveImportsError as zn, validateContainerRepoName as zt };
+//# sourceMappingURL=deploy-engine-MHqWGHl9.js.map