@go-to-k/cdkd 0.283.26 → 0.283.27

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveAutoAssetStorage, A as cyan, An as LocalMigrateError, At as loadPublishableAssetManifest, B as findSilentDropProperties, Bn as StackTerminationProtectionError, Bt as buildDenyExternalAccessPolicy, C as makeCanonicalizePropertiesFn, Cn as setAwsClients, Ct as rebuildClientForBucketRegion, D as renderStatefulReason, Dt as WorkGraph, E as isStatefulRecreateTargetSync, Et as stringifyValue, F as IAMRoleProvider, Fn as PartialFailureError, Ft as ensureAssetStorage, G as IntrinsicFunctionResolver, Gn as normalizeAwsError, Gt as runDockerStreaming, H as slowCcOperationTimeoutMs, Ht as formatDockerLoginError, I as collectInlinePolicyNamesManagedBySiblings, In as ProvisioningError, It as getBootstrapMarkerKey, J as refStateLookupFromResource, Jn as isRetryableTransientError, Jt as Synthesizer, K as cfnRefValueFromPhysicalId, Kn as withErrorHandling, Kt as AssetManifestLoader, L as clearOnUpdateRemoval, Ln as ResourceTimeoutError, Lt as parseBootstrapMarker, M as green, Mt as escapeRegExp, N as red, Nn as MissingCdkCliError, Nt as AssetModeResolver, O as formatResourceLine, On as DeployCancelledError, Ot as buildAssetRedirectMap, P as yellow, Pn as NestedStackChildDirectDestroyError, Pt as BOOTSTRAP_MARKER_PREFIX, Q as assertRegionMatch, Qt as resolveApp, R as ProviderRegistry, Rn as ResourceUpdateNotSupportedError, Rt as validateAssetBucketName, S as unsupportedFinalSnapshotError, Sn as resetAwsClients, St as S3StateBackend, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as CdkdError, Tt as AssetPublisher, U as disableInstanceApiTermination, Ut as getDockerCmd, V as CloudControlProvider, Vt as buildDockerImage, W as isTerminationProtectionPropagationError, Wt as runDockerForeground, X as normalizeAwsTagsToCfn, Xn as markNonRetryable, Xt as getDefaultStateBucketName, Y as WAFv2WebACLProvider, Yn as isThrottlingError, Yt as synthesisStatusMessage, Z as resolveExplicitPhysicalId, Zt as getLegacyStateBucketName, _ as buildFinalSnapshotIdentifier, _n as processStackMessages, _t as describeTypeWithThrottleRetry, a as DeploymentEventsStore, an as stateBucketExistenceConfirmed, at as requireConfigObject, b as isFinalSnapshotError, bn as AwsClients, bt as TemplateParser, c as replayFailedOperations, cn as CFN_TEMPLATE_URL_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as uploadCfnTemplate, dt as s3BucketDomainName, en as resolveCaptureObservedState, et as configBooleanRefusal, f as withResourceDeadline, fn as expectedOwnerParam, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AssemblyReader, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as derivePartitionAndUrlSuffix, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveUseCdkBootstrapAssets, it as requireConfigArray, j as gray, jn as LocalStartServiceError, jt as rewriteTemplateAssetReferences, k as bold, kn as LocalInvokeBuildError$1, kt as createAssetRedirectResolver, l as replayRollback, ln as MIGRATE_TMP_PREFIX, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as canonicalizeRegion, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefault, nt as readConfigString, o as planFailedOps, on as warnDeprecatedNoPrefixCliFlag, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as PARTITION_TABLE, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as isMarkedNonRetryable, qt as getDockerImageBySourceHash, r as DeployEngine, rn as resolveStateBucketWithDefaultAndSource, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_BODY_LIMIT, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveSkipPrefix, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as findLargeInlineResources, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vt as withRetry, w as extractDeploymentEventError, wt as shouldRetainResource, x as refusesFinalSnapshot, xn as getAwsClients, xt as LockManager, y as createPreDeleteFinalSnapshot, yn as resolveBucketRegion, yt as DagBuilder, z as findActionableSilentDrops, zn as StackHasActiveImportsError, zt as validateContainerRepoName } from "./deploy-engine-B6z9CCAL.js";
+import { $ as coerceCfnBoolean, $t as resolveApp, A as cyan, An as LocalInvokeBuildError$1, At as createAssetRedirectResolver, B as findSilentDropProperties, Bn as StackHasActiveImportsError, Bt as validateContainerRepoName, C as makeCanonicalizePropertiesFn, Cn as resetAwsClients, Ct as S3StateBackend, D as renderStatefulReason, Dt as stringifyValue, E as isStatefulRecreateTargetSync, En as CdkdError, Et as AssetPublisher, F as IAMRoleProvider, Fn as NestedStackChildDirectDestroyError, Ft as BOOTSTRAP_MARKER_PREFIX, G as IntrinsicFunctionResolver, Gt as runDockerForeground, H as slowCcOperationTimeoutMs, Ht as buildDockerImage, I as collectInlinePolicyNamesManagedBySiblings, In as PartialFailureError, It as ensureAssetStorage, J as refStateLookupFromResource, Jn as isMarkedNonRetryable, Jt as getDockerImageBySourceHash, K as cfnRefValueFromPhysicalId, Kn as normalizeAwsError, Kt as runDockerStreaming, L as clearOnUpdateRemoval, Ln as ProvisioningError, Lt as getBootstrapMarkerKey, M as green, Mn as LocalStartServiceError, Mt as rewriteTemplateAssetReferences, N as red, Nt as escapeRegExp, O as formatResourceLine, Ot as WorkGraph, P as yellow, Pn as MissingCdkCliError, Pt as AssetModeResolver, Q as assertRegionMatch, Qt as getLegacyStateBucketName, R as ProviderRegistry, Rn as ResourceTimeoutError, Rt as parseBootstrapMarker, S as unsupportedFinalSnapshotError, Sn as getAwsClients, St as LockManager, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as shouldRetainResource, U as disableInstanceApiTermination, Ut as formatDockerLoginError, V as CloudControlProvider, Vn as StackTerminationProtectionError, Vt as buildDenyExternalAccessPolicy, W as isTerminationProtectionPropagationError, Wt as getDockerCmd, X as normalizeAwsTagsToCfn, Xn as isThrottlingError, Xt as synthesisStatusMessage, Y as WAFv2WebACLProvider, Yn as isRetryableTransientError, Yt as Synthesizer, Z as resolveExplicitPhysicalId, Zn as markNonRetryable, Zt as getDefaultStateBucketName, _ as buildFinalSnapshotIdentifier, _n as AssemblyReader, _t as INTRINSIC_KEYS, a as DeploymentEventsStore, an as resolveUseCdkBootstrapAssets, at as requireConfigObject, b as isFinalSnapshotError, bn as resolveBucketRegion, bt as DagBuilder, c as replayFailedOperations, cn as CFN_TEMPLATE_BODY_LIMIT, ct as redactSecretsForState, d as deleteSkipReason, dn as findLargeInlineResources, dt as s3BucketDomainName, en as resolveAutoAssetStorage, et as configBooleanRefusal, f as withResourceDeadline, fn as uploadCfnTemplate, ft as s3BucketDualStackDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as derivePartitionAndUrlSuffix, gt as DiffCalculator, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as canonicalizeRegion, ht as applyRoleArnIfSet, i as DeploymentEventsReader, in as resolveStateBucketWithDefaultAndSource, it as requireConfigArray, j as gray, jn as LocalMigrateError, jt as loadPublishableAssetManifest, k as bold, kn as DeployCancelledError, kt as buildAssetRedirectMap, l as replayRollback, ln as CFN_TEMPLATE_URL_LIMIT, lt as scrubResourceRecord, m as computeImplicitDeleteEdges, mn as PARTITION_TABLE, mt as s3BucketWebsiteUrl, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveSkipPrefix, nt as readConfigString, o as planFailedOps, on as stateBucketExistenceConfirmed, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as expectedOwnerParam, pt as s3BucketRegionalDomainName, q as getAccountInfo, qn as withErrorHandling, qt as AssetManifestLoader, r as DeployEngine, rn as resolveStateBucketWithDefault, rt as replayWarn, s as planRollback, sn as warnDeprecatedNoPrefixCliFlag, st as TEMPLATE_SOURCED_READBACK_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveCaptureObservedState, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as MIGRATE_TMP_PREFIX, ut as s3BucketArn, v as ccRoutedFinalSnapshotError, vn as processStackMessages, vt as describeTypeWithThrottleRetry, w as extractDeploymentEventError, wn as setAwsClients, wt as rebuildClientForBucketRegion, x as refusesFinalSnapshot, xn as AwsClients, xt as TemplateParser, y as createPreDeleteFinalSnapshot, yt as withRetry, z as findActionableSilentDrops, zn as ResourceUpdateNotSupportedError, zt as validateAssetBucketName } from "./deploy-engine-CsvKYG0d.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CshsD-Pi.js";
+import { t as ASGProvider } from "./asg-provider-uNJDVURJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -56744,6 +56744,307 @@ function createDeployCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/analyzer/outputs-diff.ts
+/**
+* A `${...}` placeholder `Fn::Sub` did NOT substitute.
+*
+* `resolveSub` catches a genuine `Ref` / `Fn::GetAtt` miss, WARNS, and keeps the
+* literal `${Foo}` in the output string — it neither throws nor leaves an
+* intrinsic object behind. So a half-substituted `Fn::Sub` reaches this module
+* looking like an ordinary resolved string, and comparing it against state
+* reports a phantom change whose printed value is `"arn:...${NewBucket}"`.
+*
+* Only consulted for a value whose TEMPLATE source actually contained an
+* `Fn::Sub` (see {@link templateUsesSub}). Applying it to every string
+* over-matches badly: an IAM policy body with `${aws:username}`, a UserData
+* snippet with a shell `${VAR}`, or any literal a user wrote would set
+* `resolutionFailed` and suppress the WHOLE Outputs section for that stack, on
+* every run, forever.
+*
+* Within `Fn::Sub`-sourced values one false positive remains and is accepted:
+* `${!Literal}` is `Fn::Sub`'s ESCAPE and resolves to the literal text
+* `${Literal}`, which post-resolution is indistinguishable from a placeholder
+* that failed to substitute. That case merely SUPPRESSES the section (the
+* pre-#1921 behavior) whereas the alternative is a phantom reported every run.
+*/
+const UNSUBSTITUTED_SUB_PLACEHOLDER = /\$\{[^}]*\}/;
+/**
+* True when `value` is, or anywhere CONTAINS, something the diff could not
+* fully resolve against current state.
+*
+* The deploy engine's twin check is `Object.values(bag).some(v => v ===
+* undefined)` — its resolver THROWS on failure and the catch stores `undefined`.
+* The diff's resolver is best-effort and fails in three further ways that all
+* have to count as "unresolved" here, because anything that slips through is
+* compared against state and reported as a change the apply will never make:
+*
+* 1. `undefined` — the SAME signal the deploy side keys on. `resolve` returns it
+*    WITHOUT throwing for a constructible-but-unknown attribute
+*    (`AWS::DynamoDB::Table.StreamArn`, `AWS::IAM::Policy.PolicyId`,
+*    `AWS::EC2::SecurityGroup.VpcId`, ...). `JSON.stringify` drops an
+*    `undefined`-valued key, so state can never hold one and such an output
+*    would otherwise report a PERMANENT phantom `ADD` printing `new: undefined`.
+* 2. A symbol — `Ref: AWS::NoValue` resolves to a sentinel symbol, which
+*    `resolveValue` strips only INSIDE arrays / objects; a top-level
+*    `Fn::If` selecting `AWS::NoValue` returns it bare. Not persistable, so
+*    again a permanent phantom.
+* 3. A surviving intrinsic OBJECT, or — only when the template source used
+*    `Fn::Sub` — an unsubstituted placeholder STRING (see
+*    {@link UNSUBSTITUTED_SUB_PLACEHOLDER}).
+*
+* DEEP rather than shallow: an unresolved leaf can sit anywhere inside an array
+* or object an outer intrinsic already built.
+*/
+function isUnresolvedValue(value, sourceUsedSub) {
+	if (value === void 0) return true;
+	if (typeof value === "symbol") return true;
+	if (typeof value === "string") return sourceUsedSub && UNSUBSTITUTED_SUB_PLACEHOLDER.test(value);
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some((v) => isUnresolvedValue(v, sourceUsedSub));
+	const keys = Object.keys(value);
+	if (keys.length === 1 && INTRINSIC_KEYS.has(keys[0])) return true;
+	return Object.values(value).some((v) => isUnresolvedValue(v, sourceUsedSub));
+}
+/**
+* True when this output's RAW template value contains an `Fn::Sub` anywhere —
+* including nested inside an `Fn::Join` / `Fn::If`, since those resolve their
+* arguments and a laundered placeholder from an inner `Fn::Sub` surfaces in the
+* outer result.
+*/
+function templateUsesSub(templateValue) {
+	if (templateValue === null || typeof templateValue !== "object") return false;
+	if (Array.isArray(templateValue)) return templateValue.some(templateUsesSub);
+	const record = templateValue;
+	if (Object.prototype.hasOwnProperty.call(record, "Fn::Sub")) return true;
+	return Object.values(record).some(templateUsesSub);
+}
+/**
+* True when `value` is a string carrying a SECRET-BEARING CloudFormation
+* dynamic reference — `{{resolve:secretsmanager:` or `{{resolve:ssm-secure:`,
+* the two spellings that are secret regardless of what they point at.
+*
+* The diff resolves with `skipDynamicReferences`, so a secret-bearing output
+* arrives here as its unresolved `{{resolve:...}}` expression — which is also
+* what post-GHSA state stores. A state record written by an OLDER binary can
+* still hold the resolved PLAINTEXT instead (that mismatch is exactly what
+* `cdkd scrub` exists to repair), and printing it is this module's problem
+* because it is the first code path that DISPLAYS a stored output value.
+*/
+function isSecretDynamicReference(value) {
+	if (typeof value !== "string") return false;
+	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
+}
+/** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
+function valuesEqual(a, b) {
+	if (a === b) return true;
+	if (a == null || b == null) return a === b;
+	if (typeof a !== typeof b) return false;
+	if (typeof a !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => valuesEqual(v, b[i]));
+	}
+	const ao = a;
+	const bo = b;
+	const ak = Object.keys(ao);
+	if (ak.length !== Object.keys(bo).length) return false;
+	for (const k of ak) {
+		if (!Object.prototype.hasOwnProperty.call(bo, k)) return false;
+		if (!valuesEqual(ao[k], bo[k])) return false;
+	}
+	return true;
+}
+/**
+* Resolve a template's `Outputs` section into the exact bag shape the deploy
+* engine persists to `StackState.outputs` (issue #1921).
+*
+* This is the preview twin of `DeployEngine.resolveOutputs`, and the three
+* semantics below are load-bearing for parity — a preview that builds a
+* DIFFERENT bag than the apply persists reports a phantom change on every run,
+* which is this issue's own bug class inverted. `tests/unit/analyzer/
+* outputs-diff.test.ts` fences each one against drift on the deploy side.
+*
+* 1. An output whose `Condition` evaluates false is SKIPPED, not resolved —
+*    CloudFormation simply does not create it (mirrors the resource side's
+*    `filterResourcesByCondition`; an unknown condition name is kept).
+* 2. An `Export.Name` is stored as a SECOND key holding the same value, so
+*    `Fn::ImportValue` can find it by export name. Both keys land in state, so
+*    both must land here.
+* 3. Resolution is best-effort and never throws — a diff must never harden into
+*    an error where the deploy would have succeeded.
+*
+* The parity claim is scoped to the deploy engine's NO-CHANGE branch, which is
+* the one this preview stands in for. Its changed-resources branch resolves
+* outputs with no `resolutionFailed` gate at all — correctly, because by then
+* every resource exists and resolution is expected to succeed, whereas a diff
+* runs BEFORE any of them are created.
+*
+* Deliberately does NOT redact secrets the way the deploy side does: this
+* resolver runs with `skipDynamicReferences`, so a `{{resolve:...}}` reference
+* is never resolved to plaintext in the first place and the bag already holds
+* the expression that state stores post-redaction.
+*/
+async function resolveTemplateOutputs(template, resolveFn, conditions) {
+	const logger = getLogger().child("OutputsDiff");
+	const outputs = {};
+	const exportNames = /* @__PURE__ */ new Set();
+	const failedKeys = /* @__PURE__ */ new Set();
+	const secretSourceKeys = /* @__PURE__ */ new Set();
+	let resolutionFailed = false;
+	if (!template.Outputs) return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+	/**
+	* Record a key the resolver DROPPED — plus the literal `Export.Name` alias the
+	* deploy would have written alongside it. Both are absent from the bag, so
+	* both would otherwise read as phantom REMOVEs and make the suppression
+	* warning fire on the ordinary pending-resource case.
+	*/
+	const recordFailure = (outputKey, output) => {
+		failedKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
+	};
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (!isSecretDynamicReference(output.Value)) continue;
+		secretSourceKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
+	}
+	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
+			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+			continue;
+		}
+		const sourceUsedSub = templateUsesSub(output.Value);
+		let value;
+		try {
+			value = await resolveFn(structuredClone(output.Value));
+		} catch (error) {
+			logger.debug(`Diff could not resolve output ${outputKey}: ${String(error)}`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		if (isUnresolvedValue(value, sourceUsedSub)) {
+			logger.debug(`Diff left output ${outputKey} unresolved (references a pending resource)`);
+			resolutionFailed = true;
+			recordFailure(outputKey, output);
+			continue;
+		}
+		outputs[outputKey] = value;
+		if (output.Export?.Name) {
+			let exportName = output.Export.Name;
+			const exportSourceUsedSub = templateUsesSub(output.Export.Name);
+			if (typeof exportName !== "string") try {
+				exportName = await resolveFn(structuredClone(exportName));
+			} catch (error) {
+				logger.debug(`Diff could not resolve Export.Name of ${outputKey}: ${String(error)}`);
+				resolutionFailed = true;
+				continue;
+			}
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+				outputs[exportName] = value;
+				exportNames.add(exportName);
+			} else resolutionFailed = true;
+		}
+	}
+	return {
+		outputs,
+		exportNames,
+		failedKeys,
+		secretSourceKeys,
+		resolutionFailed
+	};
+}
+/**
+* Compare the persisted Outputs bag against the one the next deploy would
+* write, key by key (issue #1921).
+*
+* Compares BAG KEYS rather than template output names on purpose. The bag is
+* what actually lands in `StackState.outputs` AND what
+* `ExportIndexStore.updateForStack` publishes, so a key-level comparison is
+* exactly the `outputMapsEqual` predicate the deploy engine gates its persist
+* on — no interpretive layer in between that could drift from apply semantics.
+* The practical payoff is that the motivating #875 case shows the user the
+* literal export name their downstream `Fn::ImportValue` needs.
+*
+* ## Withholding legacy secret plaintext
+*
+* This is the first code path that DISPLAYS a stored output value, and
+* `cdkd diff` is routinely run in CI — so a value that turns out to be secret
+* plaintext would land in build logs. `StackState.outputs` is only guaranteed
+* redacted for records written after the GHSA fix; an older binary persisted
+* the RESOLVED plaintext, which is the condition `cdkd scrub` repairs.
+*
+* Two independent signals identify such a record, and BOTH are needed:
+*
+* - the desired side is still a secret-bearing expression per
+*   {@link isSecretDynamicReference} (this resolver runs with
+*   `skipDynamicReferences`) while the stored side is not; and
+* - `secretSourceKeys` — the template itself declares the key's value as such a
+*   reference. This one reaches cases the first cannot: a
+*   condition-skipped secret output, or one deleted from the template, has NO
+*   desired side at all and would otherwise print in full as a REMOVE row.
+*
+* A hit on either makes the WHOLE record suspect, not just that key: the
+* record was written by a pre-GHSA binary, so every value in it is unredacted.
+* Withholding is therefore record-level. The change is still REPORTED — only
+* the value is withheld — so `--fail` and the exports story are unaffected.
+*/
+function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set()) {
+	const changes = [];
+	const currentBag = current ?? {};
+	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
+		if (isSecretDynamicReference(oldValue)) return false;
+		return isSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
+	});
+	const push = (change) => {
+		if (legacyRecord && change.changeType !== "ADD") {
+			const { oldValue: _dropped, ...rest } = change;
+			changes.push({
+				...rest,
+				oldValueRedacted: true
+			});
+			return;
+		}
+		changes.push(change);
+	};
+	for (const [name, newValue] of Object.entries(desired)) {
+		const isExport = exportNames.has(name);
+		if (!Object.prototype.hasOwnProperty.call(currentBag, name)) {
+			changes.push({
+				name,
+				changeType: "ADD",
+				newValue,
+				isExport
+			});
+			continue;
+		}
+		const oldValue = currentBag[name];
+		if (!valuesEqual(oldValue, newValue)) push({
+			name,
+			changeType: "MODIFY",
+			oldValue,
+			newValue,
+			isExport
+		});
+	}
+	for (const [name, oldValue] of Object.entries(currentBag)) {
+		if (Object.prototype.hasOwnProperty.call(desired, name)) continue;
+		push({
+			name,
+			changeType: "REMOVE",
+			oldValue,
+			isExport: false
+		});
+	}
+	return changes;
+}
+
 //#endregion
 //#region src/cli/cfn-stack-states.ts
 /**
@@ -57705,6 +58006,11 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * resolver so changes buried inside intrinsics (e.g. `Fn::Join` literal
 * args) are detected against resolved values in state.
 *
+* Also computes the `Outputs` delta (issue #1921) — an Outputs-only change has
+* a byte-identical `Resources` section, so without it such a stack previews as
+* "No changes detected" while the apply persists new outputs and republishes
+* the exports index.
+*
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
@@ -57749,7 +58055,16 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		...conditions && { conditions },
 		skipDynamicReferences: true
 	});
-	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions);
+	let outputChanges = [];
+	if (resolved.resolutionFailed) {
+		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
+	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys);
+	return {
+		changes,
+		outputChanges
+	};
 }
 /**
 * Resolve a nested-stack child's input `Parameters` (declared on the parent's
@@ -57812,12 +58127,14 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback);
 	const node = {
 		stackName,
 		displayName,
 		region,
-		changes: await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback),
+		changes,
 		ccApiRoutes: collectCcApiRoutes(template, state),
+		outputChanges,
 		children: []
 	};
 	if (!recursive) return node;
@@ -57862,12 +58179,14 @@ async function buildDiffTree(args) {
 */
 async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator) {
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator);
 	const node = {
 		stackName,
 		displayName: stackName,
 		region,
-		changes: await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator),
+		changes,
 		ccApiRoutes: /* @__PURE__ */ new Map(),
+		outputChanges,
 		children: []
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -57925,7 +58244,7 @@ function collectCcApiRoutes(template, state) {
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
-	return false;
+	return node.outputChanges.length > 0;
 }
 /** True when this node OR any descendant has a real change (tree-wide drift detector for `--fail`). */
 function treeHasChanges(node) {
@@ -57956,26 +58275,17 @@ function diffTreeToJson(node) {
 		stack: node.stackName,
 		region: node.region,
 		changes,
+		outputChanges: node.outputChanges.map((change) => ({
+			name: change.name,
+			changeType: change.changeType,
+			...change.changeType !== "ADD" && !change.oldValueRedacted ? { oldValue: change.oldValue } : {},
+			...change.oldValueRedacted ? { oldValueRedacted: true } : {},
+			...change.changeType !== "REMOVE" ? { newValue: change.newValue } : {},
+			export: change.isExport
+		})),
 		children: node.children.map(diffTreeToJson)
 	};
 }
-const INTRINSIC_KEYS = /* @__PURE__ */ new Set([
-	"Ref",
-	"Fn::Sub",
-	"Fn::GetAtt",
-	"Fn::Join",
-	"Fn::Select",
-	"Fn::Split",
-	"Fn::If",
-	"Fn::ImportValue",
-	"Fn::FindInMap",
-	"Fn::Base64",
-	"Fn::GetAZs",
-	"Fn::Equals",
-	"Fn::And",
-	"Fn::Or",
-	"Fn::Not"
-]);
 function isIntrinsic(value) {
 	if (value === null || value === void 0 || typeof value !== "object" || Array.isArray(value)) return false;
 	const keys = Object.keys(value);
@@ -58111,6 +58421,84 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		delete: deleteCount
 	};
 }
+/** Stand-in printed instead of a withheld legacy-plaintext output value. */
+const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run `cdkd scrub`>";
+/**
+* Strip characters that let a template-controlled string manipulate the
+* TERMINAL rather than merely appear in it: C0 (incl. ESC, so no ANSI sequence
+* survives), DEL, C1 (the 8-bit CSI forms some terminals still honor), and the
+* bidi / format overrides that visually reorder a rendered line.
+*
+* Applied only on the human-render path. The `--json` payload is deliberately
+* left byte-faithful: it is a machine interface, an export NAME is data a
+* consumer may match on, and silently mutating it there would trade a real
+* correctness regression for a display concern belonging to whatever renders
+* the JSON. `JSON.stringify` already escapes everything below 0x20.
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
+* only, deliberately NOT C0.
+*
+* `JSON.stringify` escapes every character below 0x20 that occurs INSIDE a
+* string, so the only C0 left on this path is the pretty-printer's own
+* structural newlines — stripping those collapses a multi-line value onto a
+* single line. What `JSON.stringify` passes through unchanged is the C1 range
+* and the bidi overrides, and those are what this removes.
+*/
+function stripDisplayOnlyChars(value) {
+	return value.replace(/[\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+/**
+* Render one node's Outputs delta (issue #1921) via `logFn`, returning the
+* per-kind counts. Emits nothing when there is no delta, so an unchanged
+* Outputs section adds no noise to a resource-only diff.
+*
+* Rows are keyed by the PERSISTED bag key, which is what `StackState.outputs`
+* holds and what the exports index publishes. An output carrying an
+* `Export.Name` therefore shows TWO rows — its logical name and its export
+* name — because the deploy writes both keys. That is the useful half for the
+* motivating case: the `[export]`-tagged row IS the string a downstream
+* `Fn::ImportValue` resolves, so the user can match it against the consumer
+* that was failing with "export not found".
+*/
+function renderOutputChangeLines(outputChanges, logFn) {
+	const counts = {
+		add: 0,
+		change: 0,
+		remove: 0
+	};
+	if (outputChanges.length === 0) return counts;
+	logFn("\n  Outputs:");
+	const indent = "            ";
+	const render = (value) => stripDisplayOnlyChars((JSON.stringify(value, null, 2) ?? "undefined").replace(/\n/g, `\n${indent}`));
+	const renderOld = (change) => change.oldValueRedacted ? REDACTED_LEGACY_PLAINTEXT : render(change.oldValue);
+	for (const change of outputChanges) {
+		const exported = change.isExport ? " [export]" : "";
+		const name = stripControlChars(change.name);
+		switch (change.changeType) {
+			case "ADD":
+				counts.add++;
+				logFn(`    [+] ${name}${exported}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "MODIFY":
+				counts.change++;
+				logFn(`    [~] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				logFn(`          new: ${render(change.newValue)}`);
+				break;
+			case "REMOVE":
+				counts.remove++;
+				logFn(`    [-] ${name}${exported}`);
+				logFn(`          old: ${renderOld(change)}`);
+				break;
+		}
+	}
+	return counts;
+}
 /**
 * Render a diff tree (root + nested children, DFS) via `logFn`. Only nodes
 * that actually have changes get a block — unchanged nested children are
@@ -58123,7 +58511,9 @@ function renderDiffTree(node, isRoot, logFn) {
 	if (nodeHasChanges(node)) {
 		logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
 		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes);
+		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
+		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
 }
@@ -79390,7 +79780,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.26");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.27");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;