@go-to-k/cdkd 0.283.30 → 0.283.32

package/dist/{deploy-engine-Bb4ECtz3.js → deploy-engine-rYTNzst0.js}

@@ -5560,6 +5560,27 @@ var AssetModeResolver = class {
 function escapeRegExp$1(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/**
+* Remove control characters from a value about to be PRINTED.
+*
+* Lives beside {@link escapeRegExp} for the reason that helper's own note
+* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
+* in `src/deployment/outputs-export-alias.ts` — and copies of a
+* security-shaped helper drift. Both print the same class of string: a
+* resolved CloudFormation Output / `Export.Name`, which passed no CFn
+* validator, so it can carry ANSI escapes or bidi overrides straight into a
+* terminal or a CI log.
+*
+* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
+* only: a `--json` payload is a machine interface where an export name is data
+* a consumer may match on, and mutating it there trades a correctness
+* regression for a display concern (see `stripDisplayOnlyChars`, which is the
+* narrower guard for an already-serialized payload and stays local to its
+* caller because its C0 exclusion is specific to that path).
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
 
 //#endregion
 //#region src/assets/asset-redirect.ts
@@ -9925,40 +9946,88 @@ function buildNeedleRegex(values) {
 	if (needles.length === 0) return void 0;
 	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
 }
-/** The bag was produced by resolving the source: same shape, template source. */
+/**
+* The bag was produced by resolving the source: same shape, template source.
+*
+* `sourceIsSameGeneration` is FALSE despite the name, and that is the whole
+* lesson of issue #1917's review: the RULES describe the source, but the deploy
+* engine's persist choke point applies them to every record in the state map,
+* including ones this pass never rewrote. A template can never certify the
+* generation of the bag it is walked against.
+*/
 const TEMPLATE_DERIVED_RULES = {
 	descendArrays: true,
-	trustAnyExpression: false
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
+};
+/**
+* An AWS readback, or a persisted STATE bag, projected from the TEMPLATE: no
+* relaxation applies.
+*
+* One constant covers both bags because the template is what decides all three
+* rules here, and it decides them identically: shapes may diverge (no
+* positional descent), the template carries PUBLIC ssm expressions (no blanket
+* trust), and it is a different generation from anything it is walked against
+* (no source-takes-precedence on an expression-shaped leaf). An earlier draft
+* split this into a second `TEMPLATE_SOURCED_STATE_BAG_RULES` for `cdkd scrub`;
+* the two ended up byte-identical once the axis moved from CALLER to
+* GENERATION, and two identical constants are a drift hazard, not a
+* distinction.
+*/
+const TEMPLATE_SOURCED_RULES = {
+	descendArrays: false,
+	trustAnyExpression: false,
+	sourceIsSameGeneration: false
 };
-/** An AWS readback projected from a persisted STATE bag. */
+/** An AWS readback projected from THIS record's own persisted STATE bag. */
 const STATE_SOURCED_READBACK_RULES = {
 	descendArrays: false,
-	trustAnyExpression: true
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
 };
-/** An AWS readback projected from the TEMPLATE: neither relaxation applies. */
-const TEMPLATE_SOURCED_READBACK_RULES = {
+/**
+* A STATE source that is no longer this bag's own generation — `cdkd scrub`'s
+* `observedProperties` walk (issue #1917 review).
+*
+* It differs from {@link STATE_SOURCED_READBACK_RULES} on one flag, and the
+* difference is not cosmetic. Scrub positions `properties` against TODAY's
+* template BEFORE the observed bag is walked, so the "record's own properties"
+* that serve as the observed source may already carry an expression the stack
+* has never deployed. Taking that source for an observed leaf that ALREADY
+* holds an expression rewrites the drift baseline onto an undeployed
+* reference — which `cdkd drift --revert` then pushes to AWS.
+*
+* `trustAnyExpression` stays TRUE: the source is still a STATE bag, holding no
+* public expressions, and that relaxation is what lets scrub clean a legacy
+* PLAINTEXT observed leaf (issue #1900) rather than falling back to a value
+* scan that an old state file gives no needles for.
+*/
+const STATE_SOURCED_CROSS_GENERATION_RULES = {
 	descendArrays: false,
-	trustAnyExpression: false
+	trustAnyExpression: true,
+	sourceIsSameGeneration: false
 };
 /**
-* The bag was produced by resolving a STATE source — both relaxations apply.
+* The bag was produced by resolving a STATE source — every relaxation applies.
 *
 * The rollback replay is the case (issue #1910): `resolveReplayProps` resolves
 * the JOURNALED bag and the provider's `effectiveProperties` come back from
 * that, so the two have identical structure and positional array descent is
-* sound exactly as it is for a template-derived bag. And the source is a
-* persisted record, which holds no PUBLIC expressions — a `String` ssm
-* reference is stored resolved — so any `{{resolve:...}}` in it is by
-* construction a secret.
+* sound exactly as it is for a template-derived bag. The source is a persisted
+* record, which holds no PUBLIC expressions — a `String` ssm reference is
+* stored resolved — so any `{{resolve:...}}` in it is by construction a secret.
+* And it is the SAME generation the bag was resolved from, one statement
+* earlier in the same call, which is as strong as that claim ever gets.
 *
-* Using `STATE_SOURCED_READBACK_RULES` here instead would be wrong in the
-* quiet direction: it turns array descent OFF, so a secret nested in a
-* `Tags[]` / ECS `secrets[]` element falls to the value scan and a colliding
-* pair still collapses there.
+* Using a `*_SOURCED_*` constant here instead would be wrong in the quiet
+* direction: it turns positional array descent OFF for a bag that genuinely
+* does correspond positionally, and drops the generation claim for the one
+* writer that can actually make it.
 */
 const STATE_DERIVED_RULES = {
 	descendArrays: true,
-	trustAnyExpression: true
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true
 };
 function isDynamicReferenceString(value) {
 	return typeof value === "string" && value.includes("{{resolve:");
@@ -10252,6 +10321,103 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	return matched;
 }
 /**
+* Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
+* (issue #1915).
+*
+* Both are the identity field of an unordered CloudFormation list that really
+* does carry secrets: `Name` is the ECS `ContainerDefinitions[]` /
+* `Environment[]` / `Secrets[]` and CodeBuild `EnvironmentVariables[]` shape,
+* `Key` is the `Tags[]` shape the drift normalizer already keys on
+* (`canonicalizeTagListsDeep` in `src/analyzer/drift-normalize.ts`). The list
+* is deliberately SHORT: an entry is only useful when it is a genuine identity,
+* and a wrong entry costs a refused pairing rather than a wrong one (see
+* {@link identityKeyFor}), so widening it buys little and has to be justified
+* per shape.
+*
+* Worth naming rather than leaving to be rediscovered: `drift-normalize.ts`
+* deliberately moved its GENERAL case OFF heuristics like this one, onto
+* provider-DECLARED paths (`getDriftUnorderedPaths` + `matchesPathPrefix`),
+* after issue #1783 showed a heuristic claiming order-independence for a list
+* that was order-SIGNIFICANT (`KeySchema`). Only its `Tags[]` pass is still a
+* heuristic. This module diverges on purpose, because the two failure modes are
+* not comparable: there, a wrong claim SUPPRESSES real drift; here, the worst a
+* wrong pairing key can do is fail the uniqueness test and refuse, leaving the
+* leaf exactly where the value scan already had it. If that ever stops being
+* true — if a pairing gains the power to DELETE or REORDER rather than only to
+* rewrite a matched leaf — this list has to move to a declared seam too.
+*/
+const ARRAY_IDENTITY_KEYS = ["Name", "Key"];
+/**
+* Is every element of `items` a plain object carrying a NON-EMPTY OWN string at
+* `key`, with no two elements sharing a value?
+*
+* `Object.hasOwn` for the same reason the object walk below uses it: without
+* it the prototype chain answers for a key like `constructor`, and while state
+* that came from `JSON.parse` cannot carry one, this module is called with
+* caller-constructed bags too and the two walks disagreeing is the kind of gap
+* that only shows up once something else changes.
+*
+* The empty string is excluded because it is not a distinguishing identity —
+* the same reason the value scan refuses it as a needle. Two elements both
+* carrying `Name: ''` would otherwise pair on "equality" that means nothing.
+*/
+function isUniquelyKeyedBy(items, key) {
+	if (items.length === 0) return false;
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!isPlainObject$2(item) || !Object.hasOwn(item, key)) return false;
+		const id = item[key];
+		if (typeof id !== "string" || id === "") return false;
+		if (seen.has(id)) return false;
+		seen.add(id);
+	}
+	return true;
+}
+/**
+* Pick a key that identifies the elements of BOTH arrays, or `undefined` when
+* none does (issue #1915).
+*
+* This is what lets a leaf nested in an ARRAY be positioned on a path where
+* positional descent is refused. `descendArrays: false` is not a claim that the
+* bag and source elements are unrelated — it is a claim that their ORDER does
+* not correspond, because AWS does not preserve list order (the reason
+* `src/analyzer/drift-normalize.ts` exists). Matching by an identity FIELD
+* answers the order objection directly instead of working around it, so the
+* relaxation is sound on every rules constant and is deliberately NOT gated on
+* one.
+*
+* Requiring uniqueness WITHIN each array is what makes a pairing impossible to
+* get wrong: pairing is by string EQUALITY, so a bag element can only ever meet
+* the source element carrying the same identity, and uniqueness means there is
+* at most one of those. A key that is not really an identity (a repeated enum
+* value) fails the uniqueness test and refuses the whole pairing rather than
+* producing a plausible-looking wrong one. An element with no partner is not
+* guessed at either — it falls to the value scan, exactly as the whole array
+* did before.
+*
+* Keys are tried in {@link ARRAY_IDENTITY_KEYS} order and the FIRST one that
+* qualifies on both sides wins; a key that fails does not veto the next one.
+*
+* Two shapes this deliberately does NOT reach, stated so they are bounds rather
+* than surprises — both fail closed, leaving the leaf to the value scan:
+*
+* - **The identity field itself holds a secret.** The source element carries
+*   `{Name: '{{resolve:...}}'}` and the bag element the resolved plaintext, so
+*   the two never pair and the element's other leaves are not reached either.
+*   Closing it would mean pairing on a field whose two sides are KNOWN to
+*   differ, i.e. exactly the guessing the uniqueness rule exists to forbid. On
+*   the unchanged-resource path the value scan is also a no-op, so such a leaf
+*   keeps its plaintext — narrow (an identity field is a name, not a
+*   credential) but real.
+* - **Arrays of arrays.** `M: [[{Name, Value}]]` pairs nothing, because the
+*   OUTER elements are arrays rather than plain objects and have no identity
+*   field to key on. Positional descent into the outer list would reintroduce
+*   the order assumption this function exists to avoid.
+*/
+function identityKeyFor(bag, source) {
+	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
+}
+/**
 * PATH-based redaction: walk `bag` alongside a SOURCE bag that still carries the
 * unresolved `{{resolve:...}}` expressions, and wherever the source leaf is such
 * a string, persist THAT string verbatim.
@@ -10284,16 +10450,41 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 * where neither is.
 */
 function redactByPath(bag, source, secrets, rules, secretExpressions) {
-	if (typeof bag === "string" && isSingleDynamicReferenceToken(bag)) return bag;
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) return source;
+		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
+			return source;
+		}
 		return redactSecretsForState(bag, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
 	}
-	if (rules.descendArrays && Array.isArray(bag) && Array.isArray(source) && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key !== void 0) {
+			const sourceIndexById = /* @__PURE__ */ new Map();
+			source.forEach((item, i) => {
+				sourceIndexById.set(item[key], i);
+			});
+			let orderPreserved = true;
+			const partnerIndex = bag.map((item, i) => {
+				const j = sourceIndexById.get(item[key]);
+				if (j === void 0) return -1;
+				if (j !== i) orderPreserved = false;
+				return j;
+			});
+			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
+			return bag.map((item, i) => {
+				const j = partnerIndex[i];
+				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions);
+				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions);
+				return redactSecretsForState(item, secrets);
+			});
+		}
+		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = {};
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
@@ -10319,6 +10510,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
+			if (isSingleDynamicReferenceToken(value)) return value;
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
@@ -10342,13 +10534,23 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 * changed, or the input by identity when there are no secrets — so callers can
 * detect a no-op cheaply. Shared by the deploy engine's save choke point and
 * the `cdkd scrub` command so both scrub the same three fields identically.
-*/
-function scrubResourceRecord(record, secrets, sourceProperties) {
+*
+* `observedRules` overrides the rules the `observedProperties` walk would
+* otherwise DERIVE from whether a `sourceProperties` bag was supplied. Exactly
+* one caller needs it and the reason is not obvious, so it is a parameter
+* rather than another derivation: `cdkd scrub` has already repositioned
+* `properties` against TODAY's template by the time it calls this, so the
+* "record's own properties" this walk falls back to are no longer the same
+* GENERATION as the observed bag beside them (issue #1917 review). Left
+* unspecified, the derivation below is right for every other caller, whose
+* `properties` reach this function untouched.
+*/
+function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	if (secrets.size === 0 && sourceProperties === void 0 && !record.observedProperties) return record;
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_READBACK_RULES);
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_RULES));
 	return next;
 }
 /**
@@ -14895,7 +15097,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BpVWOeU3.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CVoisQ0L.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -19950,6 +20152,262 @@ function collectInlinePolicyNamesManagedBySiblings(targetPhysicalId, context, at
 	return result;
 }
 
+//#endregion
+//#region src/deployment/outputs-export-alias.ts
+/**
+* Does CloudFormation suppress this output on this deploy?
+*
+* CFn does not create an output whose `Condition` evaluates false, and
+* `resolveOutputs` mirrors that (issue #1028). Unknown condition names are
+* KEPT, matching `filterResourcesByCondition` on the resource side — a
+* condition cdkd could not evaluate must not silently delete an output.
+*
+* DEPLOY-SIDE ONLY. `cdkd scrub` deliberately does not use this: see
+* {@link collectDeclaredOutputNames}.
+*/
+function isOutputSuppressedByCondition(output, conditions) {
+	return output.Condition !== void 0 && conditions?.[output.Condition] === false;
+}
+/**
+* The output NAMES this deploy actually publishes — every declared output minus
+* the condition-suppressed ones.
+*
+* This is the set that owns keys in BOTH bags, and the reason the answer is
+* "published" rather than "declared": a suppressed output writes no value, so
+* it must not write a position source either, and its name is free for an
+* export alias to use. Reserving names for suppressed outputs would drop a
+* WORKING export the moment an unrelated condition went false.
+*
+* Sound at deploy time because these are the SAME condition values the deploy
+* itself acted on. Not sound in scrub — see {@link collectDeclaredOutputNames}.
+*/
+function collectPublishedOutputNames(outputs, conditions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [name, output] of Object.entries(outputs)) if (!isOutputSuppressedByCondition(output, conditions)) names.add(name);
+	return names;
+}
+/**
+* Every DECLARED output name, conditions ignored — the set `cdkd scrub` tests
+* collisions against.
+*
+* Scrub must be a SUPERSET here, and the asymmetry with the deploy engine is
+* forced by what scrub can know. Its condition values are re-evaluated
+* best-effort, from template defaults only (the command takes no
+* `--parameters`), and `evaluateConditions` assumes FALSE on any evaluation
+* failure. So "suppressed" is both easy to hit spuriously and impossible to
+* confirm against the deploy that actually wrote the state.
+*
+* The two error directions are not symmetric, which is what settles the rule:
+*
+* - Judging a colliding output suppressed when the DEPLOY published it (the
+*   spurious-false case above) makes scrub miss the collision, write the
+*   exporting output's expression over the colliding key, and persist a
+*   reference naming a DIFFERENT secret — the #1919 corruption, produced by
+*   the remediation command itself.
+* - Judging it published when the deploy suppressed it costs one spurious
+*   warning and one key redacted by VALUE match instead of by position. State
+*   exactly what that costs, since an earlier revision understated it: the
+*   value map is keyed by PLAINTEXT, so when two DISTINCT secrets resolve to
+*   one value it keeps only the last, and that key can be persisted holding a
+*   reference naming the OTHER secret. It is a smaller blast radius than the
+*   first case (one key, and only when two secrets coincide, versus every
+*   collision) but it is the same KIND of error, not a mere loss of precision.
+*
+* A wrong reference beats a lost precision bound, so scrub over-approximates.
+*/
+function collectDeclaredOutputNames(outputs) {
+	return new Set(Object.keys(outputs));
+}
+/**
+* Would aliasing `exportName` land on a key another output owns?
+*
+* An output exporting under its OWN name is not a collision: the alias rewrites
+* the identical key with the identical value, and both bags then carry the same
+* source.
+*
+* Deliberately NOT extended to two outputs sharing one `Export.Name` with no
+* output of that name. Both bags stay consistent there (one iteration writes
+* both the value and its source), so it is not this issue's class — see
+* `docs/cross-stack-references.md`.
+*/
+function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
+	return exportName !== outputKey && ownedOutputNames.has(exportName);
+}
+/**
+* Mirrors `secret-redaction`'s own `MIN_NEEDLE_LENGTH`. Duplicated rather than
+* imported because the two bounds answer different questions and should be free
+* to diverge: that one bounds what may be REWRITTEN, this one what may be
+* REFUSED or REPORTED.
+*/
+const MIN_SECRET_NEEDLE = 4;
+/**
+* Which recorded secrets are visible in `text`, or `undefined` when none is.
+*
+* ONE rule for both callers below, because they were inconsistent and the
+* inconsistency was a hole: the export-name check refused only an exact
+* whole-name match while the state-KEY scan did bounded containment over the
+* same kind of map — so `prod-<secret>-endpoint` was written as a state key by
+* the deploy and then reported by `cdkd scrub` as an UNREPAIRABLE leak. The tool
+* was creating the exact state it tells the user it cannot fix.
+*
+* A WHOLE-value match counts at any length; an EMBEDDED one only at or above
+* {@link MIN_SECRET_NEEDLE}. The bound is what makes containment safe to use for
+* a refusal at all — an unbounded scan over a degenerate one-character secret
+* matches almost every name and silently drops working exports — and its cost
+* is stated rather than hidden: a secret of three characters or fewer embedded
+* in a longer string is not seen. That value is indistinguishable from
+* coincidence, and the same bound already governs every substring redaction
+* cdkd performs.
+*
+* No empty-string case is needed at either caller: the resolver never records an
+* empty secret (`secret-redaction` says so — an empty needle would match every
+* leaf), and the length bound excludes it from the containment arm regardless.
+*/
+function secretsPresentIn(text, secrets) {
+	if (!secrets || secrets.size === 0) return void 0;
+	const exposure = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) if (text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext)) exposure.set(plaintext, expression);
+	return exposure.size > 0 ? exposure : void 0;
+}
+/**
+* The secrets present in a resolved `Export.Name`, or `undefined` when it
+* carries none.
+*
+* An `Export.Name` may be an intrinsic (`Fn::Sub` / `Fn::Join`), and those
+* substitute dynamic references — so the resolved name can contain a resolved
+* secret. That name would become a state KEY, and every redaction pass walks
+* VALUES only, so the plaintext would land in `state.json` and be republished
+* into the exports index.
+*
+* TWO signals, and neither subsumes the other:
+*
+* - `substitutedIntoName` — the caller resolves the name with its OWN
+*   `recordedSecretValues` map, so a non-empty map means the resolver
+*   substituted a secret INTO THIS NAME. Exact, and the only arm that can see a
+*   substituted secret SHORTER than the containment bound below.
+* - a bounded containment scan of `recordedThisPass` ({@link secretsPresentIn}),
+*   which catches plaintext that arrived by any other route — a literal name, a
+*   cache hit, an `Fn::Sub` variable echoing the value.
+*
+* An earlier revision had only the first, calling the scan unpromising because
+* an UNBOUNDED one is: a degenerate one-character recorded secret would make
+* every name containing that character "secret" and silently drop working
+* exports. The bound is what makes the scan safe, and without the scan the
+* deploy wrote `prod-<secret>-endpoint` as a state key that `cdkd scrub` then
+* reported as unrepairable.
+*
+* The containment arm applies with no order caveat any more: the deploy engine
+* resolves EVERY output value
+* before deciding any alias, so this arm sees the complete map whatever the
+* declaration order. (An earlier revision of this paragraph said catching that
+* required "resolving the whole template before deciding anything" and called
+* it impractical — the value pass already does exactly that, at no extra cost.
+* The residual is now only a secret first substituted by ANOTHER output's
+* `Export.Name`, since those resolve in the second pass, in declaration order.)
+*
+* No empty-string special case, in either map: the resolver never records an
+* empty secret (`secret-redaction.ts` states it — an empty needle would match
+* every leaf), so an `''` key cannot reach here, and a guard against it would
+* be a branch no test could ever distinguish.
+*/
+function exportNameSecretExposure(exportName, substitutedIntoName, recordedThisPass) {
+	const exposure = new Map(substitutedIntoName);
+	for (const [plaintext, expression] of secretsPresentIn(exportName, recordedThisPass) ?? []) exposure.set(plaintext, expression);
+	return exposure.size > 0 ? exposure : void 0;
+}
+/**
+* Secrets visible in a state KEY, or `undefined` when there are none.
+*
+* Unlike {@link exportNameSecretExposure} there is no resolution to attribute
+* this to: the key was written by an EARLIER binary, so containment is the only
+* available signal. It is therefore bounded the same way `secret-redaction`
+* bounds its own substring scan — a value shorter than {@link MIN_SECRET_NEEDLE}
+* is matched only as the WHOLE key — because an unbounded containment scan over
+* a degenerate short secret flags every key in the state and fails the
+* `--dry-run --fail` CI gate repo-wide, which is the availability failure the
+* export-name check was redesigned to avoid.
+*
+* Bound and cost are {@link secretsPresentIn}'s; see there.
+*/
+function stateKeySecretExposure(key, secrets) {
+	return secretsPresentIn(key, secrets);
+}
+/**
+* Replace EVERY occurrence of every exposed secret with the mask.
+*
+* Deliberately not `maskSecretsInText`: that helper skips needles shorter than
+* its minimum length, which is right when scanning arbitrary bags for
+* coincidental matches but wrong here, where the values are known to be IN this
+* string. Feeding a detected-but-unmaskable name to it printed the secret under
+* a "masked:" label — a message asserting a protection it had not performed.
+* Longest-first so a secret containing another is masked whole.
+*/
+function maskEveryOccurrence(text, exposure) {
+	let out = text;
+	for (const value of Array.from(exposure.keys()).sort((a, b) => b.length - a.length)) out = out.split(value).join("***");
+	return out;
+}
+/**
+* Warning for an `Export.Name` that resolved to something containing secret
+* plaintext. Refused rather than published: the name would be a state KEY, and
+* keys are never redacted.
+*
+* The name is shown MASKED, and omitted entirely if masking somehow left it
+* unchanged. stderr is a reader like any other, so the invariant is absolute: a
+* message must never claim a masking it did not perform.
+*/
+function secretBearingExportNameWarning(outputKey, exportName, exposure) {
+	const masked = stripControlChars(maskEveryOccurrence(exportName, exposure));
+	const shown = masked === stripControlChars(exportName) ? "" : `(masked: "${masked}") `;
+	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+}
+/**
+* Warning for a state KEY that already holds secret plaintext — the residue an
+* EARLIER binary left when it published an export name that resolved to one.
+*
+* `cdkd scrub` cannot repair this. Every redaction pass rewrites VALUES; a key
+* is the export's identity, so renaming it here would silently retire an export
+* consumers resolve by name, and dropping it would delete a live export. The
+* remedy is in the template: give the output a non-secret `Export.Name` and
+* redeploy, which rewrites `state.outputs` wholesale and republishes the index.
+* Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
+*/
+function secretBearingStateKeyWarning(stackName, key, exposure) {
+	return `State for ${stripControlChars(stackName)} holds an output KEY containing a secret (masked: "${stripControlChars(maskEveryOccurrence(key, exposure))}") — cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+}
+/**
+* Warning for an `Export.Name` colliding with an output NAME it does not own.
+*
+* Names both outputs because the two are equally likely to be the mistake, and
+* says which value survives — the export is skipped, so the key keeps the
+* output's own value.
+*
+* No masking here, and none is needed: the name printed is one that MATCHED a
+* declared output name, i.e. template text, and a name carrying a secret is
+* refused by {@link secretBearingExportNameWarning} before this is reached.
+*/
+function exportAliasCollisionWarning(outputKey, exportName) {
+	const shown = stripControlChars(exportName);
+	const from = stripControlChars(outputKey);
+	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
+}
+/**
+* Warning for the same collision seen by `cdkd scrub`, whose remedy differs.
+*
+* Scrub does not resolve outputs — it redacts state written by an EARLIER
+* binary, where the alias may have won the colliding key — so it cannot claim
+* the key belongs to either output. It drops the position source for that key
+* and lets the value scan decide from the plaintext actually stored, which is
+* why this message promises something weaker than the deploy-time one. It can
+* also fire on a template the deploy handled cleanly, per
+* {@link collectDeclaredOutputNames}.
+*/
+function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
+	const exposure = secretsPresentIn(exportName, secrets);
+	const shown = stripControlChars(exposure ? maskEveryOccurrence(exportName, exposure) : exportName);
+	return `Output ${stripControlChars(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+}
+
 //#endregion
 //#region src/utils/colors.ts
 /**
@@ -21526,16 +21984,22 @@ async function resolveReplayProps(props, resolver, secrets) {
 * deploy reports a change that never converges — the same defect the four
 * deploy-side writers had, arriving here through the replay instead.
 *
-* It takes `STATE_DERIVED_RULES`, which is BOTH relaxations. The source is a
+* It takes `STATE_DERIVED_RULES`, which is every relaxation. The source is a
 * persisted record, so it holds no PUBLIC expressions (a `String` ssm reference
 * is stored resolved) and any `{{resolve:...}}` in it is by construction a
 * secret — that is `trustAnyExpression`. And the bag WAS produced by resolving
 * that source (`resolveReplayProps` -> the provider's `effectiveProperties`),
 * so the two have identical structure and positional array descent is sound —
-* that is `descendArrays`. Using `STATE_SOURCED_READBACK_RULES` here reads
-* plausible and is wrong in the quiet direction: it turns array descent off, so
-* a secret nested in a `Tags[]` / ECS `secrets[]` element would still collapse
-* on the replay path.
+* that is `descendArrays`. It is also the SAME generation, resolved one
+* statement earlier in this call — that is `sourceIsSameGeneration`, and this
+* writer is one of only two that can honestly claim it.
+*
+* Using `STATE_SOURCED_READBACK_RULES` here reads plausible and is wrong in the
+* quiet direction: it turns positional array descent off. Since issue #1915 a
+* `Tags[]` / ECS `Environment[]` element is reached by KEYED descent either
+* way, so the concrete loss is narrower than it was — it is a list whose
+* elements carry no `Name` / `Key` identity, which only positional descent can
+* walk.
 *
 * No-op when the op resolved no secret.
 */
@@ -22107,7 +22571,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.30";
+	return "0.283.32";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -22748,6 +23212,14 @@ var DeployEngine = class {
 	*/
 	outputsTemplateSource = {};
 	/**
+	* Whether {@link outputsTemplateSource} may be used to POSITION the outputs
+	* redaction. False once an outputs pass threw partway: the post-loop
+	* name pass never ran, so the bag holds only the alias keys written before
+	* the throw — a partial source built from THIS template, while the bag the
+	* failure path then redacts is the PREVIOUS deploy's. Reset per `deploy()`.
+	*/
+	outputsSourceUsable = true;
+	/**
 	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
 	* each CREATE / UPDATE attempted (issue #1198). Written just before the
 	* provider call; read only when the op FAILS, to journal the failed op's
@@ -22792,6 +23264,7 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
+		this.outputsSourceUsable = true;
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -22835,7 +23308,7 @@ var DeployEngine = class {
 	*/
 	redactOutputs(outputs) {
 		if (this.outputSecrets.size === 0) return outputs;
-		return redactSecretsForState(outputs, this.outputSecrets, this.outputsTemplateSource);
+		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0);
 	}
 	/**
 	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
@@ -24439,9 +24912,30 @@ var DeployEngine = class {
 		});
 	}
 	/**
-	* Resolve stack outputs from template and resource attributes
+	* What a failed Output resolution does, shared by both passes of
+	* {@link resolveOutputs} so they cannot drift — the alias pass reports the
+	* SAME failure for a name it could not resolve as the value pass does for a
+	* value, which is what the single-pass shape did when both lived in one
+	* `try`.
+	*
+	* Issue #1111 item 2: under `--strict-getatt` an unresolvable Output fails
+	* the deploy instead of silently publishing nothing (which breaks downstream
+	* `Fn::ImportValue` consumers with "export not found" long after this deploy
+	* exits 0).
+	*/
+	handleOutputResolutionFailure(error, outputKey, outputs) {
+		if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
+		this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
+		outputs[outputKey] = void 0;
+	}
+	/**
+	* Resolve stack outputs from template and resource attributes.
 	*
-	* Uses IntrinsicFunctionResolver for full CloudFormation intrinsic function support.
+	* Uses `IntrinsicFunctionResolver` for full CloudFormation intrinsic function
+	* support, and runs in TWO passes — every value, then every export alias —
+	* so an alias decision sees the complete set of secrets this pass resolved
+	* rather than whatever the declaration order happened to have recorded by
+	* then (issue #1919).
 	*/
 	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
 		if (!template.Outputs) return {};
@@ -24452,29 +24946,58 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
-		for (const [outputKey, output] of Object.entries(template.Outputs)) {
-			if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
-				this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
-				continue;
+		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
+		let outputsPassCompleted = false;
+		try {
+			for (const [outputKey, output] of Object.entries(template.Outputs)) {
+				if (isOutputSuppressedByCondition(output, conditions)) {
+					this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+					continue;
+				}
+				try {
+					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
+				} catch (error) {
+					this.handleOutputResolutionFailure(error, outputKey, outputs);
+				}
 			}
-			try {
-				const value = await this.resolver.resolve(output.Value, context);
-				outputs[outputKey] = value;
-				if (output.Export?.Name) {
-					const exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, context);
-					if (typeof exportName === "string") {
-						outputs[exportName] = value;
-						this.outputsTemplateSource[exportName] = output.Value;
+			for (const [outputKey, output] of Object.entries(template.Outputs)) {
+				if (isOutputSuppressedByCondition(output, conditions)) continue;
+				if (!output.Export?.Name) continue;
+				const value = outputs[outputKey];
+				if (value === void 0) continue;
+				const nameSecrets = /* @__PURE__ */ new Map();
+				let exportName;
+				try {
+					try {
+						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+							...context,
+							recordedSecretValues: nameSecrets
+						});
+					} finally {
+						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
+				} catch (error) {
+					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					continue;
+				}
+				if (typeof exportName !== "string") continue;
+				const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues);
+				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure));
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName));
+				else {
+					outputs[exportName] = value;
+					this.outputsTemplateSource[exportName] = output.Value;
 				}
-			} catch (error) {
-				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
-				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
-				outputs[outputKey] = void 0;
 			}
+			outputsPassCompleted = true;
+		} finally {
+			if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
+			if (!outputsPassCompleted) this.outputsSourceUsable = false;
+		}
+		for (const [outputKey, output] of Object.entries(template.Outputs)) {
+			if (!publishedOutputNames.has(outputKey)) continue;
+			this.outputsTemplateSource[outputKey] = output.Value;
 		}
-		if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
-		for (const [outputKey, output] of Object.entries(template.Outputs)) this.outputsTemplateSource[outputKey] = output.Value;
 		return outputs;
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -24489,5 +25012,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, resolveApp as $t, cyan as A, LocalInvokeBuildError as An, createAssetRedirectResolver as At, findSilentDropProperties as B, StackHasActiveImportsError as Bn, validateContainerRepoName as Bt, makeCanonicalizePropertiesFn as C, resetAwsClients as Cn, S3StateBackend as Ct, renderStatefulReason as D, ConfigError as Dn, stringifyValue as Dt, isStatefulRecreateTargetSync as E, CdkdError as En, AssetPublisher as Et, IAMRoleProvider as F, NestedStackChildDirectDestroyError as Fn, BOOTSTRAP_MARKER_PREFIX as Ft, IntrinsicFunctionResolver as G, isCdkdError as Gn, runDockerForeground as Gt, slowCcOperationTimeoutMs as H, StateError as Hn, buildDockerImage as Ht, collectInlinePolicyNamesManagedBySiblings as I, PartialFailureError as In, ensureAssetStorage as It, refStateLookupFromResource as J, isMarkedNonRetryable as Jn, getDockerImageBySourceHash as Jt, cfnRefValueFromPhysicalId as K, normalizeAwsError as Kn, runDockerStreaming as Kt, clearOnUpdateRemoval as L, ProvisioningError as Ln, getBootstrapMarkerKey as Lt, green as M, LocalStartServiceError as Mn, rewriteTemplateAssetReferences as Mt, red as N, LockError as Nn, escapeRegExp$1 as Nt, formatResourceLine as O, DependencyError as On, WorkGraph as Ot, yellow as P, MissingCdkCliError as Pn, AssetModeResolver as Pt, assertRegionMatch as Q, __exportAll as Qn, getLegacyStateBucketName as Qt, ProviderRegistry as R, ResourceTimeoutError as Rn, parseBootstrapMarker as Rt, unsupportedFinalSnapshotError as S, getAwsClients as Sn, LockManager as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, AssetError as Tn, shouldRetainResource as Tt, disableInstanceApiTermination as U, SynthesisError as Un, formatDockerLoginError as Ut, CloudControlProvider as V, StackTerminationProtectionError as Vn, buildDenyExternalAccessPolicy as Vt, isTerminationProtectionPropagationError as W, formatError as Wn, getDockerCmd as Wt, normalizeAwsTagsToCfn as X, isThrottlingError as Xn, synthesisStatusMessage as Xt, WAFv2WebACLProvider as Y, isRetryableTransientError as Yn, Synthesizer as Yt, resolveExplicitPhysicalId as Z, markNonRetryable as Zn, getDefaultStateBucketName as Zt, buildFinalSnapshotIdentifier as _, AssemblyReader as _n, INTRINSIC_KEYS as _t, DeploymentEventsStore as a, resolveUseCdkBootstrapAssets as an, requireConfigObject as at, isFinalSnapshotError as b, resolveBucketRegion as bn, DagBuilder as bt, replayFailedOperations as c, CFN_TEMPLATE_BODY_LIMIT as cn, redactSecretsForState as ct, deleteSkipReason as d, findLargeInlineResources as dn, s3BucketDomainName as dt, resolveAutoAssetStorage as en, configBooleanRefusal as et, withResourceDeadline as f, uploadCfnTemplate as fn, s3BucketDualStackDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, derivePartitionAndUrlSuffix as gn, DiffCalculator as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, canonicalizeRegion as hn, applyRoleArnIfSet as ht, DeploymentEventsReader as i, resolveStateBucketWithDefaultAndSource as in, requireConfigArray as it, gray as j, LocalMigrateError as jn, loadPublishableAssetManifest as jt, bold as k, DeployCancelledError as kn, buildAssetRedirectMap as kt, replayRollback as l, CFN_TEMPLATE_URL_LIMIT as ln, scrubResourceRecord as lt, computeImplicitDeleteEdges as m, PARTITION_TABLE as mn, s3BucketWebsiteUrl as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveSkipPrefix as nn, readConfigString as nt, planFailedOps as o, stateBucketExistenceConfirmed as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, expectedOwnerParam as pn, s3BucketRegionalDomainName as pt, getAccountInfo as q, withErrorHandling as qn, AssetManifestLoader as qt, DeployEngine as r, resolveStateBucketWithDefault as rn, replayWarn as rt, planRollback as s, warnDeprecatedNoPrefixCliFlag as sn, TEMPLATE_SOURCED_READBACK_RULES as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveCaptureObservedState as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, MIGRATE_TMP_PREFIX as un, s3BucketArn as ut, ccRoutedFinalSnapshotError as v, processStackMessages as vn, describeTypeWithThrottleRetry as vt, extractDeploymentEventError as w, setAwsClients as wn, rebuildClientForBucketRegion as wt, refusesFinalSnapshot as x, AwsClients as xn, TemplateParser as xt, createPreDeleteFinalSnapshot as y, clearBucketRegionCache as yn, withRetry as yt, findActionableSilentDrops as z, ResourceUpdateNotSupportedError as zn, validateAssetBucketName as zt };
-//# sourceMappingURL=deploy-engine-Bb4ECtz3.js.map
+export { getAccountInfo as $, isCdkdError as $n, runDockerForeground as $t, cyan as A, getAwsClients as An, S3StateBackend as At, stateKeySecretExposure as B, LocalStartServiceError as Bn, escapeRegExp$1 as Bt, makeCanonicalizePropertiesFn as C, canonicalizeRegion as Cn, DiffCalculator as Ct, renderStatefulReason as D, clearBucketRegionCache as Dn, DagBuilder as Dt, isStatefulRecreateTargetSync as E, processStackMessages as En, withRetry as Et, collectDeclaredOutputNames as F, ConfigError as Fn, WorkGraph as Ft, findActionableSilentDrops as G, ProvisioningError as Gn, getBootstrapMarkerKey as Gt, collectInlinePolicyNamesManagedBySiblings as H, MissingCdkCliError as Hn, AssetModeResolver as Ht, collectPublishedOutputNames as I, DependencyError as In, buildAssetRedirectMap as It, slowCcOperationTimeoutMs as J, StackHasActiveImportsError as Jn, validateContainerRepoName as Jt, findSilentDropProperties as K, ResourceTimeoutError as Kn, parseBootstrapMarker as Kt, exportAliasCollisionScrubWarning as L, DeployCancelledError as Ln, createAssetRedirectResolver as Lt, green as M, setAwsClients as Mn, shouldRetainResource as Mt, red as N, AssetError as Nn, AssetPublisher as Nt, formatResourceLine as O, resolveBucketRegion as On, TemplateParser as Ot, yellow as P, CdkdError as Pn, stringifyValue as Pt, cfnRefValueFromPhysicalId as Q, formatError as Qn, getDockerCmd as Qt, isExportAliasCollision as R, LocalInvokeBuildError as Rn, loadPublishableAssetManifest as Rt, unsupportedFinalSnapshotError as S, PARTITION_TABLE as Sn, applyRoleArnIfSet as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, AssemblyReader as Tn, describeTypeWithThrottleRetry as Tt, clearOnUpdateRemoval as U, NestedStackChildDirectDestroyError as Un, BOOTSTRAP_MARKER_PREFIX as Ut, IAMRoleProvider as V, LockError as Vn, stripControlChars as Vt, ProviderRegistry as W, PartialFailureError as Wn, ensureAssetStorage as Wt, isTerminationProtectionPropagationError as X, StateError as Xn, buildDockerImage as Xt, disableInstanceApiTermination as Y, StackTerminationProtectionError as Yn, buildDenyExternalAccessPolicy as Yt, IntrinsicFunctionResolver as Z, SynthesisError as Zn, formatDockerLoginError as Zt, buildFinalSnapshotIdentifier as _, CFN_TEMPLATE_URL_LIMIT as _n, s3BucketArn as _t, DeploymentEventsStore as a, getDefaultStateBucketName as an, markNonRetryable as ar, coerceCfnBoolean as at, isFinalSnapshotError as b, uploadCfnTemplate as bn, s3BucketRegionalDomainName as bt, replayFailedOperations as c, resolveAutoAssetStorage as cn, readConfigString as ct, deleteSkipReason as d, resolveStateBucketWithDefault as dn, requireConfigObject as dt, runDockerStreaming as en, normalizeAwsError as er, refStateLookupFromResource as et, withResourceDeadline as f, resolveStateBucketWithDefaultAndSource as fn, requireConfigString as ft, PRE_DELETE_SNAPSHOT_TYPES as g, CFN_TEMPLATE_BODY_LIMIT as gn, scrubResourceRecord as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, warnDeprecatedNoPrefixCliFlag as hn, redactSecretsForState as ht, DeploymentEventsReader as i, synthesisStatusMessage as in, isThrottlingError as ir, assertRegionMatch as it, gray as j, resetAwsClients as jn, rebuildClientForBucketRegion as jt, bold as k, AwsClients as kn, LockManager as kt, replayRollback as l, resolveCaptureObservedState as ln, replayWarn as lt, computeImplicitDeleteEdges as m, stateBucketExistenceConfirmed as mn, TEMPLATE_SOURCED_RULES as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, getDockerImageBySourceHash as nn, isMarkedNonRetryable as nr, normalizeAwsTagsToCfn as nt, planFailedOps as o, getLegacyStateBucketName as on, __exportAll as or, configBooleanRefusal as ot, IMPLICIT_DELETE_DEPENDENCIES as p, resolveUseCdkBootstrapAssets as pn, STATE_SOURCED_CROSS_GENERATION_RULES as pt, CloudControlProvider as q, ResourceUpdateNotSupportedError as qn, validateAssetBucketName as qt, DeployEngine as r, Synthesizer as rn, isRetryableTransientError as rr, resolveExplicitPhysicalId as rt, planRollback as s, resolveApp as sn, configStringRefusal as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssetManifestLoader as tn, withErrorHandling as tr, WAFv2WebACLProvider as tt, UNSPECIFIED_SKIP_REASON as u, resolveSkipPrefix as un, requireConfigArray as ut, ccRoutedFinalSnapshotError as v, MIGRATE_TMP_PREFIX as vn, s3BucketDomainName as vt, extractDeploymentEventError as w, derivePartitionAndUrlSuffix as wn, INTRINSIC_KEYS as wt, refusesFinalSnapshot as x, expectedOwnerParam as xn, s3BucketWebsiteUrl as xt, createPreDeleteFinalSnapshot as y, findLargeInlineResources as yn, s3BucketDualStackDomainName as yt, secretBearingStateKeyWarning as z, LocalMigrateError as zn, rewriteTemplateAssetReferences as zt };
+//# sourceMappingURL=deploy-engine-rYTNzst0.js.map