@go-to-k/cdkd 0.284.21 → 0.284.23

package/dist/{deploy-engine--N_xnvjI.js → deploy-engine-HfFU96oJ.js}

@@ -11106,6 +11106,29 @@ function dynamicReferenceTokens(value) {
 	return value.match(DYNAMIC_REFERENCE_TOKEN_SCAN) ?? [];
 }
 /**
+* Where each complete `{{resolve:...}}` token sits in the string, as
+* `[start, end)` offsets. The OFFSETS are what {@link dynamicReferenceTokens}
+* cannot give, and the value scan needs them to decide whether a needle match
+* lies inside a reference or merely beside one.
+*
+* `lastIndex` is reset before `matchAll`, and that is load-bearing rather than
+* defensive. `String.prototype.matchAll` does not MUTATE the pattern's
+* `lastIndex` — it clones — but it SEEDS the clone from it, so a caller that
+* left the shared constant dirty (the constant's own doc forbids `.exec` /
+* `.test` on it for exactly this reason) would make this function skip every
+* span before that offset, silently restoring the splice this offsets are used
+* to prevent. Measured, not assumed.
+*/
+function dynamicReferenceSpans(value) {
+	DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+	const spans = [];
+	for (const match of value.matchAll(DYNAMIC_REFERENCE_TOKEN_SCAN)) spans.push({
+		start: match.index,
+		end: match.index + match[0].length
+	});
+	return spans;
+}
+/**
 * Does this MIXED leaf embed a reference that may be PUBLIC config?
 *
 * A plain `{{resolve:ssm:...}}` is classified by the parameter's TYPE, not by
@@ -11283,6 +11306,92 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	/**
+	* The SUBSTRING arm for a leaf the resolver substituted INTO rather than
+	* replaced. ONE rule over the WHOLE leaf (issue
+	* [#1935](https://github.com/go-to-k/cdkd/issues/1935)):
+	*
+	* > replace every recorded-plaintext match EXCEPT one that lies STRICTLY
+	* > INSIDE a complete `{{resolve:...}}` span.
+	*
+	* "Strictly inside" means contained by a span and SHORTER than it. The four
+	* positions a match can take, and why each lands where it does:
+	*
+	* - **strictly inside a span** -> KEPT. This is the defect: a plaintext that
+	*   happens to occur inside a token's own TEXT was spliced into the
+	*   reference. Deploy 1 persists
+	*   `jdbc://appdb:{{resolve:secretsmanager:appdb/creds:SecretString:password}}@host`;
+	*   deploy 2 records an ssm SecureString whose plaintext is `appdb`; the walk
+	*   wrote `{{resolve:secretsmanager:{{resolve:ssm:/app/dbname}}/creds:...}}`.
+	*   `resolveReplayProps` scans with `([^}]+)`, which stops at the FIRST `}`,
+	*   so the replay asks Secrets Manager for the secret id
+	*   `{{resolve:ssm:/app/dbname` — rollback blocked, or garbage applied to a
+	*   live resource. `cdkd scrub` writes the same wreckage into `properties`
+	*   and `observedProperties`.
+	* - **coextensive with a span** -> REPLACED. A secret whose resolved
+	*   PLAINTEXT is itself a `{{resolve:...}}` string (issue #1917), embedded in
+	*   a larger leaf. This is why "mask only OUTSIDE the spans" is wrong on its
+	*   own: that plaintext IS a span, so span-skipping would stop redacting it
+	*   and trade a mangling bug for a disclosure.
+	* - **containing or straddling a span** -> REPLACED. A recorded plaintext
+	*   that embeds a whole reference plus surrounding text. Nothing is spliced,
+	*   because the whole reference is consumed by the replacement. An earlier
+	*   revision of this fix expressed the rule as TWO rules — replace a span
+	*   that is a recorded plaintext, value-scan the text between spans — and
+	*   that form DROPPED this case at both ends (it is neither a whole span nor
+	*   contained in the text between spans), persisting the plaintext in the
+	*   clear where the pre-fix code had redacted it. A REGRESSION, caught by the
+	*   security review, and the reason the rule is one predicate over the whole
+	*   leaf rather than a split.
+	* - **disjoint from every span** -> REPLACED. The ordinary embedded secret.
+	*
+	* Scanning the WHOLE leaf in ONE pass is also what preserves what needle
+	* PRECEDENCE there is. {@link buildNeedleRegex} sorts alternatives
+	* longest-first, which decides only between alternatives matching at the SAME
+	* offset; the scan itself is LEFTMOST-first, so a shorter secret starting
+	* EARLIER still wins and the tail of the longer one survives in the clear
+	* (`zzABCDEFzz` with needles `ABCD` / `BCDEF` leaves `EF`). That is regex
+	* semantics, identical before and after this change, and is not something
+	* this rule claims to fix.
+	*
+	* What the single pass DOES restore is the same-offset ordering across a span
+	* boundary. The two-rule form scanned each BETWEEN-span stretch separately,
+	* so a long straddling needle was never even a candidate and a short one
+	* starting later in the tail won by default — the leaf took the WRONG
+	* expression, which the replay then re-resolves and applies (the issue #1910
+	* class).
+	*
+	* TWO KNOWN RESIDUALS around a STRAY `{{resolve:` opener, both pinned by
+	* tests rather than left as prose, and they fail in OPPOSITE directions
+	* because the span grammar is greedy `[^}]+` (deliberately — it is the
+	* resolver's own spelling, unified by issue #1936):
+	*
+	* - **no later `}}` in the leaf** -> no span, so a needle after the opener is
+	*   REPLACED and the result reads as a reference to a bogus secret id.
+	*   Identical to the pre-fix code. Refusing to redact there would leave
+	*   PLAINTEXT behind two characters any string can contain.
+	* - **a later `}}` anywhere in the leaf** -> the opener and that `}}` form
+	*   ONE span swallowing everything between them, so a needle in that region
+	*   is KEPT — the only shape where this rule redacts LESS than the code it
+	*   replaced. Narrow but real, and the reachable carrier is named rather than
+	*   waved at: the resolver shares this grammar, so such a leaf could not have
+	*   resolved on the deploy path, which leaves an `observedProperties`
+	*   READBACK (arbitrary text from AWS) as the way one arrives.
+	*
+	* Narrowing the span pattern here would close the second and open two worse
+	* holes: it would re-fork the one grammar issue #1936 unified, and it would
+	* make an ALREADY-MANGLED legacy leaf parse differently and be spliced again,
+	* contradicting this change's own "not repaired, not made worse" property.
+	* So the residual is documented, not fixed.
+	*/
+	const scanLeaf = (value, needles) => {
+		const spans = isDynamicReferenceString(value) ? dynamicReferenceSpans(value) : [];
+		return value.replace(needles, (match, offset) => {
+			const end = offset + match.length;
+			if (spans.some((span) => span.start <= offset && end <= span.end && (span.start !== offset || span.end !== end))) return match;
+			return secrets.get(match) ?? "***";
+		});
+	};
 	const walk = (value) => {
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
@@ -11291,8 +11400,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
-			regex.lastIndex = 0;
-			return value.replace(regex, (m) => secrets.get(m) ?? "***");
+			return scanLeaf(value, regex);
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
@@ -16752,7 +16860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D5G53CUp.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Cucl2K22.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24119,7 +24227,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 		eventType: "ROLLBACK_STARTED",
 		stackName
 	});
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
+	const resolver = new ReplayResolvers(ctx.region);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -24184,6 +24292,21 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * Cognito `client_secret`). Rollback is synth-free, so re-resolve straight from
 * the expression string here.
 *
+* BOTH SIDES OF A DIFF ARE CLASSIFIED, not just the bag that is written, and
+* that is deliberate (issue #2057 review). The `revert` / `--revert-failed`
+* arms call this twice — once for the desired bag and once for the CURRENT /
+* ATTEMPTED one, which only becomes the provider's `previousProperties`. Two
+* things make a wrong-region value there consequential rather than cosmetic:
+* a patch-based provider computes its patch previous-vs-desired, so a wrong
+* previous side can emit a wrong patch or, when both sides carry the same
+* expression and resolve to the same wrong value, silently compute a NO-OP and
+* skip the revert entirely; and every resolved plaintext lands in the SHARED
+* per-op `secrets` map, which is the redaction needle for the state record this
+* op persists, so a foreign-region plaintext mis-redacts that record. In
+* practice both bags carry the SAME expression (state redacts them identically),
+* so scoping the refusal to the written bag would buy a rare case at the cost of
+* a rule nobody could apply by reading one call site.
+*
 * Records each `plaintext -> expression` into `secrets` so the caller can redact
 * the persisted state record back to the expression — the same
 * resolve-for-provider + redact-for-state split the deploy engine applies at its
@@ -24197,28 +24320,365 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * `StringList` parameter is public config, stored resolved, and never appears
 * as an expression in the journal.
 */
-async function resolveReplayProps(props, resolver, secrets) {
+async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
 	if (props === void 0) return void 0;
-	const ctx = {
+	const resolverContext = {
 		template: { Resources: {} },
 		resources: {},
 		recordedSecretValues: secrets
 	};
-	const walk = async (v) => {
-		if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, ctx) : v;
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return v;
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext);
+		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
-			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i]);
+			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i], `${path}[${i}]`);
 			return out;
 		}
 		if (v !== null && typeof v === "object") {
 			const out = {};
-			for (const [k, val] of Object.entries(v)) out[k] = await walk(val);
+			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
 			return out;
 		}
 		return v;
 	};
-	return await walk(props);
+	return await walk(props, "");
+}
+/**
+* The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
+* therefore the only ones the region question below is asked about: every
+* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
+* exactly when its parameter is a `SecureString` (issue #1901).
+*
+* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
+* because it is public. `ssm-secure` is the live example and is emphatically
+* not public: `resolveDynamicReferences` has no arm for it, so the literal
+* token is passed through to AWS and CloudFormation resolves it SERVER-side.
+* cdkd never holds its value, so there is no region for cdkd to get wrong —
+* which is the only reason it can be waved through here.
+*/
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
+/**
+* Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
+*
+* Mirrors `IntrinsicFunctionResolver.resolveSecretsManagerReference`'s own
+* split — including the END-ANCHORED whole-secret form — because a secret ID
+* may legitimately contain colons (an ARN always does), so `split(':')[1]` is
+* wrong for exactly the shape this file cares about most.
+*/
+function secretsManagerSecretId(inner) {
+	const afterService = inner.substring(15);
+	let stringIdx = afterService.indexOf(":SecretString:");
+	let binaryIdx = afterService.indexOf(":SecretBinary:");
+	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
+	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
+	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
+	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
+}
+/**
+* The parameter name an `{{resolve:ssm:...}}` reference asks for — byte-for-byte
+* what `IntrinsicFunctionResolver.resolveSSMReference` passes as `GetParameter`'s
+* `Name`, which is `parts.slice(1).join(':')` on the colon-split inner body.
+*
+* The whole remainder, deliberately, with NOTHING stripped:
+*
+*  - An SSM dynamic reference CAN name a full ARN. The resolver joins the tail
+*    back together, so `{{resolve:ssm:arn:aws:ssm:us-west-2:111122223333:parameter/db/pw}}`
+*    reaches AWS as that ARN. A `split(':')[1]` here would yield the literal
+*    `'arn'` — a parameter that does not exist — and then report the reference
+*    as region-LESS and refuse it, which is the guess-in-the-other-direction the
+*    `named-region` arm exists to prevent.
+*  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
+*    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
+*    a different thing in the refusal message than the one that would be read.
+*/
+function ssmParameterName(inner) {
+	return inner.substring(4);
+}
+/**
+* The region an ARN names, or `undefined` for anything that is not an ARN with
+* a populated region field (`arn:<partition>:<service>:<region>:...`).
+*/
+function arnRegion(secretId) {
+	if (!secretId.startsWith("arn:")) return void 0;
+	const region = secretId.split(":")[3];
+	return region ? region : void 0;
+}
+/**
+* The producer regions a stack's persisted cross-stack reads name, for
+* {@link RollbackExecutorContext.importedProducerRegions} (issue #2057).
+*
+* Both record kinds count, and for the same reason: each one is a value this
+* stack read out of ANOTHER region's state, so each one is a way a
+* foreign-region `{{resolve:...}}` expression can have reached this stack's own
+* record. `imports` is the strong `Fn::ImportValue` edge; `outputReads` is the
+* weak `Fn::GetStackOutput` one (schema v8), which is the EASIER of the two to
+* point across a region boundary because the reference carries its own
+* `Region` argument.
+*
+* Deduplicated case-insensitively, keeping each region's first-recorded
+* spelling so the refusal message echoes what the user will see in
+* `state.json`. The consumer's own region is deliberately NOT filtered here —
+* {@link classifyReplaySecretRegion} does that, because it is the one that
+* knows which region is asking.
+*
+* Exported so the two `RollbackExecutorContext` construction sites derive the
+* list identically — `cdkd rollback` from the state it loaded, and
+* `DeployEngine.rollbackExecutorContext` from `crossStackReadsForPartialSave`,
+* which unions that snapshot with the reads the failing deploy itself made.
+*/
+function producerRegionsFromState(state) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
+		const canonical = canonicalizeRegion(entry.sourceRegion);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(entry.sourceRegion);
+	}
+	return regions;
+}
+/**
+* Decide which region must answer for a single `{{resolve:...}}` expression a
+* rollback replay is about to re-resolve — issue
+* [#2057](https://github.com/go-to-k/cdkd/issues/2057).
+*
+* WHY A REPLAY CAN BE HOLDING A FOREIGN REGION'S EXPRESSION AT ALL. Since
+* issue #1934 a cross-stack consumer re-resolves a redacted producer value in
+* the PRODUCER's region (`reresolveCrossStackValue` /
+* `resolverForProducerRegion`) — correct, because a Secrets Manager secret or
+* an SSM `SecureString` of the same NAME in two regions is two independent
+* values. The plaintext is then recorded into the CONSUMER's
+* `recordedSecretValues`, so the consumer's `state.json` (and from there the
+* rollback journal) persists the PRODUCER's spelling of the expression. That is
+* the right thing to persist, and it is region-less: the reader cannot tell
+* from the string which region produced it.
+*
+* The replay rebuilds its resolver from the CONSUMER's region alone, so
+* re-resolving that expression locally answers from a same-named secret in the
+* wrong region and writes it to a LIVE resource. Silent, and on the recovery
+* path. The rule applied here is the family's, from issue #1957: A NAMED REGION
+* BINDS; NEVER SUBSTITUTE A GUESS. The three verdicts are that one sentence:
+*
+*  - **`named-region`** — the expression's SECRET_ID is an ARN, which names its
+*    own region. The region is ESTABLISHED, so it binds: the caller resolves
+*    through a resolver pinned to it ({@link ReplayResolvers.forRegion}) rather
+*    than refusing. Refusing here would be the guess in the other direction.
+*
+*    cdkd would otherwise get this wrong, which is why the arm exists at all:
+*    `resolveSecretsManagerReference` builds its client from
+*    `this.explicitRegion` and passes the ARN through as an opaque `SecretId`,
+*    and `@aws-sdk/client-secrets-manager`'s endpoint ruleset has NO
+*    ARN-derived endpoint rule (unlike, say, S3 access points), so a
+*    foreign-region ARN is sent to the stack's own regional endpoint. What the
+*    SERVICE then does with it is not something this repo can settle offline —
+*    see the fixture note in
+*    `tests/integration/rollback-cross-region-secret/README.md`. Pinning the
+*    client to the ARN's region is correct either way: if Secrets Manager would
+*    have refused the foreign ARN, this turns a hard failure into a correct
+*    resolution; if it would have honoured it, this reaches the same value by
+*    the documented route. Neither outcome is a regression.
+*
+*  - **`ambiguous`** — the expression names no region (the plain name form) AND
+*    this stack has a foreign producer region on record
+*    ({@link RollbackExecutorContext.importedProducerRegions}). Nothing on hand
+*    can establish the origin, so the replay refuses instead of guessing.
+*
+*    KNOWN OVER-REFUSAL, accepted deliberately, and WIDER THAN THE SSM CASE
+*    ALONE — state both, because the second one is the common shape:
+*
+*    (a) Any NAME-FORM `secretsmanager` reference in a stack that has ANY
+*    foreign producer region on record is refused, even when that secret is
+*    the stack's own purely-local one and has nothing to do with the
+*    cross-region read. The evidence is per-STACK, not per-reference, so one
+*    cross-region export plus one ordinary
+*    `{{resolve:secretsmanager:mysecret:SecretString:pw}}` is enough — and CDK's
+*    `secretValueFromJson` emits exactly that name form, so this is the shape
+*    most people will meet. It also persists: with the union the producer
+*    region stays on record until the next SUCCESSFUL deploy. Per-reference
+*    evidence is what would narrow it, and that needs the region recorded
+*    ALONGSIDE the expression — the persisted-shape change issue #2057
+*    deliberately deferred (its options 1 and 2). Until then the refusal is
+*    loud, names the ARN spelling as the remedy, and is the fail-closed side
+*    of a trade whose other side is a silent wrong-secret write.
+*
+*    (b) An `ssm` reference is secret only when its parameter is a
+*    `SecureString`, and this arm cannot tell. So a `{{resolve:ssm:/app/env}}`
+*    naming a PUBLIC `String` that reached a persisted bag (issue #2036's
+*    acknowledged over-redaction) is refused too. Narrowing it by
+*    `isRecordedSecretExpression` was considered and REJECTED, and not because
+*    the store is unreachable — it is imported by this very file. It is
+*    unusable: `recordedSecretExpressions` is populated BY resolution, and in
+*    the standalone `cdkd rollback` process nothing has resolved anything when
+*    the first op is classified, so the store is empty and every `ssm` verdict
+*    would come back "not secret" — turning the protection off for exactly the
+*    SecureString case it exists for. Worse, once one op DID resolve a
+*    reference the store would be warm for the next, so the verdict would
+*    depend on OP ORDER. A resolve-the-type-first probe is unsound for the
+*    same reason the whole issue exists: the TYPE is region-dependent (#1957),
+*    so probing locally can report `String` for a name that is `SecureString`
+*    in the producer's region and wave through the very write this refuses.
+*    The residual is therefore a loud, actionable error on a narrow
+*    intersection (an over-redacted public ssm reference AND a cross-region
+*    read on record), which is the fail-closed side of the trade.
+*
+*  - **`local`** — everything else, which is the overwhelmingly common case:
+*    every non-secret service, every same-region ARN (the ordinary CDK
+*    `secretValueFromJson` shape), and every name-form expression in a stack
+*    with no foreign producer region recorded. Resolved exactly as before this
+*    change.
+*
+* A same-region ARN answers `local` even when a foreign producer region IS on
+* record: the expression settles the question itself, so the weaker evidence
+* never gets consulted.
+*/
+function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
+	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
+	if (inner === void 0) return { kind: "local" };
+	const service = inner.split(":")[0];
+	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return { kind: "local" };
+	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
+	if (!secretName) return { kind: "local" };
+	const named = arnRegion(secretName);
+	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "named-region",
+		secretName,
+		region: named
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const foreignProducerRegions = [];
+	for (const candidate of importedProducerRegions ?? []) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreignProducerRegions.push(candidate);
+	}
+	if (foreignProducerRegions.length === 0) return { kind: "local" };
+	return {
+		kind: "ambiguous",
+		secretName,
+		foreignProducerRegions
+	};
+}
+/**
+* The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
+* region an ARN-named reference asks for (issue #2057).
+*
+* One instance per replay, not per op — the resolved-value cache lives on the
+* resolver INSTANCE since issue #1933, so a resolver per op would re-fetch every
+* referenced secret once per op. The pinned siblings are cached here for the
+* same reason: a 100-op replay of a bag carrying one foreign ARN must pay one
+* `GetSecretValue`, not a hundred.
+*
+* A pinned sibling is a PLAIN resolver, deliberately NOT the resolver class's
+* own `producerRegionGuest` (which the class sets on the siblings
+* `resolverForProducerRegion` builds, to stop a foreign region pinning a verdict
+* in the process-global `recordedSecretExpressions` store — the issue #1933
+* shape, where an `ssm` parameter whose TYPE differs by region has one region's
+* verdict decide the other's redaction).
+*
+* WHY A GUEST FLAG IS NOT NEEDED HERE, and the argument has to be this one
+* rather than "only `secretsmanager` routes to a sibling" (that earlier claim
+* was FALSE — `resolveSSMReference` joins its colon-split tail back together, so
+* an `ssm` reference CAN name a full ARN and CAN therefore route here):
+*
+*   {@link ReplayResolvers.forRegion} is reached ONLY from a `named-region`
+*   verdict, which `classifyReplaySecretRegion` returns only when the
+*   SECRET_ID / parameter name starts with `arn:` and carries a region. So a
+*   pinned sibling only ever resolves an expression whose KEY EMBEDS THE
+*   REGION IT IS BEING RESOLVED IN.
+*
+* The store is keyed by the expression string alone, and that is exactly what
+* makes #1933 possible: two regions sharing one key. An ARN-form key cannot be
+* shared by two regions, so a verdict pinned from a sibling can never contradict
+* another region's for the same key. If a future change ever routes a
+* region-LESS expression to `forRegion`, this argument dies with it and the
+* sibling needs the guest flag.
+*/
+var ReplayResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* The refusal an `ambiguous` replay reference throws (issue #2057).
+*
+* A plain throw, like the final-snapshot refusals above and for the same
+* reason: the per-op catch in {@link replaySingle} /
+* {@link replayFailedOperations} counts it as a failure, which keeps the
+* journal segment and lets the user re-run once the reference is disambiguated.
+* Refusing is strictly better than the alternative it replaces — resolving a
+* producer-region reference against the consumer's region does not fail, it
+* succeeds with the WRONG credential and writes it to a resource that is live.
+*
+* Names the reference, the regions, and the remedy. Never the resolved value:
+* nothing here has resolved anything yet, and the expression is the same string
+* `state.json` already stores in the clear.
+*/
+function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
+	return new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
+* the region {@link classifyReplaySecretRegion} says must answer (issue #2057).
+*
+* Refuses FIRST, over the whole leaf, before any reference is fetched: a leaf
+* can splice several references together, and resolving the safe ones first
+* would leave half a credential fetched (and cached, and recorded as a
+* redaction needle) for an op that is about to be refused anyway.
+*
+* Then TWO paths, and the split is deliberate rather than an optimisation:
+*
+*  - With no foreign-region reference — every leaf on every existing code path
+*    — the leaf goes to `resolveDynamicReferences` WHOLE, exactly as before this
+*    change. That method has its own well-tested substitution semantics (it
+*    collects matches from the ORIGINAL string, so a resolved plaintext that is
+*    itself token-shaped is never re-resolved — issue #1917), and this change
+*    does not want to relitigate any of it.
+*  - With one, the leaf is rebuilt segment by segment so each reference can be
+*    resolved by its OWN region's resolver. `resolveDynamicReferences` resolves
+*    every token in the string it is handed with the one resolver it is called
+*    on, so a mixed leaf cannot be served by a single call. Each token is
+*    resolved ALONE and its result concatenated, which means no resolved value
+*    is ever re-scanned for tokens either.
+*
+* `dynamicReferenceTokens` returns the tokens in order and non-overlapping, so
+* walking the leaf with a moving `indexOf` cursor reproduces their positions
+* exactly, duplicates included.
+*/
+async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousReplaySecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, execCtx.region);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${execCtx.region}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		out += await resolver.resolveDynamicReferences(token, resolverContext);
+		cursor = at + token.length;
+	}
+	return out + leaf.slice(cursor);
 }
 /**
 * Redact resolved secret plaintext back out of a post-rollback state record
@@ -24542,7 +25002,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
-				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets) ?? {};
+				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
@@ -24634,8 +25094,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
 				});
-				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets);
-				const currentProps = await resolveReplayProps(current.properties, resolver, secrets);
+				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
+				const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
 				const revertResult = await updateWithRollbackRetry(provider, [
 					op.logicalId,
 					current.physicalId,
@@ -24695,7 +25155,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		remainingFailedOps: []
 	};
 	const { logger } = ctx;
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
+	const resolver = new ReplayResolvers(ctx.region);
 	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_STARTED",
@@ -24786,8 +25246,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
-					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets);
-					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets);
+					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
+					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
@@ -24925,7 +25385,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.21";
+	return "0.284.23";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25475,6 +25935,92 @@ function deepEqualValue(a, b) {
 	}
 	return true;
 }
+/**
+* The `imports` / `outputReads` records to persist on a save that is NOT the
+* final success save — the UNION of the pre-deploy snapshot and what THIS
+* session resolved (issue
+* [#2057](https://github.com/go-to-k/cdkd/issues/2057) review).
+*
+* Every non-success save used to write `currentState.imports` /
+* `currentState.outputReads` verbatim, i.e. the PRE-DEPLOY snapshot, while
+* writing the POST-deploy `newResources` beside it. So a deploy that
+* introduced a cross-stack read and then failed persisted resources built FROM
+* that read next to a record that does not mention it. Two consequences, and
+* only the first is about #2057:
+*
+*  1. A rollback journal exists only after a FAILED deploy, so
+*     {@link producerRegionsFromState} saw an empty list on exactly the deploy
+*     that introduces a cross-region secret read — and
+*     `classifyReplaySecretRegion` answered `local`, resolving the producer's
+*     region-less expression in the consumer's region. The refusal was inert
+*     where it mattered most.
+*  2. INDEPENDENT PRE-EXISTING BUG. `state.imports[]` is what
+*     `findActiveImportConsumers` (`src/cli/commands/destroy-runner.ts`) scans
+*     to refuse destroying a producer while a consumer still imports from it,
+*     and `state.outputReads[]` is what `findDownstreamConsumers`
+*     (`src/cli/commands/recreate-downstream-consumers.ts`) enumerates. A
+*     failed deploy therefore silently DOWNGRADED a fresh strong reference to
+*     no reference: the consumer's resource is live and recorded, its import is
+*     not, and `cdkd destroy` on the producer sails through the strong-ref
+*     pre-flight. This exists on main today, with or without #2057.
+*
+* DIRECTION OF THE RESIDUAL, stated rather than left to be discovered: a union
+* never drops a record, so a stack that STOPS reading across a region keeps the
+* stale entry until its next SUCCESSFUL deploy, whose save replaces the list
+* wholesale (`imports: [...this.recordedImports]`). Until then a purely-local
+* rollback can be refused on the strength of a read the template no longer has.
+* That is the fail-closed side — a clear error naming the region to reconcile,
+* versus a silent wrong-secret write — and the same asymmetry already justifies
+* preserving the snapshot at all (dropping it would strip a live strong-ref
+* record on every diff-clean deploy).
+*
+* THE RULE IS "EVERY SAVE EXCEPT THE TERMINAL SUCCESS ONE", and it is stated
+* that way rather than as "every non-success save" because the latter is loose
+* in both directions: the diff-clean no-change save in `doDeploy` is a SUCCESS
+* outcome and unions anyway (nothing was re-resolved, so the union is an
+* identity there and one rule beats an exception), while
+* `persistStateAfterOutputFailure` looks like a success save — provisioning
+* was clean — and is not one.
+*
+* THE ENUMERATION IS NOT KEPT HERE, DELIBERATELY. Two prose counts in this
+* lane were measured wrong (an "ALL FIVE" that missed
+* `persistStateAfterOutputFailure`, and a "three post-rollback saves" that is
+* two), and each wrong count is worse than none: it is the sentence a reader
+* uses to conclude the rule is already applied everywhere.
+* `tests/unit/deployment/deploy-engine-cross-stack-read-writers.test.ts`
+* derives the set instead — it SCANS this file for every `imports:` /
+* `outputReads:` object key that writes a VALUE and fails on any that is not
+* the one allow-listed success-path write, with a positive control proving the
+* scan can see a violation. A save site added here fails that test rather than
+* escaping silently, so the authority on "where is this applied" is a grep the
+* test performs, not a number anybody has to maintain.
+*/
+function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads) {
+	const imports = unionCrossStackReads(previous.imports, recordedImports, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.exportName}`);
+	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.outputName}`);
+	return {
+		...imports.length > 0 && { imports },
+		...outputReads.length > 0 && { outputReads }
+	};
+}
+/**
+* Concatenate two cross-stack-read lists, dropping a later duplicate of an
+* identity an earlier entry already carries. First-seen wins, so the PRE-DEPLOY
+* spelling of a region survives — entries are COMPARED on a canonicalized
+* region but STORED verbatim, mirroring `producerRegionsFromState`.
+*/
+function unionCrossStackReads(previous, recorded, identity) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const entry of [...previous ?? [], ...recorded]) {
+		if (entry === null || typeof entry !== "object") continue;
+		const key = identity(entry);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(entry);
+	}
+	return out;
+}
 var DeployEngine = class {
 	logger = getLogger().child("DeployEngine");
 	resolver;
@@ -25670,7 +26216,7 @@ var DeployEngine = class {
 	*/
 	redactOutputs(outputs) {
 		if (this.outputSecrets.size === 0) return outputs;
-		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0);
+		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES);
 	}
 	/**
 	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
@@ -26020,8 +26566,7 @@ var DeployEngine = class {
 							stackName: currentState.stackName,
 							resources: currentState.resources,
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
-							...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-							...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
 						};
 						const saveOptions = {};
@@ -26139,8 +26684,7 @@ var DeployEngine = class {
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
-						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-						...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
 					const migrate = pendingMigration;
@@ -26270,8 +26814,7 @@ var DeployEngine = class {
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
-					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-					...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
 				const migrate = pendingMigration;
@@ -26297,7 +26840,7 @@ var DeployEngine = class {
 				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			} else {
 				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName)).failures === 0;
+				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName, currentState)).failures === 0;
 			}
 			try {
 				const postRollbackState = {
@@ -26306,8 +26849,7 @@ var DeployEngine = class {
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
-					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-					...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
@@ -26323,8 +26865,7 @@ var DeployEngine = class {
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
-						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-						...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
@@ -26389,8 +26930,7 @@ var DeployEngine = class {
 			stackName: currentState.stackName,
 			resources: newResources,
 			outputs: currentState.outputs,
-			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
-			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
+			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
 		try {
@@ -26417,8 +26957,8 @@ var DeployEngine = class {
 	* command drives identical semantics). Thin wrapper that builds the
 	* executor context from the engine's collaborators and delegates.
 	*/
-	async performRollback(completedOperations, stateResources, stackName) {
-		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext());
+	async performRollback(completedOperations, stateResources, stackName, previousState) {
+		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext(previousState));
 		return {
 			failures: result.failures,
 			warnings: result.warnings
@@ -26477,14 +27017,15 @@ var DeployEngine = class {
 		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, run 'cdkd rollback ${stackName} --revert-failed' to revert it.`);
 	}
 	/** Build the {@link RollbackExecutorContext} from the engine's fields. */
-	rollbackExecutorContext() {
+	rollbackExecutorContext(previousState) {
 		return {
 			providerRegistry: this.providerRegistry,
 			region: this.stackRegion,
 			logger: this.logger,
 			recordEvent: (event) => this.recordEvent(event),
 			finalSnapshotClients: this.options.finalSnapshotClients,
-			skipFinalSnapshot: this.options.skipFinalSnapshot
+			skipFinalSnapshot: this.options.skipFinalSnapshot,
+			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads))
 		};
 	}
 	/**
@@ -27464,5 +28005,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isTerminationProtectionPropagationError as $, PartialFailureError as $n, getBootstrapMarkerKey as $t, renderStatefulReason as A, expectedOwnerParam as An, applyRoleArnIfSet as At, exportAliasCollisionScrubWarning as B, resetAwsClients as Bn, shouldRetainResource as Bt, isFinalSnapshotError as C, stateBucketExistenceConfirmed as Cn, redactSecretsForState as Ct, extractDeploymentEventError as D, MIGRATE_TMP_PREFIX as Dn, s3BucketDualStackDomainName as Dt, makeCanonicalizePropertiesFn as E, CFN_TEMPLATE_URL_LIMIT as En, s3BucketDomainName as Et, green as F, processStackMessages as Fn, DagBuilder as Ft, collectInlinePolicyNamesManagedBySiblings as G, DependencyError as Gn, createAssetRedirectResolver as Gt, secretBearingStateKeyWarning as H, AssetError as Hn, stringifyValue as Ht, red as I, clearBucketRegionCache as In, TemplateParser as It, findActionableSilentDrops as J, LocalMigrateError as Jn, escapeRegExp$1 as Jt, clearOnUpdateRemoval as K, DeployCancelledError as Kn, loadPublishableAssetManifest as Kt, yellow as L, resolveBucketRegion as Ln, LockManager as Lt, bold as M, canonicalizeRegion as Mn, INTRINSIC_KEYS as Mt, cyan as N, derivePartitionAndUrlSuffix as Nn, describeTypeWithThrottleRetry as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, findLargeInlineResources as On, s3BucketRegionalDomainName as Ot, gray as P, AssemblyReader as Pn, withRetry as Pt, disableInstanceApiTermination as Q, NestedStackChildDirectDestroyError as Qn, ensureAssetStorage as Qt, collectDeclaredOutputNames as R, AwsClients as Rn, S3StateBackend as Rt, createPreDeleteFinalSnapshot as S, resolveUseCdkBootstrapAssets as Sn, maskSecretsInText as St, unsupportedFinalSnapshotError as T, CFN_TEMPLATE_BODY_LIMIT as Tn, s3BucketArn as Tt, stateKeySecretExposure as U, CdkdError as Un, WorkGraph as Ut, isExportAliasCollision as V, setAwsClients as Vn, AssetPublisher as Vt, IAMRoleProvider as W, ConfigError as Wn, buildAssetRedirectMap as Wt, CloudControlProvider as X, LockError as Xn, AssetModeResolver as Xt, findSilentDropProperties as Y, LocalStartServiceError as Yn, stripControlChars as Yt, slowCcOperationTimeoutMs as Z, MissingCdkCliError as Zn, BOOTSTRAP_MARKER_PREFIX as Zt, computeImplicitDeleteEdges as _, resolveAutoAssetStorage as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, buildDockerImage as an, StateError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveStateBucketWithDefault as bn, dynamicReferenceTokens as bt, replayFailedOperations as c, runDockerForeground as cn, isCdkdError as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDockerImageBySourceHash as dn, isMarkedNonRetryable as dr, readConfigString as dt, parseBootstrapMarker as en, ProvisioningError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, Synthesizer as fn, isRetryableTransientError as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveApp as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, getLegacyStateBucketName as hn, __exportAll as hr, requireConfigString as ht, DeploymentEventsReader as i, buildDenyExternalAccessPolicy as in, StackTerminationProtectionError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, PARTITION_TABLE as jn, DiffCalculator as jt, isStatefulRecreateTargetSync as k, uploadCfnTemplate as kn, s3BucketWebsiteUrl as kt, replayRollback as l, runDockerStreaming as ln, normalizeAwsError as lr, configBooleanRefusal as lt, withResourceDeadline as m, getDefaultStateBucketName as mn, markNonRetryable as mr, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, validateAssetBucketName as nn, ResourceUpdateNotSupportedError as nr, getAccountInfo as nt, planFailedOps as o, formatDockerLoginError as on, SynthesisError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, synthesisStatusMessage as pn, isThrottlingError as pr, requireConfigArray as pt, ProviderRegistry as q, LocalInvokeBuildError as qn, rewriteTemplateAssetReferences as qt, DeployEngine as r, validateContainerRepoName as rn, StackHasActiveImportsError as rr, refStateLookupFromResource as rt, planRollback as s, getDockerCmd as sn, formatError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, readBootstrapMarkerBody as tn, ResourceTimeoutError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, AssetManifestLoader as un, withErrorHandling as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveCaptureObservedState as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, warnDeprecatedNoPrefixCliFlag as wn, scrubResourceRecord as wt, ccRoutedFinalSnapshotError as x, resolveStateBucketWithDefaultAndSource as xn, isSingleDynamicReferenceToken as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveSkipPrefix as yn, createSecretMasker as yt, collectPublishedOutputNames as z, getAwsClients as zn, rebuildClientForBucketRegion as zt };
-//# sourceMappingURL=deploy-engine--N_xnvjI.js.map
+export { disableInstanceApiTermination as $, NestedStackChildDirectDestroyError as $n, ensureAssetStorage as $t, isStatefulRecreateTargetSync as A, uploadCfnTemplate as An, s3BucketWebsiteUrl as At, collectPublishedOutputNames as B, getAwsClients as Bn, rebuildClientForBucketRegion as Bt, createPreDeleteFinalSnapshot as C, resolveUseCdkBootstrapAssets as Cn, maskSecretsInText as Ct, makeCanonicalizePropertiesFn as D, CFN_TEMPLATE_URL_LIMIT as Dn, s3BucketDomainName as Dt, unsupportedFinalSnapshotError as E, CFN_TEMPLATE_BODY_LIMIT as En, s3BucketArn as Et, gray as F, AssemblyReader as Fn, withRetry as Ft, IAMRoleProvider as G, ConfigError as Gn, buildAssetRedirectMap as Gt, isExportAliasCollision as H, setAwsClients as Hn, AssetPublisher as Ht, green as I, processStackMessages as In, DagBuilder as It, ProviderRegistry as J, LocalInvokeBuildError as Jn, rewriteTemplateAssetReferences as Jt, collectInlinePolicyNamesManagedBySiblings as K, DependencyError as Kn, createAssetRedirectResolver as Kt, red as L, clearBucketRegionCache as Ln, TemplateParser as Lt, formatResourceLine as M, PARTITION_TABLE as Mn, DiffCalculator as Mt, bold as N, canonicalizeRegion as Nn, INTRINSIC_KEYS as Nt, extractDeploymentEventError as O, MIGRATE_TMP_PREFIX as On, s3BucketDualStackDomainName as Ot, cyan as P, derivePartitionAndUrlSuffix as Pn, describeTypeWithThrottleRetry as Pt, slowCcOperationTimeoutMs as Q, MissingCdkCliError as Qn, BOOTSTRAP_MARKER_PREFIX as Qt, yellow as R, resolveBucketRegion as Rn, LockManager as Rt, ccRoutedFinalSnapshotError as S, resolveStateBucketWithDefaultAndSource as Sn, isSingleDynamicReferenceToken as St, refusesFinalSnapshot as T, warnDeprecatedNoPrefixCliFlag as Tn, scrubResourceRecord as Tt, secretBearingStateKeyWarning as U, AssetError as Un, stringifyValue as Ut, exportAliasCollisionScrubWarning as V, resetAwsClients as Vn, shouldRetainResource as Vt, stateKeySecretExposure as W, CdkdError as Wn, WorkGraph as Wt, findSilentDropProperties as X, LocalStartServiceError as Xn, stripControlChars as Xt, findActionableSilentDrops as Y, LocalMigrateError as Yn, escapeRegExp$1 as Yt, CloudControlProvider as Z, LockError as Zn, AssetModeResolver as Zt, IMPLICIT_DELETE_DEPENDENCIES as _, resolveApp as _n, STATE_SOURCED_CROSS_GENERATION_RULES as _t, DeploymentEventsStore as a, buildDenyExternalAccessPolicy as an, StackTerminationProtectionError as ar, WAFv2WebACLProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, resolveSkipPrefix as bn, createSecretMasker as bt, producerRegionsFromState as c, getDockerCmd as cn, formatError as cr, assertRegionMatch as ct, updatePartialMessage as d, AssetManifestLoader as dn, withErrorHandling as dr, configStringRefusal as dt, getBootstrapMarkerKey as en, PartialFailureError as er, isTerminationProtectionPropagationError as et, updatePartialReason as f, getDockerImageBySourceHash as fn, isMarkedNonRetryable as fr, readConfigString as ft, maskingRetryLogger as g, getLegacyStateBucketName as gn, __exportAll as gr, requireConfigString as gt, withResourceDeadline as h, getDefaultStateBucketName as hn, markNonRetryable as hr, requireConfigObject as ht, DeploymentEventsReader as i, validateContainerRepoName as in, StackHasActiveImportsError as ir, refStateLookupFromResource as it, renderStatefulReason as j, expectedOwnerParam as jn, applyRoleArnIfSet as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, findLargeInlineResources as kn, s3BucketRegionalDomainName as kt, replayFailedOperations as l, runDockerForeground as ln, isCdkdError as lr, coerceCfnBoolean as lt, deleteSkipReason as m, synthesisStatusMessage as mn, isThrottlingError as mr, requireConfigArray as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, readBootstrapMarkerBody as nn, ResourceTimeoutError as nr, cfnRefValueFromPhysicalId as nt, planFailedOps as o, buildDockerImage as on, StateError as or, normalizeAwsTagsToCfn as ot, UNSPECIFIED_SKIP_REASON as p, Synthesizer as pn, isRetryableTransientError as pr, replayWarn as pt, clearOnUpdateRemoval as q, DeployCancelledError as qn, loadPublishableAssetManifest as qt, DeployEngine as r, validateAssetBucketName as rn, ResourceUpdateNotSupportedError as rr, getAccountInfo as rt, planRollback as s, formatDockerLoginError as sn, SynthesisError as sr, resolveExplicitPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, parseBootstrapMarker as tn, ProvisioningError as tr, IntrinsicFunctionResolver as tt, replayRollback as u, runDockerStreaming as un, normalizeAwsError as ur, configBooleanRefusal as ut, computeImplicitDeleteEdges as v, resolveAutoAssetStorage as vn, STATE_SOURCED_READBACK_RULES as vt, isFinalSnapshotError as w, stateBucketExistenceConfirmed as wn, redactSecretsForState as wt, buildFinalSnapshotIdentifier as x, resolveStateBucketWithDefault as xn, dynamicReferenceTokens as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, resolveCaptureObservedState as yn, TEMPLATE_SOURCED_RULES as yt, collectDeclaredOutputNames as z, AwsClients as zn, S3StateBackend as zt };
+//# sourceMappingURL=deploy-engine-HfFU96oJ.js.map