@go-to-k/cdkd 0.284.30 → 0.284.32

package/dist/{deploy-engine-BFgi0RJr.js → deploy-engine-DsUQ4GxO.js}

@@ -771,7 +771,7 @@ function formatDuration(ms) {
 * "the referenced thing does not exist" miss (issue
 * [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
 *
-* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
+* The distinction exists for one consumer of THIS class: `Fn::Sub`'s variable
 * resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
 * the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
 * long-standing, deliberate behavior for a genuinely unknown variable — but a
@@ -782,11 +782,15 @@ function formatDuration(ms) {
 *
 * Throwing this class rather than a bare `Error` is what lets that catch
 * re-raise a refusal (carrying its own message and remedy) while leaving the
-* not-found path on warn-and-keep. Nothing else branches on it.
+* not-found path on warn-and-keep. Nothing else branches on THIS class;
+* `cdkd scrub` branches on the {@link CrossAccountSecretRefusalError} SUBCLASS,
+* for the reason group 3 below gives.
 *
-* **Throw sites split into two groups, and the enumeration is worth keeping
+* **Throw sites split into three groups, and the enumeration is worth keeping
 * accurate** — an out-of-date one reads as "these are all of them", which is
-* how the #1730 site below went unlisted for three releases. All live in
+* how the #1730 site below went unlisted for three releases, and how the
+* cross-account `Fn::GetStackOutput` site in group 3 went unlisted from the
+* day it shipped. All live in
 * `src/deployment/intrinsic-function-resolver.ts`:
 *
 * 1. Reachable from `Fn::Sub`'s `${LogicalId.Attribute}` form, i.e. the ones
@@ -800,29 +804,77 @@ function formatDuration(ms) {
 *    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874).
 *    `Fn::Sub` cannot syntactically contain an `Fn::Split`, so those change no
 *    behavior by being this class.
+* 3. PERMANENT — the one site where no user action and no re-run can make the
+*    read succeed: `resolveGetStackOutput`'s cross-account refusal to resolve a
+*    producer account's redacted dynamic reference with the consumer's
+*    credentials. It throws the SUBCLASS
+*    {@link CrossAccountSecretRefusalError} rather than this class, because
+*    every site in groups 1 and 2 is USER-FIXABLE (correct the stale
+*    placeholder ARN, deploy the producer so STS resolves, enrich the
+*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split`) and a
+*    consumer that treats "permanent" as a property of the CLASS silently
+*    downgrades all five. `cdkd scrub`'s cross-stack pre-pass is that consumer:
+*    it records a permanent refusal as a FINDING and scrubs the rest of the
+*    stack, but must REFUSE the stack for a fixable one, since a re-run after
+*    the fix would scrub it (issue
+*    [#2133](https://github.com/go-to-k/cdkd/issues/2133) review). Match on the
+*    subclass, never on this class.
 *
 * The class is deliberately NOT `markNonRetryable` at construction, unlike
 * {@link ResourceUpdateNotSupportedError}: EXACTLY ONE of its throw sites is
 * genuinely time-dependent — the fabricated-account guard, where
 * `getAccountInfo` caches a fabricated answer for only 10s precisely so a
 * later attempt can heal — so a constructor-level marker would wrongly make
-* that one terminal. Every OTHER site marks at its own `throw`: all five
+* that one terminal. Every OTHER site marks at its own `throw`: all six
 * decide from inputs a retry cannot change (a persisted state record, an
-* attribute-name suffix, a CLI flag, an already-resolved value's type), and
-* all five interpolate template-controlled text into their message, which the
+* attribute-name suffix, a CLI flag, an already-resolved value's type, a
+* template's literal `RoleArn`), and all six interpolate
+* template-controlled text into their message, which the
 * SUBSTRING-matching retry classifiers can read as transient (issue #1838 —
 * a logical id like `MyDependencyViolationHandler` is enough). So the split is
 * "which SITE can heal", not "which class"; do not read the unmarked class as
 * a statement that these refusals are retryable.
 */
 var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
+	constructor(message, cause, code = "INTRINSIC_RESOLUTION_REFUSAL") {
+		super(message, code, cause);
 		this.name = "IntrinsicResolutionRefusalError";
 		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
 	}
 };
 /**
+* The ONE refusal in group 3 of {@link IntrinsicResolutionRefusalError}: a
+* cross-account `Fn::GetStackOutput` whose stored value is a redacted dynamic
+* reference (issue [#2133](https://github.com/go-to-k/cdkd/issues/2133)
+* review).
+*
+* A SUBCLASS rather than a flag, so the two properties stay independent:
+* `instanceof IntrinsicResolutionRefusalError` is still true, which is what
+* `resolveSub`'s catch re-raises on (making this refusal propagate out of an
+* `Fn::Sub` instead of being laundered into a literal `${...}`), while
+* consumers that need "no re-run can change this" match on THIS class and
+* therefore cannot capture the five user-fixable siblings.
+*
+* `code` is distinct for the same reason a message is not: a consumer keying
+* on `INTRINSIC_RESOLUTION_REFUSAL` would capture every sibling, and one
+* keying on message text breaks the moment the wording improves.
+*
+* `cdkd scrub` is the consumer today. Its cross-stack pre-pass records a
+* refusal of THIS class as an unverifiable FINDING — the rest of the stack is
+* still scrubbed, and the run exits non-zero — because refusing the whole
+* stack would strand every other secret in it forever. A sibling refusal
+* (a stale placeholder ARN, an unenriched `Fn::GetAtt`, a malformed
+* `Fn::Split`, all reachable through an `Fn::Sub`-built export name) must
+* REFUSE instead, since the user can fix the cause and re-run.
+*/
+var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_CROSS_ACCOUNT_SECRET");
+		this.name = "CrossAccountSecretRefusalError";
+		Object.setPrototypeOf(this, CrossAccountSecretRefusalError.prototype);
+	}
+};
+/**
 * Dependency resolution errors
 */
 var DependencyError = class DependencyError extends CdkdError {
@@ -6798,6 +6850,11 @@ async function rebuildClientForBucketRegion(client, bucket, opts = {}) {
 * deep — split off into a constant so call sites can clearly distinguish
 * "two-segment legacy key" from "three-segment new key".
 */
+/**
+* `{stack}/state.json` — one segment plus the file, i.e. the v1 region-less
+* layout. Exported because `state-file-keys.ts` classifies the same layouts
+* from the other side and the two must not drift (issue #2001).
+*/
 const LEGACY_KEY_DEPTH = 2;
 /** The `version: 2` region-prefixed key. */
 const NEW_KEY_DEPTH = 3;
@@ -7164,7 +7221,7 @@ var S3StateBackend = class {
 						}
 						continue;
 					}
-					if (segments.length === LEGACY_KEY_DEPTH) {
+					if (segments.length === 2) {
 						const [stackName] = segments;
 						if (!stackName) continue;
 						const region = await this.readLegacyRegion(stackName);
@@ -13238,6 +13295,12 @@ function buildUnknownIntrinsicError(key) {
 * `Record<string, unknown>` and deliberately NOT coerced to string — a
 * list-valued `Fn::GetAtt` persists a JSON array — so a secret-bearing output
 * is not always a bare string.
+*
+* EXPORTED for `cdkd scrub` (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)), which asks the inverse
+* question of the same value: a cross-stack read that comes back carrying NO
+* dynamic reference is one scrub could not turn into a needle, because a needle
+* is only ever recorded by resolving a `{{resolve:...}}` expression.
 */
 function carriesDynamicReference(value) {
 	if (typeof value === "string") return value.includes("{{resolve:");
@@ -13366,6 +13429,14 @@ const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
 */
 const MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES = 4;
 /**
+* How many producer output KEYS an `Fn::GetStackOutput` not-found error may
+* enumerate (issue #2133 review). See {@link
+* IntrinsicFunctionResolver.describeAvailableOutputs} for why the list is
+* bounded at all; the value is "enough to fix a typo, few enough that one error
+* cannot dump a producer's whole key space".
+*/
+const MAX_LISTED_AVAILABLE_OUTPUTS = 10;
+/**
 * Test seam: overriding `sleep` lets unit tests drive the backoff schedule
 * without real waits (mirrors `describeTypeRetryDelays`).
 */
@@ -13398,9 +13469,13 @@ const dynamicReferenceRetryDelays = {};
 * a hostname that does not exist and the SDK fails loudly.
 *
 * Note the sibling pattern in `src/cli/commands/state-file-keys.ts` is NOT
-* reusable here: it requires `^[a-z]{2}(-[a-z]+)+-\d+$`, which rejects
-* `eusc-de-east-1` (the European Sovereign Cloud partition's four-letter
-* prefix).
+* reusable here, and the reason is structural rather than a gap in its
+* coverage: it is SHAPE-based because its job is the opposite one — telling a
+* region segment apart from a stack name sitting in the same key position —
+* so it must enumerate the shape this predicate refuses to. (Its prefix was
+* exactly `^[a-z]{2}` until issue #2001, which is what made it reject the
+* European Sovereign Cloud partition's four-letter `eusc-de-east-1`; it now
+* takes `{2,4}`, and is still the wrong tool here.)
 *
 * Callers must {@link canonicalizeRegion} first — `US-EAST-1` is a documented
 * input and is lowercase-canonical, not invalid.
@@ -14966,7 +15041,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved1 = await this.resolveValue(value1, context);
 		const resolved2 = await this.resolveValue(value2, context);
 		const result = JSON.stringify(resolved1) === JSON.stringify(resolved2);
-		this.logger.debug(`Resolved Fn::Equals: ${JSON.stringify(resolved1)} === ${JSON.stringify(resolved2)} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Equals: ${this.maskSecretsForLog(JSON.stringify(resolved1), context)} === ${this.maskSecretsForLog(JSON.stringify(resolved2), context)} -> ${result}`);
 		return result;
 	}
 	/**
@@ -15124,7 +15199,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			return v;
 		};
-		this.logger.debug(`Re-resolving dynamic reference(s) in ${origin}`);
+		this.logger.debug(`Re-resolving dynamic reference(s) in ${this.maskSecretsForLog(origin, context)}`);
 		return await walk(value);
 	}
 	/**
@@ -15211,23 +15286,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
-		this.logger.debug(`Resolving Fn::ImportValue: ${exportName}`);
+		const loggedExportName = this.maskSecretsForLog(exportName, context);
+		this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 		if (context.exportIndex) {
 			let entry;
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(entry.value)} (from index: ${entry.producerStack} / ${entry.producerRegion})`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
 				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`);
 			}
 		}
 		const allStacks = await context.stateBackend.listStacks();
-		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${exportName}`);
+		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${loggedExportName}`);
 		let found;
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
@@ -15249,7 +15325,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const { state } = stateData;
 				if (state.outputs && exportName in state.outputs) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(value)} (from stack: ${refStack} / ${lookupRegion})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${refStack} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
@@ -15272,9 +15348,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`);
 		if (this.cfnFallback) {
-			const cfnExport = await this.lookupCfnExport(exportName);
+			const cfnExport = await this.lookupCfnExport(exportName, context);
 			if (cfnExport) {
-				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(cfnExport.value)} (from CloudFormation exports${cfnExport.exportingStackId ? `; exporting stack: ${cfnExport.exportingStackId}` : ""}; weak reference — producer is not cdkd-managed)`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from CloudFormation exports${cfnExport.exportingStackId ? `; exporting stack: ${cfnExport.exportingStackId}` : ""}; weak reference — producer is not cdkd-managed)`);
 				return cfnExport.value;
 			}
 		}
@@ -15292,7 +15368,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* deliberate: without this fallback the deploy would have failed with
 	* the same not-found error anyway.
 	*/
-	async lookupCfnExport(exportName) {
+	async lookupCfnExport(exportName, context) {
 		let listing = this.cfnExportsPromise;
 		if (!listing) {
 			listing = this.fetchAllCfnExports();
@@ -15309,10 +15385,40 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${exportName}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
+	/**
+	* Render the `Available outputs: ...` tail of an `Fn::GetStackOutput`
+	* not-found error (issue #2133 review).
+	*
+	* These are the PRODUCER's `state.outputs` / CloudFormation output KEYS, and
+	* they land in a top-level ERROR — the one thing on this path that reaches a
+	* CI log at default verbosity. A key can itself hold plaintext: that is the
+	* `secretBearingStateKeyWarning` class (issue #1919), which `cdkd scrub`
+	* counts and deliberately never prints, so the enumeration must not be the
+	* one place that does.
+	*
+	* MASKED and CAPPED rather than dropped. Masking is the treatment every other
+	* identifier on this path already gets, and the cap bounds what one error can
+	* disclose (a producer with hundreds of outputs would otherwise dump all of
+	* them). Dropping the names entirely was considered and rejected: a typo'd
+	* `OutputName` is the overwhelmingly common cause, and the list is what makes
+	* the error actionable.
+	*
+	* Residual, stated rather than hidden: the needles belong to the CONSUMER's
+	* resolution, so a plaintext sitting in a PRODUCER key that this consumer
+	* never resolved is not maskable from here. The cap is what bounds that case;
+	* `cdkd scrub` reporting the producer's own `secretBearingKeys` is the remedy.
+	*/
+	describeAvailableOutputs(keys, context) {
+		if (keys.length === 0) return "(none)";
+		const shown = keys.slice(0, MAX_LISTED_AVAILABLE_OUTPUTS);
+		const rendered = shown.map((k) => this.maskSecretsForLog(k, context)).join(", ");
+		const hidden = keys.length - shown.length;
+		return hidden > 0 ? `${rendered} (+${hidden} more)` : rendered;
+	}
 	/** Full paginated ListExports walk backing {@link lookupCfnExport}'s memo. */
 	async fetchAllCfnExports() {
 		const client = this.getCfnClient(this.resolverRegion);
@@ -15335,7 +15441,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* logged for non-not-found failures). Same graceful-degradation
 	* contract as {@link lookupCfnExport}.
 	*/
-	async lookupCfnStackOutputs(stackName, region) {
+	async lookupCfnStackOutputs(stackName, region, context) {
 		const cacheKey = `${region}\0${stackName}`;
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
@@ -15349,7 +15455,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${stackName}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -15464,18 +15570,20 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			roleArn = raw;
 		}
 		if (!roleArn && context.stackName && context.stackName === stackName && region === this.resolverRegion) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		const loggedStackName = this.maskSecretsForLog(stackName, context);
+		const loggedOutputName = this.maskSecretsForLog(outputName, context);
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
-				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region);
+				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context);
 				if (cfnOutputs) {
 					if (!(outputName in cfnOutputs)) {
-						const available = Object.keys(cfnOutputs).join(", ") || "(none)";
+						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
 						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
-					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName} -> ${JSON.stringify(value)} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
@@ -15483,13 +15591,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!(outputName in outputs)) {
-			const available = Object.keys(outputs).join(", ") || "(none)";
+			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
 			throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in stack '${stackName}' (${region}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""} -> ${JSON.stringify(value)}`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`);
 	}
 	/**
@@ -16879,7 +16987,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-qMgJEhCM.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BVzQ7mQX.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25792,7 +25900,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.30";
+	return "0.284.32";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28412,5 +28520,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, DependencyError as $n, createAssetRedirectResolver as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveUseCdkBootstrapAssets as An, maskSecretsInText as At, collectDeclaredOutputNames as B, canonicalizeRegion as Bn, INTRINSIC_KEYS as Bt, ccRoutedFinalSnapshotError as C, getLegacyStateBucketName as Cn, __exportAll as Cr, STATE_SOURCED_READBACK_RULES as Ct, unsupportedFinalSnapshotError as D, resolveSkipPrefix as Dn, errorCauseChain as Dt, refusesFinalSnapshot as E, resolveCaptureObservedState as En, dynamicReferenceTokens as Et, cyan as F, MIGRATE_TMP_PREFIX as Fn, s3BucketDualStackDomainName as Ft, stateKeySecretExposure as G, resolveBucketRegion as Gn, LockManager as Gt, exportAliasCollisionScrubWarning as H, AssemblyReader as Hn, withRetry as Ht, gray as I, findLargeInlineResources as In, s3BucketRegionalDomainName as It, clearOnUpdateRemoval as J, resetAwsClients as Jn, shouldRetainResource as Jt, IAMRoleProvider as K, AwsClients as Kn, S3StateBackend as Kt, green as L, uploadCfnTemplate as Ln, s3BucketWebsiteUrl as Lt, renderStatefulReason as M, warnDeprecatedNoPrefixCliFlag as Mn, scrubResourceRecord as Mt, formatResourceLine as N, CFN_TEMPLATE_BODY_LIMIT as Nn, s3BucketArn as Nt, makeCanonicalizePropertiesFn as O, resolveStateBucketWithDefault as On, isSingleDynamicReferenceToken as Ot, bold as P, CFN_TEMPLATE_URL_LIMIT as Pn, s3BucketDomainName as Pt, beginCommandInterruptScope as Q, ConfigError as Qn, buildAssetRedirectMap as Qt, red as R, expectedOwnerParam as Rn, applyRoleArnIfSet as Rt, buildFinalSnapshotIdentifier as S, getDefaultStateBucketName as Sn, markNonRetryable as Sr, STATE_SOURCED_CROSS_GENERATION_RULES as St, isFinalSnapshotError as T, resolveAutoAssetStorage as Tn, createSecretMasker as Tt, isExportAliasCollision as U, processStackMessages as Un, DagBuilder as Ut, collectPublishedOutputNames as V, derivePartitionAndUrlSuffix as Vn, describeTypeWithThrottleRetry as Vt, secretBearingStateKeyWarning as W, clearBucketRegionCache as Wn, TemplateParser as Wt, findActionableSilentDrops as X, AssetError as Xn, stringifyValue as Xt, ProviderRegistry as Y, setAwsClients as Yn, AssetPublisher as Yt, findSilentDropProperties as Z, CdkdError as Zn, WorkGraph as Zt, maskingRetryLogger as _, runDockerStreaming as _n, normalizeAwsError as _r, readConfigString as _t, DeploymentEventsStore as a, BOOTSTRAP_MARKER_PREFIX as an, MissingCdkCliError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, Synthesizer as bn, isRetryableTransientError as br, requireConfigObject as bt, planRollback as c, parseBootstrapMarker as cn, ProvisioningError as cr, getAccountInfo as ct, replayRollback as d, validateContainerRepoName as dn, StackHasActiveImportsError as dr, normalizeAwsTagsToCfn as dt, loadPublishableAssetManifest as en, DeployCancelledError as er, isInterruptedWaitError as et, updatePartialMessage as f, buildDenyExternalAccessPolicy as fn, StackTerminationProtectionError as fr, resolveExplicitPhysicalId as ft, withResourceDeadline as g, runDockerForeground as gn, isCdkdError as gr, configStringRefusal as gt, deleteSkipReason as h, getDockerCmd as hn, formatError as hr, configBooleanRefusal as ht, DeploymentEventsReader as i, AssetModeResolver as in, LockError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, stateBucketExistenceConfirmed as jn, redactSecretsForState as jt, extractDeploymentEventError as k, resolveStateBucketWithDefaultAndSource as kn, maskSecretsInError as kt, producerRegionsFromState as l, readBootstrapMarkerBody as ln, ResourceTimeoutError as lr, refStateLookupFromResource as lt, UNSPECIFIED_SKIP_REASON as m, formatDockerLoginError as mn, SynthesisError as mr, coerceCfnBoolean as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, escapeRegExp$1 as nn, LocalMigrateError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, ensureAssetStorage as on, NestedStackChildDirectDestroyError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDockerImage as pn, StateError as pr, assertRegionMatch as pt, collectInlinePolicyNamesManagedBySiblings as q, getAwsClients as qn, rebuildClientForBucketRegion as qt, DeployEngine as r, stripControlChars as rn, LocalStartServiceError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, getBootstrapMarkerKey as sn, PartialFailureError as sr, cfnRefValueFromPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, rewriteTemplateAssetReferences as tn, LocalInvokeBuildError as tr, startInterruptWatch as tt, replayFailedOperations as u, validateAssetBucketName as un, ResourceUpdateNotSupportedError as ur, WAFv2WebACLProvider as ut, IMPLICIT_DELETE_DEPENDENCIES as v, AssetManifestLoader as vn, withErrorHandling as vr, replayWarn as vt, createPreDeleteFinalSnapshot as w, resolveApp as wn, TEMPLATE_SOURCED_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, synthesisStatusMessage as xn, isThrottlingError as xr, requireConfigString as xt, computeImplicitDeleteEdges as y, getDockerImageBySourceHash as yn, isMarkedNonRetryable as yr, requireConfigArray as yt, yellow as z, PARTITION_TABLE as zn, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-BFgi0RJr.js.map
+export { endCommandInterruptScope as $, ConfigError as $n, buildAssetRedirectMap as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveStateBucketWithDefaultAndSource as An, maskSecretsInError as At, collectDeclaredOutputNames as B, PARTITION_TABLE as Bn, DiffCalculator as Bt, ccRoutedFinalSnapshotError as C, getDefaultStateBucketName as Cn, isThrottlingError as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Ct, unsupportedFinalSnapshotError as D, resolveCaptureObservedState as Dn, dynamicReferenceTokens as Dt, refusesFinalSnapshot as E, resolveAutoAssetStorage as En, createSecretMasker as Et, cyan as F, CFN_TEMPLATE_URL_LIMIT as Fn, s3BucketDomainName as Ft, stateKeySecretExposure as G, clearBucketRegionCache as Gn, TemplateParser as Gt, exportAliasCollisionScrubWarning as H, derivePartitionAndUrlSuffix as Hn, describeTypeWithThrottleRetry as Ht, gray as I, MIGRATE_TMP_PREFIX as In, s3BucketDualStackDomainName as It, clearOnUpdateRemoval as J, getAwsClients as Jn, rebuildClientForBucketRegion as Jt, IAMRoleProvider as K, resolveBucketRegion as Kn, LockManager as Kt, green as L, findLargeInlineResources as Ln, s3BucketRegionalDomainName as Lt, renderStatefulReason as M, stateBucketExistenceConfirmed as Mn, redactSecretsForState as Mt, formatResourceLine as N, warnDeprecatedNoPrefixCliFlag as Nn, scrubResourceRecord as Nt, makeCanonicalizePropertiesFn as O, resolveSkipPrefix as On, errorCauseChain as Ot, bold as P, CFN_TEMPLATE_BODY_LIMIT as Pn, s3BucketArn as Pt, beginCommandInterruptScope as Q, CdkdError as Qn, WorkGraph as Qt, red as R, uploadCfnTemplate as Rn, s3BucketWebsiteUrl as Rt, buildFinalSnapshotIdentifier as S, synthesisStatusMessage as Sn, isRetryableTransientError as Sr, requireConfigString as St, isFinalSnapshotError as T, resolveApp as Tn, __exportAll as Tr, TEMPLATE_SOURCED_RULES as Tt, isExportAliasCollision as U, AssemblyReader as Un, withRetry as Ut, collectPublishedOutputNames as V, canonicalizeRegion as Vn, INTRINSIC_KEYS as Vt, secretBearingStateKeyWarning as W, processStackMessages as Wn, DagBuilder as Wt, findActionableSilentDrops as X, setAwsClients as Xn, AssetPublisher as Xt, ProviderRegistry as Y, resetAwsClients as Yn, shouldRetainResource as Yt, findSilentDropProperties as Z, AssetError as Zn, stringifyValue as Zt, maskingRetryLogger as _, runDockerForeground as _n, formatError as _r, configStringRefusal as _t, DeploymentEventsStore as a, AssetModeResolver as an, LocalStartServiceError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, getDockerImageBySourceHash as bn, withErrorHandling as br, requireConfigArray as bt, planRollback as c, getBootstrapMarkerKey as cn, NestedStackChildDirectDestroyError as cr, cfnRefValueFromPhysicalId as ct, replayRollback as d, validateAssetBucketName as dn, ResourceTimeoutError as dr, WAFv2WebACLProvider as dt, createAssetRedirectResolver as en, CrossAccountSecretRefusalError as er, isInterruptedWaitError as et, updatePartialMessage as f, validateContainerRepoName as fn, ResourceUpdateNotSupportedError as fr, normalizeAwsTagsToCfn as ft, withResourceDeadline as g, getDockerCmd as gn, SynthesisError as gr, configBooleanRefusal as gt, deleteSkipReason as h, formatDockerLoginError as hn, StateError as hr, coerceCfnBoolean as ht, DeploymentEventsReader as i, stripControlChars as in, LocalMigrateError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, resolveUseCdkBootstrapAssets as jn, maskSecretsInText as jt, extractDeploymentEventError as k, resolveStateBucketWithDefault as kn, isSingleDynamicReferenceToken as kt, producerRegionsFromState as l, parseBootstrapMarker as ln, PartialFailureError as lr, getAccountInfo as lt, UNSPECIFIED_SKIP_REASON as m, buildDockerImage as mn, StackTerminationProtectionError as mr, assertRegionMatch as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, rewriteTemplateAssetReferences as nn, DeployCancelledError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, BOOTSTRAP_MARKER_PREFIX as on, LockError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDenyExternalAccessPolicy as pn, StackHasActiveImportsError as pr, resolveExplicitPhysicalId as pt, collectInlinePolicyNamesManagedBySiblings as q, AwsClients as qn, S3StateBackend as qt, DeployEngine as r, escapeRegExp$1 as rn, LocalInvokeBuildError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, ensureAssetStorage as sn, MissingCdkCliError as sr, carriesDynamicReference as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, loadPublishableAssetManifest as tn, DependencyError as tr, startInterruptWatch as tt, replayFailedOperations as u, readBootstrapMarkerBody as un, ProvisioningError as ur, refStateLookupFromResource as ut, IMPLICIT_DELETE_DEPENDENCIES as v, runDockerStreaming as vn, isCdkdError as vr, readConfigString as vt, createPreDeleteFinalSnapshot as w, getLegacyStateBucketName as wn, markNonRetryable as wr, STATE_SOURCED_READBACK_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, Synthesizer as xn, isMarkedNonRetryable as xr, requireConfigObject as xt, computeImplicitDeleteEdges as y, AssetManifestLoader as yn, normalizeAwsError as yr, replayWarn as yt, yellow as z, expectedOwnerParam as zn, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-DsUQ4GxO.js.map