@go-to-k/cdkd 0.284.31 → 0.284.33

package/dist/{deploy-engine-DYdEWX-s.js → deploy-engine-mhGFd83I.js}

@@ -771,7 +771,7 @@ function formatDuration(ms) {
 * "the referenced thing does not exist" miss (issue
 * [#1740](https://github.com/go-to-k/cdkd/issues/1740)).
 *
-* The distinction exists for exactly one consumer: `Fn::Sub`'s variable
+* The distinction exists for one consumer of THIS class: `Fn::Sub`'s variable
 * resolution, which speculatively tries `Ref` and then `Fn::GetAtt` and keeps
 * the raw `${...}` placeholder when neither resolves. That warn-and-keep is the
 * long-standing, deliberate behavior for a genuinely unknown variable — but a
@@ -782,11 +782,15 @@ function formatDuration(ms) {
 *
 * Throwing this class rather than a bare `Error` is what lets that catch
 * re-raise a refusal (carrying its own message and remedy) while leaving the
-* not-found path on warn-and-keep. Nothing else branches on it.
+* not-found path on warn-and-keep. Nothing else branches on THIS class;
+* `cdkd scrub` branches on the {@link CrossAccountSecretRefusalError} SUBCLASS,
+* for the reason group 3 below gives.
 *
-* **Throw sites split into two groups, and the enumeration is worth keeping
+* **Throw sites split into three groups, and the enumeration is worth keeping
 * accurate** — an out-of-date one reads as "these are all of them", which is
-* how the #1730 site below went unlisted for three releases. All live in
+* how the #1730 site below went unlisted for three releases, and how the
+* cross-account `Fn::GetStackOutput` site in group 3 went unlisted from the
+* day it shipped. All live in
 * `src/deployment/intrinsic-function-resolver.ts`:
 *
 * 1. Reachable from `Fn::Sub`'s `${LogicalId.Attribute}` form, i.e. the ones
@@ -800,29 +804,77 @@ function formatDuration(ms) {
 *    inspects it: `resolveSplit`'s two refusals of a non-string value (#1874).
 *    `Fn::Sub` cannot syntactically contain an `Fn::Split`, so those change no
 *    behavior by being this class.
+* 3. PERMANENT — the one site where no user action and no re-run can make the
+*    read succeed: `resolveGetStackOutput`'s cross-account refusal to resolve a
+*    producer account's redacted dynamic reference with the consumer's
+*    credentials. It throws the SUBCLASS
+*    {@link CrossAccountSecretRefusalError} rather than this class, because
+*    every site in groups 1 and 2 is USER-FIXABLE (correct the stale
+*    placeholder ARN, deploy the producer so STS resolves, enrich the
+*    `Fn::GetAtt`, drop `--strict-getatt`, fix the malformed `Fn::Split`) and a
+*    consumer that treats "permanent" as a property of the CLASS silently
+*    downgrades all five. `cdkd scrub`'s cross-stack pre-pass is that consumer:
+*    it records a permanent refusal as a FINDING and scrubs the rest of the
+*    stack, but must REFUSE the stack for a fixable one, since a re-run after
+*    the fix would scrub it (issue
+*    [#2133](https://github.com/go-to-k/cdkd/issues/2133) review). Match on the
+*    subclass, never on this class.
 *
 * The class is deliberately NOT `markNonRetryable` at construction, unlike
 * {@link ResourceUpdateNotSupportedError}: EXACTLY ONE of its throw sites is
 * genuinely time-dependent — the fabricated-account guard, where
 * `getAccountInfo` caches a fabricated answer for only 10s precisely so a
 * later attempt can heal — so a constructor-level marker would wrongly make
-* that one terminal. Every OTHER site marks at its own `throw`: all five
+* that one terminal. Every OTHER site marks at its own `throw`: all six
 * decide from inputs a retry cannot change (a persisted state record, an
-* attribute-name suffix, a CLI flag, an already-resolved value's type), and
-* all five interpolate template-controlled text into their message, which the
+* attribute-name suffix, a CLI flag, an already-resolved value's type, a
+* template's literal `RoleArn`), and all six interpolate
+* template-controlled text into their message, which the
 * SUBSTRING-matching retry classifiers can read as transient (issue #1838 —
 * a logical id like `MyDependencyViolationHandler` is enough). So the split is
 * "which SITE can heal", not "which class"; do not read the unmarked class as
 * a statement that these refusals are retryable.
 */
 var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
-	constructor(message, cause) {
-		super(message, "INTRINSIC_RESOLUTION_REFUSAL", cause);
+	constructor(message, cause, code = "INTRINSIC_RESOLUTION_REFUSAL") {
+		super(message, code, cause);
 		this.name = "IntrinsicResolutionRefusalError";
 		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
 	}
 };
 /**
+* The ONE refusal in group 3 of {@link IntrinsicResolutionRefusalError}: a
+* cross-account `Fn::GetStackOutput` whose stored value is a redacted dynamic
+* reference (issue [#2133](https://github.com/go-to-k/cdkd/issues/2133)
+* review).
+*
+* A SUBCLASS rather than a flag, so the two properties stay independent:
+* `instanceof IntrinsicResolutionRefusalError` is still true, which is what
+* `resolveSub`'s catch re-raises on (making this refusal propagate out of an
+* `Fn::Sub` instead of being laundered into a literal `${...}`), while
+* consumers that need "no re-run can change this" match on THIS class and
+* therefore cannot capture the five user-fixable siblings.
+*
+* `code` is distinct for the same reason a message is not: a consumer keying
+* on `INTRINSIC_RESOLUTION_REFUSAL` would capture every sibling, and one
+* keying on message text breaks the moment the wording improves.
+*
+* `cdkd scrub` is the consumer today. Its cross-stack pre-pass records a
+* refusal of THIS class as an unverifiable FINDING — the rest of the stack is
+* still scrubbed, and the run exits non-zero — because refusing the whole
+* stack would strand every other secret in it forever. A sibling refusal
+* (a stale placeholder ARN, an unenriched `Fn::GetAtt`, a malformed
+* `Fn::Split`, all reachable through an `Fn::Sub`-built export name) must
+* REFUSE instead, since the user can fix the cause and re-run.
+*/
+var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_CROSS_ACCOUNT_SECRET");
+		this.name = "CrossAccountSecretRefusalError";
+		Object.setPrototypeOf(this, CrossAccountSecretRefusalError.prototype);
+	}
+};
+/**
 * Dependency resolution errors
 */
 var DependencyError = class DependencyError extends CdkdError {
@@ -10364,6 +10416,136 @@ function isRecordedSecretExpression(expression) {
 function clearRecordedSecretExpressions() {
 	recordedSecretExpressions$1.clear();
 }
+const crossStackAssociations = /* @__PURE__ */ new WeakMap();
+/** Poison for a key seen against two different (expression, plaintext) pairs. */
+const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
+/**
+* Separator for the composite keys {@link crossStackSourceKey} builds.
+*
+* A NUL rather than a printable character because no AWS export name, stack
+* name, output name, region or role ARN can contain one, so no two distinct
+* source leaves can spell a single key. A printable separator (`:` / `|`) does
+* occur inside a real export name — CDK's own convention is
+* `Stack:ExportName` — which would let one leaf's key be read as another's.
+*/
+const CROSS_STACK_KEY_SEPARATOR = "\0";
+/** A non-empty literal string, or `undefined` for anything else. */
+function literalStringOrUndefined(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/**
+* The canonical key identifying a cross-stack source leaf, or `undefined` when
+* this leaf's identity is not LITERALLY COMPUTABLE from the source alone
+* (issue #2059).
+*
+* Both sides of {@link crossStackAssociations} call THIS function, which
+* is what makes the two keys byte-identical by construction: the resolver hands
+* it the raw intrinsic it is about to resolve, the redaction path hands it the
+* template source leaf at the position being persisted, and both are the same
+* template object. Deriving the writer's key from the resolver's RESOLVED
+* `exportName` / `stackName` instead would look equivalent and is not — the
+* persist path has only the source leaf, so the two spellings would have to be
+* proven equal at every slot rather than being the same string.
+*
+* REFUSAL IS THE POINT of the literal test. An export name that is itself an
+* `Fn::Sub` / `Fn::Join` / `Ref` resolves to something the persist path cannot
+* compute — it holds the unresolved template — so there is no honest key for it
+* and this returns `undefined`. The caller then falls back to today's behavior
+* (the skeleton pass, then the value scan) rather than guessing.
+*
+* The resolver's existing `origin` string is deliberately NOT reused: it is a
+* human-readable log label built from RESOLVED values and carrying prose
+* (`(producer X / Y)`), so it is neither derivable from the source leaf nor
+* stable.
+*
+* `Region` and `RoleArn` are OPTIONAL slots, and an ABSENT one keys as empty
+* while a PRESENT-but-non-literal one refuses. Absent has to be its own key
+* rather than being filled in with the resolver's own region: the persist path
+* cannot see that region, so a key built from it could not be recomputed.
+*
+* THE KEY IS THEREFORE NOT REGION-QUALIFIED, and an `Fn::ImportValue` key never
+* is at all — so it does NOT identify one producer on its own. Two stacks in
+* two regions carrying the identical leaf produce the identical key inside one
+* `cdkd deploy --all`, because `deploy.ts` builds a resolver per stack region.
+* An earlier revision of this note claimed the opposite ("one resolver region
+* answers them all"), and that false premise is exactly what let the store's
+* first shape certify one region's expression onto another region's resource.
+* What makes the key safe is not uniqueness but SCOPE:
+* {@link crossStackAssociations} is keyed by the resolution pass's own secrets
+* bag, so a key another pass recorded cannot be reached from here at all. Each
+* entry additionally carries the plaintext it resolved to, which is what
+* refuses a MISALIGNED entry inside one pass.
+*
+* A MULTI-KEY leaf (`{'Fn::ImportValue': 'X', Extra: 1}`) is the one exception
+* to "both sides compute the same string": the resolver reaches this function
+* having already selected the intrinsic, so it hands over a single-key object
+* and gets a key, while the redaction path sees the leaf as authored and
+* refuses on the `keys.length !== 1` test above. That asymmetry is FAIL-SAFE in
+* the only direction it can go — the writer records an association no reader
+* will ever look up — and such a leaf is not valid CloudFormation anyway.
+*/
+function crossStackSourceKey(source) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	if (key === "Fn::ImportValue") {
+		const exportName = literalStringOrUndefined(source[key]);
+		if (exportName === void 0) return void 0;
+		return ["Fn::ImportValue", exportName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Fn::GetStackOutput") {
+		const args = source[key];
+		if (!isPlainObject$2(args)) return void 0;
+		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
+		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
+		if (stackName === void 0 || outputName === void 0) return void 0;
+		const slots = [
+			"Fn::GetStackOutput",
+			stackName,
+			outputName
+		];
+		for (const optional of ["Region", "RoleArn"]) {
+			const raw = Object.hasOwn(args, optional) ? args[optional] : void 0;
+			if (raw === void 0 || raw === null) {
+				slots.push("");
+				continue;
+			}
+			const literal = literalStringOrUndefined(raw);
+			if (literal === void 0) return void 0;
+			slots.push(literal);
+		}
+		return slots.join(CROSS_STACK_KEY_SEPARATOR);
+	}
+}
+/**
+* Remember, FOR THE PASS THAT OWNS `secrets`, that the cross-stack source leaf
+* keyed by `key` reads a producer value that IS the whole `{{resolve:...}}`
+* token `expression`, and that this pass saw it resolve to `plaintext`. Called
+* by the resolver, and only for a token it PROVED secret.
+*
+* `secrets` is the pass's own {@link RecordedSecretValues} bag, used as the
+* SCOPE KEY — the same object the redaction path will be handed. See
+* {@link crossStackAssociations} for why the scope, not the pairing, is what
+* makes this sound.
+*/
+function recordCrossStackExpression(secrets, key, expression, plaintext) {
+	if (!isSingleDynamicReferenceToken(expression)) return;
+	let associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) {
+		associations = /* @__PURE__ */ new Map();
+		crossStackAssociations.set(secrets, associations);
+	}
+	const seen = associations.get(key);
+	if (seen === void 0) {
+		associations.set(key, {
+			expression,
+			plaintext
+		});
+		return;
+	}
+	if (typeof seen === "symbol") return;
+	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
+}
 /**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
 * a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
@@ -10503,7 +10685,36 @@ function isDynamicReferenceString(value) {
 * leaks (both leaves are redacted, just onto one expression).
 */
 function isKnownSecretExpression(expression, secretExpressions) {
-	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression) || isRecordedSecretExpression(expression);
+	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
+}
+/**
+* The two arms of {@link isKnownSecretExpression} that need NO pass-local set:
+* `secretsmanager` by SPELLING, and anything this process PROVED secret.
+*
+* Split out so the resolver can ask the same question at the issue #2059
+* recording seam, where no `secretExpressions` set is in hand. It must not
+* acquire an argless default of its own — that is how a predicate silently
+* starts answering about a narrower population than its caller believes.
+*
+* The omitted arm costs the caller only REFUSALS. A cross-REGION `ssm`
+* `SecureString` is the one shape it can miss, because the producer-region
+* resolver is a GUEST and `pinSecretVerdict` deliberately writes nothing
+* process-wide from a guest (issue #1934's review) — so such a token is simply
+* not recorded at the seam, and its leaf falls back to the value scan.
+*
+* GUEST SUPPRESSION ALSO CUTS THE OTHER WAY, and saying only the above would be
+* one-sided. The same early return means a guest's DEFINITIVE PUBLIC verdict
+* never RETRACTS a memo either, so if the consumer's own resolver already
+* pinned that spelling as a `SecureString`, this answers `true` for a
+* producer-region parameter that is really a plain `String`. The outcome is
+* bounded to a spurious UPDATE (#1901's class) and can never be a plaintext:
+* the answer persisted is still an EXPRESSION, and the presence test beside
+* this one at the seam still requires the pass to have resolved it to a real
+* needle. Closing it means keying the verdict store by region, which is a
+* change to a store this function only reads.
+*/
+function isSecretExpressionByVerdictOrSpelling(expression) {
+	return expression.startsWith("{{resolve:secretsmanager:") || isRecordedSecretExpression(expression);
 }
 /**
 * The character class a `{{resolve:...}}` reference's INNER text is built from,
@@ -10776,6 +10987,121 @@ function intrinsicSkeletonPattern(source) {
 		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
 	}
 }
+/** Poison for an expression this pass recorded against two different plaintexts. */
+const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
+/**
+* Walk a {@link RecordedSecretValues} the OTHER way: every expression the pass
+* recorded, against the plaintext it actually resolved to.
+*
+* This is condition 3's index, built ONCE per positioning call rather than
+* re-scanned per candidate. A collapsed LOSER is absent from it, which is the
+* case both callers exist to serve.
+*
+* It is NOT an inversion, because `secrets` need not be injective — one
+* expression CAN appear under two plaintexts. Taking the last such plaintext
+* would WEAKEN condition 3 (the scan it replaced refused when ANY entry
+* disagreed with `bag`), so a conflicting expression is poisoned to a sentinel
+* no bag can equal, which refuses it exactly as the scan did.
+*
+* The branch is HARD to reach from the resolver — one resolver's
+* `cachedDynamicReferences` yields one plaintext per expression, so a single
+* pass cannot produce two — but it is no longer unreachable from there since
+* that cache became per-resolver (issue #1933): two resolvers in two regions
+* legitimately resolve one expression to two different plaintexts, and a caller
+* merging their maps lands exactly here. It is reachable through this module's
+* API regardless, and it is FENCED, by the "recorded against MORE THAN ONE
+* plaintext" case. An earlier draft of this comment claimed the divergence was
+* unobservable, reasoning that `plaintextOf[E] === bag` implies
+* `secrets.get(bag) === E` so accepting and falling back agree. That misses the
+* case where a SECOND candidate also matches: accepting `E` then makes it two
+* matches, which condition 2 refuses, and the answers differ. Asserting
+* something cannot be fenced suppresses the attempt, so it needs the same
+* evidence a fence does.
+*
+* `has` is the whole test: `RecordedSecretValues` is keyed by plaintext, so
+* iterating it never yields one plaintext twice and a second sighting of an
+* expression is always a DIFFERENT plaintext.
+*
+* SHARED by {@link positionByIntrinsicSkeleton} and
+* {@link positionByCrossStackSource} (issue #2059) rather than copied into the
+* second: the poisoning rule is the subtle half of condition 3, and two copies
+* are two places for it to be relaxed independently.
+*/
+function plaintextIndexOf(secrets) {
+	const plaintextOf = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
+	return plaintextOf;
+}
+/**
+* Position a leaf whose SOURCE is a CROSS-STACK intrinsic object
+* (`Fn::ImportValue` / `Fn::GetStackOutput`), by looking its identity up in the
+* association the RESOLVER recorded while it read the producer (issue
+* [#2059](https://github.com/go-to-k/cdkd/issues/2059)).
+*
+* This is the residual {@link positionByIntrinsicSkeleton} leaves behind, and
+* it needs a different mechanism rather than one more skeleton arm.
+* {@link intrinsicSkeletonPattern} is a TEXT matcher over the source leaf's
+* literals, and these two intrinsics carry no text about their expression at
+* all: `Fn::ImportValue`'s only literal is the export NAME, and
+* `Fn::GetStackOutput`'s are `StackName` / `OutputName` / `Region`, none of
+* which bears any relation to the producer's `{{resolve:...}}` string. A
+* pure-wildcard skeleton is not a fallback either — {@link SKELETON_WILDCARD}
+* is `[^}]*`, which cannot cross a token's own `}}` — so it would match zero
+* candidates and always refuse, i.e. degrade to the collapse. The association
+* has to come from the one place that holds both halves at once, which is
+* {@link crossStackAssociations}.
+*
+* Three conditions, mirroring the ones next door, and each removing a different
+* way of being wrong:
+*
+* 1. The bag leaf's WHOLE value is a recorded secret plaintext — verbatim
+*    condition 1 of {@link positionByIntrinsicSkeleton}. A leaf that merely
+*    EMBEDS a secret is not this shape and must keep going to the value scan,
+*    which rewrites just the substring. This is also what keeps a PUBLIC
+*    reference out (issue #1901): the resolver records a plaintext only on a
+*    proven-secret verdict, so a public parameter's value is not a key here.
+* 2. The association is ABOUT THIS BAG — the plaintext the WRITER recorded
+*    beside the expression equals the bag leaf. Against another pass this is
+*    belt-and-braces, since {@link crossStackAssociations} is scoped to the
+*    pass and a foreign entry cannot be reached; within one pass it is the only
+*    guard against a bag/source MISALIGNMENT.
+* 3. The match is not DEMONSTRABLY another value's expression — verbatim
+*    condition 3 next door, over the same {@link plaintextIndexOf} index. It is
+*    what fences a bag/source MISALIGNMENT: on a readback walk the bag leaf can
+*    hold a different resource's secret while the source leaf still spells this
+*    import, and an association recorded against a plaintext that is not this
+*    bag is refused outright. The collapsed LOSER is absent from that index, so
+*    it passes — which is the case this whole function exists to serve.
+*
+* There is deliberately NO "exactly one candidate" test (the neighbour's
+* condition 2): this is a LOOKUP rather than a search, so the ambiguity that
+* test exists to catch shows up here as a key recorded against two different
+* associations, which {@link recordCrossStackExpression} already poisons at
+* WRITE time.
+*
+* WHY THIS IS A POSITION CERTIFICATION AND NOT A WIDENING. The issue #1915
+* fences rejected an earlier attempt that took the SOURCE subtree whenever the
+* bag could not be vouched for, because it rewrote a `{Name: '', Value:
+* 'an-unrelated-literal'}` pair. Nothing here can do that: the answer is never
+* the source subtree, it is an expression a WRITER recorded against this exact
+* leaf identity; the arm fires for exactly two intrinsic spellings; and
+* condition 1 still demands that the bag leaf be a plaintext this pass
+* resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton} and
+* then to the value scan, i.e. to today's behavior.
+*/
+function positionByCrossStackSource(bag, source, secrets) {
+	if (bag === "" || !secrets.has(bag)) return void 0;
+	const key = crossStackSourceKey(source);
+	if (key === void 0) return void 0;
+	const associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) return void 0;
+	const association = associations.get(key);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association.plaintext !== bag) return void 0;
+	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) return void 0;
+	return association.expression;
+}
 /**
 * Position a leaf whose SOURCE is an intrinsic OBJECT, by matching the shape of
 * that intrinsic against the expressions this process recorded as secrets
@@ -10842,9 +11168,7 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	if (bag === "" || !secrets.has(bag)) return void 0;
 	const pattern = intrinsicSkeletonPattern(source);
 	if (!pattern) return void 0;
-	const CONFLICTING = Symbol("conflicting plaintext");
-	const plaintextOf = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING : plaintext);
+	const plaintextOf = plaintextIndexOf(secrets);
 	let matched;
 	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions$1])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
@@ -10972,18 +11296,26 @@ function identityKeyFor(bag, source) {
 * record — which already holds the expressions — redacts it with no secret
 * fetch and no value matching.
 *
-* A source leaf that is an intrinsic OBJECT (`Fn::Join` / `Fn::Sub`) has no
-* string to copy, so it goes through {@link positionByIntrinsicSkeleton} first
-* (issue #1916): when the intrinsic's literal parts describe exactly one of the
-* recorded secret expressions, THAT is persisted. This is the dominant CDK
-* shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
-*
-* The value scan is still applied wherever neither can answer: a leaf that
-* merely EMBEDS a secret inside surrounding text, an intrinsic whose skeleton
-* matches zero or several candidates, a diverged shape, a key the source lacks.
-* So the passes are complementary rather than alternatives — path where
-* position is knowable, skeleton where the position is an intrinsic, value
-* where neither is.
+* A source leaf that is an intrinsic OBJECT has no string to copy, so it goes
+* through two positioning passes before the value scan, in this order:
+*
+* - {@link positionByCrossStackSource} (issue #2059), for the two CROSS-STACK
+*   spellings `Fn::ImportValue` / `Fn::GetStackOutput`. Those carry no text
+*   about their expression at all, so the skeleton below structurally cannot
+*   describe them; instead the RESOLVER recorded, while reading the producer,
+*   which `{{resolve:...}}` token this exact leaf identity reads.
+* - {@link positionByIntrinsicSkeleton} (issue #1916), for `Fn::Join` /
+*   `Fn::Sub`: when the intrinsic's literal parts describe exactly one of the
+*   recorded secret expressions, THAT is persisted. This is the dominant CDK
+*   shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
+*
+* The value scan is still applied wherever none can answer: a leaf that merely
+* EMBEDS a secret inside surrounding text, an intrinsic whose skeleton matches
+* zero or several candidates, a cross-stack leaf whose identity is not
+* literally computable, a diverged shape, a key the source lacks. So the passes
+* are complementary rather than alternatives — path where position is knowable,
+* association where the position is a cross-stack read, skeleton where it is a
+* describable intrinsic, value where none is.
 */
 function redactByPath(bag, source, secrets, rules, secretExpressions) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
@@ -10994,6 +11326,8 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 		return redactSecretsForState(bag, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
+		const certified = positionByCrossStackSource(bag, source, secrets);
+		if (certified !== void 0) return certified;
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
 	}
@@ -13243,6 +13577,12 @@ function buildUnknownIntrinsicError(key) {
 * `Record<string, unknown>` and deliberately NOT coerced to string — a
 * list-valued `Fn::GetAtt` persists a JSON array — so a secret-bearing output
 * is not always a bare string.
+*
+* EXPORTED for `cdkd scrub` (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)), which asks the inverse
+* question of the same value: a cross-stack read that comes back carrying NO
+* dynamic reference is one scrub could not turn into a needle, because a needle
+* is only ever recorded by resolving a `{{resolve:...}}` expression.
 */
 function carriesDynamicReference(value) {
 	if (typeof value === "string") return value.includes("{{resolve:");
@@ -13371,6 +13711,14 @@ const FABRICATED_ACCOUNT_INFO_TTL_MS = 1e4;
 */
 const MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES = 4;
 /**
+* How many producer output KEYS an `Fn::GetStackOutput` not-found error may
+* enumerate (issue #2133 review). See {@link
+* IntrinsicFunctionResolver.describeAvailableOutputs} for why the list is
+* bounded at all; the value is "enough to fix a typo, few enough that one error
+* cannot dump a producer's whole key space".
+*/
+const MAX_LISTED_AVAILABLE_OUTPUTS = 10;
+/**
 * Test seam: overriding `sleep` lets unit tests drive the backoff schedule
 * without real waits (mirrors `describeTypeRetryDelays`).
 */
@@ -14975,7 +15323,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved1 = await this.resolveValue(value1, context);
 		const resolved2 = await this.resolveValue(value2, context);
 		const result = JSON.stringify(resolved1) === JSON.stringify(resolved2);
-		this.logger.debug(`Resolved Fn::Equals: ${JSON.stringify(resolved1)} === ${JSON.stringify(resolved2)} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Equals: ${this.maskSecretsForLog(JSON.stringify(resolved1), context)} === ${this.maskSecretsForLog(JSON.stringify(resolved2), context)} -> ${result}`);
 		return result;
 	}
 	/**
@@ -15116,7 +15464,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the producer's rather than the caller's — which is exactly what issue #2057
 	* says the other two copies get wrong.
 	*/
-	async reresolveCrossStackValue(value, producerRegion, context, origin) {
+	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey) {
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
 		const walk = async (v) => {
@@ -15133,8 +15481,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			return v;
 		};
-		this.logger.debug(`Re-resolving dynamic reference(s) in ${origin}`);
-		return await walk(value);
+		this.logger.debug(`Re-resolving dynamic reference(s) in ${this.maskSecretsForLog(origin, context)}`);
+		const reresolved = await walk(value);
+		if (sourceKey !== void 0 && typeof value === "string" && isSingleDynamicReferenceToken(value) && typeof reresolved === "string" && context.recordedSecretValues?.has(reresolved) === true && isSecretExpressionByVerdictOrSpelling(value)) recordCrossStackExpression(context.recordedSecretValues, sourceKey, value, reresolved);
+		return reresolved;
 	}
 	/**
 	* The resolver that must answer for a PRODUCER region — `this` when the
@@ -15217,26 +15567,28 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Searches all other stacks for an exported output with the given name.
 	*/
 	async resolveImportValue(importValueArg, context) {
+		const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
-		this.logger.debug(`Resolving Fn::ImportValue: ${exportName}`);
+		const loggedExportName = this.maskSecretsForLog(exportName, context);
+		this.logger.debug(`Resolving Fn::ImportValue: ${loggedExportName}`);
 		if (context.exportIndex) {
 			let entry;
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${exportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(entry.value)} (from index: ${entry.producerStack} / ${entry.producerRegion})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey);
 			}
 		}
 		const allStacks = await context.stateBackend.listStacks();
-		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${exportName}`);
+		this.logger.debug(`Found ${allStacks.length} state record(s) to search for export: ${loggedExportName}`);
 		let found;
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
@@ -15258,7 +15610,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const { state } = stateData;
 				if (state.outputs && exportName in state.outputs) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(value)} (from stack: ${refStack} / ${lookupRegion})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${refStack} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
@@ -15279,11 +15631,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`);
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey);
 		if (this.cfnFallback) {
-			const cfnExport = await this.lookupCfnExport(exportName);
+			const cfnExport = await this.lookupCfnExport(exportName, context);
 			if (cfnExport) {
-				this.logger.info(`Resolved Fn::ImportValue: ${exportName} = ${JSON.stringify(cfnExport.value)} (from CloudFormation exports${cfnExport.exportingStackId ? `; exporting stack: ${cfnExport.exportingStackId}` : ""}; weak reference — producer is not cdkd-managed)`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from CloudFormation exports${cfnExport.exportingStackId ? `; exporting stack: ${cfnExport.exportingStackId}` : ""}; weak reference — producer is not cdkd-managed)`);
 				return cfnExport.value;
 			}
 		}
@@ -15301,7 +15653,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* deliberate: without this fallback the deploy would have failed with
 	* the same not-found error anyway.
 	*/
-	async lookupCfnExport(exportName) {
+	async lookupCfnExport(exportName, context) {
 		let listing = this.cfnExportsPromise;
 		if (!listing) {
 			listing = this.fetchAllCfnExports();
@@ -15318,10 +15670,40 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${exportName}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
+	/**
+	* Render the `Available outputs: ...` tail of an `Fn::GetStackOutput`
+	* not-found error (issue #2133 review).
+	*
+	* These are the PRODUCER's `state.outputs` / CloudFormation output KEYS, and
+	* they land in a top-level ERROR — the one thing on this path that reaches a
+	* CI log at default verbosity. A key can itself hold plaintext: that is the
+	* `secretBearingStateKeyWarning` class (issue #1919), which `cdkd scrub`
+	* counts and deliberately never prints, so the enumeration must not be the
+	* one place that does.
+	*
+	* MASKED and CAPPED rather than dropped. Masking is the treatment every other
+	* identifier on this path already gets, and the cap bounds what one error can
+	* disclose (a producer with hundreds of outputs would otherwise dump all of
+	* them). Dropping the names entirely was considered and rejected: a typo'd
+	* `OutputName` is the overwhelmingly common cause, and the list is what makes
+	* the error actionable.
+	*
+	* Residual, stated rather than hidden: the needles belong to the CONSUMER's
+	* resolution, so a plaintext sitting in a PRODUCER key that this consumer
+	* never resolved is not maskable from here. The cap is what bounds that case;
+	* `cdkd scrub` reporting the producer's own `secretBearingKeys` is the remedy.
+	*/
+	describeAvailableOutputs(keys, context) {
+		if (keys.length === 0) return "(none)";
+		const shown = keys.slice(0, MAX_LISTED_AVAILABLE_OUTPUTS);
+		const rendered = shown.map((k) => this.maskSecretsForLog(k, context)).join(", ");
+		const hidden = keys.length - shown.length;
+		return hidden > 0 ? `${rendered} (+${hidden} more)` : rendered;
+	}
 	/** Full paginated ListExports walk backing {@link lookupCfnExport}'s memo. */
 	async fetchAllCfnExports() {
 		const client = this.getCfnClient(this.resolverRegion);
@@ -15344,7 +15726,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* logged for non-not-found failures). Same graceful-degradation
 	* contract as {@link lookupCfnExport}.
 	*/
-	async lookupCfnStackOutputs(stackName, region) {
+	async lookupCfnStackOutputs(stackName, region, context) {
 		const cacheKey = `${region}\0${stackName}`;
 		let fetch = this.cfnStackOutputsCache.get(cacheKey);
 		if (!fetch) {
@@ -15358,7 +15740,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${stackName}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -15454,6 +15836,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const args = arg;
 		if (!("StackName" in args)) throw new Error("Fn::GetStackOutput: StackName is required");
 		if (!("OutputName" in args)) throw new Error("Fn::GetStackOutput: OutputName is required");
+		const sourceKey = crossStackSourceKey({ "Fn::GetStackOutput": args });
 		const stackName = await this.resolveValue(args["StackName"], context);
 		if (typeof stackName !== "string" || stackName === "") throw new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`);
 		const outputName = await this.resolveValue(args["OutputName"], context);
@@ -15473,18 +15856,20 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			roleArn = raw;
 		}
 		if (!roleArn && context.stackName && context.stackName === stackName && region === this.resolverRegion) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		const loggedStackName = this.maskSecretsForLog(stackName, context);
+		const loggedOutputName = this.maskSecretsForLog(outputName, context);
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
-				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region);
+				const cfnOutputs = await this.lookupCfnStackOutputs(stackName, region, context);
 				if (cfnOutputs) {
 					if (!(outputName in cfnOutputs)) {
-						const available = Object.keys(cfnOutputs).join(", ") || "(none)";
+						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
 						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
-					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName} -> ${JSON.stringify(value)} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
@@ -15492,14 +15877,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!(outputName in outputs)) {
-			const available = Object.keys(outputs).join(", ") || "(none)";
+			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
 			throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in stack '${stackName}' (${region}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${stackName}, Region=${region}, OutputName=${outputName}${roleArn ? `, RoleArn=${roleArn}` : ""} -> ${JSON.stringify(value)}`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`);
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey);
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -16888,7 +17273,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DJvcY8lj.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CZc9Mtx2.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25801,7 +26186,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.31";
+	return "0.284.33";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28421,5 +28806,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, DependencyError as $n, createAssetRedirectResolver as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveUseCdkBootstrapAssets as An, maskSecretsInText as At, collectDeclaredOutputNames as B, canonicalizeRegion as Bn, INTRINSIC_KEYS as Bt, ccRoutedFinalSnapshotError as C, getLegacyStateBucketName as Cn, __exportAll as Cr, STATE_SOURCED_READBACK_RULES as Ct, unsupportedFinalSnapshotError as D, resolveSkipPrefix as Dn, errorCauseChain as Dt, refusesFinalSnapshot as E, resolveCaptureObservedState as En, dynamicReferenceTokens as Et, cyan as F, MIGRATE_TMP_PREFIX as Fn, s3BucketDualStackDomainName as Ft, stateKeySecretExposure as G, resolveBucketRegion as Gn, LockManager as Gt, exportAliasCollisionScrubWarning as H, AssemblyReader as Hn, withRetry as Ht, gray as I, findLargeInlineResources as In, s3BucketRegionalDomainName as It, clearOnUpdateRemoval as J, resetAwsClients as Jn, shouldRetainResource as Jt, IAMRoleProvider as K, AwsClients as Kn, S3StateBackend as Kt, green as L, uploadCfnTemplate as Ln, s3BucketWebsiteUrl as Lt, renderStatefulReason as M, warnDeprecatedNoPrefixCliFlag as Mn, scrubResourceRecord as Mt, formatResourceLine as N, CFN_TEMPLATE_BODY_LIMIT as Nn, s3BucketArn as Nt, makeCanonicalizePropertiesFn as O, resolveStateBucketWithDefault as On, isSingleDynamicReferenceToken as Ot, bold as P, CFN_TEMPLATE_URL_LIMIT as Pn, s3BucketDomainName as Pt, beginCommandInterruptScope as Q, ConfigError as Qn, buildAssetRedirectMap as Qt, red as R, expectedOwnerParam as Rn, applyRoleArnIfSet as Rt, buildFinalSnapshotIdentifier as S, getDefaultStateBucketName as Sn, markNonRetryable as Sr, STATE_SOURCED_CROSS_GENERATION_RULES as St, isFinalSnapshotError as T, resolveAutoAssetStorage as Tn, createSecretMasker as Tt, isExportAliasCollision as U, processStackMessages as Un, DagBuilder as Ut, collectPublishedOutputNames as V, derivePartitionAndUrlSuffix as Vn, describeTypeWithThrottleRetry as Vt, secretBearingStateKeyWarning as W, clearBucketRegionCache as Wn, TemplateParser as Wt, findActionableSilentDrops as X, AssetError as Xn, stringifyValue as Xt, ProviderRegistry as Y, setAwsClients as Yn, AssetPublisher as Yt, findSilentDropProperties as Z, CdkdError as Zn, WorkGraph as Zt, maskingRetryLogger as _, runDockerStreaming as _n, normalizeAwsError as _r, readConfigString as _t, DeploymentEventsStore as a, BOOTSTRAP_MARKER_PREFIX as an, MissingCdkCliError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, Synthesizer as bn, isRetryableTransientError as br, requireConfigObject as bt, planRollback as c, parseBootstrapMarker as cn, ProvisioningError as cr, getAccountInfo as ct, replayRollback as d, validateContainerRepoName as dn, StackHasActiveImportsError as dr, normalizeAwsTagsToCfn as dt, loadPublishableAssetManifest as en, DeployCancelledError as er, isInterruptedWaitError as et, updatePartialMessage as f, buildDenyExternalAccessPolicy as fn, StackTerminationProtectionError as fr, resolveExplicitPhysicalId as ft, withResourceDeadline as g, runDockerForeground as gn, isCdkdError as gr, configStringRefusal as gt, deleteSkipReason as h, getDockerCmd as hn, formatError as hr, configBooleanRefusal as ht, DeploymentEventsReader as i, AssetModeResolver as in, LockError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, stateBucketExistenceConfirmed as jn, redactSecretsForState as jt, extractDeploymentEventError as k, resolveStateBucketWithDefaultAndSource as kn, maskSecretsInError as kt, producerRegionsFromState as l, readBootstrapMarkerBody as ln, ResourceTimeoutError as lr, refStateLookupFromResource as lt, UNSPECIFIED_SKIP_REASON as m, formatDockerLoginError as mn, SynthesisError as mr, coerceCfnBoolean as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, escapeRegExp$1 as nn, LocalMigrateError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, ensureAssetStorage as on, NestedStackChildDirectDestroyError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDockerImage as pn, StateError as pr, assertRegionMatch as pt, collectInlinePolicyNamesManagedBySiblings as q, getAwsClients as qn, rebuildClientForBucketRegion as qt, DeployEngine as r, stripControlChars as rn, LocalStartServiceError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, getBootstrapMarkerKey as sn, PartialFailureError as sr, cfnRefValueFromPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, rewriteTemplateAssetReferences as tn, LocalInvokeBuildError as tr, startInterruptWatch as tt, replayFailedOperations as u, validateAssetBucketName as un, ResourceUpdateNotSupportedError as ur, WAFv2WebACLProvider as ut, IMPLICIT_DELETE_DEPENDENCIES as v, AssetManifestLoader as vn, withErrorHandling as vr, replayWarn as vt, createPreDeleteFinalSnapshot as w, resolveApp as wn, TEMPLATE_SOURCED_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, synthesisStatusMessage as xn, isThrottlingError as xr, requireConfigString as xt, computeImplicitDeleteEdges as y, getDockerImageBySourceHash as yn, isMarkedNonRetryable as yr, requireConfigArray as yt, yellow as z, PARTITION_TABLE as zn, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-DYdEWX-s.js.map
+export { endCommandInterruptScope as $, ConfigError as $n, buildAssetRedirectMap as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveStateBucketWithDefaultAndSource as An, maskSecretsInError as At, collectDeclaredOutputNames as B, PARTITION_TABLE as Bn, DiffCalculator as Bt, ccRoutedFinalSnapshotError as C, getDefaultStateBucketName as Cn, isThrottlingError as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Ct, unsupportedFinalSnapshotError as D, resolveCaptureObservedState as Dn, dynamicReferenceTokens as Dt, refusesFinalSnapshot as E, resolveAutoAssetStorage as En, createSecretMasker as Et, cyan as F, CFN_TEMPLATE_URL_LIMIT as Fn, s3BucketDomainName as Ft, stateKeySecretExposure as G, clearBucketRegionCache as Gn, TemplateParser as Gt, exportAliasCollisionScrubWarning as H, derivePartitionAndUrlSuffix as Hn, describeTypeWithThrottleRetry as Ht, gray as I, MIGRATE_TMP_PREFIX as In, s3BucketDualStackDomainName as It, clearOnUpdateRemoval as J, getAwsClients as Jn, rebuildClientForBucketRegion as Jt, IAMRoleProvider as K, resolveBucketRegion as Kn, LockManager as Kt, green as L, findLargeInlineResources as Ln, s3BucketRegionalDomainName as Lt, renderStatefulReason as M, stateBucketExistenceConfirmed as Mn, redactSecretsForState as Mt, formatResourceLine as N, warnDeprecatedNoPrefixCliFlag as Nn, scrubResourceRecord as Nt, makeCanonicalizePropertiesFn as O, resolveSkipPrefix as On, errorCauseChain as Ot, bold as P, CFN_TEMPLATE_BODY_LIMIT as Pn, s3BucketArn as Pt, beginCommandInterruptScope as Q, CdkdError as Qn, WorkGraph as Qt, red as R, uploadCfnTemplate as Rn, s3BucketWebsiteUrl as Rt, buildFinalSnapshotIdentifier as S, synthesisStatusMessage as Sn, isRetryableTransientError as Sr, requireConfigString as St, isFinalSnapshotError as T, resolveApp as Tn, __exportAll as Tr, TEMPLATE_SOURCED_RULES as Tt, isExportAliasCollision as U, AssemblyReader as Un, withRetry as Ut, collectPublishedOutputNames as V, canonicalizeRegion as Vn, INTRINSIC_KEYS as Vt, secretBearingStateKeyWarning as W, processStackMessages as Wn, DagBuilder as Wt, findActionableSilentDrops as X, setAwsClients as Xn, AssetPublisher as Xt, ProviderRegistry as Y, resetAwsClients as Yn, shouldRetainResource as Yt, findSilentDropProperties as Z, AssetError as Zn, stringifyValue as Zt, maskingRetryLogger as _, runDockerForeground as _n, formatError as _r, configStringRefusal as _t, DeploymentEventsStore as a, AssetModeResolver as an, LocalStartServiceError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, getDockerImageBySourceHash as bn, withErrorHandling as br, requireConfigArray as bt, planRollback as c, getBootstrapMarkerKey as cn, NestedStackChildDirectDestroyError as cr, cfnRefValueFromPhysicalId as ct, replayRollback as d, validateAssetBucketName as dn, ResourceTimeoutError as dr, WAFv2WebACLProvider as dt, createAssetRedirectResolver as en, CrossAccountSecretRefusalError as er, isInterruptedWaitError as et, updatePartialMessage as f, validateContainerRepoName as fn, ResourceUpdateNotSupportedError as fr, normalizeAwsTagsToCfn as ft, withResourceDeadline as g, getDockerCmd as gn, SynthesisError as gr, configBooleanRefusal as gt, deleteSkipReason as h, formatDockerLoginError as hn, StateError as hr, coerceCfnBoolean as ht, DeploymentEventsReader as i, stripControlChars as in, LocalMigrateError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, resolveUseCdkBootstrapAssets as jn, maskSecretsInText as jt, extractDeploymentEventError as k, resolveStateBucketWithDefault as kn, isSingleDynamicReferenceToken as kt, producerRegionsFromState as l, parseBootstrapMarker as ln, PartialFailureError as lr, getAccountInfo as lt, UNSPECIFIED_SKIP_REASON as m, buildDockerImage as mn, StackTerminationProtectionError as mr, assertRegionMatch as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, rewriteTemplateAssetReferences as nn, DeployCancelledError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, BOOTSTRAP_MARKER_PREFIX as on, LockError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDenyExternalAccessPolicy as pn, StackHasActiveImportsError as pr, resolveExplicitPhysicalId as pt, collectInlinePolicyNamesManagedBySiblings as q, AwsClients as qn, S3StateBackend as qt, DeployEngine as r, escapeRegExp$1 as rn, LocalInvokeBuildError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, ensureAssetStorage as sn, MissingCdkCliError as sr, carriesDynamicReference as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, loadPublishableAssetManifest as tn, DependencyError as tr, startInterruptWatch as tt, replayFailedOperations as u, readBootstrapMarkerBody as un, ProvisioningError as ur, refStateLookupFromResource as ut, IMPLICIT_DELETE_DEPENDENCIES as v, runDockerStreaming as vn, isCdkdError as vr, readConfigString as vt, createPreDeleteFinalSnapshot as w, getLegacyStateBucketName as wn, markNonRetryable as wr, STATE_SOURCED_READBACK_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, Synthesizer as xn, isMarkedNonRetryable as xr, requireConfigObject as xt, computeImplicitDeleteEdges as y, AssetManifestLoader as yn, normalizeAwsError as yr, replayWarn as yt, yellow as z, expectedOwnerParam as zn, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-mhGFd83I.js.map