@go-to-k/cdkd 0.284.32 → 0.284.34

package/dist/{deploy-engine-DsUQ4GxO.js → deploy-engine-BxP9k1OS.js}

@@ -10416,6 +10416,136 @@ function isRecordedSecretExpression(expression) {
 function clearRecordedSecretExpressions() {
 	recordedSecretExpressions$1.clear();
 }
+const crossStackAssociations = /* @__PURE__ */ new WeakMap();
+/** Poison for a key seen against two different (expression, plaintext) pairs. */
+const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
+/**
+* Separator for the composite keys {@link crossStackSourceKey} builds.
+*
+* A NUL rather than a printable character because no AWS export name, stack
+* name, output name, region or role ARN can contain one, so no two distinct
+* source leaves can spell a single key. A printable separator (`:` / `|`) does
+* occur inside a real export name — CDK's own convention is
+* `Stack:ExportName` — which would let one leaf's key be read as another's.
+*/
+const CROSS_STACK_KEY_SEPARATOR = "\0";
+/** A non-empty literal string, or `undefined` for anything else. */
+function literalStringOrUndefined(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/**
+* The canonical key identifying a cross-stack source leaf, or `undefined` when
+* this leaf's identity is not LITERALLY COMPUTABLE from the source alone
+* (issue #2059).
+*
+* Both sides of {@link crossStackAssociations} call THIS function, which
+* is what makes the two keys byte-identical by construction: the resolver hands
+* it the raw intrinsic it is about to resolve, the redaction path hands it the
+* template source leaf at the position being persisted, and both are the same
+* template object. Deriving the writer's key from the resolver's RESOLVED
+* `exportName` / `stackName` instead would look equivalent and is not — the
+* persist path has only the source leaf, so the two spellings would have to be
+* proven equal at every slot rather than being the same string.
+*
+* REFUSAL IS THE POINT of the literal test. An export name that is itself an
+* `Fn::Sub` / `Fn::Join` / `Ref` resolves to something the persist path cannot
+* compute — it holds the unresolved template — so there is no honest key for it
+* and this returns `undefined`. The caller then falls back to today's behavior
+* (the skeleton pass, then the value scan) rather than guessing.
+*
+* The resolver's existing `origin` string is deliberately NOT reused: it is a
+* human-readable log label built from RESOLVED values and carrying prose
+* (`(producer X / Y)`), so it is neither derivable from the source leaf nor
+* stable.
+*
+* `Region` and `RoleArn` are OPTIONAL slots, and an ABSENT one keys as empty
+* while a PRESENT-but-non-literal one refuses. Absent has to be its own key
+* rather than being filled in with the resolver's own region: the persist path
+* cannot see that region, so a key built from it could not be recomputed.
+*
+* THE KEY IS THEREFORE NOT REGION-QUALIFIED, and an `Fn::ImportValue` key never
+* is at all — so it does NOT identify one producer on its own. Two stacks in
+* two regions carrying the identical leaf produce the identical key inside one
+* `cdkd deploy --all`, because `deploy.ts` builds a resolver per stack region.
+* An earlier revision of this note claimed the opposite ("one resolver region
+* answers them all"), and that false premise is exactly what let the store's
+* first shape certify one region's expression onto another region's resource.
+* What makes the key safe is not uniqueness but SCOPE:
+* {@link crossStackAssociations} is keyed by the resolution pass's own secrets
+* bag, so a key another pass recorded cannot be reached from here at all. Each
+* entry additionally carries the plaintext it resolved to, which is what
+* refuses a MISALIGNED entry inside one pass.
+*
+* A MULTI-KEY leaf (`{'Fn::ImportValue': 'X', Extra: 1}`) is the one exception
+* to "both sides compute the same string": the resolver reaches this function
+* having already selected the intrinsic, so it hands over a single-key object
+* and gets a key, while the redaction path sees the leaf as authored and
+* refuses on the `keys.length !== 1` test above. That asymmetry is FAIL-SAFE in
+* the only direction it can go — the writer records an association no reader
+* will ever look up — and such a leaf is not valid CloudFormation anyway.
+*/
+function crossStackSourceKey(source) {
+	const keys = Object.keys(source);
+	if (keys.length !== 1) return void 0;
+	const key = keys[0];
+	if (key === "Fn::ImportValue") {
+		const exportName = literalStringOrUndefined(source[key]);
+		if (exportName === void 0) return void 0;
+		return ["Fn::ImportValue", exportName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
+	if (key === "Fn::GetStackOutput") {
+		const args = source[key];
+		if (!isPlainObject$2(args)) return void 0;
+		const stackName = Object.hasOwn(args, "StackName") ? literalStringOrUndefined(args["StackName"]) : void 0;
+		const outputName = Object.hasOwn(args, "OutputName") ? literalStringOrUndefined(args["OutputName"]) : void 0;
+		if (stackName === void 0 || outputName === void 0) return void 0;
+		const slots = [
+			"Fn::GetStackOutput",
+			stackName,
+			outputName
+		];
+		for (const optional of ["Region", "RoleArn"]) {
+			const raw = Object.hasOwn(args, optional) ? args[optional] : void 0;
+			if (raw === void 0 || raw === null) {
+				slots.push("");
+				continue;
+			}
+			const literal = literalStringOrUndefined(raw);
+			if (literal === void 0) return void 0;
+			slots.push(literal);
+		}
+		return slots.join(CROSS_STACK_KEY_SEPARATOR);
+	}
+}
+/**
+* Remember, FOR THE PASS THAT OWNS `secrets`, that the cross-stack source leaf
+* keyed by `key` reads a producer value that IS the whole `{{resolve:...}}`
+* token `expression`, and that this pass saw it resolve to `plaintext`. Called
+* by the resolver, and only for a token it PROVED secret.
+*
+* `secrets` is the pass's own {@link RecordedSecretValues} bag, used as the
+* SCOPE KEY — the same object the redaction path will be handed. See
+* {@link crossStackAssociations} for why the scope, not the pairing, is what
+* makes this sound.
+*/
+function recordCrossStackExpression(secrets, key, expression, plaintext) {
+	if (!isSingleDynamicReferenceToken(expression)) return;
+	let associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) {
+		associations = /* @__PURE__ */ new Map();
+		crossStackAssociations.set(secrets, associations);
+	}
+	const seen = associations.get(key);
+	if (seen === void 0) {
+		associations.set(key, {
+			expression,
+			plaintext
+		});
+		return;
+	}
+	if (typeof seen === "symbol") return;
+	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
+}
 /**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
 * a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
@@ -10555,7 +10685,36 @@ function isDynamicReferenceString(value) {
 * leaks (both leaves are redacted, just onto one expression).
 */
 function isKnownSecretExpression(expression, secretExpressions) {
-	return expression.startsWith("{{resolve:secretsmanager:") || secretExpressions.has(expression) || isRecordedSecretExpression(expression);
+	return isSecretExpressionByVerdictOrSpelling(expression) || secretExpressions.has(expression);
+}
+/**
+* The two arms of {@link isKnownSecretExpression} that need NO pass-local set:
+* `secretsmanager` by SPELLING, and anything this process PROVED secret.
+*
+* Split out so the resolver can ask the same question at the issue #2059
+* recording seam, where no `secretExpressions` set is in hand. It must not
+* acquire an argless default of its own — that is how a predicate silently
+* starts answering about a narrower population than its caller believes.
+*
+* The omitted arm costs the caller only REFUSALS. A cross-REGION `ssm`
+* `SecureString` is the one shape it can miss, because the producer-region
+* resolver is a GUEST and `pinSecretVerdict` deliberately writes nothing
+* process-wide from a guest (issue #1934's review) — so such a token is simply
+* not recorded at the seam, and its leaf falls back to the value scan.
+*
+* GUEST SUPPRESSION ALSO CUTS THE OTHER WAY, and saying only the above would be
+* one-sided. The same early return means a guest's DEFINITIVE PUBLIC verdict
+* never RETRACTS a memo either, so if the consumer's own resolver already
+* pinned that spelling as a `SecureString`, this answers `true` for a
+* producer-region parameter that is really a plain `String`. The outcome is
+* bounded to a spurious UPDATE (#1901's class) and can never be a plaintext:
+* the answer persisted is still an EXPRESSION, and the presence test beside
+* this one at the seam still requires the pass to have resolved it to a real
+* needle. Closing it means keying the verdict store by region, which is a
+* change to a store this function only reads.
+*/
+function isSecretExpressionByVerdictOrSpelling(expression) {
+	return expression.startsWith("{{resolve:secretsmanager:") || isRecordedSecretExpression(expression);
 }
 /**
 * The character class a `{{resolve:...}}` reference's INNER text is built from,
@@ -10828,6 +10987,121 @@ function intrinsicSkeletonPattern(source) {
 		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
 	}
 }
+/** Poison for an expression this pass recorded against two different plaintexts. */
+const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
+/**
+* Walk a {@link RecordedSecretValues} the OTHER way: every expression the pass
+* recorded, against the plaintext it actually resolved to.
+*
+* This is condition 3's index, built ONCE per positioning call rather than
+* re-scanned per candidate. A collapsed LOSER is absent from it, which is the
+* case both callers exist to serve.
+*
+* It is NOT an inversion, because `secrets` need not be injective — one
+* expression CAN appear under two plaintexts. Taking the last such plaintext
+* would WEAKEN condition 3 (the scan it replaced refused when ANY entry
+* disagreed with `bag`), so a conflicting expression is poisoned to a sentinel
+* no bag can equal, which refuses it exactly as the scan did.
+*
+* The branch is HARD to reach from the resolver — one resolver's
+* `cachedDynamicReferences` yields one plaintext per expression, so a single
+* pass cannot produce two — but it is no longer unreachable from there since
+* that cache became per-resolver (issue #1933): two resolvers in two regions
+* legitimately resolve one expression to two different plaintexts, and a caller
+* merging their maps lands exactly here. It is reachable through this module's
+* API regardless, and it is FENCED, by the "recorded against MORE THAN ONE
+* plaintext" case. An earlier draft of this comment claimed the divergence was
+* unobservable, reasoning that `plaintextOf[E] === bag` implies
+* `secrets.get(bag) === E` so accepting and falling back agree. That misses the
+* case where a SECOND candidate also matches: accepting `E` then makes it two
+* matches, which condition 2 refuses, and the answers differ. Asserting
+* something cannot be fenced suppresses the attempt, so it needs the same
+* evidence a fence does.
+*
+* `has` is the whole test: `RecordedSecretValues` is keyed by plaintext, so
+* iterating it never yields one plaintext twice and a second sighting of an
+* expression is always a DIFFERENT plaintext.
+*
+* SHARED by {@link positionByIntrinsicSkeleton} and
+* {@link positionByCrossStackSource} (issue #2059) rather than copied into the
+* second: the poisoning rule is the subtle half of condition 3, and two copies
+* are two places for it to be relaxed independently.
+*/
+function plaintextIndexOf(secrets) {
+	const plaintextOf = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING_PLAINTEXT : plaintext);
+	return plaintextOf;
+}
+/**
+* Position a leaf whose SOURCE is a CROSS-STACK intrinsic object
+* (`Fn::ImportValue` / `Fn::GetStackOutput`), by looking its identity up in the
+* association the RESOLVER recorded while it read the producer (issue
+* [#2059](https://github.com/go-to-k/cdkd/issues/2059)).
+*
+* This is the residual {@link positionByIntrinsicSkeleton} leaves behind, and
+* it needs a different mechanism rather than one more skeleton arm.
+* {@link intrinsicSkeletonPattern} is a TEXT matcher over the source leaf's
+* literals, and these two intrinsics carry no text about their expression at
+* all: `Fn::ImportValue`'s only literal is the export NAME, and
+* `Fn::GetStackOutput`'s are `StackName` / `OutputName` / `Region`, none of
+* which bears any relation to the producer's `{{resolve:...}}` string. A
+* pure-wildcard skeleton is not a fallback either — {@link SKELETON_WILDCARD}
+* is `[^}]*`, which cannot cross a token's own `}}` — so it would match zero
+* candidates and always refuse, i.e. degrade to the collapse. The association
+* has to come from the one place that holds both halves at once, which is
+* {@link crossStackAssociations}.
+*
+* Three conditions, mirroring the ones next door, and each removing a different
+* way of being wrong:
+*
+* 1. The bag leaf's WHOLE value is a recorded secret plaintext — verbatim
+*    condition 1 of {@link positionByIntrinsicSkeleton}. A leaf that merely
+*    EMBEDS a secret is not this shape and must keep going to the value scan,
+*    which rewrites just the substring. This is also what keeps a PUBLIC
+*    reference out (issue #1901): the resolver records a plaintext only on a
+*    proven-secret verdict, so a public parameter's value is not a key here.
+* 2. The association is ABOUT THIS BAG — the plaintext the WRITER recorded
+*    beside the expression equals the bag leaf. Against another pass this is
+*    belt-and-braces, since {@link crossStackAssociations} is scoped to the
+*    pass and a foreign entry cannot be reached; within one pass it is the only
+*    guard against a bag/source MISALIGNMENT.
+* 3. The match is not DEMONSTRABLY another value's expression — verbatim
+*    condition 3 next door, over the same {@link plaintextIndexOf} index. It is
+*    what fences a bag/source MISALIGNMENT: on a readback walk the bag leaf can
+*    hold a different resource's secret while the source leaf still spells this
+*    import, and an association recorded against a plaintext that is not this
+*    bag is refused outright. The collapsed LOSER is absent from that index, so
+*    it passes — which is the case this whole function exists to serve.
+*
+* There is deliberately NO "exactly one candidate" test (the neighbour's
+* condition 2): this is a LOOKUP rather than a search, so the ambiguity that
+* test exists to catch shows up here as a key recorded against two different
+* associations, which {@link recordCrossStackExpression} already poisons at
+* WRITE time.
+*
+* WHY THIS IS A POSITION CERTIFICATION AND NOT A WIDENING. The issue #1915
+* fences rejected an earlier attempt that took the SOURCE subtree whenever the
+* bag could not be vouched for, because it rewrote a `{Name: '', Value:
+* 'an-unrelated-literal'}` pair. Nothing here can do that: the answer is never
+* the source subtree, it is an expression a WRITER recorded against this exact
+* leaf identity; the arm fires for exactly two intrinsic spellings; and
+* condition 1 still demands that the bag leaf be a plaintext this pass
+* resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton} and
+* then to the value scan, i.e. to today's behavior.
+*/
+function positionByCrossStackSource(bag, source, secrets) {
+	if (bag === "" || !secrets.has(bag)) return void 0;
+	const key = crossStackSourceKey(source);
+	if (key === void 0) return void 0;
+	const associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) return void 0;
+	const association = associations.get(key);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association.plaintext !== bag) return void 0;
+	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) return void 0;
+	return association.expression;
+}
 /**
 * Position a leaf whose SOURCE is an intrinsic OBJECT, by matching the shape of
 * that intrinsic against the expressions this process recorded as secrets
@@ -10894,9 +11168,7 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	if (bag === "" || !secrets.has(bag)) return void 0;
 	const pattern = intrinsicSkeletonPattern(source);
 	if (!pattern) return void 0;
-	const CONFLICTING = Symbol("conflicting plaintext");
-	const plaintextOf = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) plaintextOf.set(expression, plaintextOf.has(expression) ? CONFLICTING : plaintext);
+	const plaintextOf = plaintextIndexOf(secrets);
 	let matched;
 	for (const candidate of /* @__PURE__ */ new Set([...secretExpressions, ...recordedSecretExpressions$1])) {
 		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
@@ -11024,18 +11296,26 @@ function identityKeyFor(bag, source) {
 * record — which already holds the expressions — redacts it with no secret
 * fetch and no value matching.
 *
-* A source leaf that is an intrinsic OBJECT (`Fn::Join` / `Fn::Sub`) has no
-* string to copy, so it goes through {@link positionByIntrinsicSkeleton} first
-* (issue #1916): when the intrinsic's literal parts describe exactly one of the
-* recorded secret expressions, THAT is persisted. This is the dominant CDK
-* shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
-*
-* The value scan is still applied wherever neither can answer: a leaf that
-* merely EMBEDS a secret inside surrounding text, an intrinsic whose skeleton
-* matches zero or several candidates, a diverged shape, a key the source lacks.
-* So the passes are complementary rather than alternatives — path where
-* position is knowable, skeleton where the position is an intrinsic, value
-* where neither is.
+* A source leaf that is an intrinsic OBJECT has no string to copy, so it goes
+* through two positioning passes before the value scan, in this order:
+*
+* - {@link positionByCrossStackSource} (issue #2059), for the two CROSS-STACK
+*   spellings `Fn::ImportValue` / `Fn::GetStackOutput`. Those carry no text
+*   about their expression at all, so the skeleton below structurally cannot
+*   describe them; instead the RESOLVER recorded, while reading the producer,
+*   which `{{resolve:...}}` token this exact leaf identity reads.
+* - {@link positionByIntrinsicSkeleton} (issue #1916), for `Fn::Join` /
+*   `Fn::Sub`: when the intrinsic's literal parts describe exactly one of the
+*   recorded secret expressions, THAT is persisted. This is the dominant CDK
+*   shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
+*
+* The value scan is still applied wherever none can answer: a leaf that merely
+* EMBEDS a secret inside surrounding text, an intrinsic whose skeleton matches
+* zero or several candidates, a cross-stack leaf whose identity is not
+* literally computable, a diverged shape, a key the source lacks. So the passes
+* are complementary rather than alternatives — path where position is knowable,
+* association where the position is a cross-stack read, skeleton where it is a
+* describable intrinsic, value where none is.
 */
 function redactByPath(bag, source, secrets, rules, secretExpressions) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
@@ -11046,6 +11326,8 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 		return redactSecretsForState(bag, secrets);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
+		const certified = positionByCrossStackSource(bag, source, secrets);
+		if (certified !== void 0) return certified;
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
 	}
@@ -15182,7 +15464,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the producer's rather than the caller's — which is exactly what issue #2057
 	* says the other two copies get wrong.
 	*/
-	async reresolveCrossStackValue(value, producerRegion, context, origin) {
+	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey) {
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
 		const walk = async (v) => {
@@ -15200,7 +15482,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return v;
 		};
 		this.logger.debug(`Re-resolving dynamic reference(s) in ${this.maskSecretsForLog(origin, context)}`);
-		return await walk(value);
+		const reresolved = await walk(value);
+		if (sourceKey !== void 0 && typeof value === "string" && isSingleDynamicReferenceToken(value) && typeof reresolved === "string" && context.recordedSecretValues?.has(reresolved) === true && isSecretExpressionByVerdictOrSpelling(value)) recordCrossStackExpression(context.recordedSecretValues, sourceKey, value, reresolved);
+		return reresolved;
 	}
 	/**
 	* The resolver that must answer for a PRODUCER region — `this` when the
@@ -15283,6 +15567,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Searches all other stacks for an exported output with the given name.
 	*/
 	async resolveImportValue(importValueArg, context) {
+		const sourceKey = crossStackSourceKey({ "Fn::ImportValue": importValueArg });
 		const exportName = await this.resolveValue(importValueArg, context);
 		if (typeof exportName !== "string") throw new Error(`Fn::ImportValue: export name must resolve to a string, got ${typeof exportName}`);
 		if (!context.stateBackend) throw new Error("Fn::ImportValue: state backend is required for cross-stack references");
@@ -15299,7 +15584,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
 				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey);
 			}
 		}
 		const allStacks = await context.stateBackend.listStacks();
@@ -15346,7 +15631,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`);
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey);
 		if (this.cfnFallback) {
 			const cfnExport = await this.lookupCfnExport(exportName, context);
 			if (cfnExport) {
@@ -15551,6 +15836,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const args = arg;
 		if (!("StackName" in args)) throw new Error("Fn::GetStackOutput: StackName is required");
 		if (!("OutputName" in args)) throw new Error("Fn::GetStackOutput: OutputName is required");
+		const sourceKey = crossStackSourceKey({ "Fn::GetStackOutput": args });
 		const stackName = await this.resolveValue(args["StackName"], context);
 		if (typeof stackName !== "string" || stackName === "") throw new Error(`Fn::GetStackOutput: StackName must resolve to a non-empty string, got ${typeof stackName}`);
 		const outputName = await this.resolveValue(args["OutputName"], context);
@@ -15598,7 +15884,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
 		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`);
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey);
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -16987,7 +17273,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BVzQ7mQX.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DZ_xdKkZ.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25900,7 +26186,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.32";
+	return "0.284.34";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28521,4 +28807,4 @@ var DeployEngine = class {
 
 //#endregion
 export { endCommandInterruptScope as $, ConfigError as $n, buildAssetRedirectMap as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveStateBucketWithDefaultAndSource as An, maskSecretsInError as At, collectDeclaredOutputNames as B, PARTITION_TABLE as Bn, DiffCalculator as Bt, ccRoutedFinalSnapshotError as C, getDefaultStateBucketName as Cn, isThrottlingError as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Ct, unsupportedFinalSnapshotError as D, resolveCaptureObservedState as Dn, dynamicReferenceTokens as Dt, refusesFinalSnapshot as E, resolveAutoAssetStorage as En, createSecretMasker as Et, cyan as F, CFN_TEMPLATE_URL_LIMIT as Fn, s3BucketDomainName as Ft, stateKeySecretExposure as G, clearBucketRegionCache as Gn, TemplateParser as Gt, exportAliasCollisionScrubWarning as H, derivePartitionAndUrlSuffix as Hn, describeTypeWithThrottleRetry as Ht, gray as I, MIGRATE_TMP_PREFIX as In, s3BucketDualStackDomainName as It, clearOnUpdateRemoval as J, getAwsClients as Jn, rebuildClientForBucketRegion as Jt, IAMRoleProvider as K, resolveBucketRegion as Kn, LockManager as Kt, green as L, findLargeInlineResources as Ln, s3BucketRegionalDomainName as Lt, renderStatefulReason as M, stateBucketExistenceConfirmed as Mn, redactSecretsForState as Mt, formatResourceLine as N, warnDeprecatedNoPrefixCliFlag as Nn, scrubResourceRecord as Nt, makeCanonicalizePropertiesFn as O, resolveSkipPrefix as On, errorCauseChain as Ot, bold as P, CFN_TEMPLATE_BODY_LIMIT as Pn, s3BucketArn as Pt, beginCommandInterruptScope as Q, CdkdError as Qn, WorkGraph as Qt, red as R, uploadCfnTemplate as Rn, s3BucketWebsiteUrl as Rt, buildFinalSnapshotIdentifier as S, synthesisStatusMessage as Sn, isRetryableTransientError as Sr, requireConfigString as St, isFinalSnapshotError as T, resolveApp as Tn, __exportAll as Tr, TEMPLATE_SOURCED_RULES as Tt, isExportAliasCollision as U, AssemblyReader as Un, withRetry as Ut, collectPublishedOutputNames as V, canonicalizeRegion as Vn, INTRINSIC_KEYS as Vt, secretBearingStateKeyWarning as W, processStackMessages as Wn, DagBuilder as Wt, findActionableSilentDrops as X, setAwsClients as Xn, AssetPublisher as Xt, ProviderRegistry as Y, resetAwsClients as Yn, shouldRetainResource as Yt, findSilentDropProperties as Z, AssetError as Zn, stringifyValue as Zt, maskingRetryLogger as _, runDockerForeground as _n, formatError as _r, configStringRefusal as _t, DeploymentEventsStore as a, AssetModeResolver as an, LocalStartServiceError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, getDockerImageBySourceHash as bn, withErrorHandling as br, requireConfigArray as bt, planRollback as c, getBootstrapMarkerKey as cn, NestedStackChildDirectDestroyError as cr, cfnRefValueFromPhysicalId as ct, replayRollback as d, validateAssetBucketName as dn, ResourceTimeoutError as dr, WAFv2WebACLProvider as dt, createAssetRedirectResolver as en, CrossAccountSecretRefusalError as er, isInterruptedWaitError as et, updatePartialMessage as f, validateContainerRepoName as fn, ResourceUpdateNotSupportedError as fr, normalizeAwsTagsToCfn as ft, withResourceDeadline as g, getDockerCmd as gn, SynthesisError as gr, configBooleanRefusal as gt, deleteSkipReason as h, formatDockerLoginError as hn, StateError as hr, coerceCfnBoolean as ht, DeploymentEventsReader as i, stripControlChars as in, LocalMigrateError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, resolveUseCdkBootstrapAssets as jn, maskSecretsInText as jt, extractDeploymentEventError as k, resolveStateBucketWithDefault as kn, isSingleDynamicReferenceToken as kt, producerRegionsFromState as l, parseBootstrapMarker as ln, PartialFailureError as lr, getAccountInfo as lt, UNSPECIFIED_SKIP_REASON as m, buildDockerImage as mn, StackTerminationProtectionError as mr, assertRegionMatch as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, rewriteTemplateAssetReferences as nn, DeployCancelledError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, BOOTSTRAP_MARKER_PREFIX as on, LockError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDenyExternalAccessPolicy as pn, StackHasActiveImportsError as pr, resolveExplicitPhysicalId as pt, collectInlinePolicyNamesManagedBySiblings as q, AwsClients as qn, S3StateBackend as qt, DeployEngine as r, escapeRegExp$1 as rn, LocalInvokeBuildError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, ensureAssetStorage as sn, MissingCdkCliError as sr, carriesDynamicReference as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, loadPublishableAssetManifest as tn, DependencyError as tr, startInterruptWatch as tt, replayFailedOperations as u, readBootstrapMarkerBody as un, ProvisioningError as ur, refStateLookupFromResource as ut, IMPLICIT_DELETE_DEPENDENCIES as v, runDockerStreaming as vn, isCdkdError as vr, readConfigString as vt, createPreDeleteFinalSnapshot as w, getLegacyStateBucketName as wn, markNonRetryable as wr, STATE_SOURCED_READBACK_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, Synthesizer as xn, isMarkedNonRetryable as xr, requireConfigObject as xt, computeImplicitDeleteEdges as y, AssetManifestLoader as yn, normalizeAwsError as yr, replayWarn as yt, yellow as z, expectedOwnerParam as zn, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-DsUQ4GxO.js.map
+//# sourceMappingURL=deploy-engine-BxP9k1OS.js.map