@go-to-k/cdkd 0.284.62 → 0.284.64

package/dist/{deploy-engine-D8AIgkwy.js → deploy-engine-BtqjWvh5.js}

@@ -1,5 +1,6 @@
 import { a as getLiveRenderer, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, l as applyDefaultNameForFallback, n as getLogger, p as looksLikeCdkdGeneratedName, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-DoW7XkO0.js";
+import { t as getCdkdVersion } from "./version-BtSUTHs5.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
@@ -11709,6 +11710,10 @@ function literalStringOrUndefined(value) {
 * (`(producer X / Y)`), so it is neither derivable from the source leaf nor
 * stable.
 *
+* THREE arms answer: `Fn::ImportValue`, `Fn::GetStackOutput`, and the
+* `Fn::GetAtt` on a nested-stack OUTPUT that issue #2055's read site
+* re-resolves. Every other leaf refuses.
+*
 * `Region` and `RoleArn` are OPTIONAL slots, and an ABSENT one keys as empty
 * while a PRESENT-but-non-literal one refuses. Absent has to be its own key
 * rather than being filled in with the resolver's own region: the persist path
@@ -11767,6 +11772,26 @@ function crossStackSourceKey(source) {
 		}
 		return slots.join(CROSS_STACK_KEY_SEPARATOR);
 	}
+	if (key === "Fn::GetAtt") {
+		const raw = source[key];
+		let logicalId;
+		let attributeName;
+		if (typeof raw === "string") {
+			const parts = raw.split(".");
+			if (parts.length !== 2) return void 0;
+			logicalId = literalStringOrUndefined(parts[0]);
+			attributeName = literalStringOrUndefined(parts[1]);
+		} else if (Array.isArray(raw) && raw.length === 2) {
+			logicalId = literalStringOrUndefined(raw[0]);
+			attributeName = literalStringOrUndefined(raw[1]);
+		}
+		if (logicalId === void 0 || attributeName === void 0) return void 0;
+		return [
+			"Fn::GetAtt",
+			logicalId,
+			attributeName
+		].join(CROSS_STACK_KEY_SEPARATOR);
+	}
 }
 /**
 * Remember, FOR THE PASS THAT OWNS `secrets`, that the cross-stack source leaf
@@ -12335,7 +12360,7 @@ function plaintextIndexOf(secrets) {
 * bag could not be vouched for, because it rewrote a `{Name: '', Value:
 * 'an-unrelated-literal'}` pair. Nothing here can do that: the answer is never
 * the source subtree, it is an expression a WRITER recorded against this exact
-* leaf identity; the arm fires for exactly two intrinsic spellings; and
+* leaf identity; the arm fires for exactly three intrinsic spellings; and
 * condition 1 still demands that the bag leaf be a plaintext this pass
 * resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton} and
 * then to the value scan, i.e. to today's behavior.
@@ -14868,6 +14893,36 @@ function carriesDynamicReference(value) {
 	if (value !== null && typeof value === "object") return Object.values(value).some(carriesDynamicReference);
 	return false;
 }
+/** The nested-stack resource type, whose `Outputs.<Name>` attributes are re-resolved (issue #2055). */
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+/** Prefix `NestedStackProvider` records a child stack output under. */
+const NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX = "Outputs.";
+/**
+* `arn:cdkd-local:<childRegion>:<accountId>:nested-stack/<parent>/<logicalId>` —
+* the synthesized physicalId `NestedStackProvider.synthesizeArn` records on the
+* parent's `AWS::CloudFormation::Stack` row.
+*/
+const NESTED_STACK_LOCAL_ARN = /^arn:cdkd-local:([a-z0-9-]+):[^:]*:nested-stack\//i;
+/**
+* The CHILD stack's region, read off the parent row's synthesized physicalId
+* (issue [#2055](https://github.com/go-to-k/cdkd/issues/2055)).
+*
+* WHY THE ARN AND NOT A STATE READ. The child's own record carries `region`,
+* but its state KEY is `cdkd/<parent>~<logicalId>/<region>/state.json` — the
+* region is part of the key, so reading the record to learn the region is
+* circular. The synthesized physicalId is the SAME provider's durable record of
+* the region it deployed the child into, it sits on the resource row the
+* resolver already holds, and reading it costs no I/O on a path that is
+* otherwise hot.
+*
+* Returns `undefined` for anything that is not that shape (a hand-edited state
+* file, a record written before this provider existed), which the caller reads
+* as "use this resolver's own region".
+*/
+function nestedStackChildRegionFromLocalArn(physicalId) {
+	if (typeof physicalId !== "string") return void 0;
+	return NESTED_STACK_LOCAL_ARN.exec(physicalId)?.[1];
+}
 let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
@@ -15224,6 +15279,79 @@ function collectReferencedParameterNames(template) {
 	return referenced;
 }
 /**
+* Does coercing to `type` risk destroying the plaintext cdkd redacts against?
+*
+* DERIVED from {@link coerceParameterTypedValue}, never enumerated beside it.
+* The previous shape was a hand-kept set naming `Number` / `List<Number>`,
+* whose doc cleared `CommaDelimitedList` as safe because it "produces an array
+* of strings (both of which the recording scan and the redactor handle)". That
+* holds only for a comma-FREE secret -- and the dominant Secrets Manager shape
+* is a JSON blob, which is nothing but commas, so `,`-splitting shreds the
+* plaintext into fragments matching neither arm of
+* {@link inheritedSecretsCarriedBy}. An audited allow-list was wrong about one
+* of its own three entries, which is why this is now measured, not listed.
+*
+* Probe the REAL coercion with a canary carrying the separators the arms use --
+* a comma and surrounding whitespace -- and call the type risky when the canary
+* does not survive as one string. A `Type` added to the switch is covered the
+* day it is added, with nothing to keep in sync.
+*
+* The DEPLOY path does better: `refuseCoercedInheritedSecret` measures the loss
+* on the ACTUAL value, so a comma-free secret in a `CommaDelimitedList` still
+* works. This coarser predicate is for `cdkd diff`, which holds no secrets bag
+* and therefore cannot measure.
+*/
+const SECRET_IDENTITY_CANARY = "a, b";
+function parameterTypeMayLoseSecretIdentity(type) {
+	return coerceParameterTypedValue(SECRET_IDENTITY_CANARY, type) !== SECRET_IDENTITY_CANARY;
+}
+/**
+* ONE definition of parameter-type coercion, at module scope so
+* {@link parameterTypeMayLoseSecretIdentity} probes the same code the resolver
+* runs rather than a copy of it.
+*/
+function coerceParameterTypedValue(value, type) {
+	switch (type) {
+		case "Number": return Number(value);
+		case "List<Number>": return value.split(",").map((v) => Number(v.trim()));
+		case "CommaDelimitedList": return value.split(",").map((v) => v.trim());
+		default: return value;
+	}
+}
+/**
+* The inherited `plaintext -> expression` pairs that `value` CARRIES.
+*
+* ONE definition, shared by the RECORDING side
+* (`recordInheritedParameterSecrets`) and the REFUSAL side
+* (`refuseCoercedInheritedSecret`), because a refusal narrower than the
+* recording would let exactly the values it exists to catch through — and the
+* two drifting apart is how this class of bug reappears.
+*
+* TWO ARMS, mirroring the two `redactSecretsForState` performs, so the
+* recording side cannot be narrower than the redaction side:
+*
+* - WHOLE VALUE at any length — `{Ref: Param}` returning exactly the secret.
+* - SUBSTRING at or above {@link MIN_NEEDLE_LENGTH} — the parent built the
+*   parameter with an `Fn::Sub`, so the value is `postgres://u:<secret>@host`
+*   and only part of it is the secret. Short needles are excluded on this arm
+*   for the same reason the redactor excludes them: a 3-character secret
+*   matches half the alphabet's worth of ordinary identifiers.
+*
+* A `CommaDelimitedList` parameter arrives as an array, so the scan walks
+* string elements too.
+*/
+function inheritedSecretsCarriedBy(value, inherited) {
+	const candidates = [];
+	if (typeof value === "string") candidates.push(value);
+	else if (Array.isArray(value)) {
+		for (const element of value) if (typeof element === "string") candidates.push(element);
+	}
+	if (candidates.length === 0) return [];
+	const carried = [];
+	for (const [plaintext, expression] of inherited) if (candidates.some((candidate) => candidate === plaintext || plaintext.length >= 4 && candidate.includes(plaintext))) carried.push([plaintext, expression]);
+	return carried;
+}
+/**
 * Render a parameter VALUE for a debug log line, honoring the definition's
 * `NoEcho` flag (issue #1329). `NoEcho: true` is the template author's
 * explicit "this value is sensitive" declaration — CloudFormation masks such
@@ -15669,7 +15797,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* @param userParameters User-provided parameter values (e.g., from CLI)
 	* @returns Record of parameter names to resolved values
 	*/
-	async resolveParameters(template, userParameters) {
+	async resolveParameters(template, userParameters, options) {
+		const inheritedSecrets = options?.inheritedSecrets;
+		const maskInherited = (text) => inheritedSecrets && inheritedSecrets.size > 0 ? maskSecretsInText(text, inheritedSecrets) : text;
 		const parameters = {};
 		const templateParameters = template.Parameters;
 		if (!templateParameters || typeof templateParameters !== "object") return parameters;
@@ -15679,8 +15809,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (userParameters && name in userParameters) {
 				const userValue = userParameters[name];
 				if (userValue !== void 0) {
+					this.refuseCoercedInheritedSecret(name, paramDef, userValue, inheritedSecrets);
 					parameters[name] = this.coerceParameterValue(userValue, paramDef.Type);
-					this.logger.debug(`Parameter ${name}: using user-provided value ${stringifyParameterForLog(paramDef, userValue)}`);
+					this.logger.debug(`Parameter ${name}: using user-provided value ${maskInherited(stringifyParameterForLog(paramDef, userValue))}`);
 					continue;
 				}
 			}
@@ -15695,11 +15826,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					this.logger.debug(`Parameter ${name}: resolving SSM parameter path ${ssmPath}`);
 					const resolved = await this.resolveSSMParameter(ssmPath);
 					parameters[name] = resolved;
-					this.logger.debug(`Parameter ${name}: resolved SSM value ${stringifyParameterForLog(paramDef, resolved)}`);
+					this.logger.debug(`Parameter ${name}: resolved SSM value ${maskInherited(stringifyParameterForLog(paramDef, resolved))}`);
 					continue;
 				}
 				parameters[name] = paramDef.Default;
-				this.logger.debug(`Parameter ${name}: using default value ${stringifyParameterForLog(paramDef, paramDef.Default)}`);
+				this.logger.debug(`Parameter ${name}: using default value ${maskInherited(stringifyParameterForLog(paramDef, paramDef.Default))}`);
 				continue;
 			}
 			throw new Error(`Parameter ${name} is required but no value was provided and no default exists`);
@@ -15717,12 +15848,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Coerce parameter value to the correct type based on parameter definition
 	*/
 	coerceParameterValue(value, type) {
-		switch (type) {
-			case "Number": return Number(value);
-			case "List<Number>": return value.split(",").map((v) => Number(v.trim()));
-			case "CommaDelimitedList": return value.split(",").map((v) => v.trim());
-			default: return value;
-		}
+		return coerceParameterTypedValue(value, type);
 	}
 	/**
 	* Resolve all intrinsic functions in a value
@@ -15812,6 +15938,101 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return resolved;
 	}
 	/**
+	* Copy any {@link ResolverContext.inheritedSecrets} pair whose PLAINTEXT is
+	* present in a just-resolved parameter value into this context's
+	* `recordedSecretValues` (issues #1903 / #2087).
+	*
+	* WHY AT RESOLUTION TIME. This is the whole of the #2087 fix. The parent
+	* hands a nested child already-resolved plaintext, so the child's own
+	* resolution never sees a `{{resolve:` and cannot record the pair itself; the
+	* first cut pre-SEEDED every child resource's map with the parent's bag,
+	* which restored the redaction but destroyed the per-resource scoping
+	* `perResourceSecrets` exists for. `redactSecretsForState` substring-matches
+	* at or above {@link MIN_NEEDLE_LENGTH}, so a child resource that never
+	* referenced the parameter but happens to spell `my-production-bucket` while
+	* the secret is `production` had its state persisted as
+	* `my-{{resolve:...}}-bucket` — which `redactParametersForDiff` does NOT
+	* mirror on the desired side (it rewrites only the PARAMETERS), so every
+	* later deploy saw a change: a perpetual UPDATE, or a perpetual REPLACEMENT
+	* on a create-only property.
+	*
+	* Recording here binds the pair to exactly the resources whose resolution
+	* consumed the parameter — which are exactly the ones that can carry the
+	* plaintext into their persisted state — so the child gets the SAME scoping
+	* RULE the PARENT already has, where `perResourceSecrets` is keyed by logical
+	* id.
+	*
+	* That is PARITY with the parent, not a claim of exactness. Once a pair is in
+	* a resource's bag, `redactSecretsForState` substring-matches every leaf of
+	* THAT resource, so a resource which both `Ref`s the parameter and carries an
+	* unrelated literal spelling the plaintext has the literal rewritten too. The
+	* parent has precisely this residual for any resource that resolves a
+	* `{{resolve:...}}`; what #2087 removed was the much wider version, where
+	* every resource in the child got the bag whether it consumed the parameter
+	* or not.
+	*
+	* The TWO ARMS of the match live in {@link inheritedSecretsCarriedBy}, shared
+	* with the refusal below so the two can never drift apart.
+	*
+	* Covers every consumption shape, because `Fn::Sub` / `Fn::Join` /
+	* `Fn::Select` / `Fn::FindInMap` all re-enter `resolveValue` and reach the
+	* parameter through this same `Ref` branch.
+	*
+	* Substituting is deliberately NOT done here — the resolved value is what
+	* reaches AWS, and an `Fn::Equals` over a parameter must compare the real
+	* value or the condition flips.
+	*/
+	recordInheritedParameterSecrets(value, context) {
+		const inherited = context.inheritedSecrets;
+		const recorded = context.recordedSecretValues;
+		if (!inherited || inherited.size === 0 || !recorded) return;
+		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, expression);
+	}
+	/**
+	* Refuse a child parameter whose declared `Type` would COERCE an inherited
+	* secret out of cdkd's string-keyed secret model (issue #1903, review round
+	* 2).
+	*
+	* THE MODEL IS STRING-KEYED END TO END. `RecordedSecretValues` is keyed by
+	* plaintext STRING, {@link recordInheritedParameterSecrets} scans strings and
+	* string array elements, and `redactSecretsForState` rewrites string LEAVES.
+	* `coerceParameterValue` turns a `Number` / `List<Number>` parameter into a JS
+	* number before any of that runs, so the pair was never recorded, the leaf was
+	* never rewritten, and the child's `state.json` persisted the DECRYPTED value
+	* verbatim — the exact disclosure this issue closes for `String` parameters —
+	* with `cdkd diff --recursive` then reporting a change on every run.
+	*
+	* WHY A REFUSAL RATHER THAN RECORDING ON THE PRE-COERCION STRING. Recording
+	* the pair is not enough on its own: the persisted leaf is a NUMBER, so the
+	* redactor would additionally have to rewrite a number leaf into an
+	* expression STRING, matched by `String(n) === plaintext`. That comparison
+	* both UNDER-covers (`"007"` coerces to `7` and stringifies back to `"7"`, so
+	* a zero-padded secret silently stays plaintext) and OVER-covers (a numeric
+	* secret like `8080` whole-value-matches every unrelated port in the bag —
+	* issue #2087's class, on a path where `MIN_NEEDLE_LENGTH` does not apply).
+	* A remedy that can silently under-cover is the wrong one for a disclosure
+	* path, so this refuses and NAMES the parameter instead.
+	*
+	* The blast radius is nil for CDK-authored apps: CDK synthesizes every
+	* nested-stack cross-reference parameter as `Type: String`. A hand-authored
+	* template that really wants a numeric secret can declare the parameter
+	* `String` and keep the value a string, which is what CloudFormation's own
+	* `NoEcho` / dynamic-reference handling assumes anyway.
+	*
+	* SCOPED TO THE INHERITED BAG, which is non-empty only on a nested-stack
+	* child engine, and only for a value that actually carries a pair the parent
+	* PROVED secret. An ordinary `Type: Number` parameter is untouched.
+	*
+	* The message never quotes the value.
+	*/
+	refuseCoercedInheritedSecret(name, paramDef, userValue, inherited) {
+		if (!inherited || inherited.size === 0) return;
+		const carriedBefore = inheritedSecretsCarriedBy(userValue, inherited).length;
+		if (carriedBefore === 0) return;
+		if (inheritedSecretsCarriedBy(this.coerceParameterValue(userValue, paramDef.Type), inherited).length >= carriedBefore) return;
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Nested-stack parameter '${name}' is declared 'Type: ${paramDef.Type}', but the parent stack resolved a SECRET dynamic reference into it. cdkd keeps a resolved secret out of persisted state by rewriting STRING leaves back to their {{resolve:...}} expression; coercing this value to '${paramDef.Type}' destroys the plaintext cdkd would have matched on, so the DECRYPTED secret would be left in the child stack's state.json with nothing to redact it back to. Declare '${name}' as 'Type: String' in the nested stack's template (CDK does this by default for cross-stack references), or stop passing a secret reference into it.`, void 0, "NESTED_STACK_SECRET_PARAMETER_TYPE"));
+	}
+	/**
 	* Resolve Ref intrinsic function
 	*
 	* Ref can reference:
@@ -15829,7 +16050,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (context.parameters && logicalId in context.parameters) {
 			const value = context.parameters[logicalId];
 			const paramDef = context.template.Parameters?.[logicalId];
-			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${stringifyParameterForLog(paramDef, value)}`);
+			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, value), context)}`);
+			this.recordInheritedParameterSecrets(value, context);
 			return value;
 		}
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
@@ -15934,6 +16156,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return nameServers;
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return flatValue;
 			}
 			if (attributeName.includes(".")) {
@@ -17453,8 +17676,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* recorded no secrets.
 	*/
 	maskSecretsForLog(text, context) {
+		let masked = text;
+		const inherited = context?.inheritedSecrets;
+		if (inherited && inherited.size > 0) masked = maskSecretsInText(masked, inherited);
 		const secrets = context?.recordedSecretValues;
-		return secrets ? maskSecretsInText(text, secrets) : text;
+		if (secrets && secrets.size > 0) masked = maskSecretsInText(masked, secrets);
+		return masked;
 	}
 	async resolveDynamicReferences(value, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
@@ -18617,7 +18844,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BfX7AwFi.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DGJz_iFy.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24609,6 +24836,67 @@ function collectInlinePolicyNamesManagedBySiblings(targetPhysicalId, context, at
 	return result;
 }
 
+//#endregion
+//#region src/deployment/resource-secrets-scope.ts
+/**
+* The secrets THIS process substituted into the property bag of the resource
+* currently being provisioned, scoped to that provider call's async chain
+* (issue [#1903](https://github.com/go-to-k/cdkd/issues/1903)).
+*
+* WHY AN ASYNC-LOCAL STORE RATHER THAN A FIELD ON `CreateContext`. Exactly ONE
+* provider needs the pairs — `NestedStackProvider`, which must SEED them into
+* the child `DeployEngine` it builds (see
+* `DeployEngineOptions.inheritedSecrets`) — and a `RecordedSecretValues` is
+* keyed by PLAINTEXT. `.claude/rules/providers.md` already records the rule
+* this follows: the reason `SecretMaskingContext` carries a masking FUNCTION
+* and not the bag is that putting the bag on the shared context makes every one
+* of the ~130 registered providers a place a `[...secrets.keys()]` can leak
+* from. A function cannot substitute here — seeding needs the pairs, not the
+* ability to mask — so the bag is handed through a channel only this one
+* provider reads, instead of widening the type every provider sees.
+*
+* It is also the idiom this particular provider already lives in:
+* `NestedStackProvider` reads its whole world out of
+* `getCurrentNestedStackContext()`, another `AsyncLocalStorage`.
+*
+* WHY ITS OWN LEAF MODULE rather than living in `deploy-engine.ts`, where it
+* started. Both BINDERS need it — the deploy engine and
+* `rollback-executor.ts`, whose replay arms re-resolve the journal's
+* `{{resolve:...}}` back to plaintext and drive the very same providers (issue
+* [#2086](https://github.com/go-to-k/cdkd/issues/2086)) — and
+* `deploy-engine.ts` already imports `rollback-executor.ts`, so keeping the
+* store there would have made the two modules a cycle. A leaf that imports one
+* TYPE cannot participate in one.
+*
+* SCOPE. {@link withCurrentResourceSecrets} wraps the provider CREATE / UPDATE
+* call itself, so the store is bound per resource and per retry attempt, and
+* two resources provisioned concurrently under `--concurrency` cannot see each
+* other's bag. Absent (every caller that binds nothing — `cdkd drift --revert`,
+* the import path, tests) reads as `undefined`, which the provider treats as
+* "no secrets to inherit" — the pre-#1903 behaviour.
+*/
+const currentResourceSecretsStore = new AsyncLocalStorage();
+/**
+* Run `fn` with `secrets` visible to {@link getCurrentResourceSecrets}. Used by
+* the deploy engine and the rollback executor around a provider CREATE / UPDATE
+* call; see the store's own doc for why the bag travels this way rather than on
+* `CreateContext`.
+*/
+function withCurrentResourceSecrets(secrets, fn) {
+	return currentResourceSecretsStore.run(secrets, fn);
+}
+/**
+* The bag {@link withCurrentResourceSecrets} bound for the provider call
+* currently in flight, or `undefined` when no binder is on the stack.
+*
+* Read by `NestedStackProvider` alone. A provider reading this MUST NOT
+* enumerate or log its KEYS — they are secret plaintext; the only sanctioned
+* use is handing the map on as a redaction seed.
+*/
+function getCurrentResourceSecrets() {
+	return currentResourceSecretsStore.getStore();
+}
+
 //#endregion
 //#region src/deployment/outputs-export-alias.ts
 /**
@@ -24860,9 +25148,12 @@ function exportAliasCollisionWarning(outputKey, exportName) {
 * {@link collectDeclaredOutputNames}.
 */
 function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const exposure = secretsPresentIn(exportName, secrets);
-	const shown = stripControlChars(exposure ? maskEveryOccurrence(exportName, exposure) : exportName);
-	return `Output ${stripControlChars(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+	const mask = (name) => {
+		const exposure = secretsPresentIn(name, secrets);
+		return stripControlChars(exposure ? maskEveryOccurrence(name, exposure) : name);
+	};
+	const shown = mask(exportName);
+	return `Output ${mask(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
 //#endregion
@@ -26508,6 +26799,29 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 *    backoff schedule per op — ~47s on the generic grid, or ~64s if the op
 *    hits a name cooldown, which rides its own longer grid since issue #2116.
 *
+* A FOURTH thing since issue
+* [#2086](https://github.com/go-to-k/cdkd/issues/2086): the call is bound in
+* {@link withCurrentResourceSecrets}, the async-local channel
+* `NestedStackProvider` reads to seed a nested CHILD engine with the pairs the
+* parent already resolved (issue #1903). `resolveReplayProps` has just
+* re-resolved the journal's `{{resolve:...}}` expressions back to PLAINTEXT
+* into `secrets`, so the bag in hand here is exactly the one the deploy engine
+* would have bound — and without the binding a rollback that reverts a
+* nested-stack row calls `NestedStackProvider.update`, the child engine seeds
+* nothing, and the child's `state.json` is rewritten with the DECRYPTED secret.
+* A recovery path that restores the pre-fix behaviour re-opens the very
+* disclosure the fix closes, so "absent reads as undefined, the pre-#1903
+* baseline" is not an acceptable answer HERE, however it reads elsewhere.
+*
+* `NestedStackProvider` is reachable on this path by construction, not in
+* theory: it is one of the two `disableOuterRetry` providers named above that
+* also implement `update()`, and `cdkd deploy`'s in-process auto-rollback runs
+* inside a DEPLOY-mode `withNestedStackContext` (`deploy.ts` passes
+* `nestedTemplates` / `dagBuilder` / `diffCalculator`). Standalone `cdkd
+* rollback` is NOT affected — `rollback.ts` builds a destroy-mode context with
+* none of those three fields, so `requireDeployContext` throws loudly before
+* any child engine is built.
+*
 * Returns the provider's result so the caller can honour
 * `effectiveProperties` (issue #1644) — both revert arms used to write the
 * previous state record back verbatim, dropping a narrowing the provider had
@@ -26740,8 +27054,8 @@ function redactRollbackRecord(record, secrets, journaledProps) {
 	}, secrets);
 }
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
-	if (provider.disableOuterRetry) return await provider.update(...args);
-	return await withRetry(() => provider.update(...args), logicalId, {
+	if (provider.disableOuterRetry) return await withCurrentResourceSecrets(secrets, () => provider.update(...args));
+	return await withRetry(() => withCurrentResourceSecrets(secrets, () => provider.update(...args)), logicalId, {
 		logger: maskingRetryLogger(logger, secrets),
 		...isInterrupted && {
 			isInterrupted,
@@ -26819,6 +27133,16 @@ async function updateWithRollbackRetry(provider, args, logicalId, logger, isInte
 * now earns its place by ALSO covering the late name release that the inner
 * default classifier rejects. The two compound — measured at 640s of total
 * sleep on a cooldown, inside the 30-minute per-resource deadline.
+*
+* ## The secrets scope, on both call sites (issue #2086)
+*
+* Each caller's `create` thunk binds {@link withCurrentResourceSecrets} around
+* `createProvider.create(...)`, for the same reason
+* {@link updateWithRollbackRetry} does around `update(...)`: a
+* reverse-replacement replay of an `AWS::CloudFormation::Stack` row re-CREATES
+* the child, and an unbound store makes the child engine persist the parent's
+* plaintext. It sits INSIDE the thunk, so it is re-established on every
+* attempt of both loops rather than once around them.
 */
 async function createWithRollbackRetry(provider, create, logicalId, logger, isInterrupted, secrets, outer) {
 	if (provider.disableOuterRetry) return await create();
@@ -27039,7 +27363,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await createWithRollbackRetry(createProvider, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, logger, isInterrupted, secrets, {
+					createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
 						isRetryable: isNameCooldownError,
 						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
@@ -27057,7 +27381,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await createWithRollbackRetry(createProvider, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets)), op.logicalId, logger, isInterrupted, secrets, {
+						createResult = await createWithRollbackRetry(createProvider, () => withCurrentResourceSecrets(secrets, () => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, replayingStateCreateContext(secrets))), op.logicalId, logger, isInterrupted, secrets, {
 							isRetryable: isRecreateRetryableError,
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
@@ -28223,10 +28547,37 @@ var DeployEngine = class {
 			...this.exportIndexStore && { exportIndex: this.exportIndexStore },
 			recordedImports: this.recordedImports,
 			recordedOutputReads: this.recordedOutputReads,
+			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
 			recordedSecretValues: /* @__PURE__ */ new Map()
 		};
 	}
 	/**
+	* The parameter bag the DIFF resolver context binds, with any inherited
+	* secret plaintext rewritten back to its `{{resolve:...}}` expression (issue
+	* #1903).
+	*
+	* The provisioning pass must keep the REAL values — that is what actually
+	* reaches AWS — but the child's persisted state holds the expression, so the
+	* comparison side has to hold it too or every deploy of a secret-bearing
+	* nested stack reports a spurious UPDATE and re-issues an AWS call that
+	* changes nothing. This is the child-stack twin of the
+	* `skipDynamicReferences` flag the parent's own diff sets: same goal
+	* (expression-vs-expression), reached differently because the child's
+	* template carries `{Ref: Param}` rather than a `{{resolve:` string, so
+	* there is no reference for that flag to decline to resolve.
+	*
+	* `redactSecretsForState` rather than a `Map.get` lookup so an EMBEDDED
+	* secret — a parameter whose value is `postgres://u:<secret>@host` because
+	* the parent built it with `Fn::Sub` — is rewritten the same way the
+	* state-save choke point rewrites it, keeping the two sides byte-identical.
+	* Identity-returns when nothing was inherited.
+	*/
+	redactParametersForDiff(parameterValues) {
+		const inherited = this.options.inheritedSecrets;
+		if (!inherited || inherited.size === 0) return parameterValues;
+		return redactSecretsForState(parameterValues, inherited);
+	}
+	/**
 	* Redact resolved secret plaintext out of a bag about to be PERSISTED to
 	* state, replacing each secret value with the unresolved `{{resolve:...}}`
 	* expression it came from (GHSA fix; see `secret-redaction.ts`). No-op when
@@ -28546,7 +28897,7 @@ var DeployEngine = class {
 			} catch {}
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
-			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters);
+			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets } });
 			this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 			const context = this.buildResolverContext({
 				template,
@@ -28573,7 +28924,7 @@ var DeployEngine = class {
 			const diffResolverContext = this.buildResolverContext({
 				template: effectiveTemplate,
 				resources: currentState.resources,
-				parameters: parameterValues,
+				parameters: this.redactParametersForDiff(parameterValues),
 				conditions
 			}, stackName);
 			diffResolverContext.bestEffort = true;
@@ -29304,7 +29655,7 @@ var DeployEngine = class {
 		this.logger.info(`  ${green("✓")} Old resource deleted`);
 		this.logger.info(`  Re-creating ${logicalId}...`);
 		try {
-			return await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, createContext), logicalId, void 0, void 0, replaceProvider), logicalId, {
+			return await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider), logicalId, {
 				maxRetries: 8,
 				initialDelayMs: 2e3,
 				maxDelayMs: 1e4,
@@ -29348,7 +29699,7 @@ var DeployEngine = class {
 				});
 				const createProvider = createDecision.provider;
 				const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-				const result = await this.withRetry(() => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) }), logicalId, void 0, void 0, createProvider);
+				const result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const templateAttrs = this.extractTemplateAttributes(template, logicalId);
 				stateResources[logicalId] = {
@@ -29459,7 +29810,7 @@ var DeployEngine = class {
 							this.logger.info(`  ${green("✓")} Old resource deleted`);
 						}
 						this.logger.info(`  Creating new ${logicalId}...`);
-						createResult = await withRetry(() => this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replaceProvider), logicalId, {
+						createResult = await withRetry(() => this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider), logicalId, {
 							maxRetries: 8,
 							initialDelayMs: 2e3,
 							maxDelayMs: 1e4,
@@ -29473,7 +29824,7 @@ var DeployEngine = class {
 						this.logger.info(`  Creating new ${logicalId}...`);
 						let deletedOldFirst = false;
 						try {
-							createResult = await this.withRetry(() => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replaceProvider);
+							createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
 						} catch (createError) {
 							const createMsg = createError instanceof Error ? createError.message : String(createError);
 							if (!isNameCollisionError(createMsg)) throw createError;
@@ -29550,7 +29901,7 @@ var DeployEngine = class {
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
 					try {
-						result = await this.withRetry(() => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, updateProvider);
+						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, updateProvider);
 					} catch (updateError) {
 						const msg = updateError instanceof Error ? updateError.message : String(updateError);
 						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
@@ -29582,7 +29933,7 @@ var DeployEngine = class {
 							});
 							const replProvider = replDecision.provider;
 							const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-							const createResult = await this.withRetry(() => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) }), logicalId, void 0, void 0, replProvider);
+							const createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							const replacementResult = {
 								physicalId: createResult.physicalId,
 								wasReplaced: true,
@@ -30051,5 +30402,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, derivePartitionAndUrlSuffix as $n, exportNamesCarriedFrom as $t, renderStatefulReason as A, AssetManifestLoader as An, isCdkdError as Ar, isSingleDynamicReferenceToken as At, exportAliasCollisionScrubWarning as B, resolveStateBucketWithDefault as Bn, s3BucketRegionalDomainName as Bt, isFinalSnapshotError as C, buildDockerImage as Cn, ResourceTimeoutError as Cr, requireConfigString as Ct, extractDeploymentEventError as D, partitionSensitiveEnv as Dn, StateError as Dr, createSecretMasker as Dt, makeCanonicalizePropertiesFn as E, getDockerCmd as En, StackTerminationProtectionError as Er, TEMPLATE_SOURCED_RULES as Et, green as F, getLegacyStateBucketName as Fn, isThrottlingError as Fr, classifyReplaySecretRegion as Ft, collectInlinePolicyNamesManagedBySiblings as G, CFN_TEMPLATE_BODY_LIMIT as Gn, describeTypeWithThrottleRetry as Gt, secretBearingStateKeyWarning as H, resolveUseCdkBootstrapAssets as Hn, applyRoleArnIfSet as Ht, red as I, resolveApp as In, markNonRetryable as Ir, producerRegionsFromState as It, findActionableSilentDrops as J, findLargeInlineResources as Jn, TemplateParser as Jt, clearOnUpdateRemoval as K, CFN_TEMPLATE_URL_LIMIT as Kn, withRetry as Kt, yellow as L, resolveAutoAssetStorage as Ln, __exportAll as Lr, s3BucketArn as Lt, bold as M, Synthesizer as Mn, withErrorHandling as Mr, maskSecretsInText as Mt, cyan as N, synthesisStatusMessage as Nn, isMarkedNonRetryable as Nr, redactSecretsForState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, runDockerForeground as On, SynthesisError as Or, dynamicReferenceTokens as Ot, gray as P, getDefaultStateBucketName as Pn, isRetryableTransientError as Pr, scrubResourceRecord as Pt, beginCommandInterruptScope as Q, canonicalizeRegion as Qn, rebuildClientForBucketRegion as Qt, collectDeclaredOutputNames as R, resolveCaptureObservedState as Rn, s3BucketDomainName as Rt, createPreDeleteFinalSnapshot as S, buildDenyExternalAccessPolicy as Sn, ProvisioningError as Sr, requireConfigObject as St, unsupportedFinalSnapshotError as T, formatDockerLoginError as Tn, StackHasActiveImportsError as Tr, STATE_SOURCED_READBACK_RULES as Tt, stateKeySecretExposure as U, stateBucketExistenceConfirmed as Un, DiffCalculator as Ut, isExportAliasCollision as V, resolveStateBucketWithDefaultAndSource as Vn, s3BucketWebsiteUrl as Vt, IAMRoleProvider as W, warnDeprecatedNoPrefixCliFlag as Wn, INTRINSIC_KEYS as Wt, CUSTOM_RESOURCE_RESPONSE_PREFIX as X, expectedOwnerParam as Xn, displaySafe as Xt, findSilentDropProperties as Y, uploadCfnTemplate as Yn, LockManager as Yt, DEFAULT_STATE_PREFIX as Z, PARTITION_TABLE as Zn, S3StateBackend as Zt, computeImplicitDeleteEdges as _, isCrossRegionRedirect as _n, LocalStartServiceError as _r, configBooleanRefusal as _t, DeploymentEventsStore as a, WorkGraph as an, getAwsClients as ar, disableInstanceApiTermination as at, buildFinalSnapshotIdentifier as b, validateAssetBucketName as bn, NestedStackChildDirectDestroyError as br, replayWarn as bt, replayFailedOperations as c, loadPublishableAssetManifest as cn, AssetError as cr, carriesDynamicReference as ct, updatePartialReason as d, stripControlChars as dn, CrossAccountSecretRefusalError as dr, refStateLookupFromResource as dt, importableOutputKeys as en, AssemblyReader as er, interruptWatchListenerCount as et, UNSPECIFIED_SKIP_REASON as f, AssetModeResolver as fn, DependencyError as fr, WAFv2WebACLProvider as ft, IMPLICIT_DELETE_DEPENDENCIES as g, getBootstrapMarkerKey as gn, LocalMigrateError as gr, coerceCfnBoolean as gt, maskingRetryLogger as h, ensureAssetStorage as hn, LocalInvokeBuildError as hr, assertRegionMatch as ht, DeploymentEventsReader as i, stringifyValue as in, AwsClients as ir, slowCcOperationTimeoutMs as it, formatResourceLine as j, getDockerImageBySourceHash as jn, normalizeAwsError as jr, maskSecretsInError as jt, isStatefulRecreateTargetSync as k, runDockerStreaming as kn, formatError as kr, errorCauseChain as kt, replayRollback as l, rewriteTemplateAssetReferences as ln, CdkdError as lr, cfnRefValueFromPhysicalId as lt, withResourceDeadline as m, assertAssetBucketRegion as mn, DynamicReferenceRegionAmbiguousError as mr, resolveExplicitPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, shouldRetainResource as nn, clearBucketRegionCache as nr, startInterruptWatch as nt, planFailedOps as o, buildAssetRedirectMap as on, resetAwsClients as or, isTerminationProtectionPropagationError as ot, deleteSkipReason as p, BOOTSTRAP_MARKER_PREFIX as pn, DeployCancelledError as pr, normalizeAwsTagsToCfn as pt, ProviderRegistry as q, MIGRATE_TMP_PREFIX as qn, DagBuilder as qt, DeployEngine as r, AssetPublisher as rn, resolveBucketRegion as rr, CloudControlProvider as rt, planRollback as s, createAssetRedirectResolver as sn, setAwsClients as sr, IntrinsicFunctionResolver as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, importableOutputs as tn, processStackMessages as tr, isInterruptedWaitError as tt, updatePartialMessage as u, escapeRegExp$1 as un, ConfigError as ur, getAccountInfo as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, parseBootstrapMarker as vn, LockError as vr, configStringRefusal as vt, refusesFinalSnapshot as w, dockerSpawnEnvWithSensitive as wn, ResourceUpdateNotSupportedError as wr, STATE_SOURCED_CROSS_GENERATION_RULES as wt, ccRoutedFinalSnapshotError as x, validateContainerRepoName as xn, PartialFailureError as xr, requireConfigArray as xt, PRE_DELETE_SNAPSHOT_TYPES as y, readBootstrapMarkerBody as yn, MissingCdkCliError as yr, readConfigString as yt, collectPublishedOutputNames as z, resolveSkipPrefix as zn, s3BucketDualStackDomainName as zt };
-//# sourceMappingURL=deploy-engine-D8AIgkwy.js.map
+export { beginCommandInterruptScope as $, PARTITION_TABLE as $n, S3StateBackend as $t, renderStatefulReason as A, runDockerForeground as An, SynthesisError as Ar, dynamicReferenceTokens as At, exportAliasCollisionScrubWarning as B, resolveCaptureObservedState as Bn, s3BucketDomainName as Bt, isFinalSnapshotError as C, validateContainerRepoName as Cn, PartialFailureError as Cr, requireConfigArray as Ct, extractDeploymentEventError as D, formatDockerLoginError as Dn, StackHasActiveImportsError as Dr, STATE_SOURCED_READBACK_RULES as Dt, makeCanonicalizePropertiesFn as E, dockerSpawnEnvWithSensitive as En, ResourceUpdateNotSupportedError as Er, STATE_SOURCED_CROSS_GENERATION_RULES as Et, green as F, synthesisStatusMessage as Fn, isMarkedNonRetryable as Fr, redactSecretsForState as Ft, IAMRoleProvider as G, stateBucketExistenceConfirmed as Gn, DiffCalculator as Gt, secretBearingStateKeyWarning as H, resolveStateBucketWithDefault as Hn, s3BucketRegionalDomainName as Ht, red as I, getDefaultStateBucketName as In, isRetryableTransientError as Ir, scrubResourceRecord as It, ProviderRegistry as J, CFN_TEMPLATE_URL_LIMIT as Jn, withRetry as Jt, collectInlinePolicyNamesManagedBySiblings as K, warnDeprecatedNoPrefixCliFlag as Kn, INTRINSIC_KEYS as Kt, yellow as L, getLegacyStateBucketName as Ln, isThrottlingError as Lr, classifyReplaySecretRegion as Lt, bold as M, AssetManifestLoader as Mn, isCdkdError as Mr, isSingleDynamicReferenceToken as Mt, cyan as N, getDockerImageBySourceHash as Nn, normalizeAwsError as Nr, maskSecretsInError as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, getDockerCmd as On, StackTerminationProtectionError as Or, TEMPLATE_SOURCED_RULES as Ot, gray as P, Synthesizer as Pn, withErrorHandling as Pr, maskSecretsInText as Pt, DEFAULT_STATE_PREFIX as Q, expectedOwnerParam as Qn, displaySafe as Qt, collectDeclaredOutputNames as R, resolveApp as Rn, markNonRetryable as Rr, producerRegionsFromState as Rt, createPreDeleteFinalSnapshot as S, validateAssetBucketName as Sn, NestedStackChildDirectDestroyError as Sr, replayWarn as St, unsupportedFinalSnapshotError as T, buildDockerImage as Tn, ResourceTimeoutError as Tr, requireConfigString as Tt, stateKeySecretExposure as U, resolveStateBucketWithDefaultAndSource as Un, s3BucketWebsiteUrl as Ut, isExportAliasCollision as V, resolveSkipPrefix as Vn, s3BucketDualStackDomainName as Vt, getCurrentResourceSecrets as W, resolveUseCdkBootstrapAssets as Wn, applyRoleArnIfSet as Wt, findSilentDropProperties as X, findLargeInlineResources as Xn, TemplateParser as Xt, findActionableSilentDrops as Y, MIGRATE_TMP_PREFIX as Yn, DagBuilder as Yt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Z, uploadCfnTemplate as Zn, LockManager as Zt, computeImplicitDeleteEdges as _, ensureAssetStorage as _n, LocalInvokeBuildError as _r, assertRegionMatch as _t, DeploymentEventsStore as a, AssetPublisher as an, resolveBucketRegion as ar, slowCcOperationTimeoutMs as at, buildFinalSnapshotIdentifier as b, parseBootstrapMarker as bn, LockError as br, configStringRefusal as bt, replayFailedOperations as c, buildAssetRedirectMap as cn, resetAwsClients as cr, IntrinsicFunctionResolver as ct, updatePartialReason as d, rewriteTemplateAssetReferences as dn, CdkdError as dr, getAccountInfo as dt, rebuildClientForBucketRegion as en, canonicalizeRegion as er, endCommandInterruptScope as et, UNSPECIFIED_SKIP_REASON as f, escapeRegExp$1 as fn, ConfigError as fr, parameterTypeMayLoseSecretIdentity as ft, IMPLICIT_DELETE_DEPENDENCIES as g, assertAssetBucketRegion as gn, DynamicReferenceRegionAmbiguousError as gr, resolveExplicitPhysicalId as gt, maskingRetryLogger as h, BOOTSTRAP_MARKER_PREFIX as hn, DeployCancelledError as hr, normalizeAwsTagsToCfn as ht, DeploymentEventsReader as i, shouldRetainResource as in, clearBucketRegionCache as ir, CloudControlProvider as it, formatResourceLine as j, runDockerStreaming as jn, formatError as jr, errorCauseChain as jt, isStatefulRecreateTargetSync as k, partitionSensitiveEnv as kn, StateError as kr, createSecretMasker as kt, replayRollback as l, createAssetRedirectResolver as ln, setAwsClients as lr, carriesDynamicReference as lt, withResourceDeadline as m, AssetModeResolver as mn, DependencyError as mr, WAFv2WebACLProvider as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, importableOutputKeys as nn, AssemblyReader as nr, isInterruptedWaitError as nt, planFailedOps as o, stringifyValue as on, AwsClients as or, disableInstanceApiTermination as ot, deleteSkipReason as p, stripControlChars as pn, CrossAccountSecretRefusalError as pr, refStateLookupFromResource as pt, clearOnUpdateRemoval as q, CFN_TEMPLATE_BODY_LIMIT as qn, describeTypeWithThrottleRetry as qt, DeployEngine as r, importableOutputs as rn, processStackMessages as rr, startInterruptWatch as rt, planRollback as s, WorkGraph as sn, getAwsClients as sr, isTerminationProtectionPropagationError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, exportNamesCarriedFrom as tn, derivePartitionAndUrlSuffix as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, loadPublishableAssetManifest as un, AssetError as ur, cfnRefValueFromPhysicalId as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, getBootstrapMarkerKey as vn, LocalMigrateError as vr, coerceCfnBoolean as vt, refusesFinalSnapshot as w, buildDenyExternalAccessPolicy as wn, ProvisioningError as wr, requireConfigObject as wt, ccRoutedFinalSnapshotError as x, readBootstrapMarkerBody as xn, MissingCdkCliError as xr, readConfigString as xt, PRE_DELETE_SNAPSHOT_TYPES as y, isCrossRegionRedirect as yn, LocalStartServiceError as yr, configBooleanRefusal as yt, collectPublishedOutputNames as z, resolveAutoAssetStorage as zn, __exportAll as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-BtqjWvh5.js.map