@go-to-k/cdkd 0.284.62 → 0.284.64

package/dist/index.d.ts

@@ -90,6 +90,7 @@ interface PropertyChange {
 }
 //#endregion
 //#region src/deployment/secret-redaction.d.ts
+type RecordedSecretValues = Map<string, string>;
 type SecretMasker = (text: string) => string;
 //#endregion
 //#region src/provisioning/region-check.d.ts
@@ -1048,6 +1049,7 @@ interface DeployEngineOptions {
     parentLogicalId: string;
     parentRegion: string;
   };
+  inheritedSecrets?: RecordedSecretValues;
   onCurrentStateLoaded?: (stackName: string, state: StackState | undefined) => Promise<void>;
   recreateViaCcApiTargets?: ReadonlySet<string>;
   recreateViaSdkProviderTargets?: ReadonlySet<string>;
@@ -1098,6 +1100,7 @@ declare class DeployEngine {
   constructor(stateBackend: S3StateBackend, lockManager: LockManager, dagBuilder: DagBuilder, diffCalculator: DiffCalculator, providerRegistry: ProviderRegistry, options: DeployEngineOptions | undefined, stackRegion: string, exportIndexStore?: ExportIndexStore);
   deploy(stackName: string, template: CloudFormationTemplate): Promise<DeployResult>;
   private buildResolverContext;
+  private redactParametersForDiff;
   private redactOutputs;
   private redactOperationsForJournal;
   private redactStateForPersist;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAyBA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KCuhEU,gBAAgB;;;UC/iFX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UAMP,6BAA6B;EAE5C;EAEA,aAAa;;UAOL,iCAAiC;EAEzC;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;KA4ClD;WAGG;;WAYA;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCzjC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCzCf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA2CA;EAcR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cCnNrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAsOC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAgbvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCt2BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cA6BS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA0CR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UChqBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA4Da;;;UChKC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UC1SN;EACf;EACA;IACE;IACA;IACA;;;;;UCZa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCLe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7SO;KAGA;KAcA;KAqCA;UAkBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EASA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAWF;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cCwBE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAoJL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAyMJ;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCzlExC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;;UAUH;EACf;EACA,aAAa;EACb,gBAAgB;;UAQD;EACf;EACA;EACA;;cAuDW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UAmGpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EAqEJ,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChMY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCxGE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;;UAWE;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC7VZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCvDK;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAmBW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EAwDhD,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EA8BlC,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAuB9D,sBAAsB,mBAAmB,iBAAiB;UAuBlD;UAuBA;UAuBA;UASA;UAgDN;;;;UCz7BO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC5DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UClHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UChQK;EAEf;EASA;;cA+FW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAwIW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UA+HA;UA2BN;EAaF,iBAAiB,mBAAmB,6BAA6B;UAoDzD;UAsBN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cClnCQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EAgJR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KCjXA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCxbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UCzfO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EA4BF,wBAAwB,mBAAmB,OAAO,2BAA2B;EAuB7E,0BAA0B;EAmB1B,gCAAgC;EAmBhC,gBAAgB;EAkBhB;EASA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAoOW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA8BnE;UAiDA;UA8DA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UAqEM;UAkqBA;UAokBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqSN;UAaA;UAmBA;UAwBA;UAyCM;UA0CA;UAkKA;UAgtCN;UA8BA;UA4BA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgBA;UAwCM;UAmRN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAyBA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC1fU,uBAAuB;KAkkFvB,gBAAgB;;;UChmFX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UAMP,6BAA6B;EAE5C;EAEA,aAAa;;UAOL,iCAAiC;EAEzC;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;KA4ClD;WAGG;;WAYA;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UCzjC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCzCf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA2CA;EAcR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cCnNrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAsOC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAgbvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCt2BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cA6BS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MA0CR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UChqBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA4Da;;;UChKC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UC1SN;EACf;EACA;IACE;IACA;IACA;;;;;UCZa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCLe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7SO;KAGA;KAcA;KAqCA;UAkBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EASA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAWF;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cCwBE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAoJL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAyMJ;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCzlExC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;;UAUH;EACf;EACA,aAAa;EACb,gBAAgB;;UAQD;EACf;EACA;EACA;;cAuDW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UAmGpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EAqEJ,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChMY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCvGE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;;UAWE;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC9VZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCvDK;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAmBW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EAwDhD,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EA8BlC,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAuB9D,sBAAsB,mBAAmB,iBAAiB;UAuBlD;UAuBA;UAuBA;UASA;UAgDN;;;;UCz7BO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC5DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UClHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UChQK;EAEf;EASA;;cA+FW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UAwIW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UA+HA;UA2BN;EAaF,iBAAiB,mBAAmB,6BAA6B;UAoDzD;UAsBN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cClnCQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EAgJR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KCjXA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCxbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UCxfO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAuB7E,0BAA0B;EAmB1B,gCAAgC;EAmBhC,gBAAgB;EAkBhB;EASA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAoOW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA8BnE;UAqFA;UA0BA;UA8DA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UAqEM;UAqrBA;UAokBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqSN;UAaA;UAmBA;UAwBA;UAyCM;UA0CA;UAwKA;UAguCN;UA8BA;UA4BA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgBA;UAwCM;UAmRN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ar as isCdkdError, Dr as StateError, Jt as TemplateParser, Mn as Synthesizer, Or as SynthesisError, Sr as ProvisioningError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as getAwsClients, cr as AssetError, er as AssemblyReader, fr as DependencyError, ir as AwsClients, jr as normalizeAwsError, kr as formatError, lr as CdkdError, nr as clearBucketRegionCache, or as resetAwsClients, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as resolveBucketRegion, rt as CloudControlProvider, sr as setAwsClients, ur as ConfigError, vr as LockError } from "./deploy-engine-D8AIgkwy.js";
+import { $t as S3StateBackend, Ar as SynthesisError, G as IAMRoleProvider, Gt as DiffCalculator, J as ProviderRegistry, Mr as isCdkdError, Nr as normalizeAwsError, Pn as Synthesizer, Xt as TemplateParser, Yt as DagBuilder, Zt as LockManager, an as AssetPublisher, ar as resolveBucketRegion, br as LockError, cr as resetAwsClients, dr as CdkdError, fr as ConfigError, ir as clearBucketRegionCache, it as CloudControlProvider, jr as formatError, kr as StateError, lr as setAwsClients, mr as DependencyError, nr as AssemblyReader, or as AwsClients, r as DeployEngine, sr as getAwsClients, ur as AssetError, wr as ProvisioningError } from "./deploy-engine-BtqjWvh5.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-XLMSMzWe.js → program-I-xR_ceK.js}

@@ -1,7 +1,7 @@
-import { $ as endCommandInterruptScope, $n as derivePartitionAndUrlSuffix, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as AssetManifestLoader, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveStateBucketWithDefault, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as buildDockerImage, Cr as ResourceTimeoutError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as partitionSensitiveEnv, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as getDockerCmd, Er as StackTerminationProtectionError, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as getLegacyStateBucketName, Fr as isThrottlingError, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as CFN_TEMPLATE_BODY_LIMIT, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as resolveUseCdkBootstrapAssets, Ht as applyRoleArnIfSet, I as red, In as resolveApp, Ir as markNonRetryable, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as findLargeInlineResources, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as CFN_TEMPLATE_URL_LIMIT, Kt as withRetry, L as yellow, Ln as resolveAutoAssetStorage, Lt as s3BucketArn, M as bold, Mn as Synthesizer, Mr as withErrorHandling, Mt as maskSecretsInText, N as cyan, Nn as synthesisStatusMessage, Nr as isMarkedNonRetryable, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as runDockerForeground, Ot as dynamicReferenceTokens, P as gray, Pn as getDefaultStateBucketName, Pr as isRetryableTransientError, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as canonicalizeRegion, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveCaptureObservedState, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as buildDenyExternalAccessPolicy, Sr as ProvisioningError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as formatDockerLoginError, Tr as StackHasActiveImportsError, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as stateBucketExistenceConfirmed, Ut as DiffCalculator, V as isExportAliasCollision, Vn as resolveStateBucketWithDefaultAndSource, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as warnDeprecatedNoPrefixCliFlag, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as expectedOwnerParam, Xt as displaySafe, Y as findSilentDropProperties, Yn as uploadCfnTemplate, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as PARTITION_TABLE, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as isCrossRegionRedirect, _r as LocalStartServiceError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as getAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as validateAssetBucketName, br as NestedStackChildDirectDestroyError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as CrossAccountSecretRefusalError, dt as refStateLookupFromResource, en as importableOutputKeys, er as AssemblyReader, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getBootstrapMarkerKey, gr as LocalMigrateError, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as ensureAssetStorage, hr as LocalInvokeBuildError$1, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as AwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as getDockerImageBySourceHash, jr as normalizeAwsError, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as runDockerStreaming, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CdkdError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as assertAssetBucketRegion, mr as DynamicReferenceRegionAmbiguousError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, or as resetAwsClients, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as DeployCancelledError, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as MIGRATE_TMP_PREFIX, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as resolveBucketRegion, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as setAwsClients, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as processStackMessages, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as parseBootstrapMarker, vt as configStringRefusal, w as refusesFinalSnapshot, wn as dockerSpawnEnvWithSensitive, wr as ResourceUpdateNotSupportedError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as validateContainerRepoName, xr as PartialFailureError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as readBootstrapMarkerBody, yr as MissingCdkCliError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveSkipPrefix, zt as s3BucketDualStackDomainName } from "./deploy-engine-D8AIgkwy.js";
+import { $ as beginCommandInterruptScope, $n as PARTITION_TABLE, $t as S3StateBackend, A as renderStatefulReason, An as runDockerForeground, At as dynamicReferenceTokens, B as exportAliasCollisionScrubWarning, Bn as resolveCaptureObservedState, Bt as s3BucketDomainName, C as isFinalSnapshotError, Cn as validateContainerRepoName, Cr as PartialFailureError, Ct as requireConfigArray, D as extractDeploymentEventError, Dn as formatDockerLoginError, Dr as StackHasActiveImportsError, Dt as STATE_SOURCED_READBACK_RULES, E as makeCanonicalizePropertiesFn, En as dockerSpawnEnvWithSensitive, Er as ResourceUpdateNotSupportedError, Et as STATE_SOURCED_CROSS_GENERATION_RULES, F as green, Fn as synthesisStatusMessage, Fr as isMarkedNonRetryable, Ft as redactSecretsForState, G as IAMRoleProvider, Gn as stateBucketExistenceConfirmed, Gt as DiffCalculator, H as secretBearingStateKeyWarning, Hn as resolveStateBucketWithDefault, Ht as s3BucketRegionalDomainName, I as red, In as getDefaultStateBucketName, Ir as isRetryableTransientError, It as scrubResourceRecord, J as ProviderRegistry, Jn as CFN_TEMPLATE_URL_LIMIT, Jt as withRetry, K as collectInlinePolicyNamesManagedBySiblings, Kn as warnDeprecatedNoPrefixCliFlag, Kt as INTRINSIC_KEYS, L as yellow, Ln as getLegacyStateBucketName, Lr as isThrottlingError, Lt as classifyReplaySecretRegion, M as bold, Mn as AssetManifestLoader, Mt as isSingleDynamicReferenceToken, N as cyan, Nn as getDockerImageBySourceHash, Nr as normalizeAwsError, Nt as maskSecretsInError, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerCmd, Or as StackTerminationProtectionError, Ot as TEMPLATE_SOURCED_RULES, P as gray, Pn as Synthesizer, Pr as withErrorHandling, Pt as maskSecretsInText, Q as DEFAULT_STATE_PREFIX, Qn as expectedOwnerParam, Qt as displaySafe, R as collectDeclaredOutputNames, Rn as resolveApp, Rr as markNonRetryable, Rt as producerRegionsFromState, S as createPreDeleteFinalSnapshot, Sn as validateAssetBucketName, Sr as NestedStackChildDirectDestroyError, St as replayWarn, T as unsupportedFinalSnapshotError, Tn as buildDockerImage, Tr as ResourceTimeoutError, Tt as requireConfigString, U as stateKeySecretExposure, Un as resolveStateBucketWithDefaultAndSource, Ut as s3BucketWebsiteUrl, V as isExportAliasCollision, Vn as resolveSkipPrefix, Vt as s3BucketDualStackDomainName, W as getCurrentResourceSecrets, Wn as resolveUseCdkBootstrapAssets, Wt as applyRoleArnIfSet, X as findSilentDropProperties, Xn as findLargeInlineResources, Xt as TemplateParser, Y as findActionableSilentDrops, Yn as MIGRATE_TMP_PREFIX, Yt as DagBuilder, Z as CUSTOM_RESOURCE_RESPONSE_PREFIX, Zn as uploadCfnTemplate, Zt as LockManager, _ as computeImplicitDeleteEdges, _n as ensureAssetStorage, _r as LocalInvokeBuildError$1, _t as assertRegionMatch, a as DeploymentEventsStore, an as AssetPublisher, ar as resolveBucketRegion, at as slowCcOperationTimeoutMs, b as buildFinalSnapshotIdentifier, bn as parseBootstrapMarker, bt as configStringRefusal, c as replayFailedOperations, cn as buildAssetRedirectMap, cr as resetAwsClients, ct as IntrinsicFunctionResolver, d as updatePartialReason, dn as rewriteTemplateAssetReferences, dr as CdkdError, dt as getAccountInfo, en as rebuildClientForBucketRegion, er as canonicalizeRegion, et as endCommandInterruptScope, f as UNSPECIFIED_SKIP_REASON, fn as escapeRegExp, ft as parameterTypeMayLoseSecretIdentity, g as IMPLICIT_DELETE_DEPENDENCIES, gn as assertAssetBucketRegion, gr as DynamicReferenceRegionAmbiguousError, gt as resolveExplicitPhysicalId, h as maskingRetryLogger, hn as BOOTSTRAP_MARKER_PREFIX, hr as DeployCancelledError, ht as normalizeAwsTagsToCfn, i as DeploymentEventsReader, in as shouldRetainResource, it as CloudControlProvider, j as formatResourceLine, jn as runDockerStreaming, jt as errorCauseChain, k as isStatefulRecreateTargetSync, kn as partitionSensitiveEnv, kt as createSecretMasker, l as replayRollback, ln as createAssetRedirectResolver, lr as setAwsClients, lt as carriesDynamicReference, m as withResourceDeadline, mn as AssetModeResolver, mt as WAFv2WebACLProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as importableOutputKeys, nr as AssemblyReader, nt as isInterruptedWaitError, o as planFailedOps, on as stringifyValue, or as AwsClients, ot as disableInstanceApiTermination, p as deleteSkipReason, pn as stripControlChars, pr as CrossAccountSecretRefusalError, pt as refStateLookupFromResource, q as clearOnUpdateRemoval, qn as CFN_TEMPLATE_BODY_LIMIT, qt as describeTypeWithThrottleRetry, r as DeployEngine, rn as importableOutputs, rr as processStackMessages, rt as startInterruptWatch, s as planRollback, sn as WorkGraph, sr as getAwsClients, st as isTerminationProtectionPropagationError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as exportNamesCarriedFrom, tr as derivePartitionAndUrlSuffix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as loadPublishableAssetManifest, ut as cfnRefValueFromPhysicalId, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getBootstrapMarkerKey, vr as LocalMigrateError, vt as coerceCfnBoolean, w as refusesFinalSnapshot, wn as buildDenyExternalAccessPolicy, wr as ProvisioningError, wt as requireConfigObject, x as ccRoutedFinalSnapshotError, xn as readBootstrapMarkerBody, xr as MissingCdkCliError, xt as readConfigString, y as PRE_DELETE_SNAPSHOT_TYPES, yn as isCrossRegionRedirect, yr as LocalStartServiceError, yt as configBooleanRefusal, z as collectPublishedOutputNames, zn as resolveAutoAssetStorage, zt as s3BucketArn } from "./deploy-engine-BtqjWvh5.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-DoW7XkO0.js";
-import { t as ASGProvider } from "./asg-provider-BfX7AwFi.js";
+import { t as getCdkdVersion } from "./version-BtSUTHs5.js";
+import { t as ASGProvider } from "./asg-provider-DGJz_iFy.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -59963,7 +59963,7 @@ var NestedStackProvider = class {
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const attributes = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
-			physicalId: this.synthesizeArn(ctx.accountId, ctx.parentRegion, ctx.parentStackName, logicalId),
+			physicalId: this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId),
 			attributes
 		};
 	}
@@ -60038,9 +60038,11 @@ var NestedStackProvider = class {
 		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
+		const inheritedSecrets = getCurrentResourceSecrets();
 		const childEngine = new DeployEngine(parentCtx.stateBackend, parentCtx.lockManager, parentCtx.dagBuilder, parentCtx.diffCalculator, parentCtx.providerRegistry, {
 			...parentCtx.options ?? {},
 			parameters: childParameters,
+			...inheritedSecrets && inheritedSecrets.size > 0 && { inheritedSecrets },
 			parentStackInfo: {
 				parentStack: parentCtx.parentStackName,
 				parentLogicalId: logicalId,
@@ -60070,8 +60072,22 @@ var NestedStackProvider = class {
 	deriveChildStackName(parentStackName, nestedLogicalId) {
 		return `${parentStackName}~${nestedLogicalId}`;
 	}
-	synthesizeArn(accountId, region, parentStackName, logicalId) {
-		return `arn:cdkd-local:${region}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
+	/**
+	* The synthesized `physicalId` recorded on the PARENT's
+	* `AWS::CloudFormation::Stack` row.
+	*
+	* `childRegion` is the region the child stack was deployed into (its own
+	* `StackState.region`), and the segment is LOAD-BEARING as of issue
+	* [#2055](https://github.com/go-to-k/cdkd/issues/2055):
+	* `IntrinsicFunctionResolver` reads it back as the producer region when a
+	* parent property consumes `Fn::GetAtt: [<Child>, 'Outputs.<Name>']` and the
+	* child's persisted output is a redacted `{{resolve:...}}` expression. A
+	* secret NAME is regional, so resolving that expression anywhere but the
+	* child's own region can answer with a different secret. Equal to the
+	* parent's region today; do not collapse the two.
+	*/
+	synthesizeArn(accountId, childRegion, parentStackName, logicalId) {
+		return `arn:cdkd-local:${childRegion}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
 	}
 	extractParameters(properties) {
 		const params = properties["Parameters"];
@@ -60113,6 +60129,42 @@ var NestedStackProvider = class {
 		}
 		return result;
 	}
+	/**
+	* Surface the child's PERSISTED outputs as the parent's `Outputs.<Key>`
+	* attributes, VERBATIM — including a secret-bearing one, which PR #1899
+	* persists as its unresolved `{{resolve:...}}` expression.
+	*
+	* DELIBERATELY NOT the place the expression is re-resolved (issue
+	* [#2055](https://github.com/go-to-k/cdkd/issues/2055)). Re-resolving here
+	* would be easy — `readChildOutputsAsAttributes` is already async — and it
+	* would trade one bug for a worse one: this map becomes the parent's
+	* `ResourceState.attributes`, and every CONSUMER resource then reads the
+	* plaintext through `Fn::GetAtt` with no entry in its OWN
+	* `recordedSecretValues`, so the deploy engine's save choke point has nothing
+	* to redact it back to and the consumer's `state.json` persists the decrypted
+	* secret. Keeping the expression here keeps BOTH the parent's nested-stack row
+	* and every consumer's record redacted.
+	*
+	* The re-resolution therefore lives at the READ site, in
+	* `IntrinsicFunctionResolver.resolveGetAtt`, where the CONSUMER's resolver
+	* context is in hand — the same seam and the same reason as the
+	* `Fn::ImportValue` / `Fn::GetStackOutput` arms of issue #1934.
+	*
+	* "A read site risks missing a caller" is answered for the RESOLUTION path by
+	* there being exactly one: the flat-key attribute lookup, which
+	* `getAttribute()` below exists to prove is the only route (it throws for
+	* anything that falls through it).
+	*
+	* It is NOT answered for every reader of `ResourceState.attributes` in the
+	* codebase, and an earlier revision of this note claimed it was.
+	* `AttributeFetcher.cacheFallback` in `src/analyzer/orphan-rewriter.ts` reads
+	* `orphan.attributes?.[attribute]` directly under `cdkd orphan --force` and
+	* has no resolver context to re-resolve with, so it splices the token
+	* verbatim into the referring resource's state and warns about exactly that.
+	* The seam decision above is unchanged — putting the plaintext here would
+	* make EVERY consumer persist it — but the count is "one resolution path",
+	* not "one reader".
+	*/
 	buildOutputsAttributes(outputs) {
 		const attributes = {};
 		for (const [key, value] of Object.entries(outputs)) attributes[`Outputs.${key}`] = value;
@@ -62697,6 +62749,55 @@ function isStackNotFoundError(err) {
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
 const logger = getLogger().child("DiffRecursive");
+/** Every `Ref` target reachable from a value, collected in one walk. */
+function collectRefTargets(value, refs) {
+	if (Array.isArray(value)) {
+		for (const element of value) collectRefTargets(element, refs);
+		return;
+	}
+	if (!value || typeof value !== "object") return;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") refs.add(obj["Ref"]);
+	for (const nested of Object.values(obj)) collectRefTargets(nested, refs);
+}
+/**
+* Whether ANY condition in `template` references one of `tokenParameterNames`
+* (issue #1903, review round 2).
+*
+* WHY THIS EXISTS AND WHY THE BROAD FORM IS NOT MERELY CONSERVATIVE. The
+* token-parameter guard originally skipped condition evaluation for the WHOLE
+* template as soon as any bound parameter was a redacted token, on the argument
+* that the cost is "a condition-false resource is diffed rather than pruned".
+* That is only half of it: leaving `conditions` UNDEFINED also means `resolveIf`
+* finds no entry, warns, and takes the FALSE branch for every `Fn::If` in every
+* property value — so a condition-TRUE property diffs as a spurious UPDATE
+* (perpetual, and `--fail` exits 1) and condition-gated resources surface as
+* phantom CREATEs. And it fired whenever ANY parameter was token-valued, even
+* when not one condition mentioned it.
+*
+* So the skip is narrowed to what it can actually get wrong: a condition whose
+* verdict DEPENDS on a value this side does not have.
+*
+* NO TRANSITIVE `{Condition: X}` WALK, and its absence is a reachability
+* argument rather than an omission. An `Fn::And` over a NAMED condition (issue
+* #840's shape) does inherit that condition's dependency — but the named
+* condition is itself an entry in this same `Conditions` map, and this scan
+* visits EVERY entry, so the dependency is already found directly on the
+* referenced condition. A chain walk was written first and measured dead: with
+* it removed, a template whose `IsDev` wraps `{Condition: IsProd}` while only
+* `IsProd` names the token parameter still answers `true`.
+*/
+function conditionsDependOnTokenParameters(template, tokenParameterNames) {
+	const templateConditions = template.Conditions;
+	if (!templateConditions || typeof templateConditions !== "object") return false;
+	if (tokenParameterNames.size === 0) return false;
+	for (const definition of Object.values(templateConditions)) {
+		const refs = /* @__PURE__ */ new Set();
+		collectRefTargets(definition, refs);
+		for (const ref of refs) if (tokenParameterNames.has(ref)) return true;
+	}
+	return false;
+}
 /** Empty template used to diff a removed nested child's state → all DELETE. */
 const EMPTY_TEMPLATE = { Resources: {} };
 /**
@@ -62787,6 +62888,11 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	let mergedParameters = parameters;
 	let parametersBound = false;
+	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
+	for (const name of tokenParameterNames) {
+		const declaredType = (template.Parameters?.[name])?.Type;
+		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stackName}: parameter '${name}' is declared 'Type: ${declaredType}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this — declare it 'Type: String' — and this diff keeps the unresolved reference rather than coercing it.`);
+	}
 	try {
 		const userParameters = {};
 		for (const [name, value] of Object.entries(parameters ?? {})) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") userParameters[name] = String(value);
@@ -62795,13 +62901,14 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			...parameters,
 			...templateParameters
 		};
+		for (const name of tokenParameterNames) mergedParameters[name] = (parameters ?? {})[name];
 		parametersBound = true;
 	} catch (error) {
 		logger.debug(`Diff parameter binding for stack ${stackName} is partial: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	let effectiveTemplate = template;
 	let conditions;
-	if (parametersBound) try {
+	if (parametersBound && !conditionsDependOnTokenParameters(template, tokenParameterNames)) try {
 		conditions = await intrinsicResolver.evaluateConditions({
 			template,
 			resources: currentState.resources,
@@ -62874,7 +62981,8 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 			stateBackend,
 			stackName: parentStackName,
 			bestEffort: true,
-			...parentParameters && { parameters: parentParameters }
+			...parentParameters && { parameters: parentParameters },
+			skipDynamicReferences: true
 		});
 	} catch {}
 	return resolved;
@@ -65076,7 +65184,7 @@ function makeCrossStackPrePass(deps) {
 			try {
 				loaded = await backend.getState(producer.stack, producer.region);
 			} catch (err) {
-				logger.debug(`Scrub of ${stackName}: could not re-read producer '${producer.stack}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.debug(`Scrub of ${stackName}: could not re-read producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
@@ -65089,15 +65197,16 @@ function makeCrossStackPrePass(deps) {
 				recordedImports: [],
 				recordedOutputReads: []
 			};
+			const where = `${key} in ${origin}${path ? ` at ${path}` : ""}`;
 			try {
 				await resolver.resolve({ [key]: node[key] }, probe);
 			} catch (err) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`Scrub of ${stackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				if (isByDesignRefusal(err)) {
-					const detail = `${key} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
 					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
@@ -65105,19 +65214,36 @@ function makeCrossStackPrePass(deps) {
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
 			const producer = recordedProducer(key, probe);
-			if (!producer) return;
-			if (!producerTemplates.has(producer.stack)) return;
+			if (!producer) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
+				return;
+			}
+			const loggedKey = maskSecretsInText(producer.key, secrets);
+			const loggedStack = maskSecretsInText(producer.stack, secrets);
+			if (!producerTemplates.has(producer.stack)) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), which is not a stack of this app — scrub has no template to classify export '${loggedKey}' with. Not classified as a plaintext producer.`);
+				return;
+			}
 			const verdict = secretExpressionVerdict(producer.stack, producer.key);
-			if (verdict.kind === "no") return;
+			if (verdict.kind === "no") {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose template declares no {{resolve:...}} expression for '${loggedKey}' and no re-export chain reaching one. Not classified as a plaintext producer.`);
+				return;
+			}
 			const stored = await storedProducerValue(producer, context.stateBackend);
-			if (!stored) return;
-			if (carriesDynamicReference(stored.stored)) return;
+			if (!stored) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), whose state record could not be read or does not carry the key '${loggedKey}' — cannot classify, so this is not classified as a plaintext producer.`);
+				return;
+			}
+			if (carriesDynamicReference(stored.stored)) {
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for '${loggedKey}' already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
+				return;
+			}
 			if (storedValueCarriesNoPlaintext(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved through producer '${producer.stack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (!nodeCanRefuse) {
-				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved to a plaintext from unscrubbed producer '${producer.stack}', and this position cannot refuse.`);
+				logger.debug(`Scrub of ${stackName}: ${where} resolved to a plaintext from unscrubbed producer '${loggedStack}', and this position cannot refuse.`);
 				return;
 			}
 			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
@@ -67629,6 +67755,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 		}));
 		try {
 			const resources = { ...report.state.resources };
+			let acceptedResourceCount = 0;
 			for (const outcome of driftedOutcomes) {
 				const existing = resources[outcome.logicalId];
 				if (!existing) continue;
@@ -67646,10 +67773,15 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					accepted.push(change);
 				}
 				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+				let recordedChanges = 0;
 				for (const change of accepted) {
-					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) continue;
+					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
+						recordedChanges++;
+						continue;
+					}
 					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — cdkd state holds an unresolved '{{resolve:...}}' reference at that property, and the reference wins over an accepted value. Change the template if that reference is wrong.`);
 				}
+				if (recordedChanges > 0) acceptedResourceCount++;
 				resources[outcome.logicalId] = hasObserved ? {
 					...existing,
 					observedProperties: redactedBaseline
@@ -67666,7 +67798,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			const saveOptions = { expectedEtag: report.etag };
 			if (report.migrationPending) saveOptions.migrateLegacy = true;
 			await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
-			logger.info(`✓ State updated for ${report.stackName} (${report.region}): accepted drift on ${driftedOutcomes.length} resource(s).`);
+			logger.info(`✓ State updated for ${report.stackName} (${report.region}): ` + (acceptedResourceCount === 0 ? "0 resource(s) accepted — no drifted change was recorded, and this write carried only the positioned re-redaction." : `accepted drift on ${acceptedResourceCount} resource(s).`));
 		} finally {
 			await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
 				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
@@ -68017,11 +68149,10 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 }
 /**
 * Replace every leaf of a revert payload that still holds a `{{resolve:...}}`
-* token with the value AWS currently has at that position (issue #1914,
-* round-3 review).
+* token with the value AWS currently has at that position (issue #1914).
 *
-* The round-3 change downgraded an unresolvable reference from a per-resource
-* failure to a warning, on the premise that `cdkd deploy` resolves through the
+* cdkd downgrades an unresolvable reference from a per-resource failure to a
+* warning, on the premise that `cdkd deploy` resolves through the
 * resolver's same unsupported-service arm — so AWS already holds the literal
 * and replaying it is a no-op. **That premise holds only for records cdkd
 * deployed.** CloudFormation resolves `ssm-secure` SERVER-side, so a record
@@ -68417,18 +68548,22 @@ function printAcceptPlan(reports) {
 			skipped: () => []
 		}));
 		if (drifted.length === 0) continue;
-		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
+		const lines = [];
+		let plannedWrites = 0;
 		for (const o of drifted) {
-			process.stdout.write(`  ~ ${o.logicalId} (${o.resourceType})\n`);
+			lines.push(`  ~ ${o.logicalId} (${o.resourceType})\n`);
 			for (const change of o.changes) {
 				const refusal = acceptRefusalReason(change, o.maskedPaths);
 				if (refusal !== void 0) {
-					process.stdout.write(`    ${change.path}: SKIPPED — ${refusal}\n`);
+					lines.push(`    ${change.path}: SKIPPED — ${refusal}\n`);
 					continue;
 				}
-				process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+				plannedWrites++;
+				lines.push(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
 			}
 		}
+		process.stdout.write(plannedWrites === 0 ? `\nPlan (--accept): no accepted values will be written to cdkd state for ${report.stackName} (${report.region}) — every drifted change below is refused (the run still writes the positioned re-redaction):\n` : `\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
+		for (const line of lines) process.stdout.write(line);
 	}
 }
 /**
@@ -68454,9 +68589,8 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				const cannotMaskKeys = o.notComparedCause !== void 0;
-				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
-				if (!cannotMaskKeys && preserved.length > 0) {
+				if (o.notComparedCause !== void 0 && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				else if (preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
 					for (const path of preserved) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
@@ -76325,6 +76459,7 @@ var AttributeFetcher = class {
 			};
 		}
 		this.logger.warn(`--force: live fetch failed for '${orphanLogicalId}.${attribute}' (${reason}); falling back to cached value from state.attributes.`);
+		if (carriesDynamicReference(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is an UNRESOLVED dynamic reference (a nested stack's redacted output, issue #2055). It is being written into the referring resource's state VERBATIM — cdkd cannot re-resolve it from here. Re-run without --force once the live attribute is readable, or fix the referring property by hand.`);
 		const cacheKey = `${orphanLogicalId}\0${attribute}`;
 		this.cache.set(cacheKey, cached);
 		return {
@@ -87985,4 +88120,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-XLMSMzWe.js.map
+//# sourceMappingURL=program-I-xR_ceK.js.map