@go-to-k/cdkd 0.284.76 → 0.284.78

package/dist/{deploy-engine-Dm-MdFR-.js → deploy-engine-Cvkqa30x.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-BMCefk9p.js";
+import { t as getCdkdVersion } from "./version-GEIr41xq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -288,6 +288,83 @@ const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
 */
 const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 /**
+* How far every `.cause` walk in this module reads.
+*
+* ONE constant rather than five literals, because the walks are only sound
+* together: {@link isMarkedNonRetryable} is what stops a deliberate refusal
+* being read as transient, so any walk that reads text FURTHER than the marker
+* walk creates a band where a refusal is legible but its marker is not.
+* {@link retryClassificationText} shipped at 10 against the marker's 5 for
+* exactly that reason, and the chain shape that makes the band reachable is
+* the one the code already cites -- a nested-stack failure grows one
+* `ProvisioningError` per level.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamped on an error whose own message deliberately WITHHOLDS text its
+* `cause` carries (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
+*
+* Distinct from {@link NON_RETRYABLE_MARKER} and orthogonal to it: this one
+* says nothing about whether the error should be retried, only that the
+* message a classifier would normally read is INCOMPLETE.
+*/
+const REDACTED_CAUSE_MARKER = Symbol.for("cdkd.redactedCause");
+/**
+* Declare that this error's message withholds text its `cause` carries, so the
+* message-based retry classifiers must read the CHAIN instead
+* (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
+*
+* cdkd's retry classifiers match by SUBSTRING over a message. That is sound
+* only while a wrapper copies its cause's text, which every wrapper did until
+* #2302 started reducing an AWS failure to its error CLASS -- S3 words its
+* `AccessDenied` as `User: arn:aws:sts::<account>:assumed-role/<role>/<session>
+* is not authorized to perform: ...`, and a THROWN message is captured into the
+* persisted `deployments/{runId}.jsonl` store. Redacting it also removed the
+* substrings the pattern table matches on: measured on `S3BucketProvider`,
+* `not authorized to perform` (retryable, on the DENSE IAM-propagation cadence)
+* and S3's `conflicting conditional operation` both went NON-retryable.
+*
+* Call it at every site that redacts, and only there. It is deliberately an
+* opt-in stamp rather than an unconditional chain read -- see
+* {@link retryClassificationText} for the measurement that forced that choice.
+*
+* Same non-extensible tolerance as {@link markNonRetryable}, for the same
+* reason: callers use it inline around the error they are about to throw, so a
+* `TypeError` here would replace the refusal with an unrelated crash. Losing
+* the stamp degrades to reading the top-level message, i.e. the pre-#2302
+* classification of a message that is now shorter -- worse, but not a crash.
+*/
+function markRedactedCause(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, REDACTED_CAUSE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was stamped
+* by {@link markRedactedCause}.
+*
+* Walked rather than read off the top link, because the redacting error is
+* itself wrapped further out: `deploy-engine.ts` re-wraps every provider
+* failure, so by the time a classifier sees it the stamp is one or more links
+* deep. Same {@link MAX_CAUSE_CHAIN_DEPTH} as the marker walk, which is what
+* lets {@link retryClassificationText} claim the two agree.
+*/
+function hasRedactedCause(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[REDACTED_CAUSE_MARKER] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Mark a cdkd-authored refusal as terminal and return it, for
 * `throw markNonRetryable(new ProvisioningError(...))`.
 *
@@ -354,7 +431,7 @@ function markNonRetryable(error) {
 */
 function isMarkedNonRetryable(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[NON_RETRYABLE_MARKER] === true) return true;
 		}
@@ -378,7 +455,7 @@ function isMarkedNonRetryable(error) {
 */
 function isThrottlingError(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const name = current.name;
 		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
 		const status = current.$metadata?.httpStatusCode;
@@ -480,7 +557,7 @@ const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
 */
 function isTransientServerError(error) {
 	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const status = current.$metadata?.httpStatusCode;
 		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
 		current = current.cause;
@@ -531,7 +608,7 @@ function describeRetryClassificationSignals(error) {
 	let sawMetadata = false;
 	let metadataName;
 	let metadataRequestId;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
 		const name = current.name;
 		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
 		const metadata = current.$metadata;
@@ -599,6 +676,62 @@ function isRetryableTransientError(error, message) {
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
+* The text every MESSAGE-based retry classifier should read: this error's own
+* message plus every message down its `cause` chain.
+*
+* Every classifier in this module that reads a message reads the TOP-LEVEL one,
+* and that was sound only while cdkd's wrappers copied their cause's text
+* verbatim -- which they did, everywhere, until issue
+* [#2302](https://github.com/go-to-k/cdkd/issues/2302). A wrapper on a THROWN
+* path may now deliberately WITHHOLD AWS's wording, because a thrown message is
+* captured into the persisted `deployments/{runId}.jsonl` store and S3's
+* `AccessDenied` names the caller's account, role and session. Measured on
+* `S3BucketProvider.create` before this function existed: the wrap turned
+* `not authorized to perform` (retryable, and on the DENSE IAM-propagation
+* cadence) and `conflicting conditional operation` (retryable) into
+* NON-retryable, i.e. the redaction silently removed a retry the deploy
+* depended on.
+*
+* This is the missing THIRD walk rather than a new idea: {@link
+* isMarkedNonRetryable} and {@link isThrottlingError} already walk the same
+* chain, for the same stated reason (cdkd wraps SDK errors routinely).
+*
+* It cannot resurrect a cdkd refusal: every consumer checks
+* {@link isMarkedNonRetryable} FIRST, that marker is itself chain-walked, and
+* both walks are bounded by the SAME {@link MAX_CAUSE_CHAIN_DEPTH}.
+*
+* It is a NO-OP for every error that has not opted in via
+* {@link markRedactedCause} -- which is every wrapper on `main` outside
+* #2302's redacting sites. An earlier revision justified itself with a wider
+* claim, that every wrapper on `main` COPIES its cause's message; that claim is
+* false (`custom-resource-provider.ts`'s `describeWaiterFailure` already
+* withholds the raw waiter payload, and it is not the only wrapper that does),
+* and it does not need to be true. The opt-in stamp makes the no-op a property
+* of the mechanism rather than of a survey.
+*
+* NEVER use the result as a LOG line or a thrown message: it is the union of
+* exactly the text the redaction exists to withhold. `retry.ts` keeps the
+* top-level message for its `warn` / `debug` output and uses this only to
+* classify.
+*/
+function retryClassificationText(error) {
+	const top = error instanceof Error ? error.message : String(error);
+	if (!hasRedactedCause(error)) return top;
+	const parts = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null && !seen.has(current); depth++) {
+		seen.add(current);
+		if (current instanceof Error) {
+			if (current.message) parts.push(current.message);
+		} else try {
+			parts.push(String(current));
+		} catch {}
+		current = current?.cause;
+	}
+	return parts.join("\n");
+}
+/**
 * True when the message is a just-created-IAM-entity propagation rejection
 * ({@link IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS}).
 *
@@ -5756,6 +5889,50 @@ var DockerAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/aws-failure-text.ts
+/** Appended to a redacted summary so the withheld half is still reachable. */
+const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
+/**
+* Whether AWS wrote this failure's message.
+*
+* Keyed on the marker fields `@aws-sdk/*` errors carry through
+* `@smithy/smithy-client`'s `ServiceException` — `$metadata` on every
+* deserialized error, `$fault` on every modeled one, `$response` where a
+* middleware attached the raw response. Nothing under `src/` sets any of them,
+* so a match cannot be a cdkd-authored error.
+*
+* A transport-level failure (a socket timeout, a DNS error) can reach a caller
+* without `$metadata`, and that is the correct answer rather than a gap: those
+* messages are written by the HTTP layer and name a host, never a caller.
+*/
+function isAwsAuthoredFailure(error) {
+	const candidate = error;
+	return candidate.$metadata !== void 0 || candidate.$fault !== void 0 || candidate.$response !== void 0;
+}
+/**
+* Describe a caught failure for a thrown message. See {@link AwsFailureText}.
+*/
+function describeAwsFailure(error) {
+	if (error instanceof Error) {
+		if (!isAwsAuthoredFailure(error)) return {
+			summary: error.message,
+			detail: error.message,
+			redacted: false
+		};
+		return {
+			summary: `${error.name || "Error"}. ${VERBOSE_POINTER}`,
+			detail: error.message,
+			redacted: true
+		};
+	}
+	return {
+		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
+		detail: String(error),
+		redacted: true
+	};
+}
+
 //#endregion
 //#region src/utils/deny-external-access-policy.ts
 /**
@@ -5945,7 +6122,11 @@ async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, acc
 	} catch (probeError) {
 		const fromProbe = readBucketRegionHeader(probeError);
 		if (fromProbe) actual = canonicalizeRegion(fromProbe);
-		else throw new CdkdError(`Asset bucket '${bucketName}' is claimed by an existing bucket, but cdkd could not determine which region that bucket is in, so it cannot confirm it belongs to ${want}. Refusing to adopt it. (region probe failed: ${probeError instanceof Error ? probeError.message : String(probeError)}) ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+		else {
+			const failure = describeAwsFailure(probeError);
+			if (failure.redacted) getLogger().debug(`GetBucketLocation failed for asset bucket '${bucketName}' while confirming it belongs to ${want}: ${failure.detail}`);
+			throw new CdkdError(`Asset bucket '${bucketName}' is claimed by an existing bucket, but cdkd could not determine which region that bucket is in, so it cannot confirm it belongs to ${want}. Refusing to adopt it. (region probe failed: ${failure.summary}) ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
+		}
 	}
 	if (actual === want) return;
 	throw new CdkdError(`Asset bucket name '${bucketName}' resolves to a bucket in ${actual}, while this operation targets ${want}. S3 bucket names are globally unique, and both 'BucketAlreadyOwnedByYou' and a cross-region redirect report ACCOUNT ownership rather than the bucket's region, so cdkd cannot treat it as ${want}'s asset bucket. cdkd asset storage is per-region by design: adopting it would publish ${want}'s assets into ${actual} and apply ${want}'s bucket configuration there. ${remedy}`, "ASSET_STORAGE_FOREIGN_REGION_BUCKET", cause);
@@ -8977,9 +9158,13 @@ function splitGetAttStringForm(getAtt) {
 * (`(producer X / Y)`), so it is neither derivable from the source leaf nor
 * stable.
 *
-* THREE arms answer: `Fn::ImportValue`, `Fn::GetStackOutput`, and the
-* `Fn::GetAtt` on a nested-stack OUTPUT that issue #2055's read site
-* re-resolves. Every other leaf refuses.
+* FIVE arms answer, and the enumeration is kept current because a stale one
+* reads as exhaustive: `Fn::ImportValue`, `Fn::GetStackOutput`, the `Fn::GetAtt`
+* on a nested-stack OUTPUT that issue #2055's read site re-resolves, the
+* single-placeholder `Fn::Sub` that normalizes ONTO that `Fn::GetAtt` key
+* (issue #2270 round 3 -- this list said THREE until issue #2291 noticed it had
+* been four since then), and the `Ref` to a nested-stack CHILD's own PARAMETER
+* (issue #2291). Every other leaf refuses.
 *
 * `Region` and `RoleArn` are OPTIONAL slots, and an ABSENT one keys as empty
 * while a PRESENT-but-non-literal one refuses. Absent has to be its own key
@@ -9082,6 +9267,11 @@ function crossStackSourceKey(source) {
 			split.attributeName
 		].join(CROSS_STACK_KEY_SEPARATOR);
 	}
+	if (key === "Ref") {
+		const parameterName = literalStringOrUndefined(source[key]);
+		if (parameterName === void 0) return void 0;
+		return ["Ref", parameterName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
 }
 /**
 * Remember, FOR THE PASS THAT OWNS `secrets`, that the cross-stack source leaf
@@ -9101,6 +9291,34 @@ function recordCrossStackExpression(secrets, key, expression, plaintext) {
 		associations = /* @__PURE__ */ new Map();
 		crossStackAssociations.set(secrets, associations);
 	}
+	storeAssociation(associations, key, expression, plaintext);
+}
+/**
+* The store's WRITE rule, shared by {@link recordCrossStackExpression} and
+* {@link recordNestedStackParameterExpressions} so the two tables cannot drift
+* apart on what a second sighting means.
+*
+* A key recorded against a DIFFERENT (expression, plaintext) pair is POISONED
+* to {@link CONFLICTING_CROSS_STACK} rather than overwritten; an already
+* poisoned key stays poisoned, because a third sighting cannot un-contradict
+* the first two. Every reader refuses a poisoned key, which degrades to the
+* value scan — today's behaviour — rather than guessing between the two.
+*
+* WHAT IS AND IS NOT FENCED, stated because a reader would otherwise assume the
+* whole thing is (review of issue #2291). The POISON-vs-OVERWRITE decision IS
+* fenced: a second sighting under a THIRD expression makes the two outcomes
+* differ (poison refuses and falls back; overwriting would certify the third),
+* and a case asserts it. Nothing fences the branch from
+* {@link recordNestedStackParameterExpressions}'s side in PRODUCTION, because
+* that writer runs once per resource bag and `Object.entries` cannot yield one
+* name twice — the poison is reachable only through this module's API. It is
+* kept as an INVARIANT, not claimed as covered behaviour.
+*
+* The `isSingleDynamicReferenceToken` shape invariant is deliberately NOT here:
+* it belongs to each writer, which is where the parameters are named and where
+* a swap could be introduced.
+*/
+function storeAssociation(associations, key, expression, plaintext) {
 	const seen = associations.get(key);
 	if (seen === void 0) {
 		associations.set(key, {
@@ -9113,6 +9331,218 @@ function recordCrossStackExpression(secrets, key, expression, plaintext) {
 	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
 }
 /**
+* The `AWS::CloudFormation::Stack` type string, named once because the recorder
+* below gates on it and the tests assert against the same population.
+*
+* DUPLICATED, deliberately: `intrinsic-function-resolver.ts` declares the same
+* literal under the same name (for the `Outputs.<Name>` re-resolution of issue
+* #2055). This module is a LEAF by design -- see the file header, it imports
+* nothing, because both the resolver and the deploy engine consume it -- so
+* importing that spelling would close a cycle, and exporting this one for the
+* resolver to import would make the leaf a source of values rather than of
+* pure functions. The two cannot drift into DISAGREEMENT in any way that
+* matters: an AWS resource type string is fixed by AWS, and a typo in either
+* copy makes that copy's gate simply never fire (no-op), never fire wrongly.
+*/
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+/**
+* What a PARENT stack's resolution proved about each `Parameters` entry of an
+* `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
+* child's PARAMETER NAME (issue
+* [#2291](https://github.com/go-to-k/cdkd/issues/2291)).
+*
+* WHY A THIRD STORE, when {@link crossStackAssociations} already holds
+* per-leaf associations. This one is OUTBOUND: it is written against the
+* PARENT's bag and describes leaves of the CHILD's template, so it has to be
+* transported across the engine boundary before any reader can use it. The
+* child's per-resource bag then receives those entries as ORDINARY
+* {@link crossStackAssociations} rows (see
+* {@link inheritNestedStackParameterAssociations}), which is what lets the
+* existing three-condition reader answer for them with no new arm.
+*
+* KEEPING THE TWO TABLES SEPARATE IS LOAD-BEARING, not tidiness. A child engine
+* that itself owns a grandchild `AWS::CloudFormation::Stack` row records the
+* GRANDCHILD's parameter names against the CHILD's bag — the same bag that
+* already carries the child's own INBOUND `Ref` associations. Writing both into
+* one table means a grandchild parameter sharing a NAME with a child parameter
+* poisons the child's entry (two expressions under one key), so a leaf that was
+* being certified correctly falls back to the value scan the moment a
+* same-named parameter appears one level down. Two tables make the collision
+* impossible rather than unlikely.
+*
+* A `WeakMap` keyed by the parent pass's own bag, for the reason
+* {@link crossStackAssociations} gives: the entries hold PLAINTEXT, and they
+* must not outlive the pass that fetched them.
+*/
+const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+/**
+* Record, for the pass that owns `secrets`, which `{{resolve:...}}` expression
+* each `Parameters` entry of a nested-stack row was resolved FROM (issue
+* #2291). No-op for every other resource type.
+*
+* THE EXPRESSIONS COME FROM THE POSITION PASS, not from `secrets`, and that is
+* the whole reason this works at all. `RecordedSecretValues` is keyed by
+* PLAINTEXT, so two parameters resolving to one value have already collapsed to
+* a single entry there by the time this runs — asking the map which expression
+* a given parameter came from returns the SURVIVOR for both. What has not
+* collapsed is the parent's own template: `Properties.Parameters.<Name>` still
+* holds each entry's own source leaf. So this walks the parent's resolved
+* parameter bag against that source with {@link redactSecretsForState}, which
+* is exactly the machinery the parent's persist path already uses and which
+* certifies PER LEAF (measured on this issue: the parent's own two properties
+* come out correct while the child's collapse onto one). Deriving the answer
+* from the positioner rather than restating its rules is what keeps this from
+* drifting away from the persist path.
+*
+* THE `rules` PARAMETER IS THE CALLER'S GENERATION CLAIM, not a knob. The
+* DEPLOY path passes {@link TEMPLATE_DERIVED_RULES} (the default): its source is
+* the parent's TEMPLATE, which can carry a PUBLIC `ssm:` reference that must
+* stay resolved (issue #1901) and which cannot certify the generation of
+* anything. The rollback REPLAY passes {@link STATE_DERIVED_RULES}, because its
+* source is the JOURNAL record — a persisted bag holding no public expressions,
+* and the same generation the bag was resolved from one statement earlier. That
+* is the identical pairing `redactRollbackRecord` already makes for the record
+* it positions, so the two replay walks now agree about what their source is.
+*
+* "No public expressions" carries the carve-out {@link PathSourceRules} states
+* and this note must not restate without it: `cdkd import` warns and persists
+* the RAW template intrinsic, so a public `ssm:` token CAN sit in a record. The
+* replay then CERTIFIES one the deploy default would refuse, at a cost bounded
+* to the issue #1901 class — a spurious UPDATE over a value state should hold
+* resolved, never a disclosure, since an expression is what gets persisted
+* either way. See the replay call sites for why gating on
+* {@link isKnownSecretExpression} is the wrong way to close it.
+*
+* FOUR REFUSALS, each degrading to today's behaviour (the child leaf falls to
+* the plaintext-keyed value scan):
+*
+* 1. REFUSAL — the resolved parameter value is not a WHOLE recorded plaintext.
+*    A parameter the parent built with an `Fn::Sub` merely EMBEDS the secret,
+*    so there is no single expression the child's leaf could be persisted as.
+*    It also bounds what this store HOLDS: an entry carries a plaintext, and
+*    remembering one this pass never resolved has no purpose.
+* 2. REFUSAL — the expression is not a single complete `{{resolve:...}}` token.
+*    The same test {@link recordCrossStackExpression} applies at its own
+*    boundary, spelled here because this writer populates a DIFFERENT table.
+*    This is what rejects an embedded case that survived refusal 1 (a value
+*    scan produced `postgres://u:{{resolve:...}}@host`, which is not a token).
+* 3. REFUSAL — the expression may never EQUAL the plaintext it is recorded
+*    against. The reader returns the expression to be PERSISTED, so an entry
+*    whose two halves coincide hands a SECRET back as though it were a
+*    reference.
+*
+*    THIS IS REACHABLE, and an earlier revision of this note called it an
+*    unreachable invariant and told the next reader not to try to fence it.
+*    That was wrong twice over: wrong on the fact, and wrong to assert it,
+*    because {@link plaintextIndexOf}'s own note records the rule that
+*    "asserting something cannot be fenced suppresses the attempt, so it needs
+*    the same evidence a fence does" -- and no such evidence existed. The
+*    reaching shape is the issue
+*    [#1917](https://github.com/go-to-k/cdkd/issues/1917) family: a
+*    SELF-REFERENTIAL secret, whose stored VALUE is byte-identical to its own
+*    `{{resolve:...}}` text, so the pass records `SELF -> SELF`. The route is
+*    NOT the value scan the old note named. It is {@link redactByPath}'s
+*    `!sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)` arm, which
+*    returns `secrets.get(bag) ?? bag` -- and for a self-referential secret
+*    that IS the bag. Under {@link STATE_DERIVED_RULES} the same input arrives
+*    by the other door (`sourceIsSameGeneration` is true, so the arm takes
+*    `return source`, which is the same string again), so both callers reach it.
+*    Fenced by the self-referential case in
+*    `secret-redaction-nested-parameter-source.test.ts`.
+*/
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$1) return;
+	if (secrets.size === 0) return;
+	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
+	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
+	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
+	const resolvedParameters = resolvedProperties["Parameters"];
+	const sourceParameters = sourceProperties["Parameters"];
+	if (!isPlainObject$2(resolvedParameters) || !isPlainObject$2(sourceParameters)) return;
+	const positioned = redactSecretsForState(resolvedParameters, secrets, sourceParameters, rules);
+	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
+		const expression = positioned[name];
+		if (typeof expression !== "string") continue;
+		if (!isSingleDynamicReferenceToken(expression)) continue;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
+		if (expression === resolvedValue) continue;
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, resolvedValue);
+	}
+}
+/**
+* Copy a parent pass's per-PARAMETER associations onto a nested-stack CHILD
+* resource's own bag, as ordinary {@link crossStackAssociations} rows keyed by
+* `{Ref: <ParamName>}` (issue #2291).
+*
+* Called by the child {@link DeployEngine} once per resolver context, so each
+* child resource's fresh bag carries them. Pre-seeding every resource this way
+* does NOT reintroduce issue #2087's over-redaction: an association can only
+* change an answer through {@link positionByCrossStackSource}'s condition 1,
+* which requires the bag leaf to be a plaintext THIS resource's bag holds — and
+* since #2087 that is true only of resources whose own resolution consumed the
+* parameter. The scoping still comes from the plaintext bag; this table only
+* decides WHICH expression such a leaf takes.
+*
+* Nothing is copied when the parent recorded nothing, which is every non-nested
+* caller and every nested one whose parameters carry no secret.
+*/
+function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
+	const table = nestedStackParameterExpressions.get(parentSecrets);
+	if (table === void 0 || table.size === 0) return;
+	let associations = crossStackAssociations.get(childSecrets);
+	for (const [name, association] of table) {
+		const key = crossStackSourceKey({ Ref: name });
+		if (key === void 0) continue;
+		if (associations === void 0) {
+			associations = /* @__PURE__ */ new Map();
+			crossStackAssociations.set(childSecrets, associations);
+		}
+		if (typeof association === "symbol") {
+			associations.set(key, association);
+			continue;
+		}
+		storeAssociation(associations, key, association.expression, association.plaintext);
+	}
+}
+/**
+* The expression a nested-stack child's PARAMETER was resolved from, or
+* `undefined` when this pass cannot certify one (issue #2291).
+*
+* The DIFF-side twin of {@link positionByCrossStackSource}, and it must exist
+* or the fix trades one bug for another. The child's persisted state now holds
+* each parameter-fed leaf's OWN expression, so the desired side of the next
+* diff has to hold it too; the engine's `redactParametersForDiff` rewrites the
+* parameter bag through the plaintext-keyed map alone, which hands BOTH members
+* of a coinciding pair the survivor's expression. The two sides would then
+* never match for the losing parameter: a perpetual UPDATE on every deploy of
+* such a child, which is issue #2087's user-visible symptom arriving through a
+* different door.
+*
+* `parentSecrets` is the INHERITED bag — the parent's own per-resource map, the
+* object this table is keyed by — not the child resource's bag.
+*
+* The same THREE conditions {@link positionByCrossStackSource} applies, for the
+* same reasons; see that function's own notes for why condition 3 is not
+* subsumed by condition 2.
+*/
+function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
+	if (typeof resolvedValue !== "string" || resolvedValue === "") return void 0;
+	if (!parentSecrets.has(resolvedValue)) return void 0;
+	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association.plaintext !== resolvedValue) return void 0;
+	const recordedPlaintext = plaintextIndexOf(parentSecrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== resolvedValue) return void 0;
+	return association.expression;
+}
+/**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
 * a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
 * match incidental characters everywhere and mangle unrelated state. Such a
@@ -12235,11 +12665,12 @@ async function withRetry(operation, logicalId, opts = {}) {
 	} catch (error) {
 		lastError = error;
 		const message = error instanceof Error ? error.message : String(error);
+		const classifyText = retryClassificationText(error);
 		if (isMarkedNonRetryable(error)) throw error;
-		const retryable = opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message);
-		const propagation = defaultSchedule && isIamPropagationError(message);
+		const retryable = opts.isRetryable ? opts.isRetryable(classifyText, error) : isRetryableTransientError(error, classifyText);
+		const propagation = defaultSchedule && isIamPropagationError(classifyText);
 		if (propagation) sawPropagation = true;
-		const nameCooldown = defaultSchedule && !propagation && isNameCooldownError(message);
+		const nameCooldown = defaultSchedule && !propagation && isNameCooldownError(classifyText);
 		const attemptLimit = sawPropagation ? 26 : maxRetries;
 		if (!retryable || attempt >= attemptLimit) {
 			if (propagationRetries > 0 || serverErrorRetries > 0 || nameCooldownRetries > 0) {
@@ -16420,15 +16851,79 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `Fn::Select` / `Fn::FindInMap` all re-enter `resolveValue` and reach the
 	* parameter through this same `Ref` branch.
 	*
+	* WHICH EXPRESSION the pair is recorded against is the issue
+	* [#2291](https://github.com/go-to-k/cdkd/issues/2291) round-2 fix, and
+	* skipping it made the persist and diff halves DISAGREE.
+	*
+	* `inherited` is keyed by PLAINTEXT, so two parent parameters resolving to
+	* ONE value collapse to a single entry there and this method used to copy
+	* whichever expression SURVIVED. That is invisible for a leaf spelled exactly
+	* `{Ref: P}` — the persist path positions such a leaf through the parent's
+	* per-parameter association and never consults this bag's value — but every
+	* EMBEDDING shape (`Fn::Sub`, `Fn::Join`, and `{'Fn::Sub': '${P}'}`, which
+	* `crossStackSourceKey` refuses because its `Fn::Sub` arm requires a dotted
+	* attribute) falls to the plaintext-keyed VALUE SCAN, which reads exactly this
+	* bag. Meanwhile `DeployEngine.redactParametersForDiff` answers PER PARAMETER.
+	* So `Fn::Sub "postgres://u:${LoserParam}@host"` — the dominant CDK
+	* connection-string shape — persisted the SURVIVOR's expression while the
+	* desired side computed the LOSER's, and the two never matched again: a
+	* perpetual UPDATE, or a perpetual REPLACEMENT on a create-only property.
+	* That is issue [#2087](https://github.com/go-to-k/cdkd/issues/2087)'s symptom
+	* arriving through a different door, prevented for the bare-`Ref` leaf and
+	* created for the embedded one.
+	*
+	* Recording THIS parameter's own expression makes the value scan agree with
+	* the diff side, so both halves move together.
+	*
+	* THE RESIDUAL, and the earlier version of this note UNDERSTATED IT. It said
+	* the leftover case was "no worse than the behaviour before this fix". That
+	* is true only of the shape it was measured on. MEASURED 2026-08-27 against
+	* `main` (f56c2cf9) and against this branch, one child resource, parameters
+	* `A` and `B` resolving to one plaintext:
+	*
+	* | shape                                    | main    | here    |
+	* | ---------------------------------------- | ------- | ------- |
+	* | `{Ref: A}` and `{Ref: B}`                | agree   | agree   |
+	* | `Fn::Sub '${A}'` only                    | agree   | agree   |
+	* | `Fn::Sub 'x${A}'` **and** `{Ref: B}`     | agree   | DISAGREE|
+	*
+	* The third row is a NEW disagreement this PR introduces, not a pre-existing
+	* one it fails to fix: `main` had both halves take the collapsed survivor, so
+	* they matched (on the WRONG expression, which is issue #2291, but they
+	* matched). Here the DIFF side is per-parameter while an EMBEDDED leaf can
+	* only be redacted by the plaintext-keyed value scan, and this bag holds ONE
+	* entry — whichever `Ref` resolved LAST. So the embedded leaf takes `B`'s
+	* expression while the desired side computes `A`'s, and the resource reports
+	* an UPDATE on every deploy (a REPLACEMENT, on a create-only property).
+	*
+	* It is ORDER-DEPENDENT, which is why it is narrow: reversing the two
+	* properties makes the embedded parameter the last one resolved and the two
+	* halves agree again (measured). It also needs BOTH leaves in ONE resource —
+	* `perResourceSecrets` is keyed by logical id, so two resources get two bags
+	* and each is right. A resource that consumes and embeds BOTH parameters is
+	* unfixable here for the same reason and is genuinely inherent.
+	*
+	* CLOSING IT NEEDS A PLACEHOLDER-SPAN POSITION ARM — aligning an `Fn::Sub` /
+	* `Fn::Join` source against the resolved string to locate each placeholder's
+	* span and rewrite it from the association. That is a new positioning
+	* CONCEPT rather than an arm beside the existing ones: the persist path would
+	* have to reproduce the resolver's substitution semantics from a module that
+	* holds neither a resolver nor a parameter bag, and any divergence between
+	* the two reproductions is this same perpetual-UPDATE bug. Deferred to issue
+	* [#2320](https://github.com/go-to-k/cdkd/issues/2320) with the measurement.
+	* It shares only the word "span" with issue #2102, which registers live
+	* values for `{{resolve:...}}` TOKEN spans on the drift paths.
+	*
 	* Substituting is deliberately NOT done here — the resolved value is what
 	* reaches AWS, and an `Fn::Equals` over a parameter must compare the real
 	* value or the condition flips.
 	*/
-	recordInheritedParameterSecrets(value, context) {
+	recordInheritedParameterSecrets(parameterName, value, context) {
 		const inherited = context.inheritedSecrets;
 		const recorded = context.recordedSecretValues;
 		if (!inherited || inherited.size === 0 || !recorded) return;
-		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, expression);
+		const own = inheritedParameterExpression(inherited, parameterName, value);
+		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, own !== void 0 && plaintext === value ? own : expression);
 	}
 	/**
 	* Refuse a child parameter whose declared `Type` would COERCE an inherited
@@ -16493,7 +16988,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const value = context.parameters[logicalId];
 			const paramDef = context.template.Parameters?.[logicalId];
 			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, value), context)}`);
-			this.recordInheritedParameterSecrets(value, context);
+			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
@@ -19514,7 +20009,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BjebXXKD.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-R60Irey3.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -28346,6 +28841,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
@@ -28439,6 +28935,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				});
 				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
 				const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
+				recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 				const revertResult = await updateWithRollbackRetry(provider, [
 					op.logicalId,
 					current.physicalId,
@@ -28591,6 +29088,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					});
 					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
 					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
+					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
@@ -29533,6 +30031,8 @@ var DeployEngine = class {
 	* `this.buildResolverContext({...}, stackName)`.
 	*/
 	buildResolverContext(base, stackName) {
+		const recordedSecretValues = /* @__PURE__ */ new Map();
+		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
 		return {
 			template: base.template,
 			resources: base.resources,
@@ -29544,7 +30044,7 @@ var DeployEngine = class {
 			recordedImports: this.recordedImports,
 			recordedOutputReads: this.recordedOutputReads,
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
-			recordedSecretValues: /* @__PURE__ */ new Map()
+			recordedSecretValues
 		};
 	}
 	/**
@@ -29571,7 +30071,9 @@ var DeployEngine = class {
 	redactParametersForDiff(parameterValues) {
 		const inherited = this.options.inheritedSecrets;
 		if (!inherited || inherited.size === 0) return parameterValues;
-		return redactSecretsForState(parameterValues, inherited);
+		const out = {};
+		for (const [name, value] of Object.entries(parameterValues)) out[name] = inheritedParameterExpression(inherited, name, value) ?? redactSecretsForState(value, inherited);
+		return out;
 	}
 	/**
 	* Redact resolved secret plaintext out of a bag about to be PERSISTED to
@@ -30687,6 +31189,7 @@ var DeployEngine = class {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+				recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
@@ -30731,6 +31234,7 @@ var DeployEngine = class {
 				this.perResourceSecrets.set(logicalId, updateSecrets);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
+				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				if (JSON.stringify(redactSecretsForState(resolvedProps, updateSecrets, desiredProps)) === JSON.stringify(currentProps)) {
@@ -31398,5 +31902,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, MIGRATE_TMP_PREFIX as $n, redactSecretsForState as $t, renderStatefulReason as A, dockerSpawnEnvWithSensitive as An, ResourceUpdateNotSupportedError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, getDefaultStateBucketName as Bn, isRetryableTransientError as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalStartServiceError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, PartialFailureError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, NestedStackChildDirectDestroyError as Er, replayWarn as Et, green as F, runDockerStreaming as Fn, formatError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveSkipPrefix as Gn, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, resolveApp as Hn, markNonRetryable as Hr, DagBuilder as Ht, red as I, AssetManifestLoader as In, isCdkdError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveUseCdkBootstrapAssets as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveStateBucketWithDefault as Kn, TEMPLATE_SOURCED_RULES as Kt, yellow as L, getDockerImageBySourceHash as Ln, normalizeAwsError as Lr, applyRoleArnIfSet as Lt, bold as M, getDockerCmd as Mn, StackTerminationProtectionError as Mr, s3BucketArn as Mt, cyan as N, partitionSensitiveEnv as Nn, StateError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, ProvisioningError as Or, requireConfigObject as Ot, gray as P, runDockerForeground as Pn, SynthesisError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_URL_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, Synthesizer as Rn, withErrorHandling as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalMigrateError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, MissingCdkCliError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveAutoAssetStorage as Un, __exportAll as Ur, TemplateParser as Ut, isExportAliasCollision as V, getLegacyStateBucketName as Vn, isThrottlingError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveCaptureObservedState as Wn, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, warnDeprecatedNoPrefixCliFlag as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, stateBucketExistenceConfirmed as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, CFN_TEMPLATE_BODY_LIMIT as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, CrossAccountSecretRefusalError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, derivePartitionAndUrlSuffix as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DynamicReferenceRegionAmbiguousError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, clearBucketRegionCache as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, getAwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, findLargeInlineResources as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, resetAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, ConfigError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, CdkdError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, canonicalizeRegion as ir, interruptWatchListenerCount as it, formatResourceLine as j, formatDockerLoginError as jn, StackHasActiveImportsError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, buildDockerImage as kn, ResourceTimeoutError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, resolveBucketRegion as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, AssetError as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, expectedOwnerParam as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, AssemblyReader as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, setAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefaultAndSource as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, PARTITION_TABLE as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, processStackMessages as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, uploadCfnTemplate as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, AwsClients as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, DependencyError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LockError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, LocalInvokeBuildError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DeployCancelledError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, synthesisStatusMessage as zn, isMarkedNonRetryable as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-Dm-MdFR-.js.map
+export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
+//# sourceMappingURL=deploy-engine-Cvkqa30x.js.map