@go-to-k/cdkd 0.284.77 → 0.284.78

package/dist/{deploy-engine-Ce3payPI.js → deploy-engine-Cvkqa30x.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-rsHq2qI3.js";
+import { t as getCdkdVersion } from "./version-GEIr41xq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9158,9 +9158,13 @@ function splitGetAttStringForm(getAtt) {
 * (`(producer X / Y)`), so it is neither derivable from the source leaf nor
 * stable.
 *
-* THREE arms answer: `Fn::ImportValue`, `Fn::GetStackOutput`, and the
-* `Fn::GetAtt` on a nested-stack OUTPUT that issue #2055's read site
-* re-resolves. Every other leaf refuses.
+* FIVE arms answer, and the enumeration is kept current because a stale one
+* reads as exhaustive: `Fn::ImportValue`, `Fn::GetStackOutput`, the `Fn::GetAtt`
+* on a nested-stack OUTPUT that issue #2055's read site re-resolves, the
+* single-placeholder `Fn::Sub` that normalizes ONTO that `Fn::GetAtt` key
+* (issue #2270 round 3 -- this list said THREE until issue #2291 noticed it had
+* been four since then), and the `Ref` to a nested-stack CHILD's own PARAMETER
+* (issue #2291). Every other leaf refuses.
 *
 * `Region` and `RoleArn` are OPTIONAL slots, and an ABSENT one keys as empty
 * while a PRESENT-but-non-literal one refuses. Absent has to be its own key
@@ -9263,6 +9267,11 @@ function crossStackSourceKey(source) {
 			split.attributeName
 		].join(CROSS_STACK_KEY_SEPARATOR);
 	}
+	if (key === "Ref") {
+		const parameterName = literalStringOrUndefined(source[key]);
+		if (parameterName === void 0) return void 0;
+		return ["Ref", parameterName].join(CROSS_STACK_KEY_SEPARATOR);
+	}
 }
 /**
 * Remember, FOR THE PASS THAT OWNS `secrets`, that the cross-stack source leaf
@@ -9282,6 +9291,34 @@ function recordCrossStackExpression(secrets, key, expression, plaintext) {
 		associations = /* @__PURE__ */ new Map();
 		crossStackAssociations.set(secrets, associations);
 	}
+	storeAssociation(associations, key, expression, plaintext);
+}
+/**
+* The store's WRITE rule, shared by {@link recordCrossStackExpression} and
+* {@link recordNestedStackParameterExpressions} so the two tables cannot drift
+* apart on what a second sighting means.
+*
+* A key recorded against a DIFFERENT (expression, plaintext) pair is POISONED
+* to {@link CONFLICTING_CROSS_STACK} rather than overwritten; an already
+* poisoned key stays poisoned, because a third sighting cannot un-contradict
+* the first two. Every reader refuses a poisoned key, which degrades to the
+* value scan — today's behaviour — rather than guessing between the two.
+*
+* WHAT IS AND IS NOT FENCED, stated because a reader would otherwise assume the
+* whole thing is (review of issue #2291). The POISON-vs-OVERWRITE decision IS
+* fenced: a second sighting under a THIRD expression makes the two outcomes
+* differ (poison refuses and falls back; overwriting would certify the third),
+* and a case asserts it. Nothing fences the branch from
+* {@link recordNestedStackParameterExpressions}'s side in PRODUCTION, because
+* that writer runs once per resource bag and `Object.entries` cannot yield one
+* name twice — the poison is reachable only through this module's API. It is
+* kept as an INVARIANT, not claimed as covered behaviour.
+*
+* The `isSingleDynamicReferenceToken` shape invariant is deliberately NOT here:
+* it belongs to each writer, which is where the parameters are named and where
+* a swap could be introduced.
+*/
+function storeAssociation(associations, key, expression, plaintext) {
 	const seen = associations.get(key);
 	if (seen === void 0) {
 		associations.set(key, {
@@ -9294,6 +9331,218 @@ function recordCrossStackExpression(secrets, key, expression, plaintext) {
 	if (seen.expression !== expression || seen.plaintext !== plaintext) associations.set(key, CONFLICTING_CROSS_STACK);
 }
 /**
+* The `AWS::CloudFormation::Stack` type string, named once because the recorder
+* below gates on it and the tests assert against the same population.
+*
+* DUPLICATED, deliberately: `intrinsic-function-resolver.ts` declares the same
+* literal under the same name (for the `Outputs.<Name>` re-resolution of issue
+* #2055). This module is a LEAF by design -- see the file header, it imports
+* nothing, because both the resolver and the deploy engine consume it -- so
+* importing that spelling would close a cycle, and exporting this one for the
+* resolver to import would make the leaf a source of values rather than of
+* pure functions. The two cannot drift into DISAGREEMENT in any way that
+* matters: an AWS resource type string is fixed by AWS, and a typo in either
+* copy makes that copy's gate simply never fire (no-op), never fire wrongly.
+*/
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+/**
+* What a PARENT stack's resolution proved about each `Parameters` entry of an
+* `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
+* child's PARAMETER NAME (issue
+* [#2291](https://github.com/go-to-k/cdkd/issues/2291)).
+*
+* WHY A THIRD STORE, when {@link crossStackAssociations} already holds
+* per-leaf associations. This one is OUTBOUND: it is written against the
+* PARENT's bag and describes leaves of the CHILD's template, so it has to be
+* transported across the engine boundary before any reader can use it. The
+* child's per-resource bag then receives those entries as ORDINARY
+* {@link crossStackAssociations} rows (see
+* {@link inheritNestedStackParameterAssociations}), which is what lets the
+* existing three-condition reader answer for them with no new arm.
+*
+* KEEPING THE TWO TABLES SEPARATE IS LOAD-BEARING, not tidiness. A child engine
+* that itself owns a grandchild `AWS::CloudFormation::Stack` row records the
+* GRANDCHILD's parameter names against the CHILD's bag — the same bag that
+* already carries the child's own INBOUND `Ref` associations. Writing both into
+* one table means a grandchild parameter sharing a NAME with a child parameter
+* poisons the child's entry (two expressions under one key), so a leaf that was
+* being certified correctly falls back to the value scan the moment a
+* same-named parameter appears one level down. Two tables make the collision
+* impossible rather than unlikely.
+*
+* A `WeakMap` keyed by the parent pass's own bag, for the reason
+* {@link crossStackAssociations} gives: the entries hold PLAINTEXT, and they
+* must not outlive the pass that fetched them.
+*/
+const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
+/**
+* Record, for the pass that owns `secrets`, which `{{resolve:...}}` expression
+* each `Parameters` entry of a nested-stack row was resolved FROM (issue
+* #2291). No-op for every other resource type.
+*
+* THE EXPRESSIONS COME FROM THE POSITION PASS, not from `secrets`, and that is
+* the whole reason this works at all. `RecordedSecretValues` is keyed by
+* PLAINTEXT, so two parameters resolving to one value have already collapsed to
+* a single entry there by the time this runs — asking the map which expression
+* a given parameter came from returns the SURVIVOR for both. What has not
+* collapsed is the parent's own template: `Properties.Parameters.<Name>` still
+* holds each entry's own source leaf. So this walks the parent's resolved
+* parameter bag against that source with {@link redactSecretsForState}, which
+* is exactly the machinery the parent's persist path already uses and which
+* certifies PER LEAF (measured on this issue: the parent's own two properties
+* come out correct while the child's collapse onto one). Deriving the answer
+* from the positioner rather than restating its rules is what keeps this from
+* drifting away from the persist path.
+*
+* THE `rules` PARAMETER IS THE CALLER'S GENERATION CLAIM, not a knob. The
+* DEPLOY path passes {@link TEMPLATE_DERIVED_RULES} (the default): its source is
+* the parent's TEMPLATE, which can carry a PUBLIC `ssm:` reference that must
+* stay resolved (issue #1901) and which cannot certify the generation of
+* anything. The rollback REPLAY passes {@link STATE_DERIVED_RULES}, because its
+* source is the JOURNAL record — a persisted bag holding no public expressions,
+* and the same generation the bag was resolved from one statement earlier. That
+* is the identical pairing `redactRollbackRecord` already makes for the record
+* it positions, so the two replay walks now agree about what their source is.
+*
+* "No public expressions" carries the carve-out {@link PathSourceRules} states
+* and this note must not restate without it: `cdkd import` warns and persists
+* the RAW template intrinsic, so a public `ssm:` token CAN sit in a record. The
+* replay then CERTIFIES one the deploy default would refuse, at a cost bounded
+* to the issue #1901 class — a spurious UPDATE over a value state should hold
+* resolved, never a disclosure, since an expression is what gets persisted
+* either way. See the replay call sites for why gating on
+* {@link isKnownSecretExpression} is the wrong way to close it.
+*
+* FOUR REFUSALS, each degrading to today's behaviour (the child leaf falls to
+* the plaintext-keyed value scan):
+*
+* 1. REFUSAL — the resolved parameter value is not a WHOLE recorded plaintext.
+*    A parameter the parent built with an `Fn::Sub` merely EMBEDS the secret,
+*    so there is no single expression the child's leaf could be persisted as.
+*    It also bounds what this store HOLDS: an entry carries a plaintext, and
+*    remembering one this pass never resolved has no purpose.
+* 2. REFUSAL — the expression is not a single complete `{{resolve:...}}` token.
+*    The same test {@link recordCrossStackExpression} applies at its own
+*    boundary, spelled here because this writer populates a DIFFERENT table.
+*    This is what rejects an embedded case that survived refusal 1 (a value
+*    scan produced `postgres://u:{{resolve:...}}@host`, which is not a token).
+* 3. REFUSAL — the expression may never EQUAL the plaintext it is recorded
+*    against. The reader returns the expression to be PERSISTED, so an entry
+*    whose two halves coincide hands a SECRET back as though it were a
+*    reference.
+*
+*    THIS IS REACHABLE, and an earlier revision of this note called it an
+*    unreachable invariant and told the next reader not to try to fence it.
+*    That was wrong twice over: wrong on the fact, and wrong to assert it,
+*    because {@link plaintextIndexOf}'s own note records the rule that
+*    "asserting something cannot be fenced suppresses the attempt, so it needs
+*    the same evidence a fence does" -- and no such evidence existed. The
+*    reaching shape is the issue
+*    [#1917](https://github.com/go-to-k/cdkd/issues/1917) family: a
+*    SELF-REFERENTIAL secret, whose stored VALUE is byte-identical to its own
+*    `{{resolve:...}}` text, so the pass records `SELF -> SELF`. The route is
+*    NOT the value scan the old note named. It is {@link redactByPath}'s
+*    `!sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)` arm, which
+*    returns `secrets.get(bag) ?? bag` -- and for a self-referential secret
+*    that IS the bag. Under {@link STATE_DERIVED_RULES} the same input arrives
+*    by the other door (`sourceIsSameGeneration` is true, so the arm takes
+*    `return source`, which is the same string again), so both callers reach it.
+*    Fenced by the self-referential case in
+*    `secret-redaction-nested-parameter-source.test.ts`.
+*/
+function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$1) return;
+	if (secrets.size === 0) return;
+	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
+	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
+	if (!Object.hasOwn(sourceProperties, "Parameters")) return;
+	const resolvedParameters = resolvedProperties["Parameters"];
+	const sourceParameters = sourceProperties["Parameters"];
+	if (!isPlainObject$2(resolvedParameters) || !isPlainObject$2(sourceParameters)) return;
+	const positioned = redactSecretsForState(resolvedParameters, secrets, sourceParameters, rules);
+	let table = nestedStackParameterExpressions.get(secrets);
+	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
+		if (typeof resolvedValue !== "string" || !secrets.has(resolvedValue)) continue;
+		const expression = positioned[name];
+		if (typeof expression !== "string") continue;
+		if (!isSingleDynamicReferenceToken(expression)) continue;
+		const sourceLeaf = sourceParameters[name];
+		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
+		if (expression === resolvedValue) continue;
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, resolvedValue);
+	}
+}
+/**
+* Copy a parent pass's per-PARAMETER associations onto a nested-stack CHILD
+* resource's own bag, as ordinary {@link crossStackAssociations} rows keyed by
+* `{Ref: <ParamName>}` (issue #2291).
+*
+* Called by the child {@link DeployEngine} once per resolver context, so each
+* child resource's fresh bag carries them. Pre-seeding every resource this way
+* does NOT reintroduce issue #2087's over-redaction: an association can only
+* change an answer through {@link positionByCrossStackSource}'s condition 1,
+* which requires the bag leaf to be a plaintext THIS resource's bag holds — and
+* since #2087 that is true only of resources whose own resolution consumed the
+* parameter. The scoping still comes from the plaintext bag; this table only
+* decides WHICH expression such a leaf takes.
+*
+* Nothing is copied when the parent recorded nothing, which is every non-nested
+* caller and every nested one whose parameters carry no secret.
+*/
+function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
+	const table = nestedStackParameterExpressions.get(parentSecrets);
+	if (table === void 0 || table.size === 0) return;
+	let associations = crossStackAssociations.get(childSecrets);
+	for (const [name, association] of table) {
+		const key = crossStackSourceKey({ Ref: name });
+		if (key === void 0) continue;
+		if (associations === void 0) {
+			associations = /* @__PURE__ */ new Map();
+			crossStackAssociations.set(childSecrets, associations);
+		}
+		if (typeof association === "symbol") {
+			associations.set(key, association);
+			continue;
+		}
+		storeAssociation(associations, key, association.expression, association.plaintext);
+	}
+}
+/**
+* The expression a nested-stack child's PARAMETER was resolved from, or
+* `undefined` when this pass cannot certify one (issue #2291).
+*
+* The DIFF-side twin of {@link positionByCrossStackSource}, and it must exist
+* or the fix trades one bug for another. The child's persisted state now holds
+* each parameter-fed leaf's OWN expression, so the desired side of the next
+* diff has to hold it too; the engine's `redactParametersForDiff` rewrites the
+* parameter bag through the plaintext-keyed map alone, which hands BOTH members
+* of a coinciding pair the survivor's expression. The two sides would then
+* never match for the losing parameter: a perpetual UPDATE on every deploy of
+* such a child, which is issue #2087's user-visible symptom arriving through a
+* different door.
+*
+* `parentSecrets` is the INHERITED bag — the parent's own per-resource map, the
+* object this table is keyed by — not the child resource's bag.
+*
+* The same THREE conditions {@link positionByCrossStackSource} applies, for the
+* same reasons; see that function's own notes for why condition 3 is not
+* subsumed by condition 2.
+*/
+function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
+	if (typeof resolvedValue !== "string" || resolvedValue === "") return void 0;
+	if (!parentSecrets.has(resolvedValue)) return void 0;
+	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	if (association.plaintext !== resolvedValue) return void 0;
+	const recordedPlaintext = plaintextIndexOf(parentSecrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== resolvedValue) return void 0;
+	return association.expression;
+}
+/**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
 * a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
 * match incidental characters everywhere and mangle unrelated state. Such a
@@ -16602,15 +16851,79 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* `Fn::Select` / `Fn::FindInMap` all re-enter `resolveValue` and reach the
 	* parameter through this same `Ref` branch.
 	*
+	* WHICH EXPRESSION the pair is recorded against is the issue
+	* [#2291](https://github.com/go-to-k/cdkd/issues/2291) round-2 fix, and
+	* skipping it made the persist and diff halves DISAGREE.
+	*
+	* `inherited` is keyed by PLAINTEXT, so two parent parameters resolving to
+	* ONE value collapse to a single entry there and this method used to copy
+	* whichever expression SURVIVED. That is invisible for a leaf spelled exactly
+	* `{Ref: P}` — the persist path positions such a leaf through the parent's
+	* per-parameter association and never consults this bag's value — but every
+	* EMBEDDING shape (`Fn::Sub`, `Fn::Join`, and `{'Fn::Sub': '${P}'}`, which
+	* `crossStackSourceKey` refuses because its `Fn::Sub` arm requires a dotted
+	* attribute) falls to the plaintext-keyed VALUE SCAN, which reads exactly this
+	* bag. Meanwhile `DeployEngine.redactParametersForDiff` answers PER PARAMETER.
+	* So `Fn::Sub "postgres://u:${LoserParam}@host"` — the dominant CDK
+	* connection-string shape — persisted the SURVIVOR's expression while the
+	* desired side computed the LOSER's, and the two never matched again: a
+	* perpetual UPDATE, or a perpetual REPLACEMENT on a create-only property.
+	* That is issue [#2087](https://github.com/go-to-k/cdkd/issues/2087)'s symptom
+	* arriving through a different door, prevented for the bare-`Ref` leaf and
+	* created for the embedded one.
+	*
+	* Recording THIS parameter's own expression makes the value scan agree with
+	* the diff side, so both halves move together.
+	*
+	* THE RESIDUAL, and the earlier version of this note UNDERSTATED IT. It said
+	* the leftover case was "no worse than the behaviour before this fix". That
+	* is true only of the shape it was measured on. MEASURED 2026-08-27 against
+	* `main` (f56c2cf9) and against this branch, one child resource, parameters
+	* `A` and `B` resolving to one plaintext:
+	*
+	* | shape                                    | main    | here    |
+	* | ---------------------------------------- | ------- | ------- |
+	* | `{Ref: A}` and `{Ref: B}`                | agree   | agree   |
+	* | `Fn::Sub '${A}'` only                    | agree   | agree   |
+	* | `Fn::Sub 'x${A}'` **and** `{Ref: B}`     | agree   | DISAGREE|
+	*
+	* The third row is a NEW disagreement this PR introduces, not a pre-existing
+	* one it fails to fix: `main` had both halves take the collapsed survivor, so
+	* they matched (on the WRONG expression, which is issue #2291, but they
+	* matched). Here the DIFF side is per-parameter while an EMBEDDED leaf can
+	* only be redacted by the plaintext-keyed value scan, and this bag holds ONE
+	* entry — whichever `Ref` resolved LAST. So the embedded leaf takes `B`'s
+	* expression while the desired side computes `A`'s, and the resource reports
+	* an UPDATE on every deploy (a REPLACEMENT, on a create-only property).
+	*
+	* It is ORDER-DEPENDENT, which is why it is narrow: reversing the two
+	* properties makes the embedded parameter the last one resolved and the two
+	* halves agree again (measured). It also needs BOTH leaves in ONE resource —
+	* `perResourceSecrets` is keyed by logical id, so two resources get two bags
+	* and each is right. A resource that consumes and embeds BOTH parameters is
+	* unfixable here for the same reason and is genuinely inherent.
+	*
+	* CLOSING IT NEEDS A PLACEHOLDER-SPAN POSITION ARM — aligning an `Fn::Sub` /
+	* `Fn::Join` source against the resolved string to locate each placeholder's
+	* span and rewrite it from the association. That is a new positioning
+	* CONCEPT rather than an arm beside the existing ones: the persist path would
+	* have to reproduce the resolver's substitution semantics from a module that
+	* holds neither a resolver nor a parameter bag, and any divergence between
+	* the two reproductions is this same perpetual-UPDATE bug. Deferred to issue
+	* [#2320](https://github.com/go-to-k/cdkd/issues/2320) with the measurement.
+	* It shares only the word "span" with issue #2102, which registers live
+	* values for `{{resolve:...}}` TOKEN spans on the drift paths.
+	*
 	* Substituting is deliberately NOT done here — the resolved value is what
 	* reaches AWS, and an `Fn::Equals` over a parameter must compare the real
 	* value or the condition flips.
 	*/
-	recordInheritedParameterSecrets(value, context) {
+	recordInheritedParameterSecrets(parameterName, value, context) {
 		const inherited = context.inheritedSecrets;
 		const recorded = context.recordedSecretValues;
 		if (!inherited || inherited.size === 0 || !recorded) return;
-		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, expression);
+		const own = inheritedParameterExpression(inherited, parameterName, value);
+		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, own !== void 0 && plaintext === value ? own : expression);
 	}
 	/**
 	* Refuse a child parameter whose declared `Type` would COERCE an inherited
@@ -16675,7 +16988,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const value = context.parameters[logicalId];
 			const paramDef = context.template.Parameters?.[logicalId];
 			this.logger.debug(`Resolved Ref to parameter: ${logicalId} -> ${this.maskSecretsForLog(stringifyParameterForLog(paramDef, value), context)}`);
-			this.recordInheritedParameterSecrets(value, context);
+			this.recordInheritedParameterSecrets(logicalId, value, context);
 			return value;
 		}
 		const pseudoValue = await this.resolvePseudoParameter(logicalId, context);
@@ -19696,7 +20009,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CDfupCgW.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-R60Irey3.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -28528,6 +28841,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
@@ -28621,6 +28935,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				});
 				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
 				const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
+				recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 				const revertResult = await updateWithRollbackRetry(provider, [
 					op.logicalId,
 					current.physicalId,
@@ -28773,6 +29088,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 					});
 					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
 					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
+					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
@@ -29715,6 +30031,8 @@ var DeployEngine = class {
 	* `this.buildResolverContext({...}, stackName)`.
 	*/
 	buildResolverContext(base, stackName) {
+		const recordedSecretValues = /* @__PURE__ */ new Map();
+		if (this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0) inheritNestedStackParameterAssociations(recordedSecretValues, this.options.inheritedSecrets);
 		return {
 			template: base.template,
 			resources: base.resources,
@@ -29726,7 +30044,7 @@ var DeployEngine = class {
 			recordedImports: this.recordedImports,
 			recordedOutputReads: this.recordedOutputReads,
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
-			recordedSecretValues: /* @__PURE__ */ new Map()
+			recordedSecretValues
 		};
 	}
 	/**
@@ -29753,7 +30071,9 @@ var DeployEngine = class {
 	redactParametersForDiff(parameterValues) {
 		const inherited = this.options.inheritedSecrets;
 		if (!inherited || inherited.size === 0) return parameterValues;
-		return redactSecretsForState(parameterValues, inherited);
+		const out = {};
+		for (const [name, value] of Object.entries(parameterValues)) out[name] = inheritedParameterExpression(inherited, name, value) ?? redactSecretsForState(value, inherited);
+		return out;
 	}
 	/**
 	* Redact resolved secret plaintext out of a bag about to be PERSISTED to
@@ -30869,6 +31189,7 @@ var DeployEngine = class {
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+				recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
@@ -30913,6 +31234,7 @@ var DeployEngine = class {
 				this.perResourceSecrets.set(logicalId, updateSecrets);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
+				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				if (JSON.stringify(redactSecretsForState(resolvedProps, updateSecrets, desiredProps)) === JSON.stringify(currentProps)) {
@@ -31581,4 +31903,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-Ce3payPI.js.map
+//# sourceMappingURL=deploy-engine-Cvkqa30x.js.map