@go-to-k/cdkd 0.284.80 → 0.284.82

package/dist/{deploy-engine-Dsd8oL2h.js → deploy-engine-Dh4Jid_H.js}

@@ -1,5 +1,5 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-C9-E73FI.js";
-import { t as getCdkdVersion } from "./version-CdU_rRxd.js";
+import { t as getCdkdVersion } from "./version-D_b3uJus.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4008,6 +4008,83 @@ function findLargeInlineResources(template, threshold = LARGE_INLINE_RESOURCE_TH
 	return result;
 }
 
+//#endregion
+//#region src/utils/parameter-types.ts
+/**
+* ONE definition of "is this CloudFormation Parameter `Type` LIST-shaped?".
+*
+* cdkd used to hold TWO independent answers to this question (issue
+* [#2347](https://github.com/go-to-k/cdkd/issues/2347)):
+*
+* - `coerceParameterTypedValue` in `src/deployment/intrinsic-function-resolver.ts`
+*   named exactly two list types (`List<Number>`, `CommaDelimitedList`) in a
+*   `switch`, so every other `List<...>` spelling fell to `default` and a
+*   `Ref` to it resolved to the raw comma-joined STRING;
+* - `stringifyParamDefault` in `src/synthesis/macro-expander.ts` tested
+*   `inner.startsWith('List<') || inner === 'CommaDelimitedList'` when choosing
+*   the placeholder shape for an `AWS::SSM::Parameter::Value<...>` parameter,
+*   i.e. the WIDER, correct view.
+*
+* The two disagreeing is what let a `List<AWS::EC2::Subnet::Id>` child
+* parameter be handed to a nested stack as a string. They now share this
+* predicate, so a third spelling cannot appear without deleting this file.
+*
+* This lives in `src/utils/` rather than beside either consumer because it has
+* TWO, in different layers -- `src/deployment/intrinsic-function-resolver.ts`
+* and `src/synthesis/macro-expander.ts`. Hosting it in `src/deployment/` gave
+* the tree its FIRST `src/synthesis/**` -> `src/deployment/**` import, which
+* inverts the documented layer order (synthesis runs before deployment); every
+* other synthesis import goes to `../types`, `../utils` or `../cli`.
+* `src/utils/ip-protocol.ts` is the precedent, hosted here for the same reason
+* and stating it in the same place. `src/types/` was the other candidate and is
+* wrong for this: it carries type declarations plus the constants and helpers
+* that read them, not a standalone runtime predicate with no type of its own.
+*
+* ## What CloudFormation actually defines
+*
+* Measured 2026-08-28 against the AWS-published enumerations, NOT against a
+* library:
+*
+* - `parameters-section-structure.html` lists the base types as `String`,
+*   `Number`, `List<Number>`, `CommaDelimitedList`, plus "AWS-specific
+*   parameter types" and "Systems Manager parameter types". **A bare
+*   `List<String>` is NOT in that enumeration.**
+* - `cloudformation-supplied-parameter-types.html` enumerates ten AWS-specific
+*   SCALAR types and nine `List<AWS::...>` types (`List<AWS::EC2::Subnet::Id>`,
+*   `List<AWS::EC2::SecurityGroup::Id>`, ...). `List<String>` appears only as
+*   the INNER shape of the Systems Manager form
+*   `AWS::SSM::Parameter::Value<List<String>>`.
+*
+* `List<String>` is nevertheless accepted here, because `aws-cdk-lib`'s own
+* `CfnParameter` accepts it (`isListType` in
+* `node_modules/aws-cdk-lib/core/lib/cfn-parameter.js` is a substring test) and
+* `valueAsList()` on such a parameter synthesizes a template cdkd will deploy
+* WITHOUT CloudFormation ever seeing it. Treating it as a list is the reading
+* that agrees with the app that produced it; the alternative silently hands a
+* string to something the CDK typed as a string list.
+*
+* ## Why this is `startsWith`, not `aws-cdk-lib`'s `indexOf`
+*
+* `indexOf('List<') >= 0` also matches `MyList<String>` and, load-bearing here,
+* the Systems Manager OUTER form `AWS::SSM::Parameter::Value<List<String>>`.
+* That outer form must NOT be list-shaped for the coercion: the VALUE supplied
+* for an SSM-typed parameter is a Parameter Store KEY, not the resolved list,
+* so splitting it on `,` would shred a key rather than build a list. The
+* macro-expander asks this question of the INNER shape it has already peeled
+* out of `Value<...>`, so the same predicate serves both sites unchanged.
+*
+* A closing `>` is required, so `List<`, `List<>` and `List<String` are NOT
+* list-shaped. That is the whole of the claim: this predicate is a test of the
+* SPELLING, not a validator. Measured, `List< >`, `List<a>`, `List<<>>` and
+* `List<X>>` all return `true` -- nothing here rejects a nonsense inner type,
+* and cdkd deploys without CloudFormation ever seeing the template, so no
+* service-side validation stands behind it either.
+*/
+function isListParameterType(type) {
+	if (type === "CommaDelimitedList") return true;
+	return type.length > 6 && type.startsWith("List<") && type.endsWith(">");
+}
+
 //#endregion
 //#region src/synthesis/macro-expander.ts
 /** 600 seconds = 10 minutes. SDK waiter's `maxWaitTime` is in seconds. */
@@ -4281,8 +4358,7 @@ function stringifyParamDefault(value, type, paramKey, logger) {
 		const known = PARAMETER_TYPE_PLACEHOLDERS[type];
 		if (known !== void 0) return known;
 		if (type.startsWith("AWS::SSM::Parameter::Value<")) {
-			const inner = type.slice(27, -1);
-			if (inner.startsWith("List<") || inner === "CommaDelimitedList") return "placeholder,placeholder";
+			if (isListParameterType(type.slice(27, -1))) return "placeholder,placeholder";
 			return "placeholder";
 		}
 		logger.warn(`Parameter '${paramKey}' has unrecognized CFn Type '${type}'; using a generic string placeholder for the transient macro-expansion changeset. If CFn rejects the changeset with a type error, file an issue with the offending Type.`);
@@ -9646,6 +9722,8 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		const sourceLeaf = sourceParameters[name];
 		if (typeof sourceLeaf === "string" && expression !== sourceLeaf) continue;
 		if (expression === resolvedValue) continue;
+		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
+		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
 		if (table === void 0) {
 			table = /* @__PURE__ */ new Map();
 			nestedStackParameterExpressions.set(secrets, table);
@@ -9705,19 +9783,35 @@ function inheritNestedStackParameterAssociations(childSecrets, parentSecrets) {
 * `parentSecrets` is the INHERITED bag — the parent's own per-resource map, the
 * object this table is keyed by — not the child resource's bag.
 *
-* The same THREE conditions {@link positionByCrossStackSource} applies, for the
-* same reasons; see that function's own notes for why condition 3 is not
-* subsumed by condition 2.
+* The same THREE conditions the persist side applies, because it is literally
+* the same code: {@link certifiedExpressionForLeaf} OWNS the question and both
+* halves call it. See that function for why condition 3 is not subsumed by
+* condition 2.
+*
+* RETURNS AN ARRAY for a LIST-typed parameter (issue
+* [#2327](https://github.com/go-to-k/cdkd/issues/2327)), through the same
+* {@link certifiedListForLeaf} the persist side reaches from
+* {@link positionListByCrossStackSource}. `coerceParameterTypedValue` splits a
+* `CommaDelimitedList` parameter's STRING into an array before either side sees
+* it, so a scalar answer here would be compared against an array in state and
+* report a change forever — this function's own failure mode, one shape over.
+*
+* TWO CALLERS, and the widened return type is why the second one asks a
+* different question. `redactParametersForDiff` assigns the result into a
+* `Record<string, unknown>` and needs the whole parameter's answer, array
+* included. `IntrinsicFunctionResolver.recordInheritedParameterSecrets` writes
+* into a `Map<string, string>` keyed by PLAINTEXT, so it asks this per
+* PLAINTEXT — passing the carried plaintext rather than the parameter's value —
+* and keeps only a `string` answer. That is not a workaround for the type: a
+* plaintext-keyed bag has one slot per plaintext, and the question it needs
+* answered is "does THIS parameter certify THIS plaintext", which is the same
+* question for a scalar and for an element of a list.
 */
 function inheritedParameterExpression(parentSecrets, parameterName, resolvedValue) {
-	if (typeof resolvedValue !== "string" || resolvedValue === "") return void 0;
-	if (!parentSecrets.has(resolvedValue)) return void 0;
 	const association = nestedStackParameterExpressions.get(parentSecrets)?.get(parameterName);
 	if (association === void 0 || typeof association === "symbol") return void 0;
-	if (association.plaintext !== resolvedValue) return void 0;
-	const recordedPlaintext = plaintextIndexOf(parentSecrets).get(association.expression);
-	if (recordedPlaintext !== void 0 && recordedPlaintext !== resolvedValue) return void 0;
-	return association.expression;
+	if (Array.isArray(resolvedValue)) return certifiedListForLeaf(parentSecrets, association, resolvedValue);
+	return certifiedExpressionForLeaf(parentSecrets, association, resolvedValue);
 }
 /**
 * A resolved secret value shorter than this is NOT used as a redaction needle:
@@ -10206,6 +10300,103 @@ function plaintextIndexOf(secrets) {
 	return plaintextOf;
 }
 /**
+* THE THREE CONDITIONS, in ONE place, over one bag and one already-resolved
+* association (issue [#2327](https://github.com/go-to-k/cdkd/issues/2327)).
+*
+* Three call sites ask this same question and every one of them must answer it
+* identically or the PERSIST side and the DIFF side disagree — which is not a
+* hypothetical: the two halves must produce the same expression for the same
+* leaf, or the desired side of the next diff never matches what was persisted
+* and the resource reports a change on every deploy (issue #2087's symptom,
+* arriving through a second spelling of one predicate). The sites are
+* {@link positionByCrossStackSource} (persist, string leaf),
+* {@link certifiedListForLeaf} (persist and diff, list leaf) and
+* {@link inheritedParameterExpression} (diff, whole parameter). THIS FUNCTION
+* OWNS THE QUESTION; none of them re-spells it.
+*
+* 1. The leaf's WHOLE value is a recorded secret plaintext. A leaf that merely
+*    EMBEDS a secret is not this shape and must keep going to the value scan,
+*    which rewrites just the substring. This is also what keeps a PUBLIC
+*    reference out (issue #1901): the resolver records a plaintext only on a
+*    proven-secret verdict, so a public parameter's value is not a key here.
+*    The empty string is excluded for the reason the value pass excludes it: it
+*    is not a distinguishing value.
+* 2. The association is ABOUT THIS LEAF — the plaintext the WRITER recorded
+*    beside the expression equals the leaf. Within one pass this is the only
+*    guard against a bag/source MISALIGNMENT: a readback bag can hold a
+*    DIFFERENT resource's secret while the source leaf still spells this
+*    import, and condition 3 cannot refuse that (it must ACCEPT an expression
+*    absent from the pass's map, since the collapsed loser is absent too).
+* 3. The match is not DEMONSTRABLY another value's expression, over the
+*    {@link plaintextIndexOf} index. NOT subsumed by condition 2: that one
+*    compares what the WRITER recorded, this one what THIS pass's own map
+*    holds, and they can disagree when one reference answers differently in two
+*    regions (issue #1933). The collapsed LOSER is absent from the index, so it
+*    passes — which is the case this whole mechanism exists to serve.
+*/
+function certifiedExpressionForLeaf(secrets, association, leaf) {
+	if (typeof leaf !== "string" || leaf === "") return void 0;
+	if (!secrets.has(leaf)) return void 0;
+	if (association.plaintext !== leaf) return void 0;
+	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
+	if (recordedPlaintext !== void 0 && recordedPlaintext !== leaf) return void 0;
+	return association.expression;
+}
+/**
+* Apply {@link certifiedExpressionForLeaf} to every ELEMENT of a list leaf
+* (issue [#2327](https://github.com/go-to-k/cdkd/issues/2327)).
+*
+* WHAT "POSITION" MEANS FOR A LIST ELEMENT, which is the question that killed
+* the earlier attempt in issue #2012 and has to be answered before any array
+* may be certified: **it is not the index.** There is no source ARRAY to align
+* against — a list leaf's source is ONE intrinsic standing for the whole list —
+* so an index-based pairing would have nothing on the other side to pair WITH,
+* and inventing one is exactly the fabrication issue #2012 refused. What
+* certifies an element is its OWN VALUE, through condition 1 and condition 2
+* above. Order is therefore irrelevant: a reordered array certifies
+* identically, and an element the conditions do not reach is left exactly where
+* the value scan would have left it.
+*
+* NOTHING IS FABRICATED. The output array has the SAME length and the SAME
+* element ORDER as the input; every element is either an expression certified
+* from that element's own recorded plaintext, or the value-scan answer this
+* module already produces for it. No element is added, dropped, reordered, or
+* copied from the source — so there is no baseline content here that
+* `cdkd drift --revert` could push to AWS but AWS never reported. That is the
+* constraint the issue #2012 review imposed, satisfied structurally rather than
+* argued around.
+*
+* SHARED BY BOTH HALVES, and that sharing is load-bearing rather than tidy: the
+* persist side reaches it through {@link positionListByCrossStackSource} and
+* the diff side through {@link inheritedParameterExpression}, with the same
+* association content on either side ({@link inheritNestedStackParameterAssociations}
+* copies the parent's rows onto the child bag). Two spellings that agreed on
+* every case but one would reintroduce the perpetual UPDATE at that one case.
+*
+* Returns `undefined` when NO element was certified, so every caller falls
+* through to the value scan and keeps its identity-return: with an empty
+* secrets map (the issue #1900 unchanged-resource path) condition 1 refuses
+* every element, so this costs one walk and changes nothing.
+*/
+function certifiedListForLeaf(secrets, association, bag) {
+	const certified = bag.map((element) => certifiedExpressionForLeaf(secrets, association, element));
+	if (certified.every((expression) => expression === void 0)) return void 0;
+	return bag.map((element, i) => certified[i] ?? redactSecretsForState(element, secrets));
+}
+/**
+* The association {@link crossStackAssociations} holds for a SOURCE leaf, or
+* `undefined` when this pass has none (or a poisoned one) for it.
+*/
+function associationForSource(source, secrets) {
+	const key = crossStackSourceKey(source);
+	if (key === void 0) return void 0;
+	const associations = crossStackAssociations.get(secrets);
+	if (associations === void 0) return void 0;
+	const association = associations.get(key);
+	if (association === void 0 || typeof association === "symbol") return void 0;
+	return association;
+}
+/**
 * Position a leaf whose SOURCE is a CROSS-STACK intrinsic object
 * (`Fn::ImportValue` / `Fn::GetStackOutput`), by looking its identity up in the
 * association the RESOLVER recorded while it read the producer (issue
@@ -10224,27 +10415,14 @@ function plaintextIndexOf(secrets) {
 * has to come from the one place that holds both halves at once, which is
 * {@link crossStackAssociations}.
 *
-* Three conditions, mirroring the ones next door, and each removing a different
-* way of being wrong:
-*
-* 1. The bag leaf's WHOLE value is a recorded secret plaintext — verbatim
-*    condition 1 of {@link positionByIntrinsicSkeleton}. A leaf that merely
-*    EMBEDS a secret is not this shape and must keep going to the value scan,
-*    which rewrites just the substring. This is also what keeps a PUBLIC
-*    reference out (issue #1901): the resolver records a plaintext only on a
-*    proven-secret verdict, so a public parameter's value is not a key here.
-* 2. The association is ABOUT THIS BAG — the plaintext the WRITER recorded
-*    beside the expression equals the bag leaf. Against another pass this is
-*    belt-and-braces, since {@link crossStackAssociations} is scoped to the
-*    pass and a foreign entry cannot be reached; within one pass it is the only
-*    guard against a bag/source MISALIGNMENT.
-* 3. The match is not DEMONSTRABLY another value's expression — verbatim
-*    condition 3 next door, over the same {@link plaintextIndexOf} index. It is
-*    what fences a bag/source MISALIGNMENT: on a readback walk the bag leaf can
-*    hold a different resource's secret while the source leaf still spells this
-*    import, and an association recorded against a plaintext that is not this
-*    bag is refused outright. The collapsed LOSER is absent from that index, so
-*    it passes — which is the case this whole function exists to serve.
+* THE THREE CONDITIONS ARE {@link certifiedExpressionForLeaf}'s and are stated
+* ONLY there. They were re-enumerated here until issue #2327 extracted the
+* owner, and the copy had already drifted from it three ways within the same
+* change -- it dropped the empty-string clause, it explained condition 2 by a
+* scoping story ({@link crossStackAssociations} being per-pass) that is not the
+* owner's OTHER caller's, and it said "three intrinsic spellings" when
+* {@link crossStackSourceKey} answers for five. A rationale that drifts inside
+* one PR is the argument against duplicating it.
 *
 * There is deliberately NO "exactly one candidate" test (the neighbour's
 * condition 2): this is a LOOKUP rather than a search, so the ambiguity that
@@ -10257,23 +10435,16 @@ function plaintextIndexOf(secrets) {
 * bag could not be vouched for, because it rewrote a `{Name: '', Value:
 * 'an-unrelated-literal'}` pair. Nothing here can do that: the answer is never
 * the source subtree, it is an expression a WRITER recorded against this exact
-* leaf identity; the arm fires for exactly three intrinsic spellings; and
+* leaf identity; the arm fires only for the spellings
+* {@link crossStackSourceKey} can key; and
 * condition 1 still demands that the bag leaf be a plaintext this pass
 * resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton} and
 * then to the value scan, i.e. to today's behavior.
 */
 function positionByCrossStackSource(bag, source, secrets) {
-	if (bag === "" || !secrets.has(bag)) return void 0;
-	const key = crossStackSourceKey(source);
-	if (key === void 0) return void 0;
-	const associations = crossStackAssociations.get(secrets);
-	if (associations === void 0) return void 0;
-	const association = associations.get(key);
-	if (association === void 0 || typeof association === "symbol") return void 0;
-	if (association.plaintext !== bag) return void 0;
-	const recordedPlaintext = plaintextIndexOf(secrets).get(association.expression);
-	if (recordedPlaintext !== void 0 && recordedPlaintext !== bag) return void 0;
-	return association.expression;
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedExpressionForLeaf(secrets, association, bag);
 }
 /**
 * Position a leaf whose SOURCE is an intrinsic OBJECT, by matching the shape of
@@ -10457,6 +10628,49 @@ function identityKeyFor(bag, source) {
 	for (const key of ARRAY_IDENTITY_KEYS) if (isUniquelyKeyedBy(bag, key) && isUniquelyKeyedBy(source, key)) return key;
 }
 /**
+* Position the ELEMENTS of an array leaf whose SOURCE is an intrinsic OBJECT,
+* by the same leaf-identity lookup {@link positionByCrossStackSource} performs
+* for a string leaf (issue
+* [#2327](https://github.com/go-to-k/cdkd/issues/2327)).
+*
+* A child parameter declared `CommaDelimitedList` is coerced by
+* `coerceParameterTypedValue` into an ARRAY before any of this runs, so a
+* leaf the child template spells `{Ref: <Param>}` arrives beside an intrinsic
+* OBJECT as an array — a shape NO arm matched, which dropped it to the
+* plaintext-keyed value scan and handed BOTH members of a coinciding pair the
+* survivor's expression. `docs/cli-reference.md` names `CommaDelimitedList` as
+* an ALLOWED spelling for a secret-bearing nested-stack parameter, so it is
+* reachable rather than theoretical.
+*
+* The element rule, what it refuses and why nothing is fabricated all live on
+* {@link certifiedListForLeaf}, which the DIFF side calls too. TWO further
+* refusals belong to THIS site rather than to the shared rule:
+*
+* 1. REFUSAL — a source leaf {@link crossStackSourceKey} cannot key, or one
+*    this pass recorded no association for. Both fall to the value scan, i.e.
+*    to today's behaviour.
+* 2. REFUSAL — {@link positionByIntrinsicSkeleton} is deliberately NOT tried
+*    element-wise, and the asymmetry with the string arm is structural rather
+*    than caution. {@link intrinsicSkeletonPattern} accepts exactly `Fn::Join`
+*    and `Fn::Sub`, both of which produce a STRING; an array bag beside one of
+*    them is a SHAPE DIVERGENCE, not a position. Matching a per-element pattern
+*    built from text that describes the whole joined string would be a guess of
+*    precisely the kind condition 2 of that function exists to refuse.
+*
+* NOT GATED ON `rules`, for the reason the string arm next door is not: the
+* certification rests on the element being a plaintext THIS pass recorded,
+* which a previous generation's persisted expression can never be, and it never
+* depends on the two sides being positionally aligned. In practice only the
+* TEMPLATE-sourced walks can reach it at all — every STATE-sourced source leaf
+* is a persisted value, not an intrinsic object — but the safety does not rest
+* on that.
+*/
+function positionListByCrossStackSource(bag, source, secrets) {
+	const association = associationForSource(source, secrets);
+	if (association === void 0) return void 0;
+	return certifiedListForLeaf(secrets, association, bag);
+}
+/**
 * PATH-based redaction: walk `bag` alongside a SOURCE bag that still carries the
 * unresolved `{{resolve:...}}` expressions, and wherever the source leaf is such
 * a string, persist THAT string verbatim.
@@ -10488,6 +10702,14 @@ function identityKeyFor(bag, source) {
 *   recorded secret expressions, THAT is persisted. This is the dominant CDK
 *   shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
 *
+* An ARRAY leaf beside such an intrinsic OBJECT — the shape a
+* `CommaDelimitedList` nested-stack parameter produces once the child has
+* coerced it — is positioned ELEMENT-WISE by
+* {@link positionListByCrossStackSource} (issue #2327). What certifies an
+* element there is its own recorded plaintext rather than its index, so nothing
+* is aligned against a source array that does not exist; see that function for
+* the two shapes it refuses.
+*
 * The value scan is still applied wherever none can answer: a leaf that merely
 * EMBEDS a secret inside surrounding text, an intrinsic whose skeleton matches
 * zero or several candidates, a cross-stack leaf whose identity is not
@@ -10510,6 +10732,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
 	}
+	if (Array.isArray(bag) && isPlainObject$2(source)) {
+		const positionedList = positionListByCrossStackSource(bag, source, secrets);
+		if (positionedList !== void 0) return positionedList;
+	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key !== void 0) {
@@ -16409,14 +16635,26 @@ function parameterTypeMayLoseSecretIdentity(type) {
 * ONE definition of parameter-type coercion, at module scope so
 * {@link parameterTypeMayLoseSecretIdentity} probes the same code the resolver
 * runs rather than a copy of it.
+*
+* WHICH TYPES ARE LISTS is asked of the SHARED {@link isListParameterType}
+* rather than enumerated in the `switch` (issue #2347). The `switch` named only
+* `List<Number>` and `CommaDelimitedList`, so the nine `List<AWS::...>` types
+* CloudFormation defines -- `List<AWS::EC2::Subnet::Id>` and its siblings --
+* fell to `default` and a `Ref` to such a parameter resolved to the raw
+* comma-joined STRING, while `src/synthesis/macro-expander.ts` held the wider,
+* correct view of the very same question. Both sites now read one predicate.
+*
+* `List<Number>` keeps its own arm because it is the only list type whose
+* ELEMENTS are not strings; every other list type produces trimmed strings,
+* which is what CloudFormation says a `Ref` to one returns.
 */
 function coerceParameterTypedValue(value, type) {
 	switch (type) {
 		case "Number": return Number(value);
 		case "List<Number>": return value.split(",").map((v) => Number(v.trim()));
-		case "CommaDelimitedList": return value.split(",").map((v) => v.trim());
-		default: return value;
 	}
+	if (isListParameterType(type)) return value.split(",").map((v) => v.trim());
+	return value;
 }
 /**
 * The inherited `plaintext -> expression` pairs that `value` CARRIES.
@@ -16437,8 +16675,8 @@ function coerceParameterTypedValue(value, type) {
 *   for the same reason the redactor excludes them: a 3-character secret
 *   matches half the alphabet's worth of ordinary identifiers.
 *
-* A `CommaDelimitedList` parameter arrives as an array, so the scan walks
-* string elements too.
+* A LIST-TYPED parameter — any `List<...>` type or `CommaDelimitedList` — arrives as an
+* array, so the scan walks string elements too.
 */
 function inheritedSecretsCarriedBy(value, inherited) {
 	const candidates = [];
@@ -17149,8 +17387,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const inherited = context.inheritedSecrets;
 		const recorded = context.recordedSecretValues;
 		if (!inherited || inherited.size === 0 || !recorded) return;
-		const own = inheritedParameterExpression(inherited, parameterName, value);
-		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) recorded.set(plaintext, own !== void 0 && plaintext === value ? own : expression);
+		for (const [plaintext, expression] of inheritedSecretsCarriedBy(value, inherited)) {
+			const own = inheritedParameterExpression(inherited, parameterName, plaintext);
+			recorded.set(plaintext, typeof own === "string" ? own : expression);
+		}
 	}
 	/**
 	* Refuse a child parameter whose declared `Type` would COERCE an inherited
@@ -17767,7 +18007,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const [delimiter, rawValues] = joinArgs;
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
-		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a CommaDelimitedList parameter), but resolved to ${typeof values}`);
+		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
 		let result = (await Promise.all(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
@@ -18024,9 +18264,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	*
 	* - a list-valued `Fn::GetAtt` renders as `Fn::GetAtt [Zone, NameServers]`,
 	*   naming both the resource and the attribute;
-	* - a `Ref` to a `CommaDelimitedList` / `List<Number>` parameter — the
-	*   SECOND genuinely reachable array source, via `coerceParameterValue` —
-	*   renders as `Ref MyListParam`, naming the parameter.
+	* - a `Ref` to a LIST-TYPED parameter — any `List<...>` type or `CommaDelimitedList`, per the
+	*   shared `isListParameterType` — the SECOND genuinely reachable array
+	*   source, via `coerceParameterValue` — renders as `Ref MyListParam`,
+	*   naming the parameter.
 	*
 	* Anything else degrades to its bare intrinsic key, or to `undefined` for a
 	* literal (which the message then simply omits).
@@ -18131,7 +18372,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const source = this.describeSplitValueSource(value);
 			const sourceClause = source ? ` (from ${source.label})` : "";
 			if (Array.isArray(resolvedValue)) {
-				const remedy = source?.kind === "ref" ? `A CommaDelimitedList / List<Number> parameter is already a list.` : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a CommaDelimitedList / List<Number> parameter, Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
+				const remedy = source?.kind === "ref" ? "A list-typed parameter — any List<...> type (List<AWS::EC2::Subnet::Id>, List<Number>, …) or CommaDelimitedList — is already a list." : source?.kind === "getatt" ? "A list-valued Fn::GetAtt (for example AWS::Route53::HostedZone.NameServers or AWS::EC2::VPC.Ipv6CidrBlocks) already returns a list. If you wrote the Fn::Split as a workaround for cdkd resolving that attribute to a comma-delimited string, that bug is fixed (PR #1868) and the workaround is no longer needed." : "Several intrinsics already return a list — among them a list-valued Fn::GetAtt, a Ref to a list-typed parameter (any List<...> type or CommaDelimitedList), Fn::GetAZs, Fn::Cidr, and Fn::Split itself.";
 				throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} is ALREADY a list (an array of ${resolvedValue.length} item${resolvedValue.length === 1 ? "" : "s"}), not a string. CloudFormation rejects Fn::Split over a list too, so this template is not valid CloudFormation either. Remove the Fn::Split and use the value directly. ${remedy}`));
 			}
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
@@ -20235,7 +20476,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-lbqsxGkM.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BoJz-x3Q.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -32149,5 +32390,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { maskerOrIdentity as $, CFN_TEMPLATE_URL_LIMIT as $n, redactSecretsForState as $t, renderStatefulReason as A, buildDockerImage as An, ResourceTimeoutError as Ar, classifyReplaySecretRegion as At, exportAliasCollisionScrubWarning as B, synthesisStatusMessage as Bn, isMarkedNonRetryable as Br, describeTypeWithThrottleRetry as Bt, isFinalSnapshotError as C, isCrossRegionRedirect as Cn, LocalMigrateError as Cr, configBooleanRefusal as Ct, extractDeploymentEventError as D, validateContainerRepoName as Dn, NestedStackChildDirectDestroyError as Dr, requireConfigArray as Dt, makeCanonicalizePropertiesFn as E, validateAssetBucketName as En, MissingCdkCliError as Er, replayWarn as Et, green as F, runDockerForeground as Fn, SynthesisError as Fr, s3BucketRegionalDomainName as Ft, IAMRoleProvider as G, resolveCaptureObservedState as Gn, retryClassificationText as Gr, STATE_SOURCED_READBACK_RULES as Gt, secretBearingStateKeyWarning as H, getLegacyStateBucketName as Hn, isThrottlingError as Hr, DagBuilder as Ht, red as I, runDockerStreaming as In, formatError as Ir, s3BucketWebsiteUrl as It, ProviderRegistry as J, resolveStateBucketWithDefaultAndSource as Jn, dynamicReferenceTokens as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveSkipPrefix as Kn, __exportAll as Kr, TEMPLATE_SOURCED_RULES as Kt, yellow as L, AssetManifestLoader as Ln, isCdkdError as Lr, applyRoleArnIfSet as Lt, bold as M, formatDockerLoginError as Mn, StackHasActiveImportsError as Mr, s3BucketArn as Mt, cyan as N, getDockerCmd as Nn, StackTerminationProtectionError as Nr, s3BucketDomainName as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, buildDenyExternalAccessPolicy as On, PartialFailureError as Or, requireConfigObject as Ot, gray as P, partitionSensitiveEnv as Pn, StateError as Pr, s3BucketDualStackDomainName as Pt, maskDeep as Q, CFN_TEMPLATE_BODY_LIMIT as Qn, maskSecretsInText as Qt, collectDeclaredOutputNames as R, getDockerImageBySourceHash as Rn, normalizeAwsError as Rr, DiffCalculator as Rt, createPreDeleteFinalSnapshot as S, getBootstrapMarkerKey as Sn, LocalInvokeBuildError as Sr, coerceCfnBoolean as St, unsupportedFinalSnapshotError as T, readBootstrapMarkerBody as Tn, LockError as Tr, readConfigString as Tt, stateKeySecretExposure as U, resolveApp as Un, markNonRetryable as Ur, TemplateParser as Ut, isExportAliasCollision as V, getDefaultStateBucketName as Vn, isRetryableTransientError as Vr, withRetry as Vt, getCurrentResourceSecrets as W, resolveAutoAssetStorage as Wn, markRedactedCause as Wr, STATE_SOURCED_CROSS_GENERATION_RULES as Wt, findSilentDropProperties as X, stateBucketExistenceConfirmed as Xn, isSingleDynamicReferenceToken as Xt, findActionableSilentDrops as Y, resolveUseCdkBootstrapAssets as Yn, errorCauseChain as Yt, createMaskedRetryLogger as Z, warnDeprecatedNoPrefixCliFlag as Zn, maskSecretsInError as Zt, computeImplicitDeleteEdges as _, stripControlChars as _n, ConfigError as _r, refStateLookupFromResource as _t, DeploymentEventsStore as a, exportNamesCarriedFrom as an, canonicalizeRegion as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, assertAssetBucketRegion as bn, DeployCancelledError as br, resolveExplicitPhysicalId as bt, replayFailedOperations as c, shouldRetainResource as cn, processStackMessages as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, WorkGraph as dn, AwsClients as dr, IntrinsicFunctionResolver as dt, scrubResourceRecord as en, MIGRATE_TMP_PREFIX as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, buildAssetRedirectMap as fn, getAwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, escapeRegExp$1 as gn, CdkdError as gr, parameterTypeMayLoseSecretIdentity as gt, maskingRetryLogger as h, rewriteTemplateAssetReferences as hn, AssetError as hr, isUnboundTemplateParameter as ht, DeploymentEventsReader as i, rebuildClientForBucketRegion as in, PARTITION_TABLE as ir, interruptWatchListenerCount as it, formatResourceLine as j, dockerSpawnEnvWithSensitive as jn, ResourceUpdateNotSupportedError as jr, producerRegionsFromState as jt, isStatefulRecreateTargetSync as k, describeAwsFailure as kn, ProvisioningError as kr, requireConfigString as kt, replayRollback as l, AssetPublisher as ln, clearBucketRegionCache as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, loadPublishableAssetManifest as mn, setAwsClients as mr, getAccountInfo as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, displaySafe as nn, uploadCfnTemplate as nr, beginCommandInterruptScope as nt, planFailedOps as o, importableOutputKeys as on, derivePartitionAndUrlSuffix as or, startInterruptWatch as ot, deleteSkipReason as p, createAssetRedirectResolver as pn, resetAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveStateBucketWithDefault as qn, createSecretMasker as qt, DeployEngine as r, S3StateBackend as rn, expectedOwnerParam as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputs as sn, AssemblyReader as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockManager as tn, findLargeInlineResources as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, stringifyValue as un, resolveBucketRegion as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, AssetModeResolver as vn, CrossAccountSecretRefusalError as vr, WAFv2WebACLProvider as vt, refusesFinalSnapshot as w, parseBootstrapMarker as wn, LocalStartServiceError as wr, configStringRefusal as wt, ccRoutedFinalSnapshotError as x, ensureAssetStorage as xn, DynamicReferenceRegionAmbiguousError as xr, assertRegionMatch as xt, PRE_DELETE_SNAPSHOT_TYPES as y, BOOTSTRAP_MARKER_PREFIX as yn, DependencyError as yr, normalizeAwsTagsToCfn as yt, collectPublishedOutputNames as z, Synthesizer as zn, withErrorHandling as zr, INTRINSIC_KEYS as zt };
-//# sourceMappingURL=deploy-engine-Dsd8oL2h.js.map
+export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, ProvisioningError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, withErrorHandling as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, LocalInvokeBuildError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, MissingCdkCliError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LockError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StateError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, markRedactedCause as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isRetryableTransientError as Hr, withRetry as Ht, red as I, runDockerForeground as In, SynthesisError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, retryClassificationText as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, formatError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceUpdateNotSupportedError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, StackHasActiveImportsError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, NestedStackChildDirectDestroyError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackTerminationProtectionError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, isCdkdError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DynamicReferenceRegionAmbiguousError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalStartServiceError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isThrottlingError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, isMarkedNonRetryable as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, markNonRetryable as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, CdkdError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, PARTITION_TABLE as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, DependencyError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, AssemblyReader as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, resolveBucketRegion as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, AwsClients as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, AssetError as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, setAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, expectedOwnerParam as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ResourceTimeoutError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, PartialFailureError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, processStackMessages as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, resetAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, canonicalizeRegion as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, getAwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, __exportAll as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, derivePartitionAndUrlSuffix as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, clearBucketRegionCache as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, ConfigError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalMigrateError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DeployCancelledError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, CrossAccountSecretRefusalError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, normalizeAwsError as zr, DiffCalculator as zt };
+//# sourceMappingURL=deploy-engine-Dh4Jid_H.js.map