@go-to-k/cdkd 0.285.8 → 0.285.10

package/dist/index.d.ts

@@ -144,11 +144,15 @@ interface TemplateOutput {
 interface EffectivePropertiesResult {
   effectiveProperties?: Record<string, unknown>;
 }
-interface ResourceCreateResult extends EffectivePropertiesResult {
+interface NoEchoAttributesResult {
+  noEchoAttributes?: boolean;
+  noEchoAttributeNames?: readonly string[];
+}
+interface ResourceCreateResult extends EffectivePropertiesResult, NoEchoAttributesResult {
   physicalId: string;
   attributes?: Record<string, unknown>;
 }
-interface ResourceUpdateResultBase extends EffectivePropertiesResult {
+interface ResourceUpdateResultBase extends EffectivePropertiesResult, NoEchoAttributesResult {
   physicalId: string;
   wasReplaced: boolean;
   attributes?: Record<string, unknown>;
@@ -1114,6 +1118,7 @@ declare class DeployEngine {
   private recordedImports;
   private recordedOutputReads;
   private perResourceSecrets;
+  private noEchoAttributeResources;
   private perResourceTemplateProps;
   private outputSecrets;
   private outputsTemplateSource;
@@ -1125,7 +1130,10 @@ declare class DeployEngine {
   deploy(stackName: string, template: CloudFormationTemplate): Promise<DeployResult>;
   private buildResolverContext;
   private redactParametersForDiff;
+  private rememberRecoverableMaskedOutputs;
   private redactOutputs;
+  private registerNoEchoAttributes;
+  private refuseRedactedAttributeReads;
   private redactOperationsForJournal;
   private redactStateForPersist;
   private withParentInfo;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAyBA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC1fU,uBAAuB;KA03IvB,gBAAgB;;;UCx5IX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UAMP,6BAA6B;EAE5C;EAEA,aAAa;;UAOL,iCAAiC;EAEzC;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC7pC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAgbvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCl3BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCxSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EASA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAiBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cCyGE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCxqFxC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;;UAUH;EACf;EACA,aAAa;EACb,gBAAgB;;UAQD;EACf;EACA;EACA;;cAuDW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UAmGpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EAqEJ,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChMY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCtGE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;;UAWE;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC/VZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UC5BK;EAOf;IAAkB;;EAQlB;EAEA;IAAW,OAAO;;EAqBlB;;;;UC7De;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAmBW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0EhD,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UAuBA;UAuBA;UASA;UAgDN;;;;UCjjCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC5DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UClHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC/PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4JW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAaF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCz0CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC9XA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCzbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UCjfO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAuB7E,0BAA0B;EAmB1B,gCAAgC;EAmBhC,gBAAgB;EAkBhB;EASA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAoOW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA8BnE;UA0GA;UAyCA;UA8DA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UAqEM;UAqrBA;UAokBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqSN;UAaA;UAmBA;UAwBA;UAyCM;UA0CA;UAwKA;UAsxCN;UA8BA;UA4BA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgBA;UAwCM;UAmRN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAgBA;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EAyBA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAiFe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC1fU,uBAAuB;KAuvJvB,gBAAgB;;;UCrxJX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC3tC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAgbvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCl3BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCxSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC7SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EASA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAiBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cCyGE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCxqFxC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;;UAUH;EACf;EACA,aAAa;EACb,gBAAgB;;UAQD;EACf;EACA;EACA;;cAuDW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EAWpC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UAmGpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EAqEJ,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChMY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCpGE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;;UAWE;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KCjWZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UC5BK;EAOf;IAAkB;;EAQlB;EAEA;IAAW,OAAO;;EAqBlB;;;;UC7De;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAmBW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0EhD,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UAuBA;UAuBA;UASA;UAgDN;;;;UCjjCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC5DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UClHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC/PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4JW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAaF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCz0CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAYlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA2BxC,YAAY,UAAU,kBAAkB;EA2BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC9XA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCzbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EAoBF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,2BACxB,QAAQ,YAAY;UAmRf;UAoJA;iBAkGO;UAsED;UAgCN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCv+BlD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC/5BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAwBG,WAAW,oBAAoB,OAAO,mBAAmB;EAYzD,YAAY,mBAAmB,yBAAyB;UAUhD;EAaR,WAAW;UAcH;UAWA;UAyCA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAQA;UAkBA;UAYA;UA+BN;UAMA;;;;UC7eO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAuB7E,0BAA0B;EAmB1B,gCAAgC;EAmBhC,gBAAgB;EAkBhB;EASA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAoOW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAOA;UASA;UAWA;UAQA;UASA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UA+BnE;UAqHA;UAwDA;UAcA;UAiGA;UAqDA;UAwBA;UA8BA;UAkDA;UA2BA;UAkCM;UAgDA;UAsGN;UAqEM;UAqrBA;UA+kBA;UA4EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UAqSN;UAaA;UAmBA;UAwBA;UAyCM;UA0CA;UAwKA;UAi0CN;UA8BA;UA4BA;UAkCA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UAgBA;UAwCM;UAmRN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Bn as Synthesizer, Br as isCdkdError, Bt as DiffCalculator, Gt as TemplateParser, K as ProviderRegistry, Lr as StateError, Mr as ProvisioningError, Or as LockError, Rr as SynthesisError, Sr as DependencyError, U as IAMRoleProvider, Vr as normalizeAwsError, Wt as DagBuilder, _r as setAwsClients, at as CloudControlProvider, br as ConfigError, fr as clearBucketRegionCache, gr as resetAwsClients, hr as getAwsClients, in as S3StateBackend, mr as AwsClients, pr as resolveBucketRegion, r as DeployEngine, rn as LockManager, un as AssetPublisher, ur as AssemblyReader, vr as AssetError, yr as CdkdError, zr as formatError } from "./deploy-engine-D4QA_B1V.js";
+import { Br as StateError, Bt as DiffCalculator, Cr as ConfigError, Fr as ProvisioningError, Gt as TemplateParser, Hr as formatError, K as ProviderRegistry, Sr as CdkdError, Tr as DependencyError, U as IAMRoleProvider, Un as Synthesizer, Ur as isCdkdError, Vr as SynthesisError, Wr as normalizeAwsError, Wt as DagBuilder, _r as AwsClients, at as CloudControlProvider, br as setAwsClients, gr as resolveBucketRegion, hr as clearBucketRegionCache, jr as LockError, on as LockManager, pn as AssetPublisher, pr as AssemblyReader, r as DeployEngine, sn as S3StateBackend, vr as getAwsClients, xr as AssetError, yr as resetAwsClients } from "./deploy-engine-CB7zpRu0.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CjJoJOIE.js → program-BHmUE52I.js}

@@ -1,8 +1,8 @@
-import { $ as DEFAULT_STATE_PREFIX, $n as CFN_TEMPLATE_BODY_LIMIT, $t as maskSecretsInError, A as bold, An as describeAwsFailure, Ar as NestedStackChildDirectDestroyError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as Synthesizer, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as getBootstrapMarkerKey, Cr as DeployCancelledError, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as validateAssetBucketName, Dr as LocalStartServiceError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as readBootstrapMarkerBody, Er as LocalMigrateError, Et as configStringRefusal, F as yellow, Fn as partitionSensitiveEnv, Fr as StackHasActiveImportsError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as resolveAutoAssetStorage, Gr as isThrottlingError, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDefaultStateBucketName, Hr as withErrorHandling, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as runDockerForeground, Ir as StackTerminationProtectionError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveStateBucketWithDefault, Jr as markRedactedCause, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as resolveCaptureObservedState, Kr as isTransientServerError, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as runDockerStreaming, Lt as s3BucketRegionalDomainName, M as gray, Mn as dockerSpawnEnvWithSensitive, Mr as ProvisioningError, Mt as classifyReplaySecretRegion, N as green, Nn as formatDockerLoginError, Nr as ResourceTimeoutError, Nt as producerRegionsFromState, O as renderStatefulReason, On as validateContainerRepoName, Ot as replayWarn, P as red, Pn as getDockerCmd, Pr as ResourceUpdateNotSupportedError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as warnDeprecatedNoPrefixCliFlag, Qt as isSingleDynamicReferenceToken, R as exportAliasCollisionScrubWarning, Rn as AssetManifestLoader, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as ensureAssetStorage, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as parseBootstrapMarker, Tr as LocalInvokeBuildError$1, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as getLegacyStateBucketName, Ur as isMarkedNonRetryable, Ut as withRetry, V as stateKeySecretExposure, Vn as synthesisStatusMessage, Vr as normalizeAwsError, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as resolveApp, Wr as isRetryableTransientError, Wt as DagBuilder, X as maskDeep, Xn as resolveUseCdkBootstrapAssets, Xt as dynamicReferenceTokens, Y as createMaskedRetryLogger, Yn as resolveStateBucketWithDefaultAndSource, Yr as retryClassificationText, Yt as createSecretMasker, Z as maskerOrIdentity, Zn as stateBucketExistenceConfirmed, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as escapeRegExp, _r as setAwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as rebuildClientForBucketRegion, ar as displaySafe, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as BOOTSTRAP_MARKER_PREFIX, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as importableOutputs, cr as canonicalizeRegion, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as stringifyValue, dr as processStackMessages, dt as isTerminationProtectionPropagationError, en as maskSecretsInText, er as CFN_TEMPLATE_URL_LIMIT, et as beginCommandInterruptScope, f as withResourceDeadline, fn as WorkGraph, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as rewriteTemplateAssetReferences, gr as resetAwsClients, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as loadPublishableAssetManifest, hr as getAwsClients, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as S3StateBackend, ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, it as startInterruptWatch, j as cyan, jn as buildDockerImage, jr as PartialFailureError, jt as requireConfigString, k as formatResourceLine, kn as buildDenyExternalAccessPolicy, kr as MissingCdkCliError, kt as requireConfigArray, l as replayRollback, ln as shouldRetainResource, lr as derivePartitionAndUrlSuffix, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as createAssetRedirectResolver, mr as AwsClients, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as scrubResourceRecord, nr as findLargeInlineResources, nt as interruptWatchListenerCount, o as planFailedOps, on as exportNamesCarriedFrom, or as expectedOwnerParam, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as buildAssetRedirectMap, pr as resolveBucketRegion, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveSkipPrefix, qr as markNonRetryable, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as LockManager, rr as uploadCfnTemplate, rt as isInterruptedWaitError, s as planRollback, sn as importableOutputKeys, sr as PARTITION_TABLE, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as redactSecretsForState, tr as MIGRATE_TMP_PREFIX, tt as endCommandInterruptScope, u as updatePartialMessage, un as AssetPublisher, ur as AssemblyReader, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as stripControlChars, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as isCrossRegionRedirect, wr as DynamicReferenceRegionAmbiguousError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as assertAssetBucketRegion, xr as CrossAccountSecretRefusalError, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as AssetModeResolver, yr as CdkdError, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as getDockerImageBySourceHash, zt as applyRoleArnIfSet } from "./deploy-engine-D4QA_B1V.js";
+import { $ as DEFAULT_STATE_PREFIX, $n as resolveUseCdkBootstrapAssets, $t as isSingleDynamicReferenceToken, A as bold, An as validateAssetBucketName, Ar as LocalStartServiceError, At as requireConfigObject, B as secretBearingStateKeyWarning, Bn as runDockerStreaming, Bt as DiffCalculator, C as unsupportedFinalSnapshotError, Cn as BOOTSTRAP_MARKER_PREFIX, Ct as assertRegionMatch, D as isStatefulRecreateTargetSync, Dn as isCrossRegionRedirect, Dr as DynamicReferenceRegionAmbiguousError, Dt as readConfigString, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as getBootstrapMarkerKey, Er as DeployCancelledError, Et as configStringRefusal, F as yellow, Fn as dockerSpawnEnvWithSensitive, Fr as ProvisioningError, Ft as s3BucketDomainName, G as clearOnUpdateRemoval, Gn as getDefaultStateBucketName, Gr as withErrorHandling, Gt as TemplateParser, H as getCurrentResourceSecrets, Hn as getDockerImageBySourceHash, Ht as describeTypeWithThrottleRetry, I as collectDeclaredOutputNames, In as formatDockerLoginError, Ir as ResourceTimeoutError, It as s3BucketDualStackDomainName, J as findSilentDropProperties, Jn as resolveAutoAssetStorage, Jr as isThrottlingError, Jt as TEMPLATE_SOURCED_RULES, K as ProviderRegistry, Kn as getLegacyStateBucketName, Kr as isMarkedNonRetryable, Kt as STATE_SOURCED_CROSS_GENERATION_RULES, L as collectPublishedOutputNames, Ln as getDockerCmd, Lr as ResourceUpdateNotSupportedError, Lt as s3BucketRegionalDomainName, M as gray, Mn as buildDenyExternalAccessPolicy, Mr as MissingCdkCliError, Mt as classifyReplaySecretRegion, N as green, Nn as describeAwsFailure, Nr as NestedStackChildDirectDestroyError, Nt as producerRegionsFromState, O as renderStatefulReason, On as parseBootstrapMarker, Or as LocalInvokeBuildError$1, Ot as replayWarn, P as red, Pn as buildDockerImage, Pr as PartialFailureError, Pt as s3BucketArn, Q as CUSTOM_RESOURCE_RESPONSE_PREFIX, Qn as resolveStateBucketWithDefaultAndSource, Qr as retryClassificationText, Qt as errorCauseChain, R as exportAliasCollisionScrubWarning, Rn as partitionSensitiveEnv, Rr as StackHasActiveImportsError, Rt as s3BucketWebsiteUrl, S as refusesFinalSnapshot, Sn as AssetModeResolver, Sr as CdkdError, St as resolveExplicitPhysicalId, T as extractDeploymentEventError, Tn as ensureAssetStorage, Tt as configBooleanRefusal, U as IAMRoleProvider, Un as Synthesizer, Ut as withRetry, V as stateKeySecretExposure, Vn as AssetManifestLoader, Vt as INTRINSIC_KEYS, W as collectInlinePolicyNamesManagedBySiblings, Wn as synthesisStatusMessage, Wr as normalizeAwsError, Wt as DagBuilder, X as maskDeep, Xn as resolveSkipPrefix, Xr as markNonRetryable, Xt as createSecretMasker, Y as createMaskedRetryLogger, Yn as resolveCaptureObservedState, Yr as isTransientServerError, Yt as carriesSecretMask, Z as maskerOrIdentity, Zn as resolveStateBucketWithDefault, Zr as markRedactedCause, Zt as dynamicReferenceTokens, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as createAssetRedirectResolver, _r as AwsClients, _t as isUnboundTemplateParameter, a as DeploymentEventsStore, an as scrubResourceRecord, ar as findLargeInlineResources, at as CloudControlProvider, b as createPreDeleteFinalSnapshot, bn as escapeRegExp, br as setAwsClients, bt as WAFv2WebACLProvider, c as replayFailedOperations, cn as rebuildClientForBucketRegion, cr as displaySafe, ct as deleteIndeterminateGuards, d as updatePartialReason, dn as importableOutputs, dr as canonicalizeRegion, dt as isTerminationProtectionPropagationError, en as maskSecretsInError, er as stateBucketExistenceConfirmed, et as beginCommandInterruptScope, f as withResourceDeadline, fn as shouldRetainResource, fr as derivePartitionAndUrlSuffix, ft as IntrinsicFunctionResolver, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as buildAssetRedirectMap, gr as resolveBucketRegion, gt as getAccountInfo, h as computeImplicitDeleteEdges, hn as WorkGraph, ht as coerceParameterTypedValue, i as DeploymentEventsReader, in as redactSecretsForState, ir as MIGRATE_TMP_PREFIX, it as startInterruptWatch, j as cyan, jn as validateContainerRepoName, jt as requireConfigString, k as formatResourceLine, kn as readBootstrapMarkerBody, kr as LocalMigrateError, kt as requireConfigArray, l as replayRollback, ln as exportNamesCarriedFrom, lr as expectedOwnerParam, lt as deleteSkipReason, m as IMPLICIT_DELETE_DEPENDENCIES, mn as stringifyValue, mr as processStackMessages, mt as cfnRefValueFromPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as recordMaskOnlyValue, nr as CFN_TEMPLATE_BODY_LIMIT, nt as interruptWatchListenerCount, o as planFailedOps, on as LockManager, or as uploadCfnTemplate, ot as slowCcOperationTimeoutMs, p as maskingRetryLogger, pn as AssetPublisher, pr as AssemblyReader, pt as carriesDynamicReference, q as findActionableSilentDrops, qn as resolveApp, qr as isRetryableTransientError, qt as STATE_SOURCED_READBACK_RULES, r as DeployEngine, rn as recoverMaskedOutput, rr as CFN_TEMPLATE_URL_LIMIT, rt as isInterruptedWaitError, s as planRollback, sn as S3StateBackend, sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, st as UNSPECIFIED_SKIP_REASON, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as maskSecretsInText, tr as warnDeprecatedNoPrefixCliFlag, tt as endCommandInterruptScope, u as updatePartialMessage, un as importableOutputKeys, ur as PARTITION_TABLE, ut as disableInstanceApiTermination, v as buildFinalSnapshotIdentifier, vn as loadPublishableAssetManifest, vr as getAwsClients, vt as parameterTypeMayLoseSecretIdentity, w as makeCanonicalizePropertiesFn, wn as assertAssetBucketRegion, wr as CrossAccountSecretRefusalError, wt as coerceCfnBoolean, x as isFinalSnapshotError, xn as stripControlChars, xt as normalizeAwsTagsToCfn, y as ccRoutedFinalSnapshotError, yn as rewriteTemplateAssetReferences, yr as resetAwsClients, yt as refStateLookupFromResource, z as isExportAliasCollision, zn as runDockerForeground, zr as StackTerminationProtectionError, zt as applyRoleArnIfSet } from "./deploy-engine-CB7zpRu0.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DFdq83MF.js";
-import { t as ASGProvider } from "./asg-provider-CvYAGRMV.js";
+import { t as getCdkdVersion } from "./version-CR046mQU.js";
+import { t as ASGProvider } from "./asg-provider-BBky5qYW.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -60647,10 +60647,11 @@ var NestedStackProvider = class {
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
 		this.logger.info(`Deploying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
-		const attributes = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
+		const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
 			physicalId: this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId),
-			attributes
+			attributes: childOutputs.attributes,
+			...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames }
 		};
 	}
 	async update(logicalId, physicalId, _resourceType, properties, _previousProperties) {
@@ -60666,10 +60667,12 @@ var NestedStackProvider = class {
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
 		this.logger.info(`Updating nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
+		const updatedOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
 			physicalId,
 			wasReplaced: false,
-			attributes: await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion)
+			attributes: updatedOutputs.attributes,
+			...updatedOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: updatedOutputs.noEchoAttributeNames }
 		};
 	}
 	async delete(logicalId, _physicalId, _resourceType, _properties, deleteContext) {
@@ -60742,10 +60745,50 @@ var NestedStackProvider = class {
 			nestedTemplates: grandchildTemplates
 		}, () => childEngine.deploy(childStackName, childTemplate));
 	}
+	/**
+	* The child's outputs, as `Outputs.<Key>` attributes for the parent's
+	* `Fn::GetAtt` — plus the subset whose plaintext this run had to RECOVER
+	* (issue [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+	*
+	* WHY THE RECOVERY IS HERE. This method reads the child's PERSISTED state,
+	* and since #2274 an output whose value resolved a `NoEcho` custom resource's
+	* `Data` is persisted as the redaction mask. Handing the parent `***` would
+	* make the FIRST deploy of any such parent refuse — a template that deployed
+	* before the feature — so where the child engine masked that output moments
+	* ago IN THIS PROCESS, the plaintext is still available (see
+	* `recoverMaskedOutput`) and is what the parent gets. The reported names are
+	* what tells the deploy engine to re-register those values as MASK-ONLY
+	* needles, so the parent's own record and every parent resource that consumes
+	* one still persist `***`.
+	*
+	* PER ATTRIBUTE, not for the bag: a child typically exports one sensitive
+	* output among several ordinary ones, and declaring the whole bag would mask
+	* every unrelated output into the parent's state and into any parent resource
+	* that reads one.
+	*
+	* A mask this run did NOT produce (the child was deployed by an earlier run
+	* and its custom resource was `NO_CHANGE`, so no handler ran) is left as the
+	* mask, and the resolver refuses the consumer rather than writing `***` to
+	* AWS. That refusal is the feature's stated cost; recovering here removes it
+	* for the in-run case only.
+	*/
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
 		if (!childStateData) throw new Error(`Child stack state '${childStackName}' not found after deploy — NestedStackProvider invariant violated.`);
-		return this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
+		const noEchoAttributeNames = [];
+		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
+			if (!carriesSecretMask(persisted)) continue;
+			const recovered = recoverMaskedOutput(childStackName, childRegion, outputKey);
+			if (recovered === void 0) continue;
+			const attributeName = this.outputAttributeName(outputKey);
+			attributes[attributeName] = recovered;
+			noEchoAttributeNames.push(attributeName);
+		}
+		return {
+			attributes,
+			noEchoAttributeNames
+		};
 	}
 	requireContext() {
 		const ctx = getCurrentNestedStackContext();
@@ -60868,9 +60911,17 @@ var NestedStackProvider = class {
 	* make EVERY consumer persist it — but the count is "one resolution path",
 	* not "one reader".
 	*/
+	/**
+	* The ONE spelling of a child output's attribute name. Both this class's
+	* writers go through it, so the recovery pass (issue #2274) cannot name a key
+	* `buildOutputsAttributes` did not write.
+	*/
+	outputAttributeName(outputKey) {
+		return `Outputs.${outputKey}`;
+	}
 	buildOutputsAttributes(outputs) {
 		const attributes = {};
-		for (const [key, value] of Object.entries(outputs)) attributes[`Outputs.${key}`] = value;
+		for (const [key, value] of Object.entries(outputs)) attributes[this.outputAttributeName(key)] = value;
 		return attributes;
 	}
 };
@@ -67848,6 +67899,37 @@ function collectDynamicReferencePaths(value, into, path = "") {
 	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
 }
 /**
+* Record the dotted path of every leaf that IS {@link SECRET_MASK} — the
+* mask-only twin of {@link collectDynamicReferencePaths} (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WITHOUT IT A NESTED MASK IS INVISIBLE, and that is a live disclosure rather
+* than a tidiness gap. `calculateResourceDrift` deliberately does not descend
+* arrays, so a masked leaf at `ContainerDefinitions.0.Environment.0.Value`
+* surfaces as ONE change at path `ContainerDefinitions` whose `stateValue` is
+* the WHOLE ARRAY — never equal to the mask. A whole-value equality test
+* therefore answers `false`, `secretBearing` stays false, the LIVE plaintext is
+* printed by the report, and `--accept` writes it into `state.json`, undoing
+* exactly the redaction this feature exists to perform.
+*
+* The expression class already answers this, and answers it this way: paths go
+* in at the LEAF's own coordinate and {@link isSecretBearingPath} bridges to the
+* comparator's coarser one by matching ANCESTORS. Seeded off the state bags,
+* exactly like the offline dynamic-reference seed, because a mask is a fact
+* about the RECORD and needs no AWS call to see.
+*/
+function collectSecretMaskPaths(value, into, path = "") {
+	if (typeof value === "string") {
+		if (value === "***") into.add(path);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, i) => collectSecretMaskPaths(item, into, path === "" ? String(i) : `${path}.${i}`));
+		return;
+	}
+	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectSecretMaskPaths(v, into, path === "" ? k : `${path}.${k}`);
+}
+/**
 * The drift command's resolvers for ONE stack: the stack's own, plus one pinned
 * sibling per FOREIGN region an ARN-named reference asks for (issue
 * [#2108](https://github.com/go-to-k/cdkd/issues/2108)).
@@ -68217,7 +68299,7 @@ function redactDriftValue(value, secrets, secretBearing) {
 * cannot disagree — a `--dry-run` that promises a write the real run refuses is
 * worse than either behaviour on its own.
 *
-* Two refusals, both about a value cdkd could not identify rather than about
+* Three refusals, all about a value cdkd could not identify rather than about
 * secrecy as such:
 *
 * - A masked VALUE says AWS holds something at a known-secret path that is not
@@ -68227,6 +68309,10 @@ function redactDriftValue(value, secrets, secretBearing) {
 *   `setAtPath` would then create a key literally named `***` — and when
 *   `awsValue` is `undefined` it would INSERT that key rather than removing the
 *   real one, so the value check alone does not cover it.
+* - A masked BASELINE (issue #2274) says the state side itself is the mask —
+*   a `NoEcho` custom resource's `Data` redacted out of `state.json`. Accepting
+*   would write the live plaintext over a deliberate redaction, which is the
+*   opposite of what the mask is for.
 *
 * The path check is what makes the value exemptions safe: `redactDriftValue`
 * lets `undefined` / `null` / a whole expression through unmasked, which is
@@ -68236,6 +68322,7 @@ function acceptRefusalReason(change, maskedPaths) {
 	if (!maskedPaths.has(change.path)) return void 0;
 	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
 	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
+	if (change.stateValue === "***") return "cdkd does not know the value that belongs at this position — the baseline holds only the redaction mask, so accepting would write AWS-held plaintext over a deliberate redaction. Re-deploy to refresh it";
 	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
 }
 /**
@@ -68263,8 +68350,8 @@ function acceptRefusalReason(change, maskedPaths) {
 *
 * Returns the input array by identity when there is nothing to act on.
 */
-function redactDriftChanges(changes, secrets, secretPaths) {
-	if (secrets.size === 0 && secretPaths.size === 0) return {
+function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
+	if (secrets.size === 0 && secretPaths.size === 0 && maskPaths.size === 0 && !changes.some((change) => carriesSecretMask(change.stateValue))) return {
 		changes,
 		maskedPaths: /* @__PURE__ */ new Set()
 	};
@@ -68272,9 +68359,10 @@ function redactDriftChanges(changes, secrets, secretPaths) {
 	const redacted = [];
 	for (const change of changes) {
 		const maskedPath = maskSecretsInText(change.path, secrets);
-		const positionIsSecret = isSecretBearingPath(change.path, secretPaths);
+		const positionIsSecret = isSecretBearingPath(change.path, secretPaths) || isSecretBearingPath(change.path, maskPaths);
 		const nameCarriesSecret = maskedPath !== change.path;
-		const secretBearing = positionIsSecret || nameCarriesSecret;
+		const stateValueIsMask = carriesSecretMask(change.stateValue);
+		const secretBearing = positionIsSecret || nameCarriesSecret || stateValueIsMask;
 		if (secretPaths.has(change.path) && change.awsValue === void 0) continue;
 		const stateValue = redactDriftValue(change.stateValue, secrets, secretBearing);
 		const awsValue = redactDriftValue(change.awsValue, secrets, secretBearing);
@@ -68371,6 +68459,9 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				const seededSecretPaths = /* @__PURE__ */ new Set();
 				collectDynamicReferencePaths(baseline, seededSecretPaths);
 				if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+				const maskSecretPaths = /* @__PURE__ */ new Set();
+				collectSecretMaskPaths(baseline, maskSecretPaths);
+				if (useObserved) collectSecretMaskPaths(resource.properties ?? {}, maskSecretPaths);
 				const unresolvedTokens = /* @__PURE__ */ new Set();
 				const noteUnresolved = (tokens) => {
 					for (const token of tokens) unresolvedTokens.add(token);
@@ -68411,7 +68502,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 					unionWalkObjects: useObserved,
 					unorderedPaths
-				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
 				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
 				if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
 					kind: "notCompared",
@@ -69013,6 +69104,101 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
 	return walk(send, awsProperties);
 }
 /**
+* Keep `cdkd drift --revert` from pushing a REDACTION MASK to AWS (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WHY THIS EXISTS AT ALL. A `NoEcho` custom resource's `Data` resolved into a
+* dependent's property is persisted as {@link SECRET_MASK}, because there is no
+* expression to store in its place. `--revert` pushes the BASELINE to AWS, so
+* without this a revert triggered by a SIBLING key would write the literal
+* `***` onto the live SSM parameter / secret / env var — the issue #1498 /
+* #1501 data-corruption class, and strictly worse than the disclosure the mask
+* exists to prevent. Shipping the mask without this guard would trade one for
+* the other.
+*
+* The sibling of {@link preserveLiveValuesAtUnresolvedTokens} and deliberately
+* a SEPARATE function rather than another branch inside it. That one is gated
+* on `unresolvedTokens.size > 0` at its call site, and this hazard is decided
+* by the SEND bag alone — a resource can carry a mask with no unresolved token
+* anywhere, so folding the two would put this check behind a condition that has
+* nothing to do with it.
+*
+* IT REGISTERS WHAT IT MOVES, exactly as the sibling does, and an earlier
+* revision's reason for not doing so was wrong: it said "the live value is one
+* cdkd never resolved and cannot recognise, so there is no needle to record".
+* The needle is `liveValue -> {@link SECRET_MASK}`, i.e. a MASK-ONLY entry, and
+* the evidence for it is the position — THE MASKED POSITION IS THE PROOF THE
+* VALUE IS SECRET, since nothing but this module's own redaction puts a mask at
+* a leaf. Without the registration this function copies live plaintext into the
+* send bag and then `collectNarrowedTopLevelKeys` persists that delta into
+* `observedProperties` against a `secrets` map holding no entry for it — the
+* same disclosure the mask exists to prevent, arriving through the mechanism
+* that is supposed to protect it — and the same omission un-masks it in
+* `maskSecretsInText(err.message, secrets)` and in the masker handed to
+* `provider.update`.
+*
+* `secrets` is therefore MUTATED, which is why it is a parameter rather than
+* something the caller could omit. `recordMaskOnlyValue` applies its own
+* refusals (an entry that already carries a real EXPRESSION wins; a plaintext
+* below the needle floor is not recorded), so this call site states only the
+* position fact and lets the module decide what is registrable.
+*
+* TWO OUTCOMES per masked leaf, and the second is why this returns a report
+* rather than just a bag:
+*
+* - AWS holds a value there -> copy the LIVE value in. The revert then leaves
+*   that position exactly as AWS has it while still reverting every other
+*   drifted key, which is the same trade `preserveLiveValuesAtUnresolvedTokens`
+*   makes.
+* - AWS holds nothing there (the position could not be aligned, or the key is
+*   absent live) -> there is no safe value to send, so the path is reported as
+*   UNPRESERVABLE and the caller refuses the whole resource. Sending the mask
+*   would be the corruption; dropping the key would delete a property the
+*   resource may require.
+*
+* Array descent is POSITIONAL and bails to "no live value" on any length
+* mismatch, matching the sibling: a reordered readback cannot be positioned
+* against, and guessing would put one element's live value at another's index.
+*
+* Returns the input bag BY IDENTITY when it holds no mask, so the ordinary
+* revert is byte-identical and pays one walk.
+*/
+function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets) {
+	const unpreservablePaths = [];
+	let changed = false;
+	const walk = (value, live, path) => {
+		if (value === "***") {
+			if (live === void 0) {
+				unpreservablePaths.push(path);
+				return value;
+			}
+			changed = true;
+			if (typeof live === "string") recordMaskOnlyValue(secrets, live);
+			return live;
+		}
+		if (Array.isArray(value)) {
+			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
+			return value.map((item, i) => walk(item, liveItems?.[i], `${path}[${i}]`));
+		}
+		if (value !== null && typeof value === "object") {
+			const liveObject = isPlainRecord(live) ? live : void 0;
+			const out = {};
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k], path === "" ? k : `${path}.${k}`);
+			return out;
+		}
+		return value;
+	};
+	const properties = walk(send, awsProperties, "");
+	if (!changed && unpreservablePaths.length === 0) return {
+		properties: send,
+		unpreservablePaths
+	};
+	return {
+		properties,
+		unpreservablePaths
+	};
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -69254,7 +69440,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				let newProperties;
 				try {
 					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					newProperties = unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid;
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid, outcome.awsProperties, secrets);
+					if (maskPreserved.unpreservablePaths.length > 0) {
+						totalUnresolvable++;
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskPreserved.unpreservablePaths.join(", ")} — the recorded baseline holds only the redaction mask there (a NoEcho custom-resource value), and AWS reports nothing to preserve, so cdkd has no value it may write. Force that custom resource to update (change one of its properties, e.g. a nonce) and re-deploy, so its handler runs again and supplies the value — an ordinary re-deploy leaves it unchanged and the mask stays.`);
+						return;
+					}
+					newProperties = maskPreserved.properties;
 				} catch (err) {
 					totalFailed++;
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
@@ -72134,6 +72326,14 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			});
 			continue;
 		}
+		if (carriesSecretMask(stateEntry.properties)) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: "cdkd state holds only the redaction mask ('***') for at least one property — a NoEcho custom-resource value cdkd cannot re-derive. Forcing the custom resource to update does NOT clear this: the handler supplies the value to the deploy, and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again; or export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274."
+			});
+			continue;
+		}
 		if (IMPORT_UNSUPPORTED_RECREATABLE_TYPES.has(resourceType)) {
 			if (options.recreateImportUnsupported) recreateBeforePhase2.push({
 				logicalId,
@@ -75796,10 +75996,6 @@ async function eventsPruneCommand(stackName, options) {
 		const totalRuns = (await reader.listRuns(stackName, targetRegion)).length;
 		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${options.olderThan}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${options.olderThan}` : `runs beyond the newest ${20}`;
 		if (options.yes !== true) {
-			if (!process.stdin.isTTY) {
-				logger.info(gray(`Refusing to prune deployment-event history for ${stackName} (${targetRegion}) without confirmation on a non-interactive terminal. Re-run with --yes to proceed.`));
-				return;
-			}
 			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(stackName)} ${gray(`(${targetRegion})`)}: ${scope}?`)) {
 				logger.info(gray("Aborted; nothing was deleted."));
 				return;
@@ -75819,18 +76015,16 @@ async function eventsPruneCommand(stackName, options) {
 		awsClients.destroy();
 	}
 }
-/** Minimal `(y/N)` confirmation prompt. */
+/**
+* Minimal `(y/N)` prune confirmation, delegating to the shared guarded helper.
+*
+* Exported for unit testing, matching the nine siblings issue #2275 folded —
+* `tests/unit/cli/non-interactive-confirm-guards.test.ts` drives each command's
+* wrapper directly, which is how the refusal wording and the never-settling
+* hang fence are checked per site.
+*/
 async function confirmPrompt$2(prompt) {
-	const rl = readline$1.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const ans = await rl.question(`${prompt} [y/N] `);
-		return /^y(es)?$/i.test(ans.trim());
-	} finally {
-		rl.close();
-	}
+	return confirmOrRefuse(prompt, { refusal: "The cdkd events prune confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the prune, or run the command from a real terminal. Nothing has been deleted." });
 }
 /** Human-readable run listing (newest first). */
 function printRunList(stackName, region, runs) {
@@ -89193,4 +89387,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CjJoJOIE.js.map
+//# sourceMappingURL=program-BHmUE52I.js.map