@go-to-k/cdkd 0.285.8 → 0.285.9

package/dist/{deploy-engine-D4QA_B1V.js → deploy-engine-BhBR2d3w.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DFdq83MF.js";
+import { t as getCdkdVersion } from "./version-BWsyP2sq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9638,6 +9638,297 @@ function isRecordedSecretExpression(expression) {
 function clearRecordedSecretExpressions() {
 	recordedSecretExpressions$1.clear();
 }
+/**
+* The plaintexts a pass recorded with NO EXPRESSION behind them — the
+* MASK-ONLY needle class (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WHAT IT IS FOR. A Lambda-backed custom resource's handler can declare its
+* response `Data` sensitive with the documented `NoEcho: true` envelope field.
+* That value is GENERATED by the handler, so cdkd never substituted it from
+* anything: there is no `{{resolve:...}}` expression to rewrite it back onto,
+* which is exactly why {@link RecordedSecretValues} — a plaintext -> EXPRESSION
+* map — cannot hold it on its own terms. The value still must not sit in
+* `state.json`, so what gets persisted in its place is {@link SECRET_MASK}.
+*
+* WHY THE SAME MAP RATHER THAN A SECOND BAG. Every persistence reader in this
+* module already walks a `RecordedSecretValues` — `scrubResourceRecord`'s three
+* fields, the rollback journal's ops, the outputs bag, `maskSecretsInText`'s
+* log / error / event sites. Threading a parallel bag to each of them would be
+* a wide change with one place per reader to forget. Recording the pair as
+* `plaintext -> SECRET_MASK` means the whole-value arm of
+* {@link redactSecretsForState} substitutes the mask with no code change at
+* all, and every reader is covered by construction.
+*
+* THE SENTINEL VALUE **IS** THE MARKER — there is no side table, and an earlier
+* revision's `WeakMap<RecordedSecretValues, Set<string>>` was removed after a
+* mutation probe showed the extra conjunct could not be fenced AND pointed the
+* wrong way. Nothing but {@link recordMaskOnlyValue} ever writes
+* {@link SECRET_MASK} as a map VALUE (every other writer stores a whole
+* `{{resolve:...}}` token, and {@link recordCrossStackExpression} refuses
+* anything else), so the side table could only ever disagree about an entry
+* some future writer valued `***` by hand — and for THAT entry, withholding the
+* substring arm is the SAFE answer, which is what the side table would have
+* denied. Scope is unaffected: the MAP is already per-pass, so a mask cannot
+* reach another resource's bag any more than an expression can.
+*
+* THE ONE PLACE THE CLASSES MUST DIFFER: the SUBSTRING arm. Substituting an
+* EXPRESSION for a match inside a longer leaf is lossless — the persisted leaf
+* still names a value every downstream reader can re-resolve. Substituting a
+* MASK is not: an inline `***` is indistinguishable from a literal `***` a user
+* wrote, so no consumer can recognise it, and `cdkd drift --revert` /
+* `resolveReplayProps` would push the corrupted string to AWS. A mask is only
+* safe where it is RECOGNISABLE, and that means whole-leaf. So a mask-only
+* plaintext is excluded from the persist path's needle regex and reaches only
+* the whole-value arm — the same "weaker class, narrower blast radius" shape
+* PR #2415 established for its `inferred` needles, which likewise take a leaf
+* whole or not at all.
+*
+* {@link maskSecretsInText} is deliberately NOT narrowed the same way: its
+* output is a log line, an error message or an event, which nothing reads back
+* as a value, so a partial mask there costs nothing and closes an embedded
+* disclosure.
+*/
+/**
+* Record `plaintext` as MASK-ONLY in `secrets` — persist {@link SECRET_MASK} in
+* its place, with no expression to substitute (issue #2274).
+*
+* An EXPRESSION already recorded for the same plaintext WINS and this is a
+* no-op: an expression is strictly better than a mask (it is re-resolvable, it
+* survives `drift --revert` and the rollback replay, and it reaches the
+* substring arm), so a mask must never demote one. The reverse direction needs
+* no code: the resolver writes an expression straight into the map, and
+* {@link isMaskOnlyPlaintext} re-checks the map value, so a plaintext that
+* later acquires a real expression stops being mask-only immediately.
+*
+* A plaintext shorter than {@link MIN_NEEDLE_LENGTH} is REFUSED, and this floor
+* is the one place the mask class needs a bound the EXPRESSION class does not
+* (issue #2274 review). An expression-bearing needle below the threshold is
+* still substituted on the WHOLE-VALUE arm, and that is safe because the pair
+* came from a POSITION cdkd resolved: the leaf it rewrites provably held that
+* reference. A mask-only needle has no position behind it — it is a bare
+* plaintext the handler happened to return — so the whole-value arm masks EVERY
+* leaf equal to it, anywhere in the record. A handler answering
+* `Data: { Count: "7" }` would otherwise mask any property whose whole value is
+* `"7"`, unrecoverably (there is no expression to re-resolve) and on every
+* later run (the mask then trips `refuseRedactedAttributeReads`,
+* `refuseMaskedReplayBaseline` and the export blocker). The floor is the same
+* constant the substring arm already applies, so the two arms of this module
+* now agree about what is too short to be a distinguishing value.
+*
+* THE BOUND IS THE MODULE'S, NOT ONE THIS CHANNEL INVENTED, and it is stated
+* rather than overstated: {@link MIN_NEEDLE_LENGTH} is 4, so a FOUR-character
+* member (`"true"`) still becomes a needle and a property whose whole value is
+* `"true"` is still masked. Raising the floor here alone would fork the two
+* arms' idea of a distinguishing value, which is the disagreement the shared
+* constant exists to prevent. The remedy for that shape is a handler contract
+* — do not declare a whole response `NoEcho` when its `Data` mixes a secret
+* with short non-secret members — and it is asserted in
+* `secret-redaction-mask-only.test.ts` so the bound is a recorded decision
+* rather than a surprise.
+*
+* The empty string is refused by the same bound, and would be refused anyway
+* for the reason the value pass refuses it: it is not a distinguishing value,
+* and recording it would mask every empty leaf.
+*/
+function recordMaskOnlyValue(secrets, plaintext) {
+	if (plaintext.length < 4) return;
+	const existing = secrets.get(plaintext);
+	if (existing !== void 0 && existing !== "***") return;
+	secrets.set(plaintext, "***");
+}
+/**
+* Is `plaintext` a MASK-ONLY entry of `secrets`?
+*
+* Read off the MAP, so a plaintext this module marked as mask-only and the
+* resolver later records WITH an expression stops being one immediately —
+* which matters, because that entry has earned the substring arm back.
+*/
+function isMaskOnlyPlaintext(secrets, plaintext) {
+	return secrets.get(plaintext) === "***";
+}
+/**
+* Record every STRING LEAF of `value` as a MASK-ONLY needle in `secrets`.
+*
+* The bag-shaped twin of {@link recordMaskOnlyValue}, used where a whole
+* `Data` / attributes object is declared sensitive at once. Non-string leaves
+* are skipped deliberately: the redaction walk matches by string value, so
+* there is nothing to key a number or a boolean on, and both are far too
+* collision-prone to be useful needles even if there were.
+*
+* `excluded` is the set of plaintexts CDKD ITSELF SUPPLIED to the resource, and
+* passing it is what keeps a handler from masking cdkd's own inputs back at it
+* (issue #2274 review). A handler echoing its `event.ResourceProperties` into
+* `Data` — the shape the CDK `Provider` framework's samples encourage — makes
+* `Data.X` equal to the resource's own `ServiceToken`, and recording THAT as a
+* needle rewrites `properties.ServiceToken` to `***` in the very record
+* `CustomResourceProvider.delete` reads it back from, where `'***'` is a
+* truthy string that passes both of that method's guards. Such a value is not
+* handler-GENERATED at all — it is in the synthesized template already — so
+* excluding it costs no secrecy.
+*/
+function recordMaskOnlyValuesIn(value, secrets, excluded) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			if (excluded?.has(node) === true) return;
+			recordMaskOnlyValue(secrets, node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+}
+/**
+* Every WHOLE string leaf of `value`, as a set — the `excluded` argument
+* {@link recordMaskOnlyValuesIn} takes, built from the resource's own resolved
+* template properties.
+*
+* WHOLE leaves only, matching the arm the mask class is served on: a mask-only
+* needle never reaches the substring scan, so a plaintext that merely OCCURS
+* inside a property is not something this exclusion has to answer for.
+*/
+function wholeStringLeavesOf(value) {
+	const leaves = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") {
+			leaves.add(node);
+			return;
+		}
+		if (node === null || typeof node !== "object") return;
+		if (seen.has(node)) return;
+		seen.add(node);
+		if (Array.isArray(node)) {
+			for (const item of node) walk(item);
+			return;
+		}
+		for (const child of Object.values(node)) walk(child);
+	};
+	walk(value);
+	return leaves;
+}
+/**
+* Does `value` carry {@link SECRET_MASK} as a WHOLE string leaf?
+*
+* The recognition test every consumer of a REDACTED baseline shares (issue
+* #2274). A mask-only redaction is whole-leaf precisely so it stays
+* recognisable, and this is what recognises it — in the resolver (a persisted
+* attribute cdkd can no longer serve), in `cdkd drift` (a baseline that must
+* not be pushed by `--revert` nor overwritten by `--accept`), and in the
+* rollback replay (a desired bag that must not reach a provider).
+*
+* Whole-leaf EQUALITY, never containment: an inline `***` inside a longer
+* string is either a user's own literal or text this module never wrote, and
+* treating it as a mask would refuse ordinary values. The corresponding limit —
+* a NoEcho value EMBEDDED in a larger leaf keeps its plaintext — is the same
+* one the mask-only channel note above states, and is tracked separately.
+*
+* UNBOUNDED in depth, guarded by {@link WalkedContainers} — see that type for
+* why a depth cap here was a hole rather than a safety measure.
+*/
+function carriesSecretMask(value) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node) => {
+		if (typeof node === "string") return node === "***";
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some((item) => walk(item));
+		return Object.values(node).some((child) => walk(child));
+	};
+	return walk(value);
+}
+/**
+* The plaintexts the PERSIST path may scan for as SUBSTRINGS — every recorded
+* one except the mask-only class. See the mask-only channel note above for why the
+* mask class is whole-leaf only.
+*/
+function substringNeedlesOf(secrets) {
+	const needles = [];
+	for (const plaintext of secrets.keys()) if (!isMaskOnlyPlaintext(secrets, plaintext)) needles.push(plaintext);
+	return needles;
+}
+/**
+* The EXPRESSIONS a pass recorded — `secrets.values()` minus the mask-only
+* class, whose "expression" is the mask sentinel rather than a reference.
+*
+* Removing this filter is an EQUIVALENT MUTANT and no test can red on it —
+* stated rather than claimed pinned. {@link SECRET_MASK} is not a
+* dynamic-reference token, so neither `isKnownSecretExpression` nor a skeleton
+* pattern can ever accept it as a candidate. It is kept because a list
+* documented as "the expressions this pass recorded" must not silently contain
+* something that is not one: the day a candidate test stops requiring token
+* SHAPE, the sentinel would be live in it.
+*/
+function recordedExpressionsOf(secrets) {
+	const expressions = /* @__PURE__ */ new Set();
+	for (const [plaintext, expression] of secrets) if (!isMaskOnlyPlaintext(secrets, plaintext)) expressions.add(expression);
+	return expressions;
+}
+/**
+* The IN-RUN recovery channel for a stack OUTPUT this process masked (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* WHY IT EXISTS. Masking a `NoEcho` custom resource's `Data` on the way into
+* `state.json` is right within one stack, where `Fn::GetAtt` reads the value out
+* of the IN-MEMORY record and gets the plaintext. It breaks the moment the value
+* crosses a STACK boundary, because every cross-stack route reads the producer's
+* PERSISTED `state.outputs`: a nested stack's `Outputs.<Key>` (via
+* `NestedStackProvider.readChildOutputsAsAttributes`), `Fn::ImportValue` (via
+* the exports index or a state scan) and `Fn::GetStackOutput` all land on the
+* mask. Without this the FIRST deploy of a parent whose child exports such a
+* value would refuse — a template that deployed before this feature — which is
+* a regression rather than a trade.
+*
+* WHAT IT IS. `stack + region + output key -> the plaintext that key held
+* before redaction`, written at the moment the producer's outputs are redacted
+* and read at the three cross-stack sites above. It answers only for a producer
+* THIS PROCESS deployed in THIS run, which is exactly the population that has a
+* plaintext to hand back: a separate `cdkd deploy` of the consumer has none, and
+* that case is refused rather than guessed at.
+*
+* WHY THE COORDINATE, and not a plaintext-keyed set. A bare-plaintext store was
+* the shape PR #2415 was forced to WITHDRAW (`provenPublicExpressions`,
+* residual #2425): keyed on a value alone, one stack's answer is served to
+* another stack's identically-spelled read. Here the key names the producer
+* stack, its region and the output — so a hit is served only to a resolution
+* that asked for that exact output of that exact stack, i.e. to precisely the
+* reader that would have received the plaintext before this feature existed.
+* Nothing is widened.
+*
+* A RECOVERED VALUE IS STILL SECRET, and every reader re-registers it as a
+* mask-only needle in its OWN bag before using it — the recovery hands back the
+* value for the WIRE, never for persistence.
+*/
+const recoverableMaskedOutputs = /* @__PURE__ */ new Map();
+function maskedOutputKey(stackName, region, outputKey) {
+	return `${stackName}\u0000${region}\u0000${outputKey}`;
+}
+/**
+* Remember the plaintext an output held before {@link SECRET_MASK} replaced it.
+* See {@link recoverableMaskedOutputs}.
+*/
+function recordRecoverableMaskedOutput(stackName, region, outputKey, plaintext) {
+	recoverableMaskedOutputs.set(maskedOutputKey(stackName, region, outputKey), plaintext);
+}
+/**
+* The plaintext this process masked out of `stackName`'s `outputKey`, or
+* `undefined` when this run did not produce that output.
+*
+* `undefined` is the honest answer for a producer deployed by an EARLIER run:
+* the value is gone and cdkd must refuse rather than write the mask to AWS.
+*/
+function recoverMaskedOutput(stackName, region, outputKey) {
+	return recoverableMaskedOutputs.get(maskedOutputKey(stackName, region, outputKey));
+}
 const crossStackAssociations = /* @__PURE__ */ new WeakMap();
 /** Poison for a key seen against two different (expression, plaintext) pairs. */
 const CONFLICTING_CROSS_STACK = Symbol("conflicting cross-stack association");
@@ -12101,7 +12392,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
@@ -12109,7 +12400,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
 		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
-	const regex = buildNeedleRegex(secrets.keys());
+	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
 	/**
 	* The SUBSTRING arm for a leaf the resolver substituted INTO rather than
@@ -12248,6 +12539,15 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 * Used on log lines and error messages where a resolved secret could otherwise
 * be echoed. Whole-value and embedded matches are both masked. Returns `text`
 * unchanged when there is nothing to mask.
+*
+* The MASK-ONLY class (issue #2274) participates here FULLY — `secrets.keys()`,
+* not the persist path's narrowed `substringNeedlesOf` — and the asymmetry is
+* deliberate rather than an oversight. The persist path withholds the substring
+* arm from a mask because an inline `***` is a value nothing downstream can
+* recognise or re-resolve; this output is a log line, an error message or an
+* event, which no consumer reads back as a value, so a partial mask costs
+* nothing and closes an EMBEDDED disclosure that would otherwise print. See
+* the mask-only channel note above.
 */
 function maskSecretsInText(text, secrets) {
 	if (secrets.size === 0) return text;
@@ -18384,11 +18684,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
 					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, nameServers)}`);
-					return nameServers;
+					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
-				return flatValue;
+				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
 				const parts = attributeName.split(".");
@@ -18400,7 +18700,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				if (cursor !== void 0) {
 					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, cursor)}`);
-					return cursor;
+					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
@@ -18413,6 +18713,59 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return value;
 	}
 	/**
+	* Note what SECRECY the attribute just read carries, then hand it back
+	* UNCHANGED (issue [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+	*
+	* Two independent notes, in the two directions a `NoEcho` custom-resource
+	* `Data` value travels, and they are on one function because both are read
+	* off the same value at the same instant:
+	*
+	* 1. **This run's fresh value.** If a provider declared this resource's
+	*    attributes `NoEcho` earlier in THIS deploy, every string leaf becomes a
+	*    MASK-ONLY needle in the CONSUMER's own bag, so the plaintext this
+	*    resolution is about to substitute into the dependent's properties is
+	*    masked when that record is persisted. Registering into
+	*    `context.recordedSecretValues` — the consumer's bag — rather than the
+	*    producer's is what makes it work at all: `perResourceSecrets` is keyed by
+	*    LOGICAL ID, so a needle recorded under the custom resource's own id is
+	*    not in the bag the DEPENDENT's record is scrubbed with.
+	* 2. **A previous run's masked value.** If what came back IS the mask, this
+	*    attribute was redacted into `state.json` by an earlier deploy and cdkd
+	*    cannot recover it (there is no durable `NoEcho` flag and no expression to
+	*    re-resolve — issue #2449). It is recorded as a redacted READ so the
+	*    deploy engine can refuse to push the literal `***` to AWS.
+	*
+	* IT RETURNS THE VALUE, and passing through rather than mutating in place is
+	* the point: a new attribute-serving branch is written as `return
+	* this.noteAttributeSecrecy(...)` by imitation of the two that have it.
+	* `Fn::GetAtt` must keep delivering the REAL value (CloudFormation does,
+	* measured), so this can never rewrite what it is handed.
+	*
+	* IT IS NOT A GUARANTEE, and an earlier revision claimed it was ("impossible
+	* to add a third branch that silently skips the note"). Nothing in the type
+	* system stops a branch returning a value it never passed through here, and
+	* one already did: the Route 53 `NameServers` legacy-shape normalization,
+	* which reads the SAME persisted `attributes` bag and shipped without the
+	* note (it takes it now). The rule the note actually needs is about the
+	* SOURCE of the value — every branch serving one out of a PERSISTED
+	* `attributes` bag must call this — and that is not a shape a compiler can
+	* enforce. `constructGuardedAttribute`'s return is deliberately outside it:
+	* that value is fetched from AWS in this run, not read back from state, so
+	* it can be neither a stale mask nor a value a provider declared `NoEcho`.
+	*
+	* A context supplying NEITHER field — the diff / no-op resolver, `cdkd
+	* scrub`, `cdkd import` — pays two undefined checks and gets its value back.
+	*/
+	noteAttributeSecrecy(logicalId, attributeName, value, context) {
+		const declared = context.noEchoAttributeResources?.get(logicalId);
+		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
+		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
+			const read = `${logicalId}.${attributeName}`;
+			if (!context.redactedAttributeReads.includes(read)) context.redactedAttributeReads.push(read);
+		}
+		return value;
+	}
+	/**
 	* Refuse a pre-#1681 PLACEHOLDER ARN served from the cached attribute map
 	* (issue #1729) — the `Fn::GetAtt` half of the guard
 	* {@link cfnRefValueFromPhysicalId} applies to `Ref`.
@@ -19376,7 +19729,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* the producer's rather than the caller's — which is exactly what issue #2057
 	* says the other two copies get wrong.
 	*/
-	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey) {
+	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey, producerOutput) {
+		if (carriesSecretMask(value)) {
+			const recovered = producerOutput === void 0 || producerOutput.crossAccount === true ? void 0 : recoverMaskedOutput(producerOutput.stackName, producerOutput.region, producerOutput.outputKey);
+			if (recovered !== void 0) {
+				if (context.recordedSecretValues) recordMaskOnlyValuesIn(recovered, context.recordedSecretValues);
+				return recovered;
+			}
+			if (context.redactedAttributeReads !== void 0 && !context.redactedAttributeReads.includes(origin)) context.redactedAttributeReads.push(origin);
+		}
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
 		const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
@@ -19497,7 +19858,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
 				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
-				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey);
+				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
+					stackName: entry.producerStack,
+					region: entry.producerRegion,
+					outputKey: exportName
+				});
 			}
 		}
 		const allStacks = await context.stateBackend.listStacks();
@@ -19544,7 +19909,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				continue;
 			}
 		}
-		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey);
+		if (found) return await this.reresolveCrossStackValue(found.value, found.lookupRegion, context, `Fn::ImportValue '${exportName}' (producer ${found.refStack} / ${found.lookupRegion})`, sourceKey, {
+			stackName: found.refStack,
+			region: found.lookupRegion,
+			outputKey: exportName
+		});
 		if (this.cfnFallback) {
 			const cfnExport = await this.lookupCfnExport(exportName, context);
 			if (cfnExport) {
@@ -19797,7 +20166,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
 		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
-		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey);
+		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
+			stackName,
+			region,
+			outputKey: outputName,
+			...roleArn ? { crossAccount: true } : {}
+		});
 	}
 	/**
 	* Push a resolved `Fn::GetStackOutput` into the consumer's
@@ -21462,7 +21836,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CvYAGRMV.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-hNkWDuAJ.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23738,7 +24112,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 			this.logger.debug(`Successfully created custom resource ${logicalId}: ${physicalId}`);
 			return {
 				physicalId,
-				attributes
+				attributes,
+				...cfnResponse.NoEcho === true && { noEchoAttributes: true }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -23773,7 +24148,8 @@ var CustomResourceProvider = class CustomResourceProvider {
 			return {
 				physicalId: newPhysicalId,
 				wasReplaced,
-				attributes
+				attributes,
+				...cfnResponse.NoEcho === true && { noEchoAttributes: true }
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -24285,6 +24661,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				const result = { Status: "SUCCESS" };
 				if (payload.PhysicalResourceId) result.PhysicalResourceId = payload.PhysicalResourceId;
 				if (payload.Data) result.Data = payload.Data;
+				if (payload.NoEcho === true) result.NoEcho = true;
 				return result;
 			}
 			hasDirectPayload = Object.keys(payload).length > 0;
@@ -29882,6 +30259,37 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 	return await walk(props, "");
 }
 /**
+* Refuse to REPLAY a bag whose recorded baseline holds a REDACTION MASK (issue
+* [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+*
+* The rollback twin of `drift --revert`'s
+* `preserveLiveValuesAtMaskedLeaves`, and it exists for the same reason: a
+* `NoEcho` custom resource's `Data` resolved into a dependent's property is
+* persisted as {@link SECRET_MASK}, because there is no expression to store in
+* its place — and this executor replays a persisted bag straight to
+* `provider.update()` / `create()`. Without a guard the literal `***` would be
+* written onto the live resource, which is the issue #1498 / #1501
+* data-corruption class.
+*
+* IT REFUSES rather than substituting, and that is the difference from the
+* drift twin. `--revert` holds an AWS-current readback beside the baseline, so
+* it can leave the position exactly as AWS has it; a replay holds no readback
+* at all — `previousState.properties` IS its only source — so there is nothing
+* to fall back to. Failing the ONE op with an actionable message is strictly
+* better than writing a value cdkd knows is wrong, and the per-op failure
+* accounting this file already has is what carries it.
+*
+* CALLED ON THE WRITTEN SIDE ONLY. Each revert arm resolves two bags; the other
+* one becomes the provider's `previousProperties`, where a mask is harmless (a
+* patch provider comparing `***` against the desired value simply sees a
+* change, which is the correct conclusion — the live value is not what state
+* records). Refusing there would block rollbacks that have no problem.
+*/
+function refuseMaskedReplayBaseline(props, logicalId) {
+	if (props === void 0 || !carriesSecretMask(props)) return;
+	throw new CdkdError(`Cannot roll ${logicalId} back: its recorded baseline holds the redaction mask ('${"***"}') where a NoEcho custom-resource value was resolved, so cdkd would write that literal to the live resource. Restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
+}
+/**
 * The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
 * region an ARN-named reference asks for (issue #2057).
 *
@@ -30336,6 +30744,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
+				refuseMaskedReplayBaseline(resolvedPrevProps, op.logicalId);
 				recordNestedStackParameterExpressions(secrets, op.resourceType, resolvedPrevProps, prev.properties, STATE_DERIVED_RULES);
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
@@ -30429,6 +30838,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					provisionedBy: op.provisionedBy
 				});
 				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
+				refuseMaskedReplayBaseline(desiredProps, op.logicalId);
 				const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
 				recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, previousState.properties, STATE_DERIVED_RULES);
 				const revertResult = await updateWithRollbackRetry(provider, [
@@ -30585,6 +30995,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
 					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
+					refuseMaskedReplayBaseline(desiredProps, op.logicalId);
 					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
 					recordNestedStackParameterExpressions(secrets, op.resourceType, desiredProps, prev.properties, STATE_DERIVED_RULES);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
@@ -31431,6 +31842,29 @@ var DeployEngine = class {
 	*/
 	perResourceSecrets = /* @__PURE__ */ new Map();
 	/**
+	* Logical ids whose provider declared THIS RUN's `attributes` sensitive
+	* (`ResourceCreateResult.noEchoAttributes` — issue
+	* [#2274](https://github.com/go-to-k/cdkd/issues/2274)). One producer today:
+	* `CustomResourceProvider`, relaying the handler's `NoEcho: true`.
+	*
+	* IN-RUN ONLY, and that is the whole shape of the feature rather than a
+	* shortcut. `NoEcho` arrives on a RESPONSE, so cdkd knows it exactly when the
+	* handler answered — this deploy — and `ResourceState` carries no durable
+	* per-attribute flag to remember it by (a v9 -> v10 schema bump, issue
+	* [#2449](https://github.com/go-to-k/cdkd/issues/2449)). Within the run that
+	* is enough: the DAG provisions the custom resource before anything that
+	* depends on it, so every dependent's resolution sees the entry. Across runs
+	* the persisted `***` is the signal instead — see
+	* `ResolverContext.redactedAttributeReads`.
+	*
+	* Reset per `deploy()`, like `perResourceSecrets`.
+	*
+	* `true` means the WHOLE attributes bag is sensitive (a custom resource's
+	* `NoEcho` response); a SET names the sensitive members only (a nested
+	* stack's `Outputs.<Key>` entries — see `NoEchoAttributesResult`).
+	*/
+	noEchoAttributeResources = /* @__PURE__ */ new Map();
+	/**
 	* PER-RESOURCE unresolved TEMPLATE properties, keyed by logicalId (issues
 	* #1904 / #1900). The redaction choke point uses this as the POSITION source:
 	* wherever the template leaf is a `{{resolve:...}}` string, state persists
@@ -31518,6 +31952,7 @@ var DeployEngine = class {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
+		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
@@ -31545,7 +31980,9 @@ var DeployEngine = class {
 			recordedImports: this.recordedImports,
 			recordedOutputReads: this.recordedOutputReads,
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
-			recordedSecretValues
+			recordedSecretValues,
+			noEchoAttributeResources: this.noEchoAttributeResources,
+			redactedAttributeReads: []
 		};
 	}
 	/**
@@ -31594,6 +32031,30 @@ var DeployEngine = class {
 	* resolving one secret collapsed onto whichever expression was recorded last
 	* at all three.
 	*/
+	/**
+	* Record the plaintext behind every output {@link redactOutputs} just masked,
+	* for the duration of THIS PROCESS (issue #2274).
+	*
+	* Per KEY, comparing the two bags rather than re-deriving from the secrets
+	* map: what matters is whether the persisted value at this key IS a mask that
+	* the resolved value was not, which is exactly "this key's plaintext is about
+	* to become unreadable". A key already carrying `***` before redaction — a
+	* value read back out of a previous run's state — is skipped, because there
+	* is no plaintext behind it to remember.
+	*
+	* Called only from the REAL-DEPLOY outputs pass. The other two `redactOutputs`
+	* callers hand it a bag from a previous generation, where a mask is already
+	* unrecoverable and pretending otherwise would serve a stale value.
+	*/
+	rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
+		if (resolved === redacted) return;
+		for (const [key, redactedValue] of Object.entries(redacted)) {
+			if (!carriesSecretMask(redactedValue)) continue;
+			const plaintext = resolved[key];
+			if (plaintext === void 0 || carriesSecretMask(plaintext)) continue;
+			recordRecoverableMaskedOutput(stackName, this.stackRegion, key, plaintext);
+		}
+	}
 	redactOutputs(outputs) {
 		if (this.outputSecrets.size === 0) return outputs;
 		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES);
@@ -31625,6 +32086,85 @@ var DeployEngine = class {
 	* same shape — so it is redacted against ITSELF via `scrubResourceRecord`,
 	* the same #1900 fallback an UNCHANGED resource takes.
 	*/
+	/**
+	* Take a provider's `noEchoAttributes` declaration and turn it into REDACTION
+	* (issue [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
+	*
+	* TWO registrations, and both are needed because `perResourceSecrets` is
+	* keyed by LOGICAL ID:
+	*
+	* - the values go into the PRODUCER's own bag, which is what
+	*   `scrubResourceRecord` redacts this record's `attributes` with;
+	* - the logical id goes into {@link noEchoAttributeResources}, which every
+	*   later resolution consults, so a DEPENDENT that resolves an `Fn::GetAtt`
+	*   here records the same plaintext into ITS bag and its resolved
+	*   `properties` are masked too. Without the second half the custom resource's
+	*   record would be clean while the SSM parameter that consumed it still held
+	*   the plaintext — a line that cannot be explained to someone who set
+	*   `NoEcho` expecting "not in state".
+	*
+	* Called AFTER the provider returns and BEFORE the state record is built, so
+	* the needles exist by the time anything is persisted. Nothing is masked in
+	* memory: `stateResources[logicalId].attributes` keeps the REAL value, which
+	* is what the resolver serves to dependents in this same run.
+	*
+	* `ownProperties` is the resource's OWN resolved template bag, and passing it
+	* is what stops a handler from masking cdkd's inputs back at it (issue #2274
+	* review). Its whole string leaves are EXCLUDED from the needles: a handler
+	* echoing `event.ResourceProperties` into its `Data` — the shape the CDK
+	* `Provider` samples encourage — makes `Data.X` equal the resource's own
+	* `ServiceToken`, and registering that rewrites `properties.ServiceToken` to
+	* `***` in the record `CustomResourceProvider.delete` reads it back from,
+	* where the mask is a truthy string that passes both of that method's guards.
+	* A value already present in the template is not handler-GENERATED, so
+	* excluding it gives up no secrecy — and where the template value IS a
+	* resolved secret it already carries a real EXPRESSION needle, which
+	* `recordMaskOnlyValue` would refuse to demote anyway.
+	*/
+	registerNoEchoAttributes(logicalId, result, secrets, ownProperties) {
+		const attributes = result.attributes;
+		if (attributes === void 0) return;
+		const excluded = ownProperties === void 0 ? void 0 : wholeStringLeavesOf(ownProperties);
+		if (result.noEchoAttributes === true) {
+			this.noEchoAttributeResources.set(logicalId, true);
+			recordMaskOnlyValuesIn(attributes, secrets, excluded);
+			return;
+		}
+		const names = (result.noEchoAttributeNames ?? []).filter((name) => name in attributes);
+		if (names.length === 0) return;
+		this.noEchoAttributeResources.set(logicalId, new Set(names));
+		for (const name of names) recordMaskOnlyValuesIn(attributes[name], secrets, excluded);
+	}
+	/**
+	* Refuse to provision a resource whose resolution served a REDACTED attribute
+	* out of a previous deploy's state (issue #2274).
+	*
+	* The unavoidable cost of masking a `NoEcho` custom resource's `Data`: state
+	* then holds `***`, and cdkd cannot get the value back without re-invoking
+	* the handler, which is a SIDE-EFFECTING operation it must not perform just
+	* to fill in a property. Since `ResourceState` carries no durable `NoEcho`
+	* flag (issue #2449), there is not even a way to tell the user which
+	* attribute it was without this record.
+	*
+	* REFUSING IS THE SAFE DIRECTION and the alternative is not "it works": the
+	* literal `***` would be written to the live resource by any provider that
+	* sends its desired bag wholesale (`PutParameter` and every
+	* `Put*Configuration`), which is the issue #1498 / #1501 data-corruption
+	* class. A loud failure naming the remedy is strictly better than a silent
+	* wrong write.
+	*
+	* NARROW BY CONSTRUCTION. The bag is only non-empty when a `Fn::GetAtt`
+	* actually served a masked attribute during THIS resource's resolution, so a
+	* resource whose properties merely happen to contain the string `***` is
+	* untouched — which is why the check is not "does `resolvedProps` hold the
+	* mask". And the diff pass does not consult the bag at all, so an untouched
+	* stack still reports NO_CHANGE and deploys.
+	*/
+	refuseRedactedAttributeReads(logicalId, resourceType, context) {
+		const reads = context.redactedAttributeReads;
+		if (reads === void 0 || reads.length === 0) return;
+		throw new ProvisioningError(`Cannot resolve ${reads.join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. That happens when a custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Two remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
+	}
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
 			const secrets = this.perResourceSecrets.get(op.logicalId);
@@ -32272,7 +32812,9 @@ var DeployEngine = class {
 		let outputs;
 		try {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
+			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", currentEtag === void 0);
@@ -32688,6 +33230,7 @@ var DeployEngine = class {
 				}, stackName);
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				const createSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				recordNestedStackParameterExpressions(createSecrets, resourceType, resolvedProps, desiredProps);
@@ -32700,6 +33243,7 @@ var DeployEngine = class {
 				const createProvider = createDecision.provider;
 				const createProps = createDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 				const result = await this.withRetry(() => withCurrentResourceSecrets(createSecrets, () => createProvider.create(logicalId, resourceType, createProps, { maskSecrets: createSecretMasker(createSecrets) })), logicalId, void 0, void 0, createProvider);
+				this.registerNoEchoAttributes(logicalId, result, createSecrets, resolvedProps);
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const templateAttrs = this.extractTemplateAttributes(template, logicalId);
 				stateResources[logicalId] = {
@@ -32734,6 +33278,7 @@ var DeployEngine = class {
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.refuseRedactedAttributeReads(logicalId, resourceType, context);
 				this.perResourceTemplateProps.set(logicalId, desiredProps);
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
@@ -32875,6 +33420,7 @@ var DeployEngine = class {
 							}
 						}
 					}
+					this.registerNoEchoAttributes(logicalId, createResult, updateSecrets, resolvedProps);
 					stateResources[logicalId] = {
 						physicalId: createResult.physicalId,
 						resourceType,
@@ -32950,6 +33496,11 @@ var DeployEngine = class {
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
 					const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
+					this.registerNoEchoAttributes(logicalId, {
+						...carriedAttributes && { attributes: carriedAttributes },
+						...result.noEchoAttributes === true && { noEchoAttributes: true },
+						...result.noEchoAttributeNames && { noEchoAttributeNames: result.noEchoAttributeNames }
+					}, updateSecrets, resolvedProps);
 					stateResources[logicalId] = {
 						physicalId: result.physicalId,
 						resourceType,
@@ -33406,5 +33957,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { DEFAULT_STATE_PREFIX as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInError as $t, bold as A, describeAwsFailure as An, NestedStackChildDirectDestroyError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, Synthesizer as Bn, isCdkdError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DeployCancelledError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, validateAssetBucketName as Dn, LocalStartServiceError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, readBootstrapMarkerBody as En, LocalMigrateError as Er, configStringRefusal as Et, yellow as F, partitionSensitiveEnv as Fn, StackHasActiveImportsError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, resolveAutoAssetStorage as Gn, isThrottlingError as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDefaultStateBucketName as Hn, withErrorHandling as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, runDockerForeground as In, StackTerminationProtectionError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveStateBucketWithDefault as Jn, markRedactedCause as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, resolveCaptureObservedState as Kn, isTransientServerError as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, runDockerStreaming as Ln, StateError as Lr, s3BucketRegionalDomainName as Lt, gray as M, dockerSpawnEnvWithSensitive as Mn, ProvisioningError as Mr, classifyReplaySecretRegion as Mt, green as N, formatDockerLoginError as Nn, ResourceTimeoutError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, validateContainerRepoName as On, LockError as Or, replayWarn as Ot, red as P, getDockerCmd as Pn, ResourceUpdateNotSupportedError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, warnDeprecatedNoPrefixCliFlag as Qn, isSingleDynamicReferenceToken as Qt, exportAliasCollisionScrubWarning as R, AssetManifestLoader as Rn, SynthesisError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, ensureAssetStorage as Sn, DependencyError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, parseBootstrapMarker as Tn, LocalInvokeBuildError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, getLegacyStateBucketName as Un, isMarkedNonRetryable as Ur, withRetry as Ut, stateKeySecretExposure as V, synthesisStatusMessage as Vn, normalizeAwsError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, resolveApp as Wn, isRetryableTransientError as Wr, DagBuilder as Wt, maskDeep as X, resolveUseCdkBootstrapAssets as Xn, __exportAll as Xr, dynamicReferenceTokens as Xt, createMaskedRetryLogger as Y, resolveStateBucketWithDefaultAndSource as Yn, retryClassificationText as Yr, createSecretMasker as Yt, maskerOrIdentity as Z, stateBucketExistenceConfirmed as Zn, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, escapeRegExp$1 as _n, setAwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, displaySafe as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, BOOTSTRAP_MARKER_PREFIX as bn, ConfigError as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, importableOutputs as cn, canonicalizeRegion as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, stringifyValue as dn, processStackMessages as dr, isTerminationProtectionPropagationError as dt, maskSecretsInText as en, CFN_TEMPLATE_URL_LIMIT as er, beginCommandInterruptScope as et, withResourceDeadline as f, WorkGraph as fn, clearBucketRegionCache as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, rewriteTemplateAssetReferences as gn, resetAwsClients as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, loadPublishableAssetManifest as hn, getAwsClients as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, startInterruptWatch as it, cyan as j, buildDockerImage as jn, PartialFailureError as jr, requireConfigString as jt, formatResourceLine as k, buildDenyExternalAccessPolicy as kn, MissingCdkCliError as kr, requireConfigArray as kt, replayRollback as l, shouldRetainResource as ln, derivePartitionAndUrlSuffix as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, createAssetRedirectResolver as mn, AwsClients as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, scrubResourceRecord as nn, findLargeInlineResources as nr, interruptWatchListenerCount as nt, planFailedOps as o, exportNamesCarriedFrom as on, expectedOwnerParam as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, buildAssetRedirectMap as pn, resolveBucketRegion as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveSkipPrefix as qn, markNonRetryable as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, LockManager as rn, uploadCfnTemplate as rr, isInterruptedWaitError as rt, planRollback as s, importableOutputKeys as sn, PARTITION_TABLE as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, redactSecretsForState as tn, MIGRATE_TMP_PREFIX as tr, endCommandInterruptScope as tt, updatePartialMessage as u, AssetPublisher as un, AssemblyReader as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, stripControlChars as vn, AssetError as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, isCrossRegionRedirect as wn, DynamicReferenceRegionAmbiguousError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, assertAssetBucketRegion as xn, CrossAccountSecretRefusalError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, AssetModeResolver as yn, CdkdError as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, getDockerImageBySourceHash as zn, formatError as zr, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-D4QA_B1V.js.map
+export { DEFAULT_STATE_PREFIX as $, resolveUseCdkBootstrapAssets as $n, __exportAll as $r, isSingleDynamicReferenceToken as $t, bold as A, validateAssetBucketName as An, LocalStartServiceError as Ar, requireConfigObject as At, secretBearingStateKeyWarning as B, runDockerStreaming as Bn, StateError as Br, DiffCalculator as Bt, unsupportedFinalSnapshotError as C, BOOTSTRAP_MARKER_PREFIX as Cn, ConfigError as Cr, assertRegionMatch as Ct, isStatefulRecreateTargetSync as D, isCrossRegionRedirect as Dn, DynamicReferenceRegionAmbiguousError as Dr, readConfigString as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, getBootstrapMarkerKey as En, DeployCancelledError as Er, configStringRefusal as Et, yellow as F, dockerSpawnEnvWithSensitive as Fn, ProvisioningError as Fr, s3BucketDomainName as Ft, clearOnUpdateRemoval as G, getDefaultStateBucketName as Gn, withErrorHandling as Gr, TemplateParser as Gt, getCurrentResourceSecrets as H, getDockerImageBySourceHash as Hn, formatError as Hr, describeTypeWithThrottleRetry as Ht, collectDeclaredOutputNames as I, formatDockerLoginError as In, ResourceTimeoutError as Ir, s3BucketDualStackDomainName as It, findSilentDropProperties as J, resolveAutoAssetStorage as Jn, isThrottlingError as Jr, TEMPLATE_SOURCED_RULES as Jt, ProviderRegistry as K, getLegacyStateBucketName as Kn, isMarkedNonRetryable as Kr, STATE_SOURCED_CROSS_GENERATION_RULES as Kt, collectPublishedOutputNames as L, getDockerCmd as Ln, ResourceUpdateNotSupportedError as Lr, s3BucketRegionalDomainName as Lt, gray as M, buildDenyExternalAccessPolicy as Mn, MissingCdkCliError as Mr, classifyReplaySecretRegion as Mt, green as N, describeAwsFailure as Nn, NestedStackChildDirectDestroyError as Nr, producerRegionsFromState as Nt, renderStatefulReason as O, parseBootstrapMarker as On, LocalInvokeBuildError as Or, replayWarn as Ot, red as P, buildDockerImage as Pn, PartialFailureError as Pr, s3BucketArn as Pt, CUSTOM_RESOURCE_RESPONSE_PREFIX as Q, resolveStateBucketWithDefaultAndSource as Qn, retryClassificationText as Qr, errorCauseChain as Qt, exportAliasCollisionScrubWarning as R, partitionSensitiveEnv as Rn, StackHasActiveImportsError as Rr, s3BucketWebsiteUrl as Rt, refusesFinalSnapshot as S, AssetModeResolver as Sn, CdkdError as Sr, resolveExplicitPhysicalId as St, extractDeploymentEventError as T, ensureAssetStorage as Tn, DependencyError as Tr, configBooleanRefusal as Tt, IAMRoleProvider as U, Synthesizer as Un, isCdkdError as Ur, withRetry as Ut, stateKeySecretExposure as V, AssetManifestLoader as Vn, SynthesisError as Vr, INTRINSIC_KEYS as Vt, collectInlinePolicyNamesManagedBySiblings as W, synthesisStatusMessage as Wn, normalizeAwsError as Wr, DagBuilder as Wt, maskDeep as X, resolveSkipPrefix as Xn, markNonRetryable as Xr, createSecretMasker as Xt, createMaskedRetryLogger as Y, resolveCaptureObservedState as Yn, isTransientServerError as Yr, carriesSecretMask as Yt, maskerOrIdentity as Z, resolveStateBucketWithDefault as Zn, markRedactedCause as Zr, dynamicReferenceTokens as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, createAssetRedirectResolver as _n, AwsClients as _r, isUnboundTemplateParameter as _t, DeploymentEventsStore as a, scrubResourceRecord as an, findLargeInlineResources as ar, CloudControlProvider as at, createPreDeleteFinalSnapshot as b, escapeRegExp$1 as bn, setAwsClients as br, WAFv2WebACLProvider as bt, replayFailedOperations as c, rebuildClientForBucketRegion as cn, displaySafe as cr, deleteIndeterminateGuards as ct, updatePartialReason as d, importableOutputs as dn, canonicalizeRegion as dr, isTerminationProtectionPropagationError as dt, maskSecretsInError as en, stateBucketExistenceConfirmed as er, beginCommandInterruptScope as et, withResourceDeadline as f, shouldRetainResource as fn, derivePartitionAndUrlSuffix as fr, IntrinsicFunctionResolver as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, buildAssetRedirectMap as gn, resolveBucketRegion as gr, getAccountInfo as gt, computeImplicitDeleteEdges as h, WorkGraph as hn, clearBucketRegionCache as hr, coerceParameterTypedValue as ht, DeploymentEventsReader as i, redactSecretsForState as in, MIGRATE_TMP_PREFIX as ir, startInterruptWatch as it, cyan as j, validateContainerRepoName as jn, LockError as jr, requireConfigString as jt, formatResourceLine as k, readBootstrapMarkerBody as kn, LocalMigrateError as kr, requireConfigArray as kt, replayRollback as l, exportNamesCarriedFrom as ln, expectedOwnerParam as lr, deleteSkipReason as lt, IMPLICIT_DELETE_DEPENDENCIES as m, stringifyValue as mn, processStackMessages as mr, cfnRefValueFromPhysicalId as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, recordMaskOnlyValue as nn, CFN_TEMPLATE_BODY_LIMIT as nr, interruptWatchListenerCount as nt, planFailedOps as o, LockManager as on, uploadCfnTemplate as or, slowCcOperationTimeoutMs as ot, maskingRetryLogger as p, AssetPublisher as pn, AssemblyReader as pr, carriesDynamicReference as pt, findActionableSilentDrops as q, resolveApp as qn, isRetryableTransientError as qr, STATE_SOURCED_READBACK_RULES as qt, DeployEngine as r, recoverMaskedOutput as rn, CFN_TEMPLATE_URL_LIMIT as rr, isInterruptedWaitError as rt, planRollback as s, S3StateBackend as sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as sr, UNSPECIFIED_SKIP_REASON as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, maskSecretsInText as tn, warnDeprecatedNoPrefixCliFlag as tr, endCommandInterruptScope as tt, updatePartialMessage as u, importableOutputKeys as un, PARTITION_TABLE as ur, disableInstanceApiTermination as ut, buildFinalSnapshotIdentifier as v, loadPublishableAssetManifest as vn, getAwsClients as vr, parameterTypeMayLoseSecretIdentity as vt, makeCanonicalizePropertiesFn as w, assertAssetBucketRegion as wn, CrossAccountSecretRefusalError as wr, coerceCfnBoolean as wt, isFinalSnapshotError as x, stripControlChars as xn, AssetError as xr, normalizeAwsTagsToCfn as xt, ccRoutedFinalSnapshotError as y, rewriteTemplateAssetReferences as yn, resetAwsClients as yr, refStateLookupFromResource as yt, isExportAliasCollision as z, runDockerForeground as zn, StackTerminationProtectionError as zr, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-BhBR2d3w.js.map