@go-to-k/cdkd 0.288.0 → 0.288.1

package/dist/index.js

@@ -1,4 +1,4 @@
-import { Ar as clearBucketRegionCache, Br as DependencyError, Fr as setAwsClients, Ht as DiffCalculator, Ir as AssetError, J as IAMRoleProvider, Jt as DagBuilder, Kr as LockError, Lr as CdkdError, Mr as AwsClients, Nr as getAwsClients, Or as AssemblyReader, Pr as resetAwsClients, Rr as ConfigError, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, dn as S3StateBackend, ei as StateError, ii as normalizeAwsError, ir as Synthesizer, jr as resolveBucketRegion, ni as formatError, r as DeployEngine, ri as isCdkdError, st as CloudControlProvider, ti as SynthesisError, un as LockManager, wn as AssetPublisher } from "./deploy-engine-DF3fAY6q.js";
+import { Ar as clearBucketRegionCache, Br as DependencyError, Fr as setAwsClients, Ht as DiffCalculator, Ir as AssetError, J as IAMRoleProvider, Jt as DagBuilder, Kr as LockError, Lr as CdkdError, Mr as AwsClients, Nr as getAwsClients, Or as AssemblyReader, Pr as resetAwsClients, Rr as ConfigError, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, dn as S3StateBackend, ei as StateError, ii as normalizeAwsError, ir as Synthesizer, jr as resolveBucketRegion, ni as formatError, r as DeployEngine, ri as isCdkdError, st as CloudControlProvider, ti as SynthesisError, un as LockManager, wn as AssetPublisher } from "./deploy-engine-ZPkBIilF.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CizHCByV.js → program-BPeZLD0q.js}

@@ -1,8 +1,8 @@
-import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-DF3fAY6q.js";
+import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-ZPkBIilF.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BQMDIEQY.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DQCVYO5-.js";
+import { t as getCdkdVersion } from "./version-CGFRodgE.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-4QzW_6q5.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -67020,7 +67020,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			parameters = await resolver.resolveParameters(stack.template);
 		} catch (err) {
-			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
 		const resolverContext = (recordedSecretValues) => ({
@@ -67044,7 +67044,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
-			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const templateResources = stack.template.Resources ?? {};
 		for (const logicalId of Object.keys(state.resources)) {
@@ -79961,6 +79961,11 @@ function defaultOnlyParameterTemplate(template) {
 * weren't re-imported in this run — selective merge preserves them as
 * already-stored, which on the v3 baseline is already resolved-shape
 * from a prior import / deploy, so re-resolving is a no-op.
+*
+* Exported for unit testing — internal to the command flow otherwise. The
+* masking this walk applies (issue #2803) is only provable against the REAL
+* resolver, since the plaintext reaches the message through the resolver's
+* own throw rather than through anything this function writes.
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
 	const entries = Object.entries(stackState.resources);
@@ -79997,16 +80002,18 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stateBackend,
 		stackName: stackState.stackName
 	};
-	for (const [logicalId, resource] of entries) try {
+	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
-		const unresolvedProperties = resource.properties ?? {};
-		const resolved = await resolver.resolve(unresolvedProperties, {
-			...baseContext,
-			recordedSecretValues
-		});
-		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
-	} catch (err) {
-		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+		try {
+			const unresolvedProperties = resource.properties ?? {};
+			const resolved = await resolver.resolve(unresolvedProperties, {
+				...baseContext,
+				recordedSecretValues
+			});
+			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
+		} catch (err) {
+			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+		}
 	}
 }
 function printSummary(rows) {
@@ -89519,4 +89526,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CizHCByV.js.map
+//# sourceMappingURL=program-BPeZLD0q.js.map