@go-to-k/cdkd 0.288.1 → 0.288.3

package/dist/{deploy-engine-ZPkBIilF.js → deploy-engine-CfxcC3q3.js}

@@ -1,8 +1,8 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CGFRodgE.js";
+import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
@@ -2337,7 +2337,7 @@ async function resolveCrossAccountStateBucket(accountId, credentials) {
 /** Cloud assembly schema version compatible with CDK v2 */
 const CDK_ASM_VERSION = "38.0.0";
 /** Maximum context size before overflow to temp file (32KB) */
-const CONTEXT_OVERFLOW_LIMIT = 32 * 1024;
+const CONTEXT_OVERFLOW_LIMIT = 32768;
 /**
 * Remove one matched pair of surrounding quotes from a shell token, so a quoted
 * entrypoint (`"bin/app.js"`) is recognized as a .js file and re-quoted cleanly.
@@ -2551,7 +2551,6 @@ function processStackMessages(stacks, logger, options = {}) {
 		case "error":
 			hasErrors = true;
 			logger.error(`[Error at ${msg.path}] ${msg.message}`);
-			break;
 	}
 	const failAt = options.strict ? "warn" : options.ignoreErrors ? "none" : "error";
 	if (hasErrors && failAt !== "none") throw new SynthesisError("Found errors");
@@ -3174,10 +3173,7 @@ var CcApiContextProvider = class {
 			case "at-least-one":
 				if (count < 1) throw new Error(`Expected at least one ${typeName}${context}, found none`);
 				break;
-			case "at-most-one":
-				if (count > 1) throw new Error(`Expected at most one ${typeName}${context}, found ${count}`);
-				break;
-			case "any": break;
+			case "at-most-one": if (count > 1) throw new Error(`Expected at most one ${typeName}${context}, found ${count}`);
 		}
 	}
 	/**
@@ -4514,7 +4510,8 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 		const elided = failed.size - named.length;
 		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${displaySafe(bucket, { asciiOnly: true })}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
 	}
-	await warnIfPurgeIsReplicated(s3Client, bucket, [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])], {
+	const replicationKeys = [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])];
+	await warnIfPurgeIsReplicated(s3Client, bucket, replicationKeys, {
 		requestFields,
 		logger,
 		...options.objectDescription !== void 0 && { objectDescription: options.objectDescription }
@@ -5114,7 +5111,8 @@ async function expandMacrosAttempt(template, opts, logger) {
 				ChangeSetName: changeSetName
 			})).catch(() => void 0);
 			const reason = desc?.StatusReason ?? "unknown (DescribeChangeSet failed)";
-			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${desc?.Status ?? "UNKNOWN"}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
+			const status = desc?.Status ?? "UNKNOWN";
+			throw new MacroExpansionError(`CloudFormation macro expansion failed (status=${status}): ${reason}`, waiterError instanceof Error ? waiterError : void 0);
 		}
 		const tpl = await cfn.send(new GetTemplateCommand({
 			StackName: transientStackName,
@@ -5123,7 +5121,10 @@ async function expandMacrosAttempt(template, opts, logger) {
 		}));
 		if (tpl.TemplateBody === void 0 || tpl.TemplateBody === null) throw new MacroExpansionError(`CloudFormation returned no Processed-stage template body for the macro-expansion changeset. This typically indicates a CFn-side regression — re-run, and if the failure persists open an issue with the transforms involved: [${macros.join(", ")}].`);
 		const expanded = parseTemplateBody(tpl.TemplateBody);
-		if (containsMacro(expanded)) throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${enumerateMacros(expanded).join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+		if (containsMacro(expanded)) {
+			const inner = enumerateMacros(expanded);
+			throw new MacroExpansionError(`Macro expansion produced a template that still contains macros [${inner.join(", ")}]. Multi-stage macros (a macro whose expansion emits another macro reference) are intentionally out of scope in cdkd v1 — see https://github.com/go-to-k/cdkd/issues/463. If you need this pattern, manually pre-expand the template and deploy the result.`);
+		}
 		logger.debug(`Macro expansion: success — ${Object.keys(expanded.Resources ?? {}).length} resources after expansion.`);
 		return expanded;
 	} finally {
@@ -5245,7 +5246,8 @@ function loadJsonConfig(filePath) {
 * Load cdk.json from the current working directory
 */
 function loadCdkJson(cwd) {
-	return loadJsonConfig(resolve(cwd || process.cwd(), "cdk.json"));
+	const dir = cwd || process.cwd();
+	return loadJsonConfig(resolve(dir, "cdk.json"));
 }
 /**
 * Load user-level defaults from ~/.cdk.json
@@ -6200,8 +6202,10 @@ async function spawnStreaming(cmd, args, options = {}) {
 		const stderrChunks = [];
 		child.stdout.on("data", (chunk) => {
 			stdoutChunks.push(chunk);
-			if (streamLive) if (isStdoutReservedForPayload()) process.stderr.write(chunk);
-			else process.stdout.write(chunk);
+			if (streamLive) {
+				if (isStdoutReservedForPayload()) process.stderr.write(chunk);
+				else process.stdout.write(chunk);
+			}
 		});
 		child.stderr.on("data", (chunk) => {
 			stderrChunks.push(chunk);
@@ -7831,10 +7835,11 @@ async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, acc
 	const fromHeader = readBucketRegionHeader(cause);
 	if (fromHeader) actual = canonicalizeRegion(fromHeader);
 	else try {
-		actual = canonicalizeRegion(bucketLocationToRegion$1((await s3Client.send(new GetBucketLocationCommand({
+		const location = await s3Client.send(new GetBucketLocationCommand({
 			Bucket: bucketName,
 			ExpectedBucketOwner: accountId
-		}))).LocationConstraint));
+		}));
+		actual = canonicalizeRegion(bucketLocationToRegion$1(location.LocationConstraint));
 	} catch (probeError) {
 		const fromProbe = readBucketRegionHeader(probeError);
 		if (fromProbe) actual = canonicalizeRegion(fromProbe);
@@ -9000,7 +9005,8 @@ var AssetPublisher = class {
 			const err = error;
 			const message = stringifyValue(err["message"] || err["name"] || error);
 			const code = stringifyValue(err["Code"] || err["code"] || err["name"] || "");
-			throw new AssetError(`Asset publishing failed: ${code ? `${code}: ${message}` : message}`, error instanceof Error ? error : void 0);
+			const detail = code ? `${code}: ${message}` : message;
+			throw new AssetError(`Asset publishing failed: ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -9095,6 +9101,18 @@ function importableOutputs(state) {
 function exportNamesCarriedFrom(previous) {
 	return previous.exportNames === void 0 ? {} : { exportNames: previous.exportNames };
 }
+/**
+* The `skippedOutputs` field to write when a save carries the PREVIOUS
+* record's `outputs` bag forward instead of re-resolving it (issue #2740). The
+* record describes that bag — which keys the deploy that wrote it could not
+* resolve — so it travels with the bag, exactly like {@link
+* exportNamesCarriedFrom}: absent stays absent, present stays as it was. A
+* writer that re-resolves outputs does NOT call this; it writes the set the
+* resolution produced, or omits the field when nothing was skipped.
+*/
+function skippedOutputsCarriedFrom(previous) {
+	return previous.skippedOutputs === void 0 ? {} : { skippedOutputs: previous.skippedOutputs };
+}
 
 //#endregion
 //#region src/types/rollback-journal.ts
@@ -10184,9 +10202,10 @@ var S3StateBackend = class {
 			if (isNoSuchKey(error)) return { kind: "absent" };
 			const { detail } = describeAwsFailure(error);
 			this.logger.debug(`Could not read legacy state region for '${this.displayName(stackName)}': ${displaySafe(detail, { asciiOnly: true }) || "<unrenderable>"}`);
+			const cls = error instanceof Error && error.name ? error.name : "an unknown error";
 			return {
 				kind: "unreadable",
-				reason: displaySafe(error instanceof Error && error.name ? error.name : "an unknown error", { asciiOnly: true }) || "<unrenderable>"
+				reason: displaySafe(cls, { asciiOnly: true }) || "<unrenderable>"
 			};
 		}
 	}
@@ -10289,7 +10308,7 @@ function isNoSuchKey(error) {
 * tolerates FOURTEEN consecutive missed renewals before it lapses, and an
 * ordinary broad-set integ (~8 min) performs three.
 */
-const MAX_RENEWAL_INTERVAL_MS = 120 * 1e3;
+const MAX_RENEWAL_INTERVAL_MS = 12e4;
 /**
 * Renew after at most a quarter of the TTL, so a short TTL still gets three
 * chances to renew before it lapses. This is what binds the two numbers
@@ -11093,7 +11112,9 @@ var LockManager = class {
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
 		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
-		throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
+		const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
+		const safeRegion = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 
@@ -11197,6 +11218,102 @@ function resolvedPlaintextOf(secrets, expression) {
 	return typeof recorded === "string" ? recorded : void 0;
 }
 /**
+* The bag OBJECTS a deploy pass produced ITSELF and installed on a success
+* path — the fact the resolved-pair evidence above cannot state (issue
+* [#2516](https://github.com/go-to-k/cdkd/issues/2516)).
+*
+* A pair proves that THIS pass resolved a token to a plaintext; it says nothing
+* about which bag is being walked. The deploy engine's persist choke point
+* walks EVERY record in the state map against today's template, and a record
+* that merely ENTERED the create/update arm is still the PREVIOUS generation
+* until its provider call succeeds (an intermediate save, a pre/post-rollback
+* save, Ctrl-C — the same population the `sourceIsSameGeneration` note on
+* {@link PathSourceRules} names). One record also carries two bags of
+* different provenance: `properties`, this pass's resolved bag once the
+* provider succeeded, and `observedProperties`, an AWS readback installed
+* separately. So the fact is BAG-specific, not caller- or record-level, and it
+* is carried on the object: {@link markSameGenerationBag} at the moment the
+* successful result is installed, consulted by {@link redactSecretsForState}
+* for the object it is handed. A copy of the bag, a derived needle map, a
+* previous generation's record, a scrub / import / drift walk and a bag the
+* engine did not mark all answer `false` and keep the fall-through.
+*
+* A `WeakSet` for the reason {@link resolvedPairsOf} is a `WeakMap`: the mark
+* dies with the object it is on, and nothing has to clear it.
+*/
+const sameGenerationBags = /* @__PURE__ */ new WeakSet();
+/**
+* Mark `bag` as an object THIS pass is entitled to speak for, and return it.
+* The one evidence {@link positionByEmbeddedSpan} needs beyond a resolved pair
+* to write a middle SHORTER than {@link MIN_NEEDLE_LENGTH} — see the arm.
+*
+* Deliberately NOT "produced by resolving today's template, read back from a
+* resource it just wrote, and about to be installed on a success path": each
+* of those three was in this sentence and each is false at one site (an
+* unchanged resource's auto-refresh resolves nothing; the no-change re-check
+* and the journal are never installed on the record). The conditions are per
+* site and are listed below.
+*
+* WHAT THE MARK CLAIMS, which is the only thing every site shares: the object
+* is one THIS PASS is entitled to speak for, so a sub-floor middle in it may
+* be written as the token this pass recorded. What never qualifies is a bag of
+* MIXED provenance: a provider's `effectiveProperties` replacement may carry
+* previous-state values IN, so an object-level mark on it would prove nothing
+* for those leaves — it stays unmarked and keeps the residual. Nor does the
+* object the resolver produced, marked at resolution time: it is not
+* necessarily the object state ends up holding.
+*
+* The CONDITIONS are per SITE, not global, and stating them globally is what
+* this paragraph kept getting wrong (PR 2753, rounds 3 and 4). "After the
+* provider call" is false for the no-change re-check, which marks BEFORE it
+* and may skip it entirely. "Every leaf this pass produced" is false for the
+* auto-refresh readback of an UNCHANGED resource, where nothing was resolved
+* at all — there the safety comes from the empty secrets map, not from the
+* mark. Read the per-site list below rather than a rule over all five.
+*
+* The five call sites, and which of them the record HOLDS, because the earlier
+* "two never-installed copies" reading of this paragraph was false once the
+* third copy arrived:
+* - `propertiesToRecord` — the record's `properties`, installed. The resolved
+*   bag itself when the route drops nothing, a narrowed copy of it when it
+*   does, and `withoutSilentDropProperties` returns its input by reference in
+*   the first case, which is why the mark must be taken AFTER the narrowing
+*   and not before.
+* - `drainObservedCaptures` — the `observedProperties` readback it installs,
+*   and a COPY: the object a provider returned is never the marked one, so a
+*   provider that hands back its own `properties` argument cannot get a
+*   previous generation marked. It marks EVERY capture it drains, which is
+*   wider than "a resource this pass wrote" — the schema-upgrade auto-refresh
+*   of an UNCHANGED resource is marked too. What keeps that safe is the map,
+*   not the mark: `perResourceSecrets` is populated only in the create /
+*   update arms, so an unchanged resource's walk carries an empty one and the
+*   span arm cannot fire whatever the object is marked.
+* - `resolveOutputs` — the `outputs` bag this pass resolved. What every site
+*   shares is that the marked object is the redaction INPUT; whether the
+*   record then holds that same object varies, and here it depends on whether
+*   this pass recorded any output secret: with one,
+*   `redactOutputs` returns a fresh redacted bag and that return value is
+*   installed; with none — the ordinary deploy — it returns its input
+*   unchanged and the marked object IS the one
+*   stored. On the no-change path the newly redacted bag is installed when
+*   the outputs CHANGED, and the previous `persistedOutputs` is kept
+*   otherwise; that previous bag is unmarked, which is the answer that arm
+*   wants.
+* - the update arm's no-change re-check — a marked `{ ...resolvedProps }`
+*   compared against the stored record so a stored token reads as a no-op.
+*   NOT installed; the object the provider is handed is the unmarked original.
+* - the rollback journal's FAILED-op `attemptedProperties` — a marked copy, so
+*   that persisted artifact does not carry the plaintext on exactly the
+*   failure path. NOT installed on the record.
+*/
+function markSameGenerationBag(bag) {
+	sameGenerationBags.add(bag);
+	return bag;
+}
+function isSameGenerationBag(bag) {
+	return sameGenerationBags.has(bag);
+}
+/**
 * Every `{{resolve:...}}` expression this process has PROVEN resolves to a
 * secret, as a SET — uncollapsed by resolved value (issue #1910).
 *
@@ -12847,15 +12964,78 @@ function singleSpanFrame(bag, source) {
 * not create is the whole-token arm's: a middle that is ALREADY an expression
 * (a persisted answer from another generation), which the token refusal below
 * keeps out — and, by the same argument, any leaf the value scan would NOT
-* rewrite to exactly `prefix + survivor + suffix`: a middle shorter than the
-* scan's needle floor (an embedded 1-3 character secret stays the scan's
-* documented residual — issue #2516 tracks closing it with a bound that
-* proves the bag's generation, which this evidence does not), a whole leaf
-* that is itself another recorded plaintext, a needle starting in the prefix
-* and overlapping the middle. The
-* arm checks that equivalence against the scan's own answer rather than
-* re-deriving the scan's rules. Pinned by the cross-generation cases in
-* `secret-redaction-embedded-span.test.ts`.
+* rewrite to exactly `prefix + survivor + suffix`: a whole leaf that is itself
+* another recorded plaintext, a needle starting in the prefix and overlapping
+* the middle, and — on a bag whose generation is NOT proven — a middle shorter
+* than the scan's needle floor. The arm checks that equivalence against the
+* scan's own answer rather than re-deriving the scan's rules. Pinned by the
+* cross-generation cases in `secret-redaction-embedded-span.test.ts`.
+*
+* BELOW THE NEEDLE FLOOR the scan makes no claim at all (issue
+* [#2516](https://github.com/go-to-k/cdkd/issues/2516)): {@link buildNeedleRegex}
+* drops every plaintext shorter than {@link MIN_NEEDLE_LENGTH} from its
+* alternation, so an embedded 1-3 character secret is left in plaintext by
+* the scan, with or without a same-plaintext sibling. Accepting the scan's
+* silence (`scanned === bag`) as equivalence would therefore be a NEW claim
+* rather than a choice within the scan's class, and on a previous
+* generation's bag it would fabricate: a 1-3 character readback or old
+* record that COINCIDES with today's plaintext (`port:0` where AWS returns a
+* default and today's secret resolved to `0`) would be persisted as today's
+* expression, which round-trips today and, after a rotation, reports a drift
+* that never happened. So that arm is admitted only for a bag whose
+* generation IS proven: `bagIsSameGeneration`, the object-level mark
+* {@link markSameGenerationBag} puts on the bags the deploy engine hands to
+* redaction on a success path (the record's `properties`, which are the
+* resolved bag or the subset of it the SDK route writes; EVERY
+* `observedProperties` readback `drainObservedCaptures` drains, an unchanged
+* resource's auto-refresh included, where the empty secrets map rather than
+* the mark is what keeps it safe; and the `outputs` bag this pass resolved,
+* whose redacted RETURN VALUE is usually what the record holds) and on two
+* copies of the resolver's own output that the record never holds. That
+* function's contract is the authority — the conditions differ per site and
+* do not survive being stated once. Threaded down from
+* {@link redactSecretsForState} for exactly the object it was handed. With
+* the mark AND the pair, `recorded === middle` says this pass resolved the
+* source token to the middle and the bag is this pass's own, so
+* `prefix + token + suffix` is what the template says at that leaf and what
+* the resource holds. Without the mark the sub-floor middle keeps today's
+* bound, which is the scan's answer: the plaintext, unchanged.
+*
+* What stays, stated here rather than papered over. A provider that
+* substituted `effectiveProperties` built a bag of MIXED provenance, so that
+* object is never marked and a sub-floor middle in it keeps the scan's
+* answer. A readback AWS rewrote at that offset to a value that coincides
+* with the 1-3 character secret is persisted as the expression: value-equal
+* until the secret rotates, and the same residual the value scan already has
+* for a 4+ character coincidence in a readback. Every refusal of this arm
+* returns the scan's answer, so a leaf refused for interference (a frame
+* that is itself a recorded plaintext, say) has its frame rewritten and its
+* sub-floor middle left in plaintext. And this arm positions a LITERAL
+* source leaf only: an `Fn::Join` / `Fn::Sub` source rendering the same
+* `port:` + token goes to {@link positionByIntrinsicSkeleton}, which refuses
+* unless the WHOLE bag is a recorded plaintext, so a sub-floor secret
+* embedded through an intrinsic — the dominant CDK shape — still falls to
+* the value scan and persists in plaintext. `cdkd scrub`, the documented
+* repair tool for a pre-GHSA record, cannot repair a sub-floor embedded leaf
+* either: it walks a STORED bag, which no deploy marked, so the arm is
+* unreachable from it by construction and the leaf keeps the scan's answer.
+* The MASKING channel keeps the residual whole: `maskSecretsInText`'s
+* substring arm carries the same four-character floor, so once this arm has
+* put `port:{{resolve:...}}` in state, a warn line quoting an AWS message can
+* still print `port:q7`. Pre-existing and not a regression -- the #2453 class,
+* and the reason the list would otherwise read as complete when it is not
+* (maintainer review of PR 2753, round 2).
+*
+* The next DEPLOY of that resource repairs the leaves this arm is eligible
+* for — a LITERAL source leaf on a bag the engine marks — because the
+* re-check compares unequal against a record holding the plaintext and the
+* resource is written again from a bag this pass produced. The residuals
+* named above (an `effectiveProperties` substitution, an intrinsic source
+* shape) are not repaired by that deploy either; they stay tracked by
+* #2745. Tracked, with the sub-floor
+* residuals of a nested-stack child's inherited parameter and of `cdkd
+* import`'s own resolution, by issue
+* [#2745](https://github.com/go-to-k/cdkd/issues/2745).
 *
 * One shape reaches this arm that a reader may not expect: a WHOLE-token
 * source that FAILED the whole-token arm's `isKnownSecretExpression` gate (an
@@ -12883,7 +13063,7 @@ function singleSpanFrame(bag, source) {
 * the scan as a parameter, which left the bound one wrong caller away from
 * comparing against a scan of some other bag with no type error.
 */
-function positionByEmbeddedSpan(bag, source, secrets) {
+function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	const scanned = redactSecretsForState(bag, secrets);
 	const frame = singleSpanFrame(bag, source);
 	if (frame === void 0) return scanned;
@@ -12892,8 +13072,9 @@ function positionByEmbeddedSpan(bag, source, secrets) {
 	if (recorded === void 0 || recorded !== middle) return scanned;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
-	if (scanned !== prefix + survivor + suffix) return scanned;
-	return prefix + token + suffix;
+	if (scanned === prefix + survivor + suffix) return prefix + token + suffix;
+	if (bagIsSameGeneration && scanned === bag) return prefix + token + suffix;
+	return scanned;
 }
 /**
 * Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
@@ -13089,13 +13270,13 @@ function positionListByCrossStackSource(bag, source, secrets) {
 * association where the position is a cross-stack read, skeleton where it is a
 * describable intrinsic, value where none is.
 */
-function redactByPath(bag, source, secrets, rules, secretExpressions) {
+function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
 			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
 			return source;
 		}
-		return positionByEmbeddedSpan(bag, source, secrets);
+		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
 	}
 	if (typeof bag === "string" && isPlainObject$2(source)) {
 		const certified = positionByCrossStackSource(bag, source, secrets);
@@ -13124,16 +13305,16 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 			const positionalIsExact = rules.descendArrays && bag.length === source.length && orderPreserved;
 			return bag.map((item, i) => {
 				const j = partnerIndex[i];
-				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions);
-				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions);
+				if (j >= 0) return redactByPath(item, source[j], secrets, rules, secretExpressions, bagIsSameGeneration);
+				if (positionalIsExact) return redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration);
 				return redactSecretsForState(item, secrets);
 			});
 		}
-		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
+		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
 	}
 	return redactSecretsForState(bag, secrets);
@@ -14151,7 +14332,7 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
-		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets));
+		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
 		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
@@ -14991,7 +15172,10 @@ var DagBuilder = class {
 		this.logger.debug(`Dependency graph built: ${resourceIds.length} nodes, ${edgeCount} edges`);
 		edgeCount += this.addCustomResourcePolicyEdges(graph, template);
 		edgeCount += this.addLambdaVpcEdges(graph, template);
-		if (!alg.isAcyclic(graph)) throw new DependencyError(`Circular dependency detected in template. Cycles: ${this.findCycles(graph).map((c) => c.join(" -> ")).join("; ")}`);
+		if (!alg.isAcyclic(graph)) {
+			const cycles = this.findCycles(graph);
+			throw new DependencyError(`Circular dependency detected in template. Cycles: ${cycles.map((c) => c.join(" -> ")).join("; ")}`);
+		}
 		return graph;
 	}
 	/**
@@ -15020,7 +15204,10 @@ var DagBuilder = class {
 				const predecessors = graphCopy.predecessors(node);
 				return !predecessors || predecessors.length === 0;
 			});
-			if (readyNodes.length === 0) throw new DependencyError(`Circular dependency detected. Remaining nodes: ${graphCopy.nodes().join(", ")}`);
+			if (readyNodes.length === 0) {
+				const remaining = graphCopy.nodes();
+				throw new DependencyError(`Circular dependency detected. Remaining nodes: ${remaining.join(", ")}`);
+			}
 			this.logger.debug(`Level ${levelNum}: ${readyNodes.length} resources - ${readyNodes.join(", ")}`);
 			levels.push(readyNodes);
 			readyNodes.forEach((node) => {
@@ -15826,9 +16013,10 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 * 4s/8s steps overshoot it. The dense schedule applies ONLY when the caller
 * left the schedule at its defaults — a caller that passed its own
 * `maxRetries` / `initialDelayMs` / `maxDelayMs` / `isRetryable` picked that
-* schedule deliberately (e.g. the DELETE path's 3 x 5s, or the delete-then-
-* re-create sites' ~64s budget covering SQS's 60s name cooldown) and gets it
-* verbatim.
+* schedule deliberately (e.g. the DELETE path's 3 retries from 5s — 5s/8s/8s,
+* since it passes `initialDelayMs` but leaves `maxDelayMs` at the 8s default —
+* or the delete-then-re-create sites' ~64s budget covering SQS's 60s name
+* cooldown) and gets it verbatim.
 *
 * A THIRD class rides its own grid on the default schedule since issue
 * [#2116](https://github.com/go-to-k/cdkd/issues/2116): a NAME COOLDOWN (a
@@ -16511,6 +16699,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RoleArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
+			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
 			["FilesystemConfigurations", "not yet implemented by cdkd"],
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
@@ -16629,7 +16818,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationWindow", "not yet implemented by cdkd"]
+			["EvaluationWindow", "not yet implemented by cdkd"],
+			["WarmUpConfiguration", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
@@ -17457,7 +17647,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Glue::Connection", {
 		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
-		silentDrop: /* @__PURE__ */ new Map(),
+		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::Glue::Crawler", {
@@ -18021,7 +18211,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
 			"ClusterScalabilityType",
 			"DBSystemId",
 			"EngineMode",
@@ -19370,9 +19559,7 @@ var DiffCalculator = class DiffCalculator {
 			case "DELETE":
 				summary.delete++;
 				break;
-			case "NO_CHANGE":
-				summary.noChange++;
-				break;
+			case "NO_CHANGE": summary.noChange++;
 		}
 		return summary;
 	}
@@ -21122,7 +21309,8 @@ var WAFv2WebACLProvider = class {
 			this.logger.debug(`Successfully deleted WAFv2 WebACL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof WAFNonexistentItemException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`WAFv2 WebACL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -21224,7 +21412,8 @@ var WAFv2WebACLProvider = class {
 		result["TokenDomains"] = webACL.TokenDomains ? [...webACL.TokenDomains] : [];
 		if (webACL.AssociationConfig) result["AssociationConfig"] = webACL.AssociationConfig;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }))).TagInfoForResource?.TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagInfoForResource?.TagList);
 		} catch (err) {
 			this.logger.debug(`WAFv2 ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -22929,14 +23118,15 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved = {};
 		for (const [key, val] of Object.entries(obj)) {
 			const resolvedVal = await this.resolveValue(val, context);
-			if (resolvedVal !== AWS_NO_VALUE) if (key === "__proto__") Object.defineProperty(resolved, key, {
-				value: resolvedVal,
-				enumerable: true,
-				writable: true,
-				configurable: true
-			});
-			else resolved[key] = resolvedVal;
-			else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
+			if (resolvedVal !== AWS_NO_VALUE) {
+				if (key === "__proto__") Object.defineProperty(resolved, key, {
+					value: resolvedVal,
+					enumerable: true,
+					writable: true,
+					configurable: true
+				});
+				else resolved[key] = resolvedVal;
+			} else this.logger.debug(`Property ${key} resolved to AWS::NoValue, omitting from object`);
 		}
 		return resolved;
 	}
@@ -23516,6 +23706,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "ApiId": return physicalId;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
+			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
+			case "ApiId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
 			case "Id": return physicalId;
@@ -23649,9 +23844,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 						case "PublicDnsName":
 							value = instance?.PublicDnsName;
 							break;
-						case "AvailabilityZone":
-							value = instance?.Placement?.AvailabilityZone;
-							break;
+						case "AvailabilityZone": value = instance?.Placement?.AvailabilityZone;
 					}
 					if (value !== void 0 && value !== null && value !== "") {
 						cachedEc2InstanceAttributes[cacheKey] = value;
@@ -24775,7 +24968,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const credentials = await assumeRoleForCrossAccountStateRead(roleArn);
 		const { bucket, region: bucketRegion } = await resolveCrossAccountStateBucket(parsed.accountId, credentials);
 		const prefix = context.stateBackend?.prefix ?? "cdkd";
-		return new S3StateBackend(new S3Client({
+		const s3 = new S3Client({
 			...awsClientDefaults(),
 			region: bucketRegion,
 			credentials: {
@@ -24789,7 +24982,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				warn: () => {},
 				error: () => {}
 			}
-		}), {
+		});
+		return new S3StateBackend(s3, {
 			bucket,
 			prefix
 		}, {
@@ -25984,7 +26178,7 @@ function unsupportedTypeIssueUrl(resourceType) {
 
 //#endregion
 //#region src/provisioning/slow-cc-operation-timeouts.ts
-const MINUTE_MS = 60 * 1e3;
+const MINUTE_MS = 6e4;
 /**
 * 60 min covers the worst-case observed for each type with headroom over the
 * 15-30 min typical range. Keyed by CloudFormation type name. RDS / ElastiCache
@@ -26307,7 +26501,7 @@ var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
 	patchGenerator = new JsonPatchGenerator();
-	MAX_WAIT_TIME_MS = 900 * 1e3;
+	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
 	constructor() {
@@ -26466,8 +26660,9 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-4QzW_6q5.js").then((n) => n.n);
-			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
+			const { ASGProvider } = await import("./asg-provider-CQrHElrl.js").then((n) => n.n);
+			const asgProvider = new ASGProvider();
+			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
 		if (isProtectedEc2Instance) await disableInstanceApiTermination(getAwsClients().ec2, physicalId, this.logger);
@@ -27119,16 +27314,13 @@ var CloudControlProvider = class {
 					}
 				}
 				break;
-			case "AWS::ResourceGroups::Group":
-				if (!enriched["Arn"]) {
-					const model = await this.readCcResourceModel(resourceType, physicalId);
-					if (model) {
-						if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
-						this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
-					}
+			case "AWS::ResourceGroups::Group": if (!enriched["Arn"]) {
+				const model = await this.readCcResourceModel(resourceType, physicalId);
+				if (model) {
+					if (typeof model["Arn"] === "string") enriched["Arn"] = model["Arn"];
+					this.logger.debug(`Enriched ResourceGroups Group ${physicalId} with Arn from CC GetResource`);
 				}
-				break;
-			default: break;
+			}
 		}
 		return enriched;
 	}
@@ -30321,7 +30513,8 @@ var IAMRoleProvider = class {
 				await this.iamClient.send(new GetRoleCommand({ RoleName: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Role ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -31065,6 +31258,67 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure) {
 	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
 /**
+* Test `key` for recorded secret plaintext and return how it may be shown.
+*
+* Reuses {@link stateKeySecretExposure} and the same `maskEveryOccurrence` the
+* warnings below use, rather than restating either: two spellings of "is this
+* key safe to print" would disagree on the boundary cases those two encode
+* (the whole-key match for a sub-floor needle, longest-needle-first masking).
+*
+* SANITISED WITH BOTH helpers, because neither is a superset of the other —
+* measured, after a first cut swapped one for the other and silently traded
+* one class of character for another (issue #2667 review):
+*
+* | input    | `stripControlChars` | `displaySafe` |
+* | -------- | ------------------- | ------------- |
+* | `U+200E` | removed             | KEPT          |
+* | `U+200F` | removed             | KEPT          |
+* | `U+2028` | KEPT                | replaced      |
+* | `U+2029` | KEPT                | replaced      |
+*
+* `U+2028` / `U+2029` matter because this text is PERSISTED and re-rendered by
+* JSON and web log viewers that treat both as line terminators — the CI-log
+* surface this masking exists to protect, where an `Fn::Sub`-built export name
+* carrying one could forge a log line (`display-safe.ts` states that
+* rationale). `U+200E` / `U+200F` are the bidi MARKS, named as residuals in
+* that same file; they reorder rendered text without terminating a line. On a
+* path whose subject is a possibly-secret-bearing name in an operator's log,
+* neither loss is worth taking, and composing costs nothing.
+*
+* ORDER IS LOAD-BEARING, and for the OVERLAP set — not for the marks, which
+* an earlier revision of this comment named and measurement contradicted.
+* `displaySafe` never touches `U+200E` / `U+200F`, so those give identical
+* output either way. Where the two classes OVERLAP — `U+0000`-`U+001F`,
+* `U+007F`-`U+009F`, `U+202A`-`U+202E`, `U+2066`-`U+2069` — `stripControlChars`
+* DELETES while `displaySafe` replaces with a space, so strip-then-display
+* yields `"ab"` and display-then-strip yields `"a b"`. Stripping first keeps a
+* name carrying them from being padded out.
+*
+* `displaySafe` also `.trim()`s, which `stripControlChars` alone did not: a
+* display-shape change for a key with leading or trailing whitespace. Stated
+* because it is a real difference, not hidden.
+*
+* The sibling warnings in this file still use `stripControlChars` ALONE and
+* carry the `U+2028` half of the gap; widening that helper, or converting
+* them, changes call sites this issue does not touch, so it is filed as issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874) rather than done here.
+*/
+function secretSafeKeyDisplay(key, secrets) {
+	const sanitise = (text) => displaySafe(stripControlChars(text));
+	const shown = sanitise(key);
+	const exposure = stateKeySecretExposure(shown, secrets) ?? stateKeySecretExposure(key, secrets);
+	if (!exposure) return {
+		kind: "safe",
+		text: shown
+	};
+	const masked = sanitise(maskEveryOccurrence(shown, exposure));
+	if (masked === shown) return { kind: "withheld" };
+	return {
+		kind: "masked",
+		text: masked
+	};
+}
+/**
 * Warning for a state KEY that already holds secret plaintext — the residue an
 * EARLIER binary left when it published an export name that resolved to one.
 *
@@ -32121,9 +32375,9 @@ const EBS_FINAL_SNAPSHOT_TAG_KEY = "cdkd:final-snapshot-of";
 /** Test seam (matches the `describe-type.ts` / macro-expander pattern). */
 const finalSnapshotDelays = { sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)) };
 const PRE_DELETE_SNAPSHOT_POLL_INTERVAL_MS = 5e3;
-const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 3600 * 1e3;
+const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 36e5;
 /** Post-snapshot settle budget for a Redshift cluster before its delete. */
-const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 1200 * 1e3;
+const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 12e5;
 function errMsg(error) {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -32507,6 +32761,397 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/skipped-outputs.ts
+/**
+* The record `cdkd deploy` leaves behind for an Output it could NOT resolve
+* and SKIPPED, and the digest `cdkd diff` compares it against (issue
+* [#2740](https://github.com/go-to-k/cdkd/issues/2740)).
+*
+* The deploy side (`DeployEngine.handleOutputResolutionFailure`, default arm)
+* warns, stores `undefined` for the key and moves on, so a re-resolved
+* `state.outputs` lacks it (the no-change path keeps the previous bag whole
+* when any output fails, so a key that resolved on an EARLIER deploy can keep
+* its value beside a record — the reader checks absence first and ignores the
+* record then). The diff side resolves outputs with `skipDynamicReferences`, so a
+* failure that happens INSIDE a secret lookup — a JSON key the secret does not
+* hold, a reference assembled from another secret's value — does not reproduce
+* there: the value assembles into its token, the key is absent from state, and
+* `computeOutputsDiff` pushed an `ADD` the deploy would never perform, on every
+* run of an unchanged stack. The diff cannot tell from assembly alone that the
+* deploy would fail (a composed string carrying a secret reference is a
+* legitimate output), so it learns what the deploy learned instead:
+* `StackState.skippedOutputs` maps each skipped key to a digest of the
+* template inputs its resolution read, and the diff trusts the record only
+* while that digest is unchanged.
+*
+* ## What the digest covers, and why
+*
+* `skippedOutputDigest` hashes the output's OWN entry (`Value`, `Export`,
+* `Condition`, whatever else it declares) together with every top-level
+* template section EXCEPT `Resources` and `Outputs`:
+*
+* - The entry itself: repairing the `Value` expression is the obvious repair.
+*   The `Export.Name` is in it too, because the alias pass routes an
+*   `Export.Name` failure through the same handler, which blanks the output's
+*   own key even when its value resolved — so a repaired or removed export
+*   name must invalidate the record as well.
+* - `Parameters` (a `Ref`-built reference repaired through a parameter
+*   default), `Conditions` (an `Fn::If` whose branch flips), `Mappings` (an
+*   `Fn::FindInMap`-built key), and the remaining sections for the same
+*   reason, spelled as one rule rather than a list that drifts: everything an
+*   output's resolution can read besides resources. One VALUE inside them is
+*   excluded — the `Default` of a `NoEcho: true` parameter, hashed as a
+*   constant; see `withNoEchoDefaultsMasked` for why. That is the POSITION,
+*   not the parameter: its `AllowedValues`, and any literal an author puts in
+*   `Conditions`, `Rules` or `Metadata`, are hashed as before.
+* - NOT `Resources`: hashing the section would invalidate the record on every
+*   unrelated resource edit. The output CAN be repaired from that side —
+*   `collectSkippedOutputs` records both skip arms, and the quiet one is an
+*   `Fn::GetAtt` whose attribute `constructAttribute` could not build — so a
+*   digest alone would keep binding while the next deploy publishes the row
+*   and its `Export.Name`, the phantom's inverse. {@link
+*   bindingSkippedOutputs} closes that with the CHANGE MAP rather than the
+*   digest: a key whose entry references a logical id with a pending resource
+*   change does not bind. The diff has that map (it ran the resource diff
+*   first); the deploy does not need it, because a stack with any resource
+*   change takes the path that re-resolves every output and rewrites the
+*   record. REFERENCE, not repair: whether an edit could actually make the
+*   output resolvable is undecidable from a template, so an unrelated edit to
+*   a referenced resource un-binds too and the key can preview as an `ADD`
+*   again. The cost is bounded — a run with a changed resource is already
+*   reporting that row, so `--fail` exits 1 regardless — while the case it
+*   buys depends on whether the diff can resolve the output at all. For an
+*   output reading an attribute that does not exist yet — the SECOND skip arm
+*   this record covers, not the secret lookup issue #2740 was filed on — it is
+*   the VERDICT and not the row: unresolvable in
+*   both readings, so bound the diff reports the outputs settled while the
+*   next deploy is about to publish that key and its `Export.Name`. For an
+*   output the diff CAN resolve, whose reference is to a name rather than to
+*   a pending attribute (an `Fn::Sub` over an SSM parameter's name, say), the
+*   row IS the difference and reappears as an `ADD` the moment the record
+*   stops binding.
+* - NOT the sibling `Outputs`: a CloudFormation output cannot reference
+*   another output, so a sibling change cannot repair this one, and excluding
+*   them keeps an unrelated output edit from producing a one-run phantom.
+*
+* What the digest CANNOT see is a repair outside the template — the secret
+* gained the JSON key, the SSM parameter was created, a parameter VALUE
+* handed to the engine rather than declared changed (a nested stack's inputs
+* from its parent, `DeployEngineOptions.parameters`; `Parameters`
+* DECLARATIONS are hashed, supplied values are not), or **cdkd itself was
+* upgraded**: the quiet skip arm is `constructAttribute` returning nothing,
+* so a provider that gains that attribute repairs the output while neither
+* the template nor any resource moves.
+*
+* They are blind spots for three different reasons, and only the first is
+* about knowledge. The secret's key set and the SSM parameter's existence
+* need the external lookup the diff deliberately refuses to make. A supplied
+* parameter VALUE is not one of those — a nested stack's inputs are resolved
+* and forwarded to the child diff (`resolveChildStackParameters`) — it is
+* simply outside what the digest hashes, because hashing values would make
+* the record depend on a caller's arguments rather than on the template. And
+* the writing binary's version is knowable and merely unstored: keeping it
+* beside the digest and un-binding on mismatch would close that one. All four
+* end the same way: the record keeps binding until the next deploy re-resolves
+* the output, and that deploy publishes the key — unless a SIBLING output is
+* still unresolved on a run with no resource change, where the engine keeps
+* the previous outputs bag wholesale and the key stays unpublished for a
+* further run (go-to-k/cdkd#2771, pre-existing and not introduced here).
+* Documented as the accepted limitation in `docs/cli-diff.md`; it is narrower
+* than the pre-#2740 behaviour, where the diff was wrong on EVERY run.
+*
+* A repair on the RESOURCE side is NOT on that list either, but the reason is
+* narrower than it first looks. The change map above closes it only when the
+* repair arrives WITH a template resource change, which is what makes the
+* resource show on the diff at all. An OUT-OF-BAND state write does not:
+* every writer that rebuilds state outside a deploy DROPS the record rather
+* than carry it (one enumerated exception, the partial-destroy snapshot, is
+* explained with the field) — `cdkd import` refreshes `attributes` for the
+* resources it imports, `cdkd drift --accept` rewrites the properties an
+* attribute may be built from, `cdkd rollback`'s replacement arm rebuilds a
+* record with the attributes a FRESH create returned, and the rest are listed
+* with the field.
+* Dropping returns those keys to pre-#2740 behaviour until the next deploy
+* recomputes the record — a row where the diff can resolve them, the ordinary
+* whole-section suppression where it cannot — which is what keeps a
+* resource-side repair out of the list above.
+*
+* The rule is flat and it is meant to be: EVERY writer that rebuilds state
+* outside a deploy drops the record, the partial-destroy snapshot being the
+* one enumerated exception — the full list lives with the field, in
+* `StackState.skippedOutputs`. Three per-writer arguments for carrying it were
+* written during review, which is the reason for the flat rule rather than an
+* aside: two were shown wrong (substituting a value repairs an output whose
+* enclosing intrinsic was choking on what was there; scrubbing a plaintext
+* back to its expression rewrites a string outputs read verbatim) and the
+* third — deleting a property EXPOSING an attribute of the same name — could
+* not be settled either way, which argues for flatness at least as strongly.
+*
+* ## Where the digest must be taken from
+*
+* The template AS HANDED to the engine / to `computeStackDiff` — before
+* parameter binding, condition evaluation or any output resolution. The
+* INVARIANT, and the reason both callers `structuredClone` rather than pass
+* their live object: **no resolution may be visible to the digest, on either
+* side, and both sides must take it at the same point of their own flow.**
+* Two independent reasons, neither of which depends on any particular
+* resolver doing the writing: a digest that could see a resolved value would
+* (1) differ between the two sides, which computes a record the diff can
+* never re-derive, and (2) fingerprint a secret into `state.json`, since a
+* resolved value can be a decrypted one.
+*
+* The clone is therefore NOT dead weight even while no resolver mutates its
+* input. It used to be load-bearing against a live rewrite — `resolveSub`
+* substituted into the caller's two-argument `Fn::Sub` variable map until
+* go-to-k/cdkd#2764 gave it a fresh object — and the protection was never
+* derived from that call site: it is derived from the invariant above, which
+* a future in-place optimisation anywhere in either flow would silently
+* violate. `tests/unit/cli/diff-recursive-skipped-outputs.test.ts` pins the
+* current no-mutation contract from the other direction (the template handed
+* to `computeStackDiff` comes back byte-identical), so reintroducing a
+* rewrite reds a test rather than moving a digest;
+* `tests/unit/deployment/deploy-engine-skipped-outputs.test.ts` INJECTS a
+* rewrite through its resolver mock and requires the recorded digest to equal
+* a fresh parse's, which pins the ordering itself.
+*
+* Given that contract the hash covers template text only. It is over
+* canonical JSON (object keys sorted at every level), so a template
+* re-serialised with keys in another order digests identically.
+*
+* ## What the diff does with a binding record
+*
+* It previews the key as ABSENT — no row — because that is exactly what the
+* deploy will leave in state. It does NOT flag the section as failed: a
+* sibling output that genuinely changed still renders, and `--fail` still
+* exits 1 for it. A record whose digest no longer matches is simply ignored:
+* the output is previewed under the ordinary rules again (usually an `ADD`;
+* an intrinsic `Export.Name` the diff still cannot resolve keeps omitting the
+* section, as before), the next deploy re-decides it —
+* publishing it if the repair took, or recording it again under the new
+* digest — and the diff follows that decision.
+*/
+/**
+* JSON with object keys sorted at every level. Arrays keep their order (an
+* `Fn::Join` list is positional). `undefined` members are dropped, as
+* `JSON.stringify` drops them, so a parsed template and its in-memory twin
+* digest identically.
+*/
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, v) => {
+		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+			const sorted = Object.create(null);
+			for (const k of Object.keys(v).sort()) sorted[k] = v[k];
+			return sorted;
+		}
+		return v;
+	});
+}
+/** The constant a `NoEcho` `Default` is hashed as. Its text is irrelevant; that
+* it is CONSTANT is the point. */
+const NO_ECHO_DEFAULT_MASK = "<cdkd:noecho-default>";
+/**
+* `Parameters` with every `NoEcho: true` parameter's `Default` replaced by a
+* constant, for hashing only.
+*
+* The pre-resolution snapshot already keeps RESOLVED secret values out of the
+* digest. An authored `Default` under `NoEcho: true` is not one of those — it
+* is template text, and it went into the hash. With the rest of the
+* non-`Resources` sections known, a reader of `state.json` holds a confirm
+* ORACLE for a low-entropy default: guess it, recompute, compare.
+*
+* This does NOT claim the value is otherwise absent from state — a parameter a
+* resource reads can persist its RESOLVED default in that resource's
+* properties, and parameter `NoEcho` is outside the state-redaction model
+* either way. What it claims is narrower and still worth having: this record
+* must not ADD an oracle of its own for the case where the value is not
+* already there.
+*
+* The cost, stated rather than hidden: changing ONLY such a default no longer
+* moves the digest, so the record keeps binding through that edit until the
+* next deploy re-resolves the output. That is the same bounded staleness the
+* documented blind spots carry.
+*
+* Everything else about the parameter is still hashed — its `Type`, its
+* `AllowedValues`, the `NoEcho` flag itself — so a parameter appearing,
+* disappearing or changing shape still un-binds. Unmatched parameter content
+* hashes exactly as before: the map is rebuilt, but the canonicaliser sorts
+* keys and ignores prototypes, so a template with no `NoEcho` default gets the
+* digest it always had.
+*/
+function withNoEchoDefaultsMasked(parameters) {
+	if (parameters === null || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
+	const masked = Object.create(null);
+	for (const [name, decl] of Object.entries(parameters)) {
+		const body = decl;
+		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+			...body,
+			Default: NO_ECHO_DEFAULT_MASK
+		} : decl;
+	}
+	return masked;
+}
+/**
+* The digest recorded in `StackState.skippedOutputs[outputKey]` by the deploy
+* and recomputed by the diff — see the module doc for what it covers. Both
+* sides call THIS function, so the coverage is spelled once.
+*
+* `template` must be the pre-resolution snapshot the module doc describes.
+*/
+function skippedOutputDigest(template, outputKey) {
+	const sections = Object.create(null);
+	for (const [section, body] of Object.entries(template)) {
+		if (section === "Resources" || section === "Outputs") continue;
+		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
+	}
+	const entry = template.Outputs?.[outputKey];
+	return createHash("sha256").update(canonicalJson({
+		output: entry,
+		template: sections
+	})).digest("hex");
+}
+/**
+* The record a deploy writes for the bag `resolveOutputs` produced: every key
+* whose value is `undefined`, mapped to its digest. Two arms write that value:
+* the default arm of `handleOutputResolutionFailure` (the resolver THREW —
+* warned, and refused under `--strict-getatt`), and a resolver that returned
+* `undefined` outright without throwing (an attribute it could construct
+* nothing for, `constructAttribute`'s empty arm — no warn, no strict refusal).
+* Both leave the key out of a re-resolved bag (the no-change path may keep a
+* previous value under it, see the module doc), and that path's
+* `resolutionFailed` treats both the same, so this record does too: the
+* question it answers is "will the next deploy leave this key absent?", and
+* the answer is yes either way. `undefined` (the field OMITTED) when nothing
+* was skipped, so a record that carries the field says at least one output
+* was skipped.
+*
+* `template` must be the pre-resolution snapshot (see the module doc).
+*/
+function collectSkippedOutputs(template, resolvedOutputs) {
+	let record;
+	for (const [outputKey, value] of Object.entries(resolvedOutputs)) {
+		if (value !== void 0) continue;
+		record ??= Object.create(null);
+		record[outputKey] = skippedOutputDigest(template, outputKey);
+	}
+	return record;
+}
+/**
+* Every resource logical id an output entry could reference, from `Ref`,
+* either `Fn::GetAtt` spelling, and an `Fn::Sub` placeholder, walked to any
+* depth over the whole entry (`Value`, `Export.Name` and anything else it
+* declares).
+*
+* A deliberate SUPERSET: an `Fn::Sub` placeholder naming a template
+* PARAMETER, or a `Ref` to one, lands here too, since telling the two apart
+* needs the `Parameters` section and the answer only ever widens the set. The
+* one consumer intersects it with the ids that actually have a pending
+* RESOURCE change, so a name that is not a resource cannot match, and a
+* parameter deliberately named after a changed resource merely un-binds one
+* record — the direction that previews a row rather than hiding one. Pseudo
+* parameters (`AWS::…`) and the `${!Literal}` escape are dropped.
+*/
+function referencedLogicalIds(entry) {
+	const ids = /* @__PURE__ */ new Set();
+	const addName = (name) => {
+		const logicalId = name.split(".")[0];
+		if (logicalId !== void 0 && logicalId !== "" && !logicalId.startsWith("AWS::")) ids.add(logicalId);
+	};
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const obj = value;
+		if (typeof obj["Ref"] === "string") addName(obj["Ref"]);
+		const getAtt = obj["Fn::GetAtt"];
+		if (typeof getAtt === "string") addName(getAtt);
+		else if (Array.isArray(getAtt) && typeof getAtt[0] === "string") addName(getAtt[0]);
+		for (const [key, nested] of Object.entries(obj)) {
+			if (key === "Fn::Sub") {
+				walkSub(nested);
+				continue;
+			}
+			walk(nested);
+		}
+	};
+	/**
+	* `Fn::Sub` in both spellings. Handled here rather than by the generic walk
+	* because the two-argument form's second element is a VARIABLE MAP, not a
+	* template fragment: its KEYS are variable names, so letting the generic
+	* walk see `{ Ref: 'Unrelated' }` there would read a variable literally
+	* named `Ref` as a `Ref` intrinsic. The map's VALUES are walked, since the
+	* resolver resolves them.
+	*/
+	const walkSub = (sub) => {
+		const isPair = Array.isArray(sub);
+		const subTemplate = typeof sub === "string" ? sub : isPair ? sub[0] : void 0;
+		const variableMap = isPair && sub[1] !== null && typeof sub[1] === "object" ? sub[1] : void 0;
+		if (typeof subTemplate === "string") {
+			const declaredVars = new Set(variableMap === void 0 ? [] : Object.keys(variableMap));
+			for (const [, placeholder] of subTemplate.matchAll(/\$\{([^}]*)\}/g)) {
+				if (placeholder === void 0 || placeholder.startsWith("!")) continue;
+				if (declaredVars.has(placeholder)) continue;
+				addName(placeholder);
+			}
+		}
+		if (isPair) for (const [index, element] of sub.entries()) {
+			if (index === 1) {
+				if (variableMap !== void 0) for (const declared of Object.values(variableMap)) walk(declared);
+				continue;
+			}
+			walk(element);
+		}
+		else walk(sub);
+	};
+	walk(entry);
+	return ids;
+}
+/**
+* The keys of a `StackState.skippedOutputs` record that still BIND against
+* today's template: recorded digest equal to the digest of the same key over
+* `pristineTemplate`, which must be the pre-resolution snapshot the module doc
+* describes. A key the template no longer declares is skipped outright — the
+* record is inert for it, and the next deploy clears it. The diff passes the
+* result to `resolveTemplateOutputs`, which adds the one check only state can
+* answer — that the key is still absent from the stored bag.
+*
+* `changedLogicalIds` is the second half of the binding rule, and the one the
+* digest structurally cannot carry (see the module doc's `Resources` bullet):
+* the logical ids this run's resource diff reports as changing. An output
+* whose entry references one of them does NOT bind, because the deploy that
+* follows takes the changed-resources path, re-resolves every output, and may
+* publish the very key the record would have hidden. Omitted by a caller with
+* no resource diff in hand — every such caller today is a test asserting the
+* digest half alone.
+*/
+function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
+	const binding = /* @__PURE__ */ new Set();
+	if (record === null || record === void 0) return binding;
+	const declared = pristineTemplate.Outputs ?? {};
+	for (const [outputKey, digest] of Object.entries(record)) {
+		if (!Object.prototype.hasOwnProperty.call(declared, outputKey)) continue;
+		const entry = declared[outputKey];
+		if (digest !== skippedOutputDigest(pristineTemplate, outputKey)) continue;
+		if (changedLogicalIds !== void 0 && [...referencedLogicalIds(entry)].some((id) => changedLogicalIds.has(id))) continue;
+		binding.add(outputKey);
+	}
+	return binding;
+}
+/**
+* Whether two records — either possibly absent — describe the same skipped
+* set with the same digests. The no-change deploy path persists on a
+* difference here: it is the ONLY save trigger for this field on that path,
+* because a skipped output switches the outputs-changed trigger off.
+*/
+function skippedOutputsEqual(a, b) {
+	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
+	const bKeys = b === null || b === void 0 ? [] : Object.keys(b);
+	if (aKeys.length !== bKeys.length) return false;
+	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -33432,7 +34077,8 @@ var ReplayResolvers = class {
 * `state.json` already stores in the clear.
 */
 function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
-	return new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
+	return new CdkdError(`Rollback of ${logicalId}${where} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
 }
 /**
 * Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
@@ -33535,10 +34181,11 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 */
 function redactRollbackRecord(record, secrets, journaledProps) {
 	if (secrets.size === 0) return record;
-	return scrubResourceRecord(journaledProps === void 0 ? record : {
+	const positioned = journaledProps === void 0 ? record : {
 		...record,
 		properties: redactSecretsForState(record.properties, secrets, journaledProps, STATE_DERIVED_RULES)
-	}, secrets);
+	};
+	return scrubResourceRecord(positioned, secrets);
 }
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted, secrets) {
 	if (provider.disableOuterRetry) return await withCurrentResourceSecrets(secrets, () => provider.update(...args));
@@ -34759,13 +35406,13 @@ const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
 */
-const DEFAULT_RESOURCE_WARN_AFTER_MS = 300 * 1e3;
+const DEFAULT_RESOURCE_WARN_AFTER_MS = 3e5;
 /**
 * Default per-resource hard timeout: abort after 30 minutes. Matches the
 * design doc — Custom-Resource-heavy stacks should pass `--resource-timeout 1h`
 * explicitly because the Custom Resource provider's polling cap is 1h.
 */
-const DEFAULT_RESOURCE_TIMEOUT_MS = 1800 * 1e3;
+const DEFAULT_RESOURCE_TIMEOUT_MS = 18e5;
 var InterruptedError = class extends Error {
 	constructor(reason = "user") {
 		super(reason === "user" ? "Deployment interrupted by user (Ctrl+C)" : "Deployment aborted after another resource failed");
@@ -35021,8 +35668,17 @@ var DeployEngine = class {
 	* secret collapse onto whichever expression was recorded last, exactly as two
 	* resource properties did before #1904. Captured in `resolveOutputs` at the
 	* same point `outputSecrets` is accumulated. Reset per `deploy()`.
+	*
+	* Null-prototype for the same reason as the outputs bag `resolveOutputs`
+	* builds two lines away: both are keyed by TEMPLATE-CONTROLLED output names,
+	* so an output called `__proto__` would replace this bag's prototype and a
+	* later lookup of a name it never stored would inherit from it. Only the
+	* RESET in `deploy()` is pinned — reverting this initialiser alone survives
+	* the suite, measured, because `deploy()` replaces the bag before anything
+	* writes to it, so the initialiser matches the reset rather than standing as
+	* a second guard.
 	*/
-	outputsTemplateSource = {};
+	outputsTemplateSource = Object.create(null);
 	/**
 	* The export aliases the last `resolveOutputs` pass WROTE into its bag
 	* (issue #2193) — exactly the keys `outputs[exportName] = value` landed on,
@@ -35035,6 +35691,18 @@ var DeployEngine = class {
 	*/
 	resolvedExportNames = [];
 	/**
+	* The outputs the last `resolveOutputs` pass could NOT resolve and SKIPPED
+	* (the resolver threw under the default arm of
+	* `handleOutputResolutionFailure`, or returned `undefined` outright — see
+	* `collectSkippedOutputs`), each mapped to the
+	* digest `cdkd diff` compares against (issue #2740, `StackState.
+	* skippedOutputs`). `undefined` when nothing was skipped, so the saves that
+	* persist the resolved bag spread it as-is and the field stays omitted. Same
+	* lifetime rule as `resolvedExportNames`: reset at the top of every
+	* `resolveOutputs`, meaningful only right after that call returns.
+	*/
+	skippedOutputs;
+	/**
 	* Whether {@link outputsTemplateSource} may be used to POSITION the outputs
 	* redaction. False once an outputs pass threw partway: the post-loop
 	* name pass never ran, so the bag holds only the alias keys written before
@@ -35104,7 +35772,7 @@ var DeployEngine = class {
 		});
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
-		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
+		this.options.lockTimeout = options.lockTimeout ?? 3e5;
 		this.options.noRollback = options.noRollback ?? false;
 		this.options.resourceWarnAfterMs = options.resourceWarnAfterMs ?? 3e5;
 		this.options.resourceTimeoutMs = options.resourceTimeoutMs ?? 18e5;
@@ -35119,9 +35787,11 @@ var DeployEngine = class {
 		this.perResourceSecrets = /* @__PURE__ */ new Map();
 		this.noEchoAttributeResources = /* @__PURE__ */ new Map();
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
+		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
-		this.outputsTemplateSource = {};
+		this.outputsTemplateSource = Object.create(null);
 		this.outputsSourceUsable = true;
+		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
@@ -35339,7 +36009,7 @@ var DeployEngine = class {
 			const ownSecrets = secrets ?? /* @__PURE__ */ new Map();
 			const next = { ...op };
 			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
-			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(next.attemptedProperties, ownSecrets, templateProps);
+			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps);
 			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
 			return next;
 		});
@@ -35427,7 +36097,7 @@ var DeployEngine = class {
 			const logicalId = entries[i][0];
 			const observed = resolved[i];
 			const target = stateResources[logicalId];
-			if (target && observed !== void 0) target.observedProperties = observed;
+			if (target && observed !== void 0) target.observedProperties = markSameGenerationBag({ ...observed });
 		}
 	}
 	/**
@@ -35605,6 +36275,10 @@ var DeployEngine = class {
 			} catch {}
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
+			const outputsDigestSource = structuredClone({
+				...template,
+				Resources: {}
+			});
 			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets } });
 			this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 			const context = this.buildResolverContext({
@@ -35648,7 +36322,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions));
+					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
@@ -35657,7 +36331,8 @@ var DeployEngine = class {
 					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
 					const observedRefresh = this.observedCaptureTasks.size > 0;
 					if (observedRefresh) await this.drainObservedCaptures(currentState.resources);
-					if (observedRefresh || outputsChanged || exportSetChanged) try {
+					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
+					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged) try {
 						const refreshedState = {
 							version: 9,
 							region: this.stackRegion,
@@ -35665,6 +36340,7 @@ var DeployEngine = class {
 							resources: currentState.resources,
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
 							...resolutionFailed ? exportNamesCarriedFrom(currentState) : { exportNames: [...this.resolvedExportNames] },
+							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
 						};
@@ -35677,7 +36353,8 @@ var DeployEngine = class {
 							if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
 							else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
 							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(refreshedState));
-						} else this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
 						this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 					}
@@ -35719,7 +36396,7 @@ var DeployEngine = class {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
 			};
-			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending);
+			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending);
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
@@ -35761,7 +36438,7 @@ var DeployEngine = class {
 	* - DELETE follows reverse dependency order (a node starts as soon as all
 	*   resources that depend ON it have finished deleting)
 	*/
-	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
+	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
 		const concurrency = this.options.concurrency;
 		const newResources = { ...currentState.resources };
 		const actualCounts = {
@@ -35787,6 +36464,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -35919,6 +36597,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -35955,6 +36634,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -35972,6 +36652,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -35986,7 +36667,7 @@ var DeployEngine = class {
 		}
 		let outputs;
 		try {
-			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+			outputs = await this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions);
 			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
 			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -36003,6 +36684,7 @@ var DeployEngine = class {
 				resources: newResources,
 				outputs,
 				exportNames: [...this.resolvedExportNames],
+				...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 				...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 				...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
 				lastModified: Date.now()
@@ -36041,6 +36723,7 @@ var DeployEngine = class {
 			resources: newResources,
 			outputs: currentState.outputs,
 			...exportNamesCarriedFrom(currentState),
+			...skippedOutputsCarriedFrom(currentState),
 			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
@@ -36361,7 +37044,8 @@ var DeployEngine = class {
 		if (!redirect) return;
 		const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
 		if (findings.length === 0) return;
-		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n")}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+		const detail = findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n");
+		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${detail}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
 	}
 	/**
 	* The `Snapshot`-policy gate every engine delete site runs BEFORE its
@@ -36503,7 +37187,7 @@ var DeployEngine = class {
 				recordNestedStackParameterExpressions(updateSecrets, resourceType, resolvedProps, desiredProps);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
-				if (JSON.stringify(redactSecretsForState(resolvedProps, updateSecrets, desiredProps)) === JSON.stringify(currentPropsAsWritten)) {
+				if (JSON.stringify(redactSecretsForState(markSameGenerationBag({ ...resolvedProps }), updateSecrets, desiredProps)) === JSON.stringify(currentPropsAsWritten)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -36733,7 +37417,8 @@ var DeployEngine = class {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
 								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
-								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+								const createMsg = createError instanceof Error ? createError.message : String(createError);
+								if (!isNameCollisionError(createMsg)) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 							}
@@ -36782,8 +37467,10 @@ var DeployEngine = class {
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
 					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
-					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
-					else counts.updated++;
+					if (counts) {
+						if (updatePartial !== void 0) counts.updatePartial++;
+						else counts.updated++;
+					}
 					if (progress) progress.current++;
 					const updatePrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 					renderer.removeTask(logicalId);
@@ -36903,9 +37590,9 @@ var DeployEngine = class {
 	* `cdkd export`, `cdkd state`.
 	*/
 	propertiesToRecord(desiredProperties, result, resourceType, provisionedBy) {
-		const effective = result.effectiveProperties ?? desiredProperties;
-		if (provisionedBy !== "sdk") return effective;
-		return withoutSilentDropProperties(resourceType, effective);
+		if (result.effectiveProperties) return provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, result.effectiveProperties) : result.effectiveProperties;
+		const written = provisionedBy === "sdk" ? withoutSilentDropProperties(resourceType, desiredProperties) : desiredProperties;
+		return markSameGenerationBag(written);
 	}
 	/**
 	* The name-origin half of the replacement-collision messages (issue #1636).
@@ -37217,10 +37904,10 @@ var DeployEngine = class {
 	* rather than whatever the declaration order happened to have recorded by
 	* then (issue #1919).
 	*/
-	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
+	async resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 		this.resolvedExportNames = [];
 		if (!template.Outputs) return {};
-		const outputs = {};
+		const outputs = Object.create(null);
 		const context = this.buildResolverContext({
 			template,
 			resources,
@@ -37285,7 +37972,8 @@ var DeployEngine = class {
 			if (!publishedOutputNames.has(outputKey)) continue;
 			this.outputsTemplateSource[outputKey] = output.Value;
 		}
-		return outputs;
+		this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
+		return markSameGenerationBag(outputs);
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
 		const display = {};
@@ -37299,5 +37987,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { createMaskedRetryLogger as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, replayWarn as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketWebsiteUrl as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, normalizeAwsTagsToCfn as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, configBooleanRefusal as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, coerceCfnBoolean as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, producerRegionsFromState as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, findSilentDropProperties as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, DiffCalculator as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, s3BucketArn as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, s3BucketDomainName as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, requireConfigObject as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigString as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, configStringRefusal as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, classifyReplaySecretRegion as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketDualStackDomainName as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, WAFv2WebACLProvider as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, assertRegionMatch as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, INTRINSIC_KEYS as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, applyRoleArnIfSet as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, findActionableSilentDrops as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, coerceParameterTypedValue as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, isInterruptedWaitError as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, parameterTypeMayLoseSecretIdentity as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, deleteSkipReason as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, maskDeep as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, disableInstanceApiTermination as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, cfnRefValueFromPhysicalId as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, carriesDynamicReference as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, interruptWatchListenerCount as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, requireConfigArray as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, readConfigString as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, UNSPECIFIED_SKIP_REASON as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, IntrinsicFunctionResolver as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, beginCommandInterruptScope as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, startInterruptWatch as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, isTerminationProtectionPropagationError as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, endCommandInterruptScope as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, maskerOrIdentity as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, deleteIndeterminateGuards as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, getAccountInfo as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, resolveExplicitPhysicalId as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, refStateLookupFromResource as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, isUnboundTemplateParameter as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketRegionalDomainName as zt };
-//# sourceMappingURL=deploy-engine-ZPkBIilF.js.map
+export { ProviderRegistry as $, redactDockerArgvValues as $n, ResourceUpdateNotSupportedError as $r, STATE_SOURCED_READBACK_RULES as $t, renderStatefulReason as A, createAssetRedirectResolver as An, AssemblyReader as Ar, configStringRefusal as At, red as B, readBootstrapMarkerBody as Bn, ConfigError as Br, s3BucketDualStackDomainName as Bt, refusesFinalSnapshot as C, importableOutputKeys as Cn, uploadCfnTemplate as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, stringifyValue as Dn, PARTITION_TABLE as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, AssetPublisher as En, expectedOwnerParam as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, assertAssetBucketRegion as Fn, getAwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, buildDockerImage as Gn, IntrinsicResolutionRefusalError as Gr, INTRINSIC_KEYS as Gt, collectDeclaredOutputNames as H, validateContainerRepoName as Hn, DependencyError as Hr, s3BucketWebsiteUrl as Ht, bold as I, ensureAssetStorage as In, resetAwsClients as Ir, classifyReplaySecretRegion as It, stateKeySecretExposure as J, describeDockerFailure as Jn, LockError as Jr, describeTypeWithThrottleRetry as Jt, secretBearingStateKeyWarning as K, describeDockerCapturedOutput as Kn, LocalInvokeBuildError as Kr, findActionableSilentDrops as Kt, cyan as L, getBootstrapMarkerKey as Ln, setAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, rewriteTemplateAssetReferences as Mn, clearBucketRegionCache as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, AssetModeResolver as Nn, resolveBucketRegion as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, WorkGraph as On, canonicalizeRegion as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, BOOTSTRAP_MARKER_PREFIX as Pn, AwsClients as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, partitionSensitiveEnv as Qn, ResourceTimeoutError as Qr, STATE_SOURCED_CROSS_GENERATION_RULES as Qt, gray as R, isCrossRegionRedirect as Rn, AssetError as Rr, s3BucketArn as Rt, isFinalSnapshotError as S, exportNamesCarriedFrom as Sn, findLargeInlineResources as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, shouldRetainResource as Tn, displaySafe as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, buildDenyExternalAccessPolicy as Un, DeployCancelledError as Ur, applyRoleArnIfSet as Ut, yellow as V, validateAssetBucketName as Vn, CrossAccountSecretRefusalError as Vr, s3BucketRegionalDomainName as Vt, exportAliasCollisionScrubWarning as W, describeAwsFailure as Wn, DynamicReferenceRegionAmbiguousError as Wr, DiffCalculator as Wt, IAMRoleProvider as X, formatDockerLoginError as Xn, PartialFailureError as Xr, DagBuilder as Xt, getCurrentResourceSecrets as Y, dockerSpawnEnvWithSensitive as Yn, NestedStackChildDirectDestroyError as Yr, withRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, getDockerCmd as Zn, ProvisioningError as Zr, TemplateParser as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildLockContentionMessage as _n, stateBucketExistenceConfirmed as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, isCdkdError as ai, isSingleDynamicReferenceToken as an, getDockerImageBySourceHash as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, CUSTOM_RESOURCE_RESPONSE_PREFIX as bn, CFN_TEMPLATE_URL_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, isMarkedNonRetryable as ci, recordMaskOnlyValue as cn, getDefaultStateBucketName as cr, startInterruptWatch as ct, updatePartialReason as d, isTransientServerError as di, scrubResourceRecord as dn, resolveAutoAssetStorage as dr, UNSPECIFIED_SKIP_REASON as dt, StackHasActiveImportsError as ei, TEMPLATE_SOURCED_RULES as en, runDockerForeground as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, markNonRetryable as fi, LockManager as fn, resolveCaptureObservedState as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, buildForceUnlockCommand as gn, resolveUseCdkBootstrapAssets as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, __exportAll as hi, UNRENDERABLE as hn, resolveStateBucketWithDefaultAndSource as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, formatError as ii, errorCauseChain as in, AssetManifestLoader as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, loadPublishableAssetManifest as jn, processStackMessages as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, buildAssetRedirectMap as kn, derivePartitionAndUrlSuffix as kr, configBooleanRefusal as kt, replayRollback as l, isRetryableTransientError as li, recoverMaskedOutput as ln, getLegacyStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, retryClassificationText as mi, rebuildClientForBucketRegion as mn, resolveStateBucketWithDefault as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StateError as ni, createSecretMasker as nn, escapeRegExp$1 as nr, maskDeep as nt, planFailedOps as o, normalizeAwsError as oi, maskSecretsInError as on, Synthesizer as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markRedactedCause as pi, S3StateBackend as pn, resolveSkipPrefix as pr, deleteSkipReason as pt, secretSafeKeyDisplay as q, describeDockerExecFailure as qn, LocalStartServiceError as qr, findSilentDropProperties as qt, DeployEngine as r, SynthesisError as ri, dynamicReferenceTokens as rn, stripControlChars as rr, maskerOrIdentity as rt, planRollback as s, withErrorHandling as si, maskSecretsInText as sn, synthesisStatusMessage as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackTerminationProtectionError as ti, carriesSecretMask as tn, runDockerStreaming as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isThrottlingError as ui, redactSecretsForState as un, resolveApp as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, forceQuitRecoveryClause as vn, warnDeprecatedNoPrefixCliFlag as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputs as wn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, DEFAULT_STATE_PREFIX as xn, MIGRATE_TMP_PREFIX as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, shellQuote as yn, CFN_TEMPLATE_BODY_LIMIT as yr, coerceParameterTypedValue as yt, green as z, parseBootstrapMarker as zn, CdkdError as zr, s3BucketDomainName as zt };
+//# sourceMappingURL=deploy-engine-CfxcC3q3.js.map