@go-to-k/cdkd 0.288.2 → 0.288.3

package/dist/{deploy-engine-Cxt3gn8N.js → deploy-engine-CfxcC3q3.js}

@@ -1,8 +1,8 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BRByznpy.js";
+import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
@@ -9101,6 +9101,18 @@ function importableOutputs(state) {
 function exportNamesCarriedFrom(previous) {
 	return previous.exportNames === void 0 ? {} : { exportNames: previous.exportNames };
 }
+/**
+* The `skippedOutputs` field to write when a save carries the PREVIOUS
+* record's `outputs` bag forward instead of re-resolving it (issue #2740). The
+* record describes that bag — which keys the deploy that wrote it could not
+* resolve — so it travels with the bag, exactly like {@link
+* exportNamesCarriedFrom}: absent stays absent, present stays as it was. A
+* writer that re-resolves outputs does NOT call this; it writes the set the
+* resolution produced, or omits the field when nothing was skipped.
+*/
+function skippedOutputsCarriedFrom(previous) {
+	return previous.skippedOutputs === void 0 ? {} : { skippedOutputs: previous.skippedOutputs };
+}
 
 //#endregion
 //#region src/types/rollback-journal.ts
@@ -16687,6 +16699,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RoleArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
+			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
 			["FilesystemConfigurations", "not yet implemented by cdkd"],
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
@@ -16805,7 +16818,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationWindow", "not yet implemented by cdkd"]
+			["EvaluationWindow", "not yet implemented by cdkd"],
+			["WarmUpConfiguration", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
@@ -17633,7 +17647,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Glue::Connection", {
 		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
-		silentDrop: /* @__PURE__ */ new Map(),
+		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::Glue::Crawler", {
@@ -18197,7 +18211,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
 			"ClusterScalabilityType",
 			"DBSystemId",
 			"EngineMode",
@@ -23693,6 +23706,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "ApiId": return physicalId;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
+			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
+			case "ApiId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
 			case "Id": return physicalId;
@@ -26642,7 +26660,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DUlRn84u.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CQrHElrl.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31240,6 +31258,67 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure) {
 	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
 /**
+* Test `key` for recorded secret plaintext and return how it may be shown.
+*
+* Reuses {@link stateKeySecretExposure} and the same `maskEveryOccurrence` the
+* warnings below use, rather than restating either: two spellings of "is this
+* key safe to print" would disagree on the boundary cases those two encode
+* (the whole-key match for a sub-floor needle, longest-needle-first masking).
+*
+* SANITISED WITH BOTH helpers, because neither is a superset of the other —
+* measured, after a first cut swapped one for the other and silently traded
+* one class of character for another (issue #2667 review):
+*
+* | input    | `stripControlChars` | `displaySafe` |
+* | -------- | ------------------- | ------------- |
+* | `U+200E` | removed             | KEPT          |
+* | `U+200F` | removed             | KEPT          |
+* | `U+2028` | KEPT                | replaced      |
+* | `U+2029` | KEPT                | replaced      |
+*
+* `U+2028` / `U+2029` matter because this text is PERSISTED and re-rendered by
+* JSON and web log viewers that treat both as line terminators — the CI-log
+* surface this masking exists to protect, where an `Fn::Sub`-built export name
+* carrying one could forge a log line (`display-safe.ts` states that
+* rationale). `U+200E` / `U+200F` are the bidi MARKS, named as residuals in
+* that same file; they reorder rendered text without terminating a line. On a
+* path whose subject is a possibly-secret-bearing name in an operator's log,
+* neither loss is worth taking, and composing costs nothing.
+*
+* ORDER IS LOAD-BEARING, and for the OVERLAP set — not for the marks, which
+* an earlier revision of this comment named and measurement contradicted.
+* `displaySafe` never touches `U+200E` / `U+200F`, so those give identical
+* output either way. Where the two classes OVERLAP — `U+0000`-`U+001F`,
+* `U+007F`-`U+009F`, `U+202A`-`U+202E`, `U+2066`-`U+2069` — `stripControlChars`
+* DELETES while `displaySafe` replaces with a space, so strip-then-display
+* yields `"ab"` and display-then-strip yields `"a b"`. Stripping first keeps a
+* name carrying them from being padded out.
+*
+* `displaySafe` also `.trim()`s, which `stripControlChars` alone did not: a
+* display-shape change for a key with leading or trailing whitespace. Stated
+* because it is a real difference, not hidden.
+*
+* The sibling warnings in this file still use `stripControlChars` ALONE and
+* carry the `U+2028` half of the gap; widening that helper, or converting
+* them, changes call sites this issue does not touch, so it is filed as issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874) rather than done here.
+*/
+function secretSafeKeyDisplay(key, secrets) {
+	const sanitise = (text) => displaySafe(stripControlChars(text));
+	const shown = sanitise(key);
+	const exposure = stateKeySecretExposure(shown, secrets) ?? stateKeySecretExposure(key, secrets);
+	if (!exposure) return {
+		kind: "safe",
+		text: shown
+	};
+	const masked = sanitise(maskEveryOccurrence(shown, exposure));
+	if (masked === shown) return { kind: "withheld" };
+	return {
+		kind: "masked",
+		text: masked
+	};
+}
+/**
 * Warning for a state KEY that already holds secret plaintext — the residue an
 * EARLIER binary left when it published an export name that resolved to one.
 *
@@ -32682,6 +32761,397 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/skipped-outputs.ts
+/**
+* The record `cdkd deploy` leaves behind for an Output it could NOT resolve
+* and SKIPPED, and the digest `cdkd diff` compares it against (issue
+* [#2740](https://github.com/go-to-k/cdkd/issues/2740)).
+*
+* The deploy side (`DeployEngine.handleOutputResolutionFailure`, default arm)
+* warns, stores `undefined` for the key and moves on, so a re-resolved
+* `state.outputs` lacks it (the no-change path keeps the previous bag whole
+* when any output fails, so a key that resolved on an EARLIER deploy can keep
+* its value beside a record — the reader checks absence first and ignores the
+* record then). The diff side resolves outputs with `skipDynamicReferences`, so a
+* failure that happens INSIDE a secret lookup — a JSON key the secret does not
+* hold, a reference assembled from another secret's value — does not reproduce
+* there: the value assembles into its token, the key is absent from state, and
+* `computeOutputsDiff` pushed an `ADD` the deploy would never perform, on every
+* run of an unchanged stack. The diff cannot tell from assembly alone that the
+* deploy would fail (a composed string carrying a secret reference is a
+* legitimate output), so it learns what the deploy learned instead:
+* `StackState.skippedOutputs` maps each skipped key to a digest of the
+* template inputs its resolution read, and the diff trusts the record only
+* while that digest is unchanged.
+*
+* ## What the digest covers, and why
+*
+* `skippedOutputDigest` hashes the output's OWN entry (`Value`, `Export`,
+* `Condition`, whatever else it declares) together with every top-level
+* template section EXCEPT `Resources` and `Outputs`:
+*
+* - The entry itself: repairing the `Value` expression is the obvious repair.
+*   The `Export.Name` is in it too, because the alias pass routes an
+*   `Export.Name` failure through the same handler, which blanks the output's
+*   own key even when its value resolved — so a repaired or removed export
+*   name must invalidate the record as well.
+* - `Parameters` (a `Ref`-built reference repaired through a parameter
+*   default), `Conditions` (an `Fn::If` whose branch flips), `Mappings` (an
+*   `Fn::FindInMap`-built key), and the remaining sections for the same
+*   reason, spelled as one rule rather than a list that drifts: everything an
+*   output's resolution can read besides resources. One VALUE inside them is
+*   excluded — the `Default` of a `NoEcho: true` parameter, hashed as a
+*   constant; see `withNoEchoDefaultsMasked` for why. That is the POSITION,
+*   not the parameter: its `AllowedValues`, and any literal an author puts in
+*   `Conditions`, `Rules` or `Metadata`, are hashed as before.
+* - NOT `Resources`: hashing the section would invalidate the record on every
+*   unrelated resource edit. The output CAN be repaired from that side —
+*   `collectSkippedOutputs` records both skip arms, and the quiet one is an
+*   `Fn::GetAtt` whose attribute `constructAttribute` could not build — so a
+*   digest alone would keep binding while the next deploy publishes the row
+*   and its `Export.Name`, the phantom's inverse. {@link
+*   bindingSkippedOutputs} closes that with the CHANGE MAP rather than the
+*   digest: a key whose entry references a logical id with a pending resource
+*   change does not bind. The diff has that map (it ran the resource diff
+*   first); the deploy does not need it, because a stack with any resource
+*   change takes the path that re-resolves every output and rewrites the
+*   record. REFERENCE, not repair: whether an edit could actually make the
+*   output resolvable is undecidable from a template, so an unrelated edit to
+*   a referenced resource un-binds too and the key can preview as an `ADD`
+*   again. The cost is bounded — a run with a changed resource is already
+*   reporting that row, so `--fail` exits 1 regardless — while the case it
+*   buys depends on whether the diff can resolve the output at all. For an
+*   output reading an attribute that does not exist yet — the SECOND skip arm
+*   this record covers, not the secret lookup issue #2740 was filed on — it is
+*   the VERDICT and not the row: unresolvable in
+*   both readings, so bound the diff reports the outputs settled while the
+*   next deploy is about to publish that key and its `Export.Name`. For an
+*   output the diff CAN resolve, whose reference is to a name rather than to
+*   a pending attribute (an `Fn::Sub` over an SSM parameter's name, say), the
+*   row IS the difference and reappears as an `ADD` the moment the record
+*   stops binding.
+* - NOT the sibling `Outputs`: a CloudFormation output cannot reference
+*   another output, so a sibling change cannot repair this one, and excluding
+*   them keeps an unrelated output edit from producing a one-run phantom.
+*
+* What the digest CANNOT see is a repair outside the template — the secret
+* gained the JSON key, the SSM parameter was created, a parameter VALUE
+* handed to the engine rather than declared changed (a nested stack's inputs
+* from its parent, `DeployEngineOptions.parameters`; `Parameters`
+* DECLARATIONS are hashed, supplied values are not), or **cdkd itself was
+* upgraded**: the quiet skip arm is `constructAttribute` returning nothing,
+* so a provider that gains that attribute repairs the output while neither
+* the template nor any resource moves.
+*
+* They are blind spots for three different reasons, and only the first is
+* about knowledge. The secret's key set and the SSM parameter's existence
+* need the external lookup the diff deliberately refuses to make. A supplied
+* parameter VALUE is not one of those — a nested stack's inputs are resolved
+* and forwarded to the child diff (`resolveChildStackParameters`) — it is
+* simply outside what the digest hashes, because hashing values would make
+* the record depend on a caller's arguments rather than on the template. And
+* the writing binary's version is knowable and merely unstored: keeping it
+* beside the digest and un-binding on mismatch would close that one. All four
+* end the same way: the record keeps binding until the next deploy re-resolves
+* the output, and that deploy publishes the key — unless a SIBLING output is
+* still unresolved on a run with no resource change, where the engine keeps
+* the previous outputs bag wholesale and the key stays unpublished for a
+* further run (go-to-k/cdkd#2771, pre-existing and not introduced here).
+* Documented as the accepted limitation in `docs/cli-diff.md`; it is narrower
+* than the pre-#2740 behaviour, where the diff was wrong on EVERY run.
+*
+* A repair on the RESOURCE side is NOT on that list either, but the reason is
+* narrower than it first looks. The change map above closes it only when the
+* repair arrives WITH a template resource change, which is what makes the
+* resource show on the diff at all. An OUT-OF-BAND state write does not:
+* every writer that rebuilds state outside a deploy DROPS the record rather
+* than carry it (one enumerated exception, the partial-destroy snapshot, is
+* explained with the field) — `cdkd import` refreshes `attributes` for the
+* resources it imports, `cdkd drift --accept` rewrites the properties an
+* attribute may be built from, `cdkd rollback`'s replacement arm rebuilds a
+* record with the attributes a FRESH create returned, and the rest are listed
+* with the field.
+* Dropping returns those keys to pre-#2740 behaviour until the next deploy
+* recomputes the record — a row where the diff can resolve them, the ordinary
+* whole-section suppression where it cannot — which is what keeps a
+* resource-side repair out of the list above.
+*
+* The rule is flat and it is meant to be: EVERY writer that rebuilds state
+* outside a deploy drops the record, the partial-destroy snapshot being the
+* one enumerated exception — the full list lives with the field, in
+* `StackState.skippedOutputs`. Three per-writer arguments for carrying it were
+* written during review, which is the reason for the flat rule rather than an
+* aside: two were shown wrong (substituting a value repairs an output whose
+* enclosing intrinsic was choking on what was there; scrubbing a plaintext
+* back to its expression rewrites a string outputs read verbatim) and the
+* third — deleting a property EXPOSING an attribute of the same name — could
+* not be settled either way, which argues for flatness at least as strongly.
+*
+* ## Where the digest must be taken from
+*
+* The template AS HANDED to the engine / to `computeStackDiff` — before
+* parameter binding, condition evaluation or any output resolution. The
+* INVARIANT, and the reason both callers `structuredClone` rather than pass
+* their live object: **no resolution may be visible to the digest, on either
+* side, and both sides must take it at the same point of their own flow.**
+* Two independent reasons, neither of which depends on any particular
+* resolver doing the writing: a digest that could see a resolved value would
+* (1) differ between the two sides, which computes a record the diff can
+* never re-derive, and (2) fingerprint a secret into `state.json`, since a
+* resolved value can be a decrypted one.
+*
+* The clone is therefore NOT dead weight even while no resolver mutates its
+* input. It used to be load-bearing against a live rewrite — `resolveSub`
+* substituted into the caller's two-argument `Fn::Sub` variable map until
+* go-to-k/cdkd#2764 gave it a fresh object — and the protection was never
+* derived from that call site: it is derived from the invariant above, which
+* a future in-place optimisation anywhere in either flow would silently
+* violate. `tests/unit/cli/diff-recursive-skipped-outputs.test.ts` pins the
+* current no-mutation contract from the other direction (the template handed
+* to `computeStackDiff` comes back byte-identical), so reintroducing a
+* rewrite reds a test rather than moving a digest;
+* `tests/unit/deployment/deploy-engine-skipped-outputs.test.ts` INJECTS a
+* rewrite through its resolver mock and requires the recorded digest to equal
+* a fresh parse's, which pins the ordering itself.
+*
+* Given that contract the hash covers template text only. It is over
+* canonical JSON (object keys sorted at every level), so a template
+* re-serialised with keys in another order digests identically.
+*
+* ## What the diff does with a binding record
+*
+* It previews the key as ABSENT — no row — because that is exactly what the
+* deploy will leave in state. It does NOT flag the section as failed: a
+* sibling output that genuinely changed still renders, and `--fail` still
+* exits 1 for it. A record whose digest no longer matches is simply ignored:
+* the output is previewed under the ordinary rules again (usually an `ADD`;
+* an intrinsic `Export.Name` the diff still cannot resolve keeps omitting the
+* section, as before), the next deploy re-decides it —
+* publishing it if the repair took, or recording it again under the new
+* digest — and the diff follows that decision.
+*/
+/**
+* JSON with object keys sorted at every level. Arrays keep their order (an
+* `Fn::Join` list is positional). `undefined` members are dropped, as
+* `JSON.stringify` drops them, so a parsed template and its in-memory twin
+* digest identically.
+*/
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, v) => {
+		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+			const sorted = Object.create(null);
+			for (const k of Object.keys(v).sort()) sorted[k] = v[k];
+			return sorted;
+		}
+		return v;
+	});
+}
+/** The constant a `NoEcho` `Default` is hashed as. Its text is irrelevant; that
+* it is CONSTANT is the point. */
+const NO_ECHO_DEFAULT_MASK = "<cdkd:noecho-default>";
+/**
+* `Parameters` with every `NoEcho: true` parameter's `Default` replaced by a
+* constant, for hashing only.
+*
+* The pre-resolution snapshot already keeps RESOLVED secret values out of the
+* digest. An authored `Default` under `NoEcho: true` is not one of those — it
+* is template text, and it went into the hash. With the rest of the
+* non-`Resources` sections known, a reader of `state.json` holds a confirm
+* ORACLE for a low-entropy default: guess it, recompute, compare.
+*
+* This does NOT claim the value is otherwise absent from state — a parameter a
+* resource reads can persist its RESOLVED default in that resource's
+* properties, and parameter `NoEcho` is outside the state-redaction model
+* either way. What it claims is narrower and still worth having: this record
+* must not ADD an oracle of its own for the case where the value is not
+* already there.
+*
+* The cost, stated rather than hidden: changing ONLY such a default no longer
+* moves the digest, so the record keeps binding through that edit until the
+* next deploy re-resolves the output. That is the same bounded staleness the
+* documented blind spots carry.
+*
+* Everything else about the parameter is still hashed — its `Type`, its
+* `AllowedValues`, the `NoEcho` flag itself — so a parameter appearing,
+* disappearing or changing shape still un-binds. Unmatched parameter content
+* hashes exactly as before: the map is rebuilt, but the canonicaliser sorts
+* keys and ignores prototypes, so a template with no `NoEcho` default gets the
+* digest it always had.
+*/
+function withNoEchoDefaultsMasked(parameters) {
+	if (parameters === null || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
+	const masked = Object.create(null);
+	for (const [name, decl] of Object.entries(parameters)) {
+		const body = decl;
+		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+			...body,
+			Default: NO_ECHO_DEFAULT_MASK
+		} : decl;
+	}
+	return masked;
+}
+/**
+* The digest recorded in `StackState.skippedOutputs[outputKey]` by the deploy
+* and recomputed by the diff — see the module doc for what it covers. Both
+* sides call THIS function, so the coverage is spelled once.
+*
+* `template` must be the pre-resolution snapshot the module doc describes.
+*/
+function skippedOutputDigest(template, outputKey) {
+	const sections = Object.create(null);
+	for (const [section, body] of Object.entries(template)) {
+		if (section === "Resources" || section === "Outputs") continue;
+		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
+	}
+	const entry = template.Outputs?.[outputKey];
+	return createHash("sha256").update(canonicalJson({
+		output: entry,
+		template: sections
+	})).digest("hex");
+}
+/**
+* The record a deploy writes for the bag `resolveOutputs` produced: every key
+* whose value is `undefined`, mapped to its digest. Two arms write that value:
+* the default arm of `handleOutputResolutionFailure` (the resolver THREW —
+* warned, and refused under `--strict-getatt`), and a resolver that returned
+* `undefined` outright without throwing (an attribute it could construct
+* nothing for, `constructAttribute`'s empty arm — no warn, no strict refusal).
+* Both leave the key out of a re-resolved bag (the no-change path may keep a
+* previous value under it, see the module doc), and that path's
+* `resolutionFailed` treats both the same, so this record does too: the
+* question it answers is "will the next deploy leave this key absent?", and
+* the answer is yes either way. `undefined` (the field OMITTED) when nothing
+* was skipped, so a record that carries the field says at least one output
+* was skipped.
+*
+* `template` must be the pre-resolution snapshot (see the module doc).
+*/
+function collectSkippedOutputs(template, resolvedOutputs) {
+	let record;
+	for (const [outputKey, value] of Object.entries(resolvedOutputs)) {
+		if (value !== void 0) continue;
+		record ??= Object.create(null);
+		record[outputKey] = skippedOutputDigest(template, outputKey);
+	}
+	return record;
+}
+/**
+* Every resource logical id an output entry could reference, from `Ref`,
+* either `Fn::GetAtt` spelling, and an `Fn::Sub` placeholder, walked to any
+* depth over the whole entry (`Value`, `Export.Name` and anything else it
+* declares).
+*
+* A deliberate SUPERSET: an `Fn::Sub` placeholder naming a template
+* PARAMETER, or a `Ref` to one, lands here too, since telling the two apart
+* needs the `Parameters` section and the answer only ever widens the set. The
+* one consumer intersects it with the ids that actually have a pending
+* RESOURCE change, so a name that is not a resource cannot match, and a
+* parameter deliberately named after a changed resource merely un-binds one
+* record — the direction that previews a row rather than hiding one. Pseudo
+* parameters (`AWS::…`) and the `${!Literal}` escape are dropped.
+*/
+function referencedLogicalIds(entry) {
+	const ids = /* @__PURE__ */ new Set();
+	const addName = (name) => {
+		const logicalId = name.split(".")[0];
+		if (logicalId !== void 0 && logicalId !== "" && !logicalId.startsWith("AWS::")) ids.add(logicalId);
+	};
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const obj = value;
+		if (typeof obj["Ref"] === "string") addName(obj["Ref"]);
+		const getAtt = obj["Fn::GetAtt"];
+		if (typeof getAtt === "string") addName(getAtt);
+		else if (Array.isArray(getAtt) && typeof getAtt[0] === "string") addName(getAtt[0]);
+		for (const [key, nested] of Object.entries(obj)) {
+			if (key === "Fn::Sub") {
+				walkSub(nested);
+				continue;
+			}
+			walk(nested);
+		}
+	};
+	/**
+	* `Fn::Sub` in both spellings. Handled here rather than by the generic walk
+	* because the two-argument form's second element is a VARIABLE MAP, not a
+	* template fragment: its KEYS are variable names, so letting the generic
+	* walk see `{ Ref: 'Unrelated' }` there would read a variable literally
+	* named `Ref` as a `Ref` intrinsic. The map's VALUES are walked, since the
+	* resolver resolves them.
+	*/
+	const walkSub = (sub) => {
+		const isPair = Array.isArray(sub);
+		const subTemplate = typeof sub === "string" ? sub : isPair ? sub[0] : void 0;
+		const variableMap = isPair && sub[1] !== null && typeof sub[1] === "object" ? sub[1] : void 0;
+		if (typeof subTemplate === "string") {
+			const declaredVars = new Set(variableMap === void 0 ? [] : Object.keys(variableMap));
+			for (const [, placeholder] of subTemplate.matchAll(/\$\{([^}]*)\}/g)) {
+				if (placeholder === void 0 || placeholder.startsWith("!")) continue;
+				if (declaredVars.has(placeholder)) continue;
+				addName(placeholder);
+			}
+		}
+		if (isPair) for (const [index, element] of sub.entries()) {
+			if (index === 1) {
+				if (variableMap !== void 0) for (const declared of Object.values(variableMap)) walk(declared);
+				continue;
+			}
+			walk(element);
+		}
+		else walk(sub);
+	};
+	walk(entry);
+	return ids;
+}
+/**
+* The keys of a `StackState.skippedOutputs` record that still BIND against
+* today's template: recorded digest equal to the digest of the same key over
+* `pristineTemplate`, which must be the pre-resolution snapshot the module doc
+* describes. A key the template no longer declares is skipped outright — the
+* record is inert for it, and the next deploy clears it. The diff passes the
+* result to `resolveTemplateOutputs`, which adds the one check only state can
+* answer — that the key is still absent from the stored bag.
+*
+* `changedLogicalIds` is the second half of the binding rule, and the one the
+* digest structurally cannot carry (see the module doc's `Resources` bullet):
+* the logical ids this run's resource diff reports as changing. An output
+* whose entry references one of them does NOT bind, because the deploy that
+* follows takes the changed-resources path, re-resolves every output, and may
+* publish the very key the record would have hidden. Omitted by a caller with
+* no resource diff in hand — every such caller today is a test asserting the
+* digest half alone.
+*/
+function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
+	const binding = /* @__PURE__ */ new Set();
+	if (record === null || record === void 0) return binding;
+	const declared = pristineTemplate.Outputs ?? {};
+	for (const [outputKey, digest] of Object.entries(record)) {
+		if (!Object.prototype.hasOwnProperty.call(declared, outputKey)) continue;
+		const entry = declared[outputKey];
+		if (digest !== skippedOutputDigest(pristineTemplate, outputKey)) continue;
+		if (changedLogicalIds !== void 0 && [...referencedLogicalIds(entry)].some((id) => changedLogicalIds.has(id))) continue;
+		binding.add(outputKey);
+	}
+	return binding;
+}
+/**
+* Whether two records — either possibly absent — describe the same skipped
+* set with the same digests. The no-change deploy path persists on a
+* difference here: it is the ONLY save trigger for this field on that path,
+* because a skipped output switches the outputs-changed trigger off.
+*/
+function skippedOutputsEqual(a, b) {
+	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
+	const bKeys = b === null || b === void 0 ? [] : Object.keys(b);
+	if (aKeys.length !== bKeys.length) return false;
+	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -35198,8 +35668,17 @@ var DeployEngine = class {
 	* secret collapse onto whichever expression was recorded last, exactly as two
 	* resource properties did before #1904. Captured in `resolveOutputs` at the
 	* same point `outputSecrets` is accumulated. Reset per `deploy()`.
+	*
+	* Null-prototype for the same reason as the outputs bag `resolveOutputs`
+	* builds two lines away: both are keyed by TEMPLATE-CONTROLLED output names,
+	* so an output called `__proto__` would replace this bag's prototype and a
+	* later lookup of a name it never stored would inherit from it. Only the
+	* RESET in `deploy()` is pinned — reverting this initialiser alone survives
+	* the suite, measured, because `deploy()` replaces the bag before anything
+	* writes to it, so the initialiser matches the reset rather than standing as
+	* a second guard.
 	*/
-	outputsTemplateSource = {};
+	outputsTemplateSource = Object.create(null);
 	/**
 	* The export aliases the last `resolveOutputs` pass WROTE into its bag
 	* (issue #2193) — exactly the keys `outputs[exportName] = value` landed on,
@@ -35212,6 +35691,18 @@ var DeployEngine = class {
 	*/
 	resolvedExportNames = [];
 	/**
+	* The outputs the last `resolveOutputs` pass could NOT resolve and SKIPPED
+	* (the resolver threw under the default arm of
+	* `handleOutputResolutionFailure`, or returned `undefined` outright — see
+	* `collectSkippedOutputs`), each mapped to the
+	* digest `cdkd diff` compares against (issue #2740, `StackState.
+	* skippedOutputs`). `undefined` when nothing was skipped, so the saves that
+	* persist the resolved bag spread it as-is and the field stays omitted. Same
+	* lifetime rule as `resolvedExportNames`: reset at the top of every
+	* `resolveOutputs`, meaningful only right after that call returns.
+	*/
+	skippedOutputs;
+	/**
 	* Whether {@link outputsTemplateSource} may be used to POSITION the outputs
 	* redaction. False once an outputs pass threw partway: the post-loop
 	* name pass never ran, so the bag holds only the alias keys written before
@@ -35298,8 +35789,9 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
-		this.outputsTemplateSource = {};
+		this.outputsTemplateSource = Object.create(null);
 		this.outputsSourceUsable = true;
+		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
@@ -35783,6 +36275,10 @@ var DeployEngine = class {
 			} catch {}
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
+			const outputsDigestSource = structuredClone({
+				...template,
+				Resources: {}
+			});
 			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets } });
 			this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 			const context = this.buildResolverContext({
@@ -35826,7 +36322,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions));
+					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
@@ -35835,7 +36331,8 @@ var DeployEngine = class {
 					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
 					const observedRefresh = this.observedCaptureTasks.size > 0;
 					if (observedRefresh) await this.drainObservedCaptures(currentState.resources);
-					if (observedRefresh || outputsChanged || exportSetChanged) try {
+					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
+					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged) try {
 						const refreshedState = {
 							version: 9,
 							region: this.stackRegion,
@@ -35843,6 +36340,7 @@ var DeployEngine = class {
 							resources: currentState.resources,
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
 							...resolutionFailed ? exportNamesCarriedFrom(currentState) : { exportNames: [...this.resolvedExportNames] },
+							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
 						};
@@ -35855,7 +36353,8 @@ var DeployEngine = class {
 							if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
 							else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
 							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(refreshedState));
-						} else this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
 						this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 					}
@@ -35897,7 +36396,7 @@ var DeployEngine = class {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
 			};
-			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending);
+			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending);
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
@@ -35939,7 +36438,7 @@ var DeployEngine = class {
 	* - DELETE follows reverse dependency order (a node starts as soon as all
 	*   resources that depend ON it have finished deleting)
 	*/
-	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
+	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
 		const concurrency = this.options.concurrency;
 		const newResources = { ...currentState.resources };
 		const actualCounts = {
@@ -35965,6 +36464,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -36097,6 +36597,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -36133,6 +36634,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -36150,6 +36652,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -36164,7 +36667,7 @@ var DeployEngine = class {
 		}
 		let outputs;
 		try {
-			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+			outputs = await this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions);
 			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
 			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -36181,6 +36684,7 @@ var DeployEngine = class {
 				resources: newResources,
 				outputs,
 				exportNames: [...this.resolvedExportNames],
+				...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 				...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 				...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
 				lastModified: Date.now()
@@ -36219,6 +36723,7 @@ var DeployEngine = class {
 			resources: newResources,
 			outputs: currentState.outputs,
 			...exportNamesCarriedFrom(currentState),
+			...skippedOutputsCarriedFrom(currentState),
 			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
@@ -37399,10 +37904,10 @@ var DeployEngine = class {
 	* rather than whatever the declaration order happened to have recorded by
 	* then (issue #1919).
 	*/
-	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
+	async resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 		this.resolvedExportNames = [];
 		if (!template.Outputs) return {};
-		const outputs = {};
+		const outputs = Object.create(null);
 		const context = this.buildResolverContext({
 			template,
 			resources,
@@ -37467,6 +37972,7 @@ var DeployEngine = class {
 			if (!publishedOutputNames.has(outputKey)) continue;
 			this.outputsTemplateSource[outputKey] = output.Value;
 		}
+		this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
 		return markSameGenerationBag(outputs);
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -37481,5 +37987,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { createMaskedRetryLogger as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, replayWarn as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketWebsiteUrl as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, normalizeAwsTagsToCfn as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, configBooleanRefusal as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, coerceCfnBoolean as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, producerRegionsFromState as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, findSilentDropProperties as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, DiffCalculator as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, s3BucketArn as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, s3BucketDomainName as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, requireConfigObject as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigString as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, configStringRefusal as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, classifyReplaySecretRegion as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketDualStackDomainName as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, WAFv2WebACLProvider as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, assertRegionMatch as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, INTRINSIC_KEYS as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, applyRoleArnIfSet as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, findActionableSilentDrops as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, coerceParameterTypedValue as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, isInterruptedWaitError as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, parameterTypeMayLoseSecretIdentity as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, deleteSkipReason as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, maskDeep as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, disableInstanceApiTermination as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, cfnRefValueFromPhysicalId as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, carriesDynamicReference as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, interruptWatchListenerCount as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, requireConfigArray as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, readConfigString as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, UNSPECIFIED_SKIP_REASON as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, IntrinsicFunctionResolver as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, beginCommandInterruptScope as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, startInterruptWatch as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, isTerminationProtectionPropagationError as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, endCommandInterruptScope as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, maskerOrIdentity as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, deleteIndeterminateGuards as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, getAccountInfo as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, resolveExplicitPhysicalId as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, refStateLookupFromResource as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, isUnboundTemplateParameter as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketRegionalDomainName as zt };
-//# sourceMappingURL=deploy-engine-Cxt3gn8N.js.map
+export { ProviderRegistry as $, redactDockerArgvValues as $n, ResourceUpdateNotSupportedError as $r, STATE_SOURCED_READBACK_RULES as $t, renderStatefulReason as A, createAssetRedirectResolver as An, AssemblyReader as Ar, configStringRefusal as At, red as B, readBootstrapMarkerBody as Bn, ConfigError as Br, s3BucketDualStackDomainName as Bt, refusesFinalSnapshot as C, importableOutputKeys as Cn, uploadCfnTemplate as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, stringifyValue as Dn, PARTITION_TABLE as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, AssetPublisher as En, expectedOwnerParam as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, assertAssetBucketRegion as Fn, getAwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, buildDockerImage as Gn, IntrinsicResolutionRefusalError as Gr, INTRINSIC_KEYS as Gt, collectDeclaredOutputNames as H, validateContainerRepoName as Hn, DependencyError as Hr, s3BucketWebsiteUrl as Ht, bold as I, ensureAssetStorage as In, resetAwsClients as Ir, classifyReplaySecretRegion as It, stateKeySecretExposure as J, describeDockerFailure as Jn, LockError as Jr, describeTypeWithThrottleRetry as Jt, secretBearingStateKeyWarning as K, describeDockerCapturedOutput as Kn, LocalInvokeBuildError as Kr, findActionableSilentDrops as Kt, cyan as L, getBootstrapMarkerKey as Ln, setAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, rewriteTemplateAssetReferences as Mn, clearBucketRegionCache as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, AssetModeResolver as Nn, resolveBucketRegion as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, WorkGraph as On, canonicalizeRegion as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, BOOTSTRAP_MARKER_PREFIX as Pn, AwsClients as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, partitionSensitiveEnv as Qn, ResourceTimeoutError as Qr, STATE_SOURCED_CROSS_GENERATION_RULES as Qt, gray as R, isCrossRegionRedirect as Rn, AssetError as Rr, s3BucketArn as Rt, isFinalSnapshotError as S, exportNamesCarriedFrom as Sn, findLargeInlineResources as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, shouldRetainResource as Tn, displaySafe as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, buildDenyExternalAccessPolicy as Un, DeployCancelledError as Ur, applyRoleArnIfSet as Ut, yellow as V, validateAssetBucketName as Vn, CrossAccountSecretRefusalError as Vr, s3BucketRegionalDomainName as Vt, exportAliasCollisionScrubWarning as W, describeAwsFailure as Wn, DynamicReferenceRegionAmbiguousError as Wr, DiffCalculator as Wt, IAMRoleProvider as X, formatDockerLoginError as Xn, PartialFailureError as Xr, DagBuilder as Xt, getCurrentResourceSecrets as Y, dockerSpawnEnvWithSensitive as Yn, NestedStackChildDirectDestroyError as Yr, withRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, getDockerCmd as Zn, ProvisioningError as Zr, TemplateParser as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildLockContentionMessage as _n, stateBucketExistenceConfirmed as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, isCdkdError as ai, isSingleDynamicReferenceToken as an, getDockerImageBySourceHash as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, CUSTOM_RESOURCE_RESPONSE_PREFIX as bn, CFN_TEMPLATE_URL_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, isMarkedNonRetryable as ci, recordMaskOnlyValue as cn, getDefaultStateBucketName as cr, startInterruptWatch as ct, updatePartialReason as d, isTransientServerError as di, scrubResourceRecord as dn, resolveAutoAssetStorage as dr, UNSPECIFIED_SKIP_REASON as dt, StackHasActiveImportsError as ei, TEMPLATE_SOURCED_RULES as en, runDockerForeground as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, markNonRetryable as fi, LockManager as fn, resolveCaptureObservedState as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, buildForceUnlockCommand as gn, resolveUseCdkBootstrapAssets as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, __exportAll as hi, UNRENDERABLE as hn, resolveStateBucketWithDefaultAndSource as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, formatError as ii, errorCauseChain as in, AssetManifestLoader as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, loadPublishableAssetManifest as jn, processStackMessages as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, buildAssetRedirectMap as kn, derivePartitionAndUrlSuffix as kr, configBooleanRefusal as kt, replayRollback as l, isRetryableTransientError as li, recoverMaskedOutput as ln, getLegacyStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, retryClassificationText as mi, rebuildClientForBucketRegion as mn, resolveStateBucketWithDefault as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StateError as ni, createSecretMasker as nn, escapeRegExp$1 as nr, maskDeep as nt, planFailedOps as o, normalizeAwsError as oi, maskSecretsInError as on, Synthesizer as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markRedactedCause as pi, S3StateBackend as pn, resolveSkipPrefix as pr, deleteSkipReason as pt, secretSafeKeyDisplay as q, describeDockerExecFailure as qn, LocalStartServiceError as qr, findSilentDropProperties as qt, DeployEngine as r, SynthesisError as ri, dynamicReferenceTokens as rn, stripControlChars as rr, maskerOrIdentity as rt, planRollback as s, withErrorHandling as si, maskSecretsInText as sn, synthesisStatusMessage as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackTerminationProtectionError as ti, carriesSecretMask as tn, runDockerStreaming as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isThrottlingError as ui, redactSecretsForState as un, resolveApp as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, forceQuitRecoveryClause as vn, warnDeprecatedNoPrefixCliFlag as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputs as wn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, DEFAULT_STATE_PREFIX as xn, MIGRATE_TMP_PREFIX as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, shellQuote as yn, CFN_TEMPLATE_BODY_LIMIT as yr, coerceParameterTypedValue as yt, green as z, parseBootstrapMarker as zn, CdkdError as zr, s3BucketDomainName as zt };
+//# sourceMappingURL=deploy-engine-CfxcC3q3.js.map