@go-to-k/cdkd 0.288.5 → 0.288.7

package/dist/index.d.ts

@@ -593,6 +593,7 @@ declare class CloudControlProvider implements ResourceProvider {
   private cloudControlClient;
   private logger;
   private patchGenerator;
+  private readonly warnedUnresolvableSchemaTypes;
   private readonly MAX_WAIT_TIME_MS;
   private readonly INITIAL_POLL_INTERVAL_MS;
   private readonly MAX_POLL_INTERVAL_MS;
@@ -617,6 +618,7 @@ declare class CloudControlProvider implements ResourceProvider {
   static isSupportedResourceType(resourceType: string): boolean;
   readCurrentState(physicalId: string, _logicalId: string, resourceType: string, _properties?: Record<string, unknown>): Promise<Record<string, unknown> | undefined>;
   import(input: ResourceImportInput): Promise<ResourceImportResult | null>;
+  private maskUncertifiedModelValues;
 }
 //#endregion
 //#region src/provisioning/provider-registry.d.ts
@@ -1160,6 +1162,7 @@ declare class DeployEngine {
   private rememberRecoverableMaskedOutputs;
   private redactOutputs;
   private registerNoEchoAttributes;
+  private static maskedRecordRemedyFor;
   private refuseRedactedAttributeReads;
   private redactOperationsForJournal;
   private redactStateForPersist;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAyEA,iBAAiB;EAgBjB;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAgGe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC9lBU,uBAAuB;KAwxLvB,gBAAgB;;;UC3zLX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC3tC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCx0BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cC4FE,gCAAgC;UACnC;UACA;UACA;mBAGS;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAiCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAiDL,OAAO,OAAO,sBAAsB,QAAQ;;;;KCvqFxC;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;cA8MW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAyKI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChlBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCHE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC3eZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UAgDN;;;;UCvwCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC3PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4KW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj2CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC3YA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCrbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAqUf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCljClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCjqBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAmQW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAOA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAuDnE;UAqHA;UA8DA;UAcA;UAiGA;UAqDA;UAwBA;UAyDA;UAkDA;UA2BA;UAkCM;UAkFA;UAsGN;UA0GM;UA4yBA;UAgnBA;UA6EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UA+UN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UAg8DN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UA8DA;UAiEM;UAuYN"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/types/state.ts","../src/deployment/secret-redaction.ts","../src/provisioning/region-check.ts","../src/types/resource.ts","../src/types/config.ts","../src/utils/logger.ts","../src/utils/error-handler.ts","../src/utils/aws-clients.ts","../src/utils/aws-region-resolver.ts","../src/types/assembly.ts","../src/synthesis/stack-messages.ts","../src/synthesis/assembly-reader.ts","../src/cli/upload-cfn-template.ts","../src/synthesis/macro-expander.ts","../src/synthesis/synthesizer.ts","../src/types/deployment-events.ts","../src/provisioning/cloud-control-provider.ts","../src/provisioning/provider-registry.ts","../src/provisioning/final-snapshot.ts","../src/deployment/rollback-executor.ts","../src/types/rollback-journal.ts","../src/state/s3-noncurrent-version-purge.ts","../src/state/s3-state-backend.ts","../src/assets/asset-redirect.ts","../src/deployment/work-graph.ts","../src/assets/asset-publisher.ts","../src/state/lock-manager.ts","../src/analyzer/template-parser.ts","../src/analyzer/dag-builder.ts","../src/analyzer/diff-calculator.ts","../src/provisioning/providers/iam-role-provider.ts","../src/state/export-index-store.ts","../src/deployment/deploy-engine.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;KAuGY;UAyBK;EAEf;EAMA;EAEA;;UAsBe;EAEf;EAMA;EAEA;;UAMe;EAKf,SAAS;EAGT;EAMA;EAGA,WAAW,eAAe;EAG1B,SAAS;EAUT,UAAU;EAoBV,cAAc;EAqBd;EAyEA,iBAAiB;EAgBjB;EAcA;EAYA;EAGA;;UAMe;EAEf;EAGA;EAGA,YAAY;EAcZ,qBAAqB;EAGrB,aAAa;EAGb;EAGA,WAAW;EAmBX;EAMA;EA0CA;;UAMe;EAEf;EAGA;EAGA;EAGA;;KAMU;UAKK;EAEf;EAGA,YAAY;EAGZ;EAGA,oBAAoB;EAGpB,oBAAoB;EAGpB,kBAAkB;EAWlB,mBAAmB;;UAUJ;EAEf;EACA;EACA;;UAgGe;EAEf;EAGA;EAGA;EAGA;EAYA;;;;KC9lBU,uBAAuB;KAuyLvB,gBAAgB;;;UC10LX;EASf;EAyCA;EAwBA;EA0BA;;;;UClHe;EACf;EACA;EACA,aAAa,eAAe;EAC5B,WAAW,eAAe;EAC1B,UAAU,eAAe;EACzB,aAAa;EACb,WAAW;EAWX;EACA,QAAQ;;UAMO;EACf;EACA;EACA;EACA;EACA;EACA;EAMA;;UAMe;EACf;EACA,aAAa;EACb;EACA;EACA,WAAW;EACX,iBAAiB;EACjB,eAAe;EACf;EACA;;UAMe;EACf;EACA;EAOA;EACA;IACE;;;UAgCa;EAKf,sBAAsB;;UA8CP;EAKf;EAWA;;UAMe,6BAA6B,2BAA2B;EAEvE;EAEA,aAAa;;UAOL,iCAAiC,2BAA2B;EAEpE;EAEA;EAEA,aAAa;;KAwCH;WAGG;WAMA;;WAOA;WAaA;;KAOH,uBAAuB,2BAA2B;UAuB7C;WAQN;WAQA;;KA0DC;WAGG;WAKA,+BAA+B;;WAY/B,+BAA+B;WAU/B;WAaA;;UAcE;EAEf;EAGA;EAGA;EAGA;EAGA,YAAY;EASZ;;UAUe;EAEf;EAEA,aAAa;;UAiEE;EA2Df,cAAc;;UA8CC,sBAAsB;EAmBrC;EAgCA;;UAkBe,sBAAsB;EA0DrC;;UAqCe;EAWf,WAAW;IAGP;IACA;IACA,YAAY;IACZ,aAAa;;;UAQF;EAWf,oBAAoB,oBAAoB;EAwBxC,oBAAoB,oBAAoB;EAUxC;EAkBA;EAkBA;EASA,8BACE,mBACA,sBACA,YAAY,0BACX;EAmBH,OACE,mBACA,sBACA,YAAY,yBACZ,UAAU,gBACT,QAAQ;EAgBX,OACE,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAqBX,OACE,mBACA,oBACA,sBACA,aAAa,yBACb,UAAU,gBACT,eAAe;EASlB,cAAc,oBAAoB,sBAAsB,wBAAwB;EAwChF,kBACE,oBACA,mBACA,sBACA,aAAa,yBACb,UAAU,0BACT,QAAQ;EAgCX,sBAAsB,sBAAsB,aAAa;EAiCzD,+BACE,sBACA,YAAY,0BACX;EAiDH,wBAAwB;EAuDxB,6BACE,sBACA,YAAY,0BACX;EA4BH,QAAQ,OAAO,sBAAsB,QAAQ;;;;UC3tC9B;EAEf;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;EAGA;;UAMe;EAEf;EAGA;EAGA,cAAc;EAGd;EAGA;EAGA;;UAMe;EAEf;EAGA;;KAMU;UAKK;EACf,MAAM,oBAAoB;EAC1B,KAAK,oBAAoB;EACzB,KAAK,oBAAoB;EACzB,MAAM,oBAAoB;;;;cCkEf,yBAAyB;UAC5B;UACA;EAER,YAAY,QAAO,UAAmB;UAK9B;UAOA;UA0EA;EAeR,MAAM,oBAAoB;EAM1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;EAS1B,SAAS,OAAO;EAIhB,YAAY;EASZ,MAAM,iBAAiB;;cAQnB,oBAAoB;mBACP;EAEjB,YAAY,gBAAgB;UAKpB;EAMC,MAAM,oBAAoB;EAK1B,KAAK,oBAAoB;EAMzB,KAAK,oBAAoB;EAMzB,MAAM,oBAAoB;;iBAerB,aAAa;iBAUb,UAAU,QAAQ;;;cC9VrB,kBAAkB;WACb;WACA,OAAO;EAEvB,YAAY,iBAAiB,cAAc,QAAQ;;cAYxC,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cAU1B,kBAAkB;EAC7B,YAAY,iBAAiB,QAAQ;;cAU1B,uBAAuB;EAClC,YAAY,iBAAiB,QAAQ;;cA6B1B,mBAAmB;EAC9B,YAAY,iBAAiB,QAAQ;;cA6B1B,0BAA0B;WACrB;WACA;WACA;EAEhB,YACE,iBACA,sBACA,mBACA,qBACA,QAAQ;;cAmPC,wBAAwB;EACnC,YAAY,iBAAiB,QAAQ;;cAU1B,oBAAoB;EAC/B,YAAY,iBAAiB,QAAQ;;iBAsYvB,YAAY,iBAAiB,SAAS;iBAOtC,YAAY;UAwEX;EACf;EACA;;iBA2Bc,kBAAkB,cAAc,UAAS,2BAAgC;;;UCx0BxE;EACf;EACA;EACA;IACE;IACA;IACA;;;cAoCS;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,SAAQ;cAsBR;MAwDR;MAyBA,oBAAoB,KAAK;EAkB7B,WAAW,iBAAiB;EAY5B,eAAe;EAmBf,yBAAyB;EAezB,gBAAgB;MAaZ,MAAM;MAON,gBAAgB;MAOhB,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,mBAAmB;MAYf,UAAU;EAOd,gBAAgB;MAYZ,OAAO;EAOX,gBAAgB;MAYZ,OAAO;EAOX,qBAAqB;MAYjB,YAAY;EAOhB,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,wBAAwB;MAYpB,eAAe;EAOnB,2BAA2B;MAYvB,kBAAkB;EAOtB,gBAAgB;MAYZ,OAAO;EAOX,uBAAuB;MAYnB,cAAc;EAWlB,gBAAgB;MAYZ,OAAO;EAaX,2BAA2B;MAYvB,kBAAkB;EAOtB,uBAAuB;MAYnB,cAAc;EAOlB,2BAA2B;MAYvB,kBAAkB;EAOtB,oCAAoC;MAYhC,2BAA2B;EAO/B,qBAAqB;MAYjB,YAAY;EAOhB,wBAAwB;MAYpB,eAAe;EAOnB;;iBAkCc,cAAc,SAAS,kBAAkB;iBAUzC,cAAc,SAAS;iBAOvB;;;UCrrBC;EACf;EACA;IACE;IACA;IACA;;EAEF;EAaA;;iBAgEoB,oBACpB,oBACA,OAAM,6BACL;iBA2Ea;;;UChLC;EAEf;EAGA,YAAY,eAAe;EAG3B,UAAU;EAGV,UAAU;;UAMK;EAEf,MAAM;EAGN;EAMA;EAGA,aAAa;EAGb;EAGA,WAAW,eAAe;EAQ1B;;KAMU;UA+CK;EAEf;EAGA;EAGA,OAAO;;UAMQ;EAEf;EAGA;EAGA;GAGC;;UAMc;EACf;EACA;EACA;;UAMe;EACf,YAAY;;;;KClHF;UAKK;EACf,OAAO;EAGP;EAEA;;;;UC5Be;EAEf;EAOA;EAGA;EAGA,UAAU;EAGV;EAGA;EAGA;EAGA;EAeA;EAiBA,kBAAkB;EAYlB,WAAW;;cAMA;UACH;EAKR,aAAa,sBAAsB;EAmBnC,aAAa,qBAAqB,UAAU,mBAAmB;EA8C/D,SAAS,qBAAqB,UAAU,kBAAkB,oBAAoB;EAgB9E,YACE,qBACA,UAAU,kBACV,oBACC;UAOK;UAuBA;EA4HR,UAAU,WAAW;;;;UCvSN;EACf;EACA;IACE;IACA;IACA;;;;;UCTa;EACf;EASA;EACA,YAAY;EACZ,eAAe;EASf;;;;UCVe;EAEf;EAGA;EAGA;EAGA;EAGA,UAAU;EAaV;EAQA,0BAA0B;EAe1B;;UAMe;EAEf,UAAU;EAGV;EAGA,QAAQ;;cAWG;UACH;UACA;UACA;UACA;EAYF,WAAW,SAAS,mBAAmB,QAAQ;EAyJ/C,WAAW,SAAS,mBAAmB;EA0BvC,sBACJ,QAAQ,aACR,SAAS,kBACT;IAAa;IAA4B;MACxC;;;;KC9SO;KAGA;KAcA;KAsEA;UAmBK;EAEf;EAEA;EAKA;EAEA;;UAQe;EAEf;EACA,WAAW;EAMX;EAEA,UAAU;EAEV;EAEA;EAEA,SAAS;EAET,YAAY;EAEZ;EAEA;EAoBA;EAEA;EAEA;EAEA;IACE;IACA;IACA;IACA;IAqBA;;EAUF;EAyBA;EAEA,QAAQ;;UAQO;EACf,OAAO,OAAO,KAAK;WAOV;;;;cC+FE,gCAAgC;UACnC;UACA;UACA;mBAMS;mBAGA;mBAEA;mBAEA;EAEjB;EAQM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;UAuHG;EAqER,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,yBACpB,UAAU,gBACT,QAAQ;EAsKL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UA2UJ;UAyHA;UA8LA;EA2CR,iBACJ,sBACA,qBACC,QAAQ;UA0BG;UAoHN;UA8BM;UAyCA;UAi0BA;UAiCN;UAsBM;UA+BN;UAwCA;SAUD,wBAAwB;EA6EzB,iBACJ,oBACA,oBACA,sBACA,cAAc,0BACb,QAAQ;EAwJL,OAAO,OAAO,sBAAsB,QAAQ;UAoIpC;;;;KCn6FJ;UAWK;EACf,UAAU;EACV,eAAe;EACf;IAAkB;;EAiBlB;;UAUe;EACf;EACA,aAAa;EACb,gBAAgB;EAehB,qBAAqB;EAYrB;;UAQe;EACf;EACA;EACA;;cA8MW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;EAER;EAYA,sBAAsB,eAAe;EAiBrC,2BAA2B,SAAS;EA2BpC,mCAAmC;EAQnC,gCAAgC;EAUhC,iBAAiB;EAWjB,SAAS,sBAAsB,UAAU;EAQzC,WAAW;EAeX,eAAe,OAAO,sBAAsB;UA2HpC;EAmCR,YAAY,uBAAuB;EAOnC,mBAAmB;EAOnB,YAAY;EAmBZ,2BAA2B;EAO3B;EASA,gBAAgB;EAuBhB,sBAAsB,eAAe;EA4DrC,2BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;EA2BJ,oCACE,WAAW;IACT;IACA;IACA,YAAY;;EAwChB,0BACE,WAAW;IACT;IACA;IACA,YAAY;IACZ;;UAyKI;EAkDR,kBACE,WAAW;IACT;IACA;IACA,YAAY;OAEb;;;;UChlBY;EACf,KAAK;EACL,UAAU;EACV,aAAa;;;;UCHE;EAEf;EAEA;EAEA;EAQA;EAEA,gBAAgB;EAEhB;EAEA,aAAa;EAyCb;;UAWe;EAEf;EAEA;EAEA;EAEA;EAEA,gBAAgB;EAEhB;EAOA,sBAAsB;;;;KC3eZ;UAkBK;EAMf;EAEA;EACA,QAAQ;EAMR;EAEA;EAEA;EAEA,YAAY;EAQZ,mBAAmB;;UAIJ;EACf;EACA;EACA;EACA,UAAU;;;;UCMK;EAOf;IAAkB;;EAQlB;EASA;IAAW,OAAO;IAAoB,SAAS;;EAqB/C;;;;UCnGe;EACf;EAEA;;UAwBe;EACf;EACA;EACA;IACE;IACA;IACA;;;UAOa;EAgBf;;cAkEW;UACH;UACA;UACA;UACA;UACA;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,aAAY;EAyBxE;MAII;UAOI;UAQA;UAWA;UAmBM;UAiDA;EAIR,mBAAmB,UAAS,4BAAiC;EA+C7D,YAAY,mBAAmB,iBAAiB;EA0BhD,SACJ,mBACA,iBACC;IAAU,OAAO;IAAY;IAAc;;EAsExC,UACJ,mBACA,gBACA,OAAO,YACP;IAAW;IAAuB;MACjC;EAyFG,YAAY,mBAAmB,iBAAiB;EA0GhD,kBAAkB,oBAAoB;EAiDtC,cAAc,QAAQ;EA2EtB,aAAa,aAAa,cAAc,uBAAmC;EAkB3E,aAAa,cAAc;EAwB3B,YAAY,oBAAoB;EAqChC,eACJ,oBACC,QAAQ;IAAQ;IAAa,cAAc;IAAM;;EAqD9C,iBAAiB,iBAAiB;EAiDlC,wBACJ,gBACA,UAAS,KAAK,6DACb;EAkCG,oBAAoB,mBAAmB,iBAAiB,QAAQ;EAYhE,6BACJ,mBACA,gBACA,SAAS,yBACR;EA2BG,mCACJ,mBACA,gBACA,WAAW,oBACV;EAiBG,0BAA0B,mBAAmB,iBAAiB;EAmD9D,sBAAsB,mBAAmB,iBAAiB;UAqClD;UA2BN;UAIM;UA4EA;UAwBA;UAQA;UAgDN;;;;UCvwCO;EAEf;EAEA;;UAYe;EAEf,SAAS;EAET,OAAO;EAEP,SAAS;EAET;EACA;EACA;;;;KC7DU;KAKA;UAKK;EACf;EACA,MAAM;EACN,cAAc;EACd,OAAO;EAEP;;UAMe;EACf;EACA;EACA;;cAoBW;UACH;UACA;EAER,QAAQ,MAAM;EAOR,QACJ,aAAa,sBACb,KAAK,MAAM,aAAa,gBACvB;EAqGH,WAAW,OAAO;;;;UCjHH;EAEf;EAGA;EAGA;EAGA;EAGA;EASA,WAAW;;cAUA;UACH;UACA;UACA;EAMR,iBACE,OAAO,WACP,sBACA;IACE;IACA;IACA;IACA;IACA,WAAW;;EA4FT,YAAY,MAAM,WAAW;EAwB7B,oBACJ,sBACA,UAAS,wBACR;EAwDH,UAAU;;;;UC3PK;EAEf;EASA;;cA2HW;UACH;UACA;UACA;mBACS;mBACA;mBACA;mBAEA;UACT;UACA;EAER,YAAY,UAAU,UAAU,QAAQ,oBAAoB,UAAU;UA2CxD;UAIA;UA4CN;UAUA;UAcA;UAeA;EAmBF,YACJ,mBACA,gBACA,gBACA,qBACC;UA4KW;EA2BR,YAAY,mBAAmB,6BAA6B,QAAQ;UAa5D;EAmFR,SAAS,mBAAmB,6BAA6B;EAkCzD,YAAY,mBAAmB,iBAAiB;UAuBxC;UAwJA;UA2BN;EAgBF,iBAAiB,mBAAmB,6BAA6B;UA2EzD;UA6FA;UAgDN;UAiDA;UASA;UAiBA;UAWM;UA4GA;UA6BN;UAgBA;UAkBA;UAiBA;EAiBF,qBACJ,mBACA,gBACA,gBACA,oBACA,qBACA,sBACC;;;;cCj2CQ;UACH;EAKR,eAAe,UAAU;EAOzB,YAAY,UAAU,wBAAwB,oBAAoB;EAmBlE,oBAAoB,UAAU,mBAAmB;EAwCjD,kBAAkB,iBAAiB;UAS3B;EA6JR,YAAY,UAAU,kBAAkB;EA8BxC,YAAY,UAAU,kBAAkB;EA8BxC,iBAAiB,oBAAoB,YAAY;EAwCjD,mBACE,UAAU,wBACV,uBACC,YAAY;EAef,eAAe,UAAU;EAoCzB,2BACE,UAAU,wBACV,YAAY,0BACX;;;;KC3YA,YAAY,SAAS;UAQT;EAMf;;cASW;UACH;UACA;UACA;EAER,YAAY,UAAS;EAWrB,WAAW,UAAU,yBAAyB;EA+G9C,mBAAmB,OAAO;UAmDlB;EA6CR,mBAAmB,OAAO,WAAW,oBAAoB;EAoBzD,iBAAiB,OAAO,WAAW,oBAAoB;EAoBvD,sBAAsB,OAAO,WAAW;EAOxC,oBAAoB,OAAO,WAAW;EAOtC,UAAU,OAAO,WAAW,mBAAmB;UAWvC;UA4DA;UAyBA;UASA;UAwBA;UAwBA;;;;KCrbE,sBAAsB,mBAAmB;KA8CzC,4BACV,sBACA,YAAY,4BACT;cAiCQ;UACH;UACA;UACA;EA6BF,cACJ,cAAc,YACd,iBAAiB,wBACjB,YAAY,oBACZ,yBAAyB,0BACzB,+BAA+B,sBAC9B,QAAQ,YAAY;UAqUf;UAoJA;iBAkGO;UAsED;UA2CN;UA4BM;0BAqFU;iBAOT;UA0CP;EA2ER,WAAW,SAAS,YAAY;IAC9B;IACA;IACA;IACA;IACA;;EAiCF,aAAa,SAAS,YAAY,iBAAiB,MAAM,aAAa;EAOtE,WAAW,SAAS,YAAY;EAOhC,sBAAsB,SAAS,YAAY,kBAAkB;;;;cCljClD,2BAA2B;UAC9B;UACA;EACR,mBAAiB,YAAA;EAiBjB;EASM,OACJ,mBACA,sBACA,YAAY,0BACX,QAAQ;EA6JL,OACJ,mBACA,oBACA,sBACA,YAAY,yBACZ,oBAAoB,0BACnB,QAAQ;EAsNL,OACJ,mBACA,oBACA,sBACA,cAAc,yBACd,UAAU,gBACT,eAAe;UAmDJ;UAiDA;UA6CA;UAmDA;UAsCA;UAuCA;EAuDR,aACJ,oBACA,uBACA,wBACC;EA0DG,iBACJ,oBACA,oBACA,uBACA,aAAa,yBACb,UADa,0BAEZ,QAAQ;EA0KL,OAAO,OAAO,sBAAsB,QAAQ;;;;UC11BnC;EAEf;EAEA;EAGA;;UAUe;EAEf;EAEA;EAEA;;cASW;UACH;UACA;UACA;UACA;UACA;UACA;UACA;UACA;UAcA;UAEA;UACA;EAER,YACE,UAAU,UACV,gBACA,gBACA,gBACA,cAAc,gBACd,OAAM;UAWA;UAiCM;UAIA;EAuCR,OAAO,qBAAqB,QAAQ;EAuBpC,eACJ,mBACA,wBACA,SAAS,0BACR;EAiDG,wBAAwB,QAAQ,oBAAoB;EA2BpD,WACJ,oBACA,OAAO,kBACP;IAWE;MAAiB;MAAuB;;MAEzC;EAYG,YAAY,mBAAmB,yBAAyB;UAUhD;EAgBR,WAAW;UAcH;UAmBA;UA8BA;UAwBA;UAkBA;UAyBA;UAqDA;UA0CN;UAsBM;UAgCA;UAkBA;UAqBA;UAkCN;UAMA;;;;UCnpBO;EAEf;EAEA;EAEA;EAEA,aAAa;EAEb;EAOA;EAWA;EASA;EAOA,0BAA0B;EAM1B,wBAAwB;EAaxB;EAaA,gBAAgB;EAgBhB;IACE;IACA;IACA;;EAqEF,mBAAmB;EA2BnB,wBAAwB,mBAAmB,OAAO,2BAA2B;EAgE7E;IAEE;IACA,YAAY;;EAEd;IAEE;IAEA,UAAU;IAEV,gBAAgB;;EAoBlB,gBAAgB;EAkBhB;EAyBA;EAWA;EAWA;EAaA;EAYA,uBAAuB;;UAkER;EAEf;EAEA;EAEA;EAEA;EAwBA;EAQA;EAEA;EAEA;EAMA,UAAU;EAcV;;cAmQW;UACH;UACA;UACA;UAOA;UAaA;UAEA;UACA;UACA;UACA;UACA;UACA;UACA;UAUA;UAMA;UAQA;UAiBA;UAuBA;UAWA;UAOA;UAkBA;UAcA;UAYA;UAQA;UASA;UAkCA;UAOA;EAER,YACE,cAAc,gBACd,aAAa,aACb,YAAY,YACZ,gBAAgB,gBAChB,kBAAkB,kBAClB,SAAS,iCACT,qBACA,mBAAmB;EA+Bf,OAAO,mBAAmB,UAAU,yBAAyB,QAAQ;UAuDnE;UAkJA;UA8DA;UAcA;UAiGA;iBA6GO;UAgMP;UAoFA;UAyDA;UAkDA;UA2BA;UAkCM;UAkFA;UAsGN;UA0GM;UA4yBA;UAgnBA;UA6EA;UA2BA;UA+BA;UAuCN;UA+BM;UA4CA;UA+UN;UAwBA;UAWA;UAkDA;UAmBA;UAwBA;UAyCM;UA0CA;UAyLA;UAw8DN;UA+CA;UA4DA;UA6FA;UA0IA;UAgCA;UAOA;UAoCA;UA4EA;UA4BM;UA6BN;UAiCA;UAmBA;UA8DA;UAiEM;UAsgBN"}

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as ProviderRegistry, Br as setAwsClients, Fr as clearBucketRegionCache, Gr as DependencyError, Gt as DiffCalculator, Hr as CdkdError, Ir as resolveBucketRegion, Lr as AwsClients, Nr as AssemblyReader, Qt as TemplateParser, Rr as getAwsClients, Ur as ConfigError, Vr as AssetError, X as IAMRoleProvider, Zr as LockError, Zt as DagBuilder, ai as StateError, ci as isCdkdError, ei as ProvisioningError, gn as S3StateBackend, hn as LockManager, kn as AssetPublisher, li as normalizeAwsError, lr as Synthesizer, lt as CloudControlProvider, oi as SynthesisError, r as DeployEngine, si as formatError, zr as resetAwsClients } from "./deploy-engine-Dsf9bTqH.js";
+import { $ as ProviderRegistry, Br as setAwsClients, Fr as clearBucketRegionCache, Gr as DependencyError, Gt as DiffCalculator, Hr as CdkdError, Ir as resolveBucketRegion, Lr as AwsClients, Nr as AssemblyReader, Qt as TemplateParser, Rr as getAwsClients, Ur as ConfigError, Vr as AssetError, X as IAMRoleProvider, Zr as LockError, Zt as DagBuilder, ai as StateError, ci as isCdkdError, ei as ProvisioningError, gn as S3StateBackend, hn as LockManager, kn as AssetPublisher, li as normalizeAwsError, lr as Synthesizer, lt as CloudControlProvider, oi as SynthesisError, r as DeployEngine, si as formatError, zr as resetAwsClients } from "./deploy-engine-BQUjVO_m.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CMhpftan.js → program-BEvh5nqs.js}

@@ -1,8 +1,8 @@
-import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-Dsf9bTqH.js";
+import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-BQUjVO_m.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BFmq8S23.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-C_AHAmgD.js";
+import { t as getCdkdVersion } from "./version-DPtrXz0m.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CRxRmEzr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -74362,7 +74362,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "cdkd state holds only the redaction mask ('***') for at least one property — a NoEcho custom-resource value cdkd cannot re-derive. Forcing the custom resource to update does NOT clear this: the handler supplies the value to the deploy, and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again; or export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274."
+				reason: "cdkd state holds only the redaction mask ('***') for at least one property, and cdkd cannot re-derive the value. There are two ways a record comes to hold it. (1) A NoEcho custom-resource value: forcing the custom resource to update does NOT clear this — the handler supplies the value to the deploy and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again. (2) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. Either way you can also export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274."
 			});
 			continue;
 		}
@@ -79592,6 +79592,13 @@ function resolveCdkPathToLogicalIds(input, index) {
 */
 var AttributeFetcher = class {
 	cache = /* @__PURE__ */ new Map();
+	/**
+	* Orphans whose masked-`Ref` `--force` warning has already been printed.
+	* Separate from {@link cache}, which memoizes VALUES keyed by
+	* `(orphan, attribute)`; a `Ref` has no attribute and produces no cacheable
+	* value, so sharing that map would need a sentinel key that means "warned".
+	*/
+	warnedMaskedRefs = /* @__PURE__ */ new Set();
 	logger = getLogger().child("OrphanRewriter");
 	orphans;
 	providerRegistry;
@@ -79607,11 +79614,69 @@ var AttributeFetcher = class {
 	* is NOT the raw physical id (compound `<parent>|<child>` CC ids, ARN-stored
 	* SDK ids like `AWS::Events::Rule`) substitute the same value CloudFormation
 	* would have resolved.
+	*
+	* IT CAN FAIL, and the one failure is a REDACTED recovery key (issue
+	* [#2847](https://github.com/go-to-k/cdkd/issues/2847), security review of
+	* the fix round). For a handful of types CFn's `Ref` is a value stored in
+	* `properties` / `attributes` rather than the physical id, and `cdkd import`
+	* now masks any such key it cannot certify is a read-only attribute. The
+	* lookup refuses to serve a mask, so the fall-through emits the RAW PHYSICAL
+	* ID — for a Cloud-Control-routed `AWS::S3Tables::Table` a bare `TableARN`
+	* ending in a UUID, not the table name — and that value would be spliced into
+	* a sibling's persisted properties where NOTHING recognises it.
+	*
+	* That last clause is why this returns a result rather than a string. Before
+	* the lookup learned to refuse a mask it returned the literal `'***'`, which
+	* four unchanged readers DO recognise (`refuseMaskedReplayBaseline`, the
+	* `cdkd export` blocker, drift's mask handling, the deploy-time refusal) — so
+	* silently taking the fall-through here would have traded a guarded sentinel
+	* for an unguarded wrong value, which is a worse outcome than the one the
+	* refusal exists to prevent.
+	*
+	* ## The `--force` arm SUBSTITUTES THE MASK, not the physical id
+	*
+	* `--force`'s contract is "use a possibly-wrong value rather than stranding
+	* me", so this arm still produces a value — but WHICH value is the whole
+	* finding of the issue #2847 round-2 security review, and an earlier
+	* revision of this method got it backwards by handing back the physical id.
+	* That is the unguarded-wrong-value outcome the paragraph above calls worse
+	* than the bug, reached through the one arm that skips the refusal:
+	* `cdkd orphan --force` over a CC-imported `AWS::S3Tables::Table` whose
+	* `TableName` is masked wrote `arn:aws:s3tables:…/<uuid>` into a sibling's
+	* persisted property, every later deploy shipped that ARN where a table name
+	* belongs, and export / rollback / drift / deploy all passed it.
+	*
+	* {@link SECRET_MASK} keeps the `--force` escape hatch open — the rewrite
+	* completes and the orphan leaves state — while leaving a value those four
+	* readers still catch, so the damage stays inside cdkd instead of reaching
+	* AWS. That is also what {@link cacheFallback}, this method's stated mirror,
+	* already does with a masked cached attribute; the two arms now agree.
 	*/
 	ref(orphanLogicalId) {
 		const o = this.orphans[orphanLogicalId];
 		if (!o) throw new Error(`Internal: Ref to '${orphanLogicalId}' has no orphan entry — should have been filtered out`);
-		return cfnRefValueFromPhysicalId(o.resourceType, o.physicalId, refStateLookupFromResource(o));
+		let maskedKey;
+		const value = cfnRefValueFromPhysicalId(o.resourceType, o.physicalId, refStateLookupFromResource(o, (key) => {
+			maskedKey = key;
+		}));
+		if (maskedKey === void 0) return {
+			ok: true,
+			value
+		};
+		const safeType = displaySafe(o.resourceType, { asciiOnly: true });
+		const reason = `state records the redaction mask ('${"***"}') for '${maskedKey}', the key CloudFormation's Ref returns for ${safeType} — cdkd cannot recover it, and the physical id is NOT that value`;
+		if (!this.options.force) return {
+			ok: false,
+			reason
+		};
+		if (!this.warnedMaskedRefs.has(orphanLogicalId)) {
+			this.warnedMaskedRefs.add(orphanLogicalId);
+			this.logger.warn(`--force: '${orphanLogicalId}': ${reason}. Substituting '${"***"}' rather than the physical id, which would be a wrong value no later cdkd command recognises. The referring resource's state row now records a value the live resource does not have: the next 'cdkd diff' / 'cdkd deploy' reports a spurious change there (a REPLACEMENT if the property is create-only), 'cdkd rollback' refuses the record as a replay baseline, and 'cdkd export' blocks it. Re-import the record that holds the mask, or fix the referring property by hand.`);
+		}
+		return {
+			ok: true,
+			value: "***"
+		};
 	}
 	/**
 	* Return the orphan's resolved value for `Fn::GetAtt`. Hits the live
@@ -79678,6 +79743,7 @@ var AttributeFetcher = class {
 		}
 		this.logger.warn(`--force: live fetch failed for '${orphanLogicalId}.${attribute}' (${reason}); falling back to cached value from state.attributes.`);
 		if (carriesDynamicReference(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is an UNRESOLVED dynamic reference (a nested stack's redacted output, issue #2055). It is being written into the referring resource's state VERBATIM — cdkd cannot re-resolve it from here. Re-run without --force once the live attribute is readable, or fix the referring property by hand.`);
+		if (carriesSecretMask(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is the REDACTION MASK ('${"***"}'), not the attribute's value — cdkd redacted it into state and cannot recover it. It is being written into the referring resource's state VERBATIM, so that row now records a value the live resource does not have: the next 'cdkd diff' / 'cdkd deploy' reports a spurious change there (a REPLACEMENT if the property is create-only), 'cdkd rollback' refuses the record as a replay baseline, and 'cdkd export' blocks it. Re-run without --force once the live attribute is readable, re-import the record that holds the mask, or fix the referring property by hand.`);
 		const cacheKey = `${orphanLogicalId}\0${attribute}`;
 		this.cache.set(cacheKey, cached);
 		return {
@@ -79786,16 +79852,26 @@ async function rewriteValue(value, pathPrefix, ownerLogicalId, orphanSet, fetche
 	if ("Ref" in obj && Object.keys(obj).length === 1 && typeof obj["Ref"] === "string") {
 		const target = obj["Ref"];
 		if (orphanSet.has(target)) {
-			const replaced = fetcher.ref(target);
+			const result = fetcher.ref(target);
+			if (!result.ok) {
+				unresolvable.push({
+					logicalId: ownerLogicalId,
+					path: pathPrefix,
+					orphanLogicalId: target,
+					attribute: "Ref",
+					reason: result.reason
+				});
+				return value;
+			}
 			rewrites.push({
 				logicalId: ownerLogicalId,
 				path: pathPrefix,
 				kind: "ref",
 				before: { Ref: target },
-				after: replaced,
+				after: result.value,
 				orphanLogicalId: target
 			});
-			return replaced;
+			return result.value;
 		}
 		return value;
 	}
@@ -79892,17 +79968,29 @@ async function rewriteSubTemplate(template, ownerLogicalId, pathPrefix, orphanSe
 		const dot = inner.indexOf(".");
 		if (dot < 0) {
 			if (orphanSet.has(inner)) {
-				const replaced = fetcher.ref(inner);
-				rewrites.push({
-					logicalId: ownerLogicalId,
-					path: pathPrefix,
-					kind: "sub",
-					before: m[0],
-					after: replaced,
-					orphanLogicalId: inner
-				});
-				out += replaced;
-				didChange = true;
+				const result = fetcher.ref(inner);
+				if (!result.ok) {
+					unresolvable.push({
+						logicalId: ownerLogicalId,
+						path: pathPrefix,
+						orphanLogicalId: inner,
+						attribute: "Ref",
+						reason: result.reason
+					});
+					out += m[0];
+					hasUnresolvable = true;
+				} else {
+					rewrites.push({
+						logicalId: ownerLogicalId,
+						path: pathPrefix,
+						kind: "sub",
+						before: m[0],
+						after: result.value,
+						orphanLogicalId: inner
+					});
+					out += result.value;
+					didChange = true;
+				}
 			} else out += m[0];
 		} else {
 			const target = inner.slice(0, dot);
@@ -81148,7 +81236,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Two arms:
+* decision a review round paid for. Three arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -81176,6 +81264,19 @@ function defaultOnlyParameterTemplate(template) {
 *    remedy -- because a populated map makes absence from it real evidence of
 *    a public parameter, exactly as the deploy path already relies on.
 *
+*  - **Resolution SUCCEEDED but DISCARDED a subtree that is not provably
+*    inert** (issue [#2850](https://github.com/go-to-k/cdkd/issues/2850)).
+*    The count in arm 2 sees only what the raw bag SPELLS, and that issue
+*    measured two ways past it: a downgraded `Fn::If` dropping one reference
+*    while a parameter-sourced reference is ADDED elsewhere (the totals
+*    balance), and a reference sourced ENTIRELY from a parameter `Default` or
+*    a `Mappings` entry then dropped (both counts read zero, and nothing
+*    warns). {@link resolveDiscardsNonInertSubtree} carries the discard-event
+*    enumeration and the fail-closed rules; "inert" is
+*    {@link isInertDiscardedSubtree}'s definition — pure literals with no
+*    opener text and no intrinsic anywhere, because every way a discarded
+*    subtree could have SOURCED a reference is an intrinsic.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -81189,17 +81290,22 @@ function defaultOnlyParameterTemplate(template) {
 * PLAINTEXT CAN STILL BE PERSISTED by this capture. Known ways, each with its
 * issue and none of them proven to be all of them:
 *
-*  - the resolve drops a reference, or trades one away, in a manner the opener
-*    comparison below cannot see --
-*    [#2850](https://github.com/go-to-k/cdkd/issues/2850);
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
 *    the reference, so no opener exists in any template this walk is handed --
 *    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
-*  - `redactSecretsForState` cannot PAIR the readback against the source and
-*    returns the bag unchanged: a reshaped container, an identity key AWS
-*    normalised, a readback key the source lacks, an array whose anchors do not
-*    corroborate -- [#2852](https://github.com/go-to-k/cdkd/issues/2852), which
-*    carries the measured probe table;
+*  - `redactSecretsForState` cannot PAIR the readback against the source at a
+*    position the source carries NO leaf for -- an observed KEY beside a paired
+*    one -- so there is nothing to refuse from and the value scan has no needle
+*    naming it. The row `refuseUncertifiedReadbackPositions`' own table marks
+*    deliberately open, with the cost argument for leaving it that way;
+*    [#2868](https://github.com/go-to-k/cdkd/issues/2868) owns it.
+*    The OTHER pairing failures this bullet used to list -- a reshaped
+*    container, an identity key AWS normalised, an array whose anchors do not
+*    corroborate -- no longer persist the plaintext: since
+*    [#2885](https://github.com/go-to-k/cdkd/issues/2885) this capture declares
+*    its bag a drift baseline, so an uncertified position is masked. They are
+*    rows of `tests/unit/cli/import-observed-baseline-refusal-matrix.test.ts`
+*    rather than entries here;
 *  - the readback holds a secret with NO counterpart in the source at all, set
 *    out of band -- [#2868](https://github.com/go-to-k/cdkd/issues/2868), filed
 *    as a remit question rather than a defect in this mechanism.
@@ -81268,13 +81374,21 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
 		}
+		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
 		if (threw) {
 			unsafeObservedBaselineLogicalIds.add(logicalId);
 			continue;
 		}
 		const rawOpeners = countDynamicReferenceOpeners(unresolvedProperties);
 		const persistedOpeners = countDynamicReferenceOpeners(resource.properties);
-		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners) unsafeObservedBaselineLogicalIds.add(logicalId);
+		let discardsNonInertSubtree;
+		try {
+			discardsNonInertSubtree = resolveDiscardsNonInertSubtree(unresolvedProperties, conditions, template.Mappings);
+		} catch (err) {
+			logger.debug(`observed-baseline discard walk failed for imported ${logicalId} (${resource.resourceType}): ${err instanceof Error ? err.name : typeof err} — refusing the baseline fail-closed.`);
+			discardsNonInertSubtree = true;
+		}
+		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
 	return unsafeObservedBaselineLogicalIds;
 }
@@ -81308,6 +81422,199 @@ function countDynamicReferenceOpeners(bag) {
 		from = at + 10;
 	}
 }
+/**
+* Whether an object key can make the resolver treat its object as an
+* INTRINSIC. Deliberately BROADER than the resolver's own dispatch list
+* (`resolveValue` names specific keys; this matches any `Fn::`-prefixed one):
+* the callers below use it to decide what a DISCARDED subtree could have
+* been, and over-matching there only widens a refusal, never a pass.
+*/
+function isIntrinsicShapedKey(key) {
+	return key === "Ref" || key.startsWith("Fn::");
+}
+/**
+* Whether a subtree the resolve DISCARDED is provably INERT: pure JSON
+* literals, carrying no `{{resolve:` opener text in any string leaf and no
+* intrinsic-shaped object key anywhere.
+*
+* This is the capability question of issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850) asked in the
+* fail-closed direction. Asking "could this subtree have carried or SOURCED a
+* dynamic reference" precisely would need enumerating every source a reference
+* can arrive from — a parameter `Default` via `Ref` or `Fn::Sub`, a `Mappings`
+* entry via `Fn::FindInMap`, another stack's outputs via `Fn::ImportValue` /
+* `Fn::GetStackOutput` — and the enumeration missing one form is exactly how
+* the opener COUNT missed the first two. Every one of those source forms is an
+* intrinsic, so "no intrinsic at all" covers them all without naming any, and
+* a plain-literal subtree is one whose value at deploy time was the same
+* public template text this walk can read.
+*/
+function isInertDiscardedSubtree(node) {
+	if (typeof node === "string") return !node.includes(DYNAMIC_REFERENCE_OPENER);
+	if (node === null || typeof node !== "object") return true;
+	if (Array.isArray(node)) return node.every((element) => isInertDiscardedSubtree(element));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Ref" && record["Ref"] === "AWS::NoValue") return true;
+	return Object.entries(record).every(([key, value]) => !isIntrinsicShapedKey(key) && isInertDiscardedSubtree(value));
+}
+/**
+* Whether a scalar the resolver consumes RAW (an `Fn::Select` index) is a
+* template-constant literal that `resolveSelect`'s `resolvedList[index]` read
+* actually honors: a number, or the CANONICAL digit-string of one. The
+* canonical form is load-bearing, not pedantry — a delta review round
+* measured `['a','b']['01']` as `undefined` (a non-canonical string is a
+* property name, not an index) while CloudFormation integer-parses it to 1,
+* so `'01'` is exactly as selection-divergent as an intrinsic index and must
+* not count as static. Anything non-static makes the selection depend on a
+* value this import cannot reproduce.
+*/
+function isStaticSelectIndex(value) {
+	if (typeof value === "number") return Number.isInteger(value) && value >= 0;
+	return typeof value === "string" && /^(0|[1-9]\d*)$/.test(value);
+}
+/**
+* A `Fn::FindInMap` lookup-key argument the resolver can only have resolved
+* to the same key at deploy time: a plain scalar literal CARRYING NO
+* `{{resolve:` opener. The opener clause is the same delta-review finding one
+* helper up: `resolveFindInMap` resolves each key through `resolveValue`, so
+* a dynamic-reference STRING key is decrypted before the lookup and the
+* selected entry depends on the secret's deploy-time value — not on the
+* template text this walk reads.
+*/
+function isStaticLookupKey(value) {
+	if (typeof value === "string") return !value.includes(DYNAMIC_REFERENCE_OPENER);
+	return typeof value === "number" || typeof value === "boolean";
+}
+/**
+* ARM 3 of the observed-baseline refusal (issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850)): did the resolve
+* DISCARD a subtree it cannot vouch is inert?
+*
+* The opener-count comparison (ARM 2) sees only what the raw bag SPELLS, and
+* the issue measured two ways past it on the success arm: a downgraded
+* `Fn::If` that drops one reference while a parameter-sourced reference is
+* added elsewhere (the totals balance), and a reference sourced ENTIRELY from
+* outside the bag then dropped (both counts read zero, nothing throws, no
+* warn fires). Both are DISCARD events: the resolver threw a subtree away
+* unresolved, and whatever that subtree would have produced — which is what
+* AWS actually holds when the deployed condition took the other branch — is
+* exactly what the persisted bag cannot position a redaction for.
+*
+* So this walk detects the discard EVENTS on the RAW bag instead of comparing
+* positions across the resolve (which would need a path identity across the
+* `Fn::If` collapse that does not exist). The discarders, enumerated from
+* `IntrinsicFunctionResolver` rather than assumed — and re-enumerated by this
+* PR's review round, which found the first cut had missed TWO (`Fn::FindInMap`
+* and `Fn::Select` below; an earlier revision called `resolveIf` "the only
+* LAZY selector" and the resolver's own source refutes it):
+*
+*  - `resolveIf` — a LAZY selector: it resolves the selected branch
+*    only, so the unselected branch is discarded UNRESOLVED. A missing
+*    condition warns and selects the FALSE branch (no throw), so the success
+*    arm reaches it. Dispatch is `'Fn::If' in obj`, not single-key.
+*  - `resolveFindInMap` — the OTHER lazy site: the 4-argument form's
+*    `DefaultValue` is resolved only on a lookup MISS, so a HIT discards it
+*    unresolved; and a non-literal lookup KEY makes the un-taken mapping
+*    entries discarded template content. The walk's own arm comment carries
+*    both modes.
+*  - `resolveSelect` — eager on the LIST but the INDEX is consumed RAW, never
+*    resolved: an intrinsic index selects `undefined` here while
+*    CloudFormation resolved it at deploy, so the whole list is potentially
+*    discarded content. (With a NUMERIC-LITERAL index the selection is
+*    template-constant and the un-selected elements were discarded at deploy
+*    too — that case discards nothing AWS could hold.)
+*  - Dispatch order itself — `resolveValue` dispatches on the first matching
+*    intrinsic key, so an object holding an intrinsic key AMONG OTHER KEYS
+*    resolves as that intrinsic and silently DROPS the sibling keys'
+*    subtrees.
+*  - NOT `Fn::Sub`: its variable map is resolved eagerly, every entry.
+*  - NOT `Fn::Join`'s delimiter: it is consumed raw too, but CloudFormation
+*    itself admits no intrinsic there, and an intrinsic delimiter joins as
+*    `[object Object]` — a mangled value, not a discarded reference.
+*
+* Fail-closed rules, in the order tested (an earlier revision of this list
+* omitted the two arms the review round added while still claiming to BE the
+* tested order — a list that claims an order and is not the order is worse
+* than no list, so keep it complete or delete the claim):
+*
+*  - an ARRAY recurses element-wise, so a discarder inside a list property
+*    (`SecurityGroupIds: [{Fn::If: ...}]`) is found;
+*  - single-key `Fn::If` with well-formed args and a condition the evaluated
+*    map carries (`Object.hasOwn`, the same test `resolveIf` uses since issue
+*    #2767): the UNSELECTED branch must be inert, and the SELECTED branch is
+*    recursed into;
+*  - single-key `Fn::If` whose condition the map does NOT carry: BOTH
+*    branches must be inert. The resolver warns and takes the false branch,
+*    so this is a SUPERSET of mirroring it — mirroring the lookup exactly is
+*    the two-spellings-of-one-question drift this repo keeps paying for, and
+*    the superset can only over-refuse, never leak;
+*  - single-key `Fn::If` with MALFORMED args: refuse;
+*  - single-key `Fn::FindInMap`: MALFORMED (< 3 args) refuses; a 4th
+*    argument must be inert AS A WHOLE (its `DefaultValue` is resolved only
+*    on a lookup miss, and any sibling key there — or a whole 4th arg with
+*    no `DefaultValue` key — is discarded unconditionally); a non-literal
+*    lookup key refuses unless the map in scope is inert (the NAMED map for
+*    a literal map name, the whole `Mappings` section otherwise); then the
+*    args recurse;
+*  - single-key `Fn::Select`: MALFORMED (not exactly 2 args) refuses; a
+*    non-static index refuses unless the list argument is inert; then the
+*    args recurse;
+*  - a MULTI-KEY object carrying intrinsic-shaped keys: TWO or more such
+*    keys refuse outright (dispatch drops the losers as whole INTRINSICS,
+*    whose values' text is not evidence of what they pull); with exactly
+*    one, every value must be inert — which sibling the dispatch order
+*    drops is deliberately not mirrored here;
+*  - everything else recurses, so a nested `Fn::If` inside an `Fn::Join` /
+*    `Fn::Sub` argument is still found.
+*
+* Additive beside ARM 1 (throw) and ARM 2 (count loss): refusal strictly
+* widens, so no previously-refused shape can start leaking, and the risk
+* direction is over-refusal alone. The negative controls live in the matrix:
+* an `Fn::If` discarding pure literals stays ADMITTED, and so does a
+* multi-key intrinsic object whose sibling values are literals.
+*
+* THE CALLER WRAPS EVERY CALL IN A FAIL-CLOSED try (see the ARM 3 note at
+* the call site): this walk recurses synchronously and a deep-enough bag
+* overflows the call stack where the JSON.stringify arms still compute.
+*/
+function resolveDiscardsNonInertSubtree(node, conditions, mappings) {
+	if (node === null || typeof node !== "object") return false;
+	if (Array.isArray(node)) return node.some((element) => resolveDiscardsNonInertSubtree(element, conditions, mappings));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Fn::If") {
+		const args = record["Fn::If"];
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const [conditionName, valueIfTrue, valueIfFalse] = args;
+		if (!Object.hasOwn(conditions, conditionName)) return !isInertDiscardedSubtree(valueIfTrue) || !isInertDiscardedSubtree(valueIfFalse);
+		const selected = conditions[conditionName] ? valueIfTrue : valueIfFalse;
+		if (!isInertDiscardedSubtree(conditions[conditionName] ? valueIfFalse : valueIfTrue)) return true;
+		return resolveDiscardsNonInertSubtree(selected, conditions, mappings);
+	}
+	if (keys.length === 1 && keys[0] === "Fn::FindInMap") {
+		const args = record["Fn::FindInMap"];
+		if (!Array.isArray(args) || args.length < 3 || args.length > 4) return true;
+		if (args.length > 3) {
+			if (!isInertDiscardedSubtree(args[3])) return true;
+		}
+		if (!args.slice(0, 3).every((key) => isStaticLookupKey(key))) {
+			if (!isInertDiscardedSubtree(typeof args[0] === "string" && mappings !== null && typeof mappings === "object" && Object.hasOwn(mappings, args[0]) ? mappings[args[0]] : mappings)) return true;
+		}
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length === 1 && keys[0] === "Fn::Select") {
+		const args = record["Fn::Select"];
+		if (!Array.isArray(args) || args.length !== 2) return true;
+		if (!(isStaticSelectIndex(args[0]) && (!Array.isArray(args[1]) || Number(args[0]) < args[1].length)) && !isInertDiscardedSubtree(args[1])) return true;
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length > 1 && keys.some((key) => isIntrinsicShapedKey(key))) {
+		if (keys.filter((key) => isIntrinsicShapedKey(key)).length > 1) return true;
+		return !keys.every((key) => isInertDiscardedSubtree(record[key]));
+	}
+	return keys.some((key) => resolveDiscardsNonInertSubtree(record[key], conditions, mappings));
+}
 function printSummary(rows) {
 	const logger = getLogger();
 	const counts = {
@@ -81449,7 +81756,7 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
-			if (observed !== void 0) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+			if (observed !== void 0) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
@@ -90852,4 +91159,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CMhpftan.js.map
+//# sourceMappingURL=program-BEvh5nqs.js.map