@go-to-k/cdkd 0.288.6 → 0.288.7

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as ProviderRegistry, Br as setAwsClients, Fr as clearBucketRegionCache, Gr as DependencyError, Gt as DiffCalculator, Hr as CdkdError, Ir as resolveBucketRegion, Lr as AwsClients, Nr as AssemblyReader, Qt as TemplateParser, Rr as getAwsClients, Ur as ConfigError, Vr as AssetError, X as IAMRoleProvider, Zr as LockError, Zt as DagBuilder, ai as StateError, ci as isCdkdError, ei as ProvisioningError, gn as S3StateBackend, hn as LockManager, kn as AssetPublisher, li as normalizeAwsError, lr as Synthesizer, lt as CloudControlProvider, oi as SynthesisError, r as DeployEngine, si as formatError, zr as resetAwsClients } from "./deploy-engine-umIP3xus.js";
+import { $ as ProviderRegistry, Br as setAwsClients, Fr as clearBucketRegionCache, Gr as DependencyError, Gt as DiffCalculator, Hr as CdkdError, Ir as resolveBucketRegion, Lr as AwsClients, Nr as AssemblyReader, Qt as TemplateParser, Rr as getAwsClients, Ur as ConfigError, Vr as AssetError, X as IAMRoleProvider, Zr as LockError, Zt as DagBuilder, ai as StateError, ci as isCdkdError, ei as ProvisioningError, gn as S3StateBackend, hn as LockManager, kn as AssetPublisher, li as normalizeAwsError, lr as Synthesizer, lt as CloudControlProvider, oi as SynthesisError, r as DeployEngine, si as formatError, zr as resetAwsClients } from "./deploy-engine-BQUjVO_m.js";
 import { a as setLogger, n as getLogger, t as ConsoleLogger } from "./logger-Dw-3y48G.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-CxMjCbiG.js → program-BEvh5nqs.js}

@@ -1,8 +1,8 @@
-import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-umIP3xus.js";
+import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-BQUjVO_m.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-4xTzOaA1.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CC6BMuNK.js";
+import { t as getCdkdVersion } from "./version-DPtrXz0m.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CRxRmEzr.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -81236,7 +81236,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Two arms:
+* decision a review round paid for. Three arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -81264,6 +81264,19 @@ function defaultOnlyParameterTemplate(template) {
 *    remedy -- because a populated map makes absence from it real evidence of
 *    a public parameter, exactly as the deploy path already relies on.
 *
+*  - **Resolution SUCCEEDED but DISCARDED a subtree that is not provably
+*    inert** (issue [#2850](https://github.com/go-to-k/cdkd/issues/2850)).
+*    The count in arm 2 sees only what the raw bag SPELLS, and that issue
+*    measured two ways past it: a downgraded `Fn::If` dropping one reference
+*    while a parameter-sourced reference is ADDED elsewhere (the totals
+*    balance), and a reference sourced ENTIRELY from a parameter `Default` or
+*    a `Mappings` entry then dropped (both counts read zero, and nothing
+*    warns). {@link resolveDiscardsNonInertSubtree} carries the discard-event
+*    enumeration and the fail-closed rules; "inert" is
+*    {@link isInertDiscardedSubtree}'s definition — pure literals with no
+*    opener text and no intrinsic anywhere, because every way a discarded
+*    subtree could have SOURCED a reference is an intrinsic.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -81277,9 +81290,6 @@ function defaultOnlyParameterTemplate(template) {
 * PLAINTEXT CAN STILL BE PERSISTED by this capture. Known ways, each with its
 * issue and none of them proven to be all of them:
 *
-*  - the resolve drops a reference, or trades one away, in a manner the opener
-*    comparison below cannot see --
-*    [#2850](https://github.com/go-to-k/cdkd/issues/2850);
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
 *    the reference, so no opener exists in any template this walk is handed --
 *    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
@@ -81371,7 +81381,14 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		const rawOpeners = countDynamicReferenceOpeners(unresolvedProperties);
 		const persistedOpeners = countDynamicReferenceOpeners(resource.properties);
-		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners) unsafeObservedBaselineLogicalIds.add(logicalId);
+		let discardsNonInertSubtree;
+		try {
+			discardsNonInertSubtree = resolveDiscardsNonInertSubtree(unresolvedProperties, conditions, template.Mappings);
+		} catch (err) {
+			logger.debug(`observed-baseline discard walk failed for imported ${logicalId} (${resource.resourceType}): ${err instanceof Error ? err.name : typeof err} — refusing the baseline fail-closed.`);
+			discardsNonInertSubtree = true;
+		}
+		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
 	return unsafeObservedBaselineLogicalIds;
 }
@@ -81405,6 +81422,199 @@ function countDynamicReferenceOpeners(bag) {
 		from = at + 10;
 	}
 }
+/**
+* Whether an object key can make the resolver treat its object as an
+* INTRINSIC. Deliberately BROADER than the resolver's own dispatch list
+* (`resolveValue` names specific keys; this matches any `Fn::`-prefixed one):
+* the callers below use it to decide what a DISCARDED subtree could have
+* been, and over-matching there only widens a refusal, never a pass.
+*/
+function isIntrinsicShapedKey(key) {
+	return key === "Ref" || key.startsWith("Fn::");
+}
+/**
+* Whether a subtree the resolve DISCARDED is provably INERT: pure JSON
+* literals, carrying no `{{resolve:` opener text in any string leaf and no
+* intrinsic-shaped object key anywhere.
+*
+* This is the capability question of issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850) asked in the
+* fail-closed direction. Asking "could this subtree have carried or SOURCED a
+* dynamic reference" precisely would need enumerating every source a reference
+* can arrive from — a parameter `Default` via `Ref` or `Fn::Sub`, a `Mappings`
+* entry via `Fn::FindInMap`, another stack's outputs via `Fn::ImportValue` /
+* `Fn::GetStackOutput` — and the enumeration missing one form is exactly how
+* the opener COUNT missed the first two. Every one of those source forms is an
+* intrinsic, so "no intrinsic at all" covers them all without naming any, and
+* a plain-literal subtree is one whose value at deploy time was the same
+* public template text this walk can read.
+*/
+function isInertDiscardedSubtree(node) {
+	if (typeof node === "string") return !node.includes(DYNAMIC_REFERENCE_OPENER);
+	if (node === null || typeof node !== "object") return true;
+	if (Array.isArray(node)) return node.every((element) => isInertDiscardedSubtree(element));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Ref" && record["Ref"] === "AWS::NoValue") return true;
+	return Object.entries(record).every(([key, value]) => !isIntrinsicShapedKey(key) && isInertDiscardedSubtree(value));
+}
+/**
+* Whether a scalar the resolver consumes RAW (an `Fn::Select` index) is a
+* template-constant literal that `resolveSelect`'s `resolvedList[index]` read
+* actually honors: a number, or the CANONICAL digit-string of one. The
+* canonical form is load-bearing, not pedantry — a delta review round
+* measured `['a','b']['01']` as `undefined` (a non-canonical string is a
+* property name, not an index) while CloudFormation integer-parses it to 1,
+* so `'01'` is exactly as selection-divergent as an intrinsic index and must
+* not count as static. Anything non-static makes the selection depend on a
+* value this import cannot reproduce.
+*/
+function isStaticSelectIndex(value) {
+	if (typeof value === "number") return Number.isInteger(value) && value >= 0;
+	return typeof value === "string" && /^(0|[1-9]\d*)$/.test(value);
+}
+/**
+* A `Fn::FindInMap` lookup-key argument the resolver can only have resolved
+* to the same key at deploy time: a plain scalar literal CARRYING NO
+* `{{resolve:` opener. The opener clause is the same delta-review finding one
+* helper up: `resolveFindInMap` resolves each key through `resolveValue`, so
+* a dynamic-reference STRING key is decrypted before the lookup and the
+* selected entry depends on the secret's deploy-time value — not on the
+* template text this walk reads.
+*/
+function isStaticLookupKey(value) {
+	if (typeof value === "string") return !value.includes(DYNAMIC_REFERENCE_OPENER);
+	return typeof value === "number" || typeof value === "boolean";
+}
+/**
+* ARM 3 of the observed-baseline refusal (issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850)): did the resolve
+* DISCARD a subtree it cannot vouch is inert?
+*
+* The opener-count comparison (ARM 2) sees only what the raw bag SPELLS, and
+* the issue measured two ways past it on the success arm: a downgraded
+* `Fn::If` that drops one reference while a parameter-sourced reference is
+* added elsewhere (the totals balance), and a reference sourced ENTIRELY from
+* outside the bag then dropped (both counts read zero, nothing throws, no
+* warn fires). Both are DISCARD events: the resolver threw a subtree away
+* unresolved, and whatever that subtree would have produced — which is what
+* AWS actually holds when the deployed condition took the other branch — is
+* exactly what the persisted bag cannot position a redaction for.
+*
+* So this walk detects the discard EVENTS on the RAW bag instead of comparing
+* positions across the resolve (which would need a path identity across the
+* `Fn::If` collapse that does not exist). The discarders, enumerated from
+* `IntrinsicFunctionResolver` rather than assumed — and re-enumerated by this
+* PR's review round, which found the first cut had missed TWO (`Fn::FindInMap`
+* and `Fn::Select` below; an earlier revision called `resolveIf` "the only
+* LAZY selector" and the resolver's own source refutes it):
+*
+*  - `resolveIf` — a LAZY selector: it resolves the selected branch
+*    only, so the unselected branch is discarded UNRESOLVED. A missing
+*    condition warns and selects the FALSE branch (no throw), so the success
+*    arm reaches it. Dispatch is `'Fn::If' in obj`, not single-key.
+*  - `resolveFindInMap` — the OTHER lazy site: the 4-argument form's
+*    `DefaultValue` is resolved only on a lookup MISS, so a HIT discards it
+*    unresolved; and a non-literal lookup KEY makes the un-taken mapping
+*    entries discarded template content. The walk's own arm comment carries
+*    both modes.
+*  - `resolveSelect` — eager on the LIST but the INDEX is consumed RAW, never
+*    resolved: an intrinsic index selects `undefined` here while
+*    CloudFormation resolved it at deploy, so the whole list is potentially
+*    discarded content. (With a NUMERIC-LITERAL index the selection is
+*    template-constant and the un-selected elements were discarded at deploy
+*    too — that case discards nothing AWS could hold.)
+*  - Dispatch order itself — `resolveValue` dispatches on the first matching
+*    intrinsic key, so an object holding an intrinsic key AMONG OTHER KEYS
+*    resolves as that intrinsic and silently DROPS the sibling keys'
+*    subtrees.
+*  - NOT `Fn::Sub`: its variable map is resolved eagerly, every entry.
+*  - NOT `Fn::Join`'s delimiter: it is consumed raw too, but CloudFormation
+*    itself admits no intrinsic there, and an intrinsic delimiter joins as
+*    `[object Object]` — a mangled value, not a discarded reference.
+*
+* Fail-closed rules, in the order tested (an earlier revision of this list
+* omitted the two arms the review round added while still claiming to BE the
+* tested order — a list that claims an order and is not the order is worse
+* than no list, so keep it complete or delete the claim):
+*
+*  - an ARRAY recurses element-wise, so a discarder inside a list property
+*    (`SecurityGroupIds: [{Fn::If: ...}]`) is found;
+*  - single-key `Fn::If` with well-formed args and a condition the evaluated
+*    map carries (`Object.hasOwn`, the same test `resolveIf` uses since issue
+*    #2767): the UNSELECTED branch must be inert, and the SELECTED branch is
+*    recursed into;
+*  - single-key `Fn::If` whose condition the map does NOT carry: BOTH
+*    branches must be inert. The resolver warns and takes the false branch,
+*    so this is a SUPERSET of mirroring it — mirroring the lookup exactly is
+*    the two-spellings-of-one-question drift this repo keeps paying for, and
+*    the superset can only over-refuse, never leak;
+*  - single-key `Fn::If` with MALFORMED args: refuse;
+*  - single-key `Fn::FindInMap`: MALFORMED (< 3 args) refuses; a 4th
+*    argument must be inert AS A WHOLE (its `DefaultValue` is resolved only
+*    on a lookup miss, and any sibling key there — or a whole 4th arg with
+*    no `DefaultValue` key — is discarded unconditionally); a non-literal
+*    lookup key refuses unless the map in scope is inert (the NAMED map for
+*    a literal map name, the whole `Mappings` section otherwise); then the
+*    args recurse;
+*  - single-key `Fn::Select`: MALFORMED (not exactly 2 args) refuses; a
+*    non-static index refuses unless the list argument is inert; then the
+*    args recurse;
+*  - a MULTI-KEY object carrying intrinsic-shaped keys: TWO or more such
+*    keys refuse outright (dispatch drops the losers as whole INTRINSICS,
+*    whose values' text is not evidence of what they pull); with exactly
+*    one, every value must be inert — which sibling the dispatch order
+*    drops is deliberately not mirrored here;
+*  - everything else recurses, so a nested `Fn::If` inside an `Fn::Join` /
+*    `Fn::Sub` argument is still found.
+*
+* Additive beside ARM 1 (throw) and ARM 2 (count loss): refusal strictly
+* widens, so no previously-refused shape can start leaking, and the risk
+* direction is over-refusal alone. The negative controls live in the matrix:
+* an `Fn::If` discarding pure literals stays ADMITTED, and so does a
+* multi-key intrinsic object whose sibling values are literals.
+*
+* THE CALLER WRAPS EVERY CALL IN A FAIL-CLOSED try (see the ARM 3 note at
+* the call site): this walk recurses synchronously and a deep-enough bag
+* overflows the call stack where the JSON.stringify arms still compute.
+*/
+function resolveDiscardsNonInertSubtree(node, conditions, mappings) {
+	if (node === null || typeof node !== "object") return false;
+	if (Array.isArray(node)) return node.some((element) => resolveDiscardsNonInertSubtree(element, conditions, mappings));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Fn::If") {
+		const args = record["Fn::If"];
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const [conditionName, valueIfTrue, valueIfFalse] = args;
+		if (!Object.hasOwn(conditions, conditionName)) return !isInertDiscardedSubtree(valueIfTrue) || !isInertDiscardedSubtree(valueIfFalse);
+		const selected = conditions[conditionName] ? valueIfTrue : valueIfFalse;
+		if (!isInertDiscardedSubtree(conditions[conditionName] ? valueIfFalse : valueIfTrue)) return true;
+		return resolveDiscardsNonInertSubtree(selected, conditions, mappings);
+	}
+	if (keys.length === 1 && keys[0] === "Fn::FindInMap") {
+		const args = record["Fn::FindInMap"];
+		if (!Array.isArray(args) || args.length < 3 || args.length > 4) return true;
+		if (args.length > 3) {
+			if (!isInertDiscardedSubtree(args[3])) return true;
+		}
+		if (!args.slice(0, 3).every((key) => isStaticLookupKey(key))) {
+			if (!isInertDiscardedSubtree(typeof args[0] === "string" && mappings !== null && typeof mappings === "object" && Object.hasOwn(mappings, args[0]) ? mappings[args[0]] : mappings)) return true;
+		}
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length === 1 && keys[0] === "Fn::Select") {
+		const args = record["Fn::Select"];
+		if (!Array.isArray(args) || args.length !== 2) return true;
+		if (!(isStaticSelectIndex(args[0]) && (!Array.isArray(args[1]) || Number(args[0]) < args[1].length)) && !isInertDiscardedSubtree(args[1])) return true;
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length > 1 && keys.some((key) => isIntrinsicShapedKey(key))) {
+		if (keys.filter((key) => isIntrinsicShapedKey(key)).length > 1) return true;
+		return !keys.every((key) => isInertDiscardedSubtree(record[key]));
+	}
+	return keys.some((key) => resolveDiscardsNonInertSubtree(record[key], conditions, mappings));
+}
 function printSummary(rows) {
 	const logger = getLogger();
 	const counts = {
@@ -90949,4 +91159,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CxMjCbiG.js.map
+//# sourceMappingURL=program-BEvh5nqs.js.map