@go-to-k/cdkd 0.289.2 → 0.289.4

package/dist/{program-Du5rJeYT.js → program-CyIOIvtX.js}

@@ -1,8 +1,8 @@
-import { $ as collectInlinePolicyNamesManagedBySiblings, $n as describeDockerCapturedOutput, $r as LocalInvokeBuildError$1, $t as DagBuilder, A as isStatefulRecreateTargetForReplace, An as orphansAfterRollback, Ar as uploadCfnTemplate, At as coerceCfnBoolean, B as gray, Bn as AssetModeResolver, Br as resolveBucketRegion, Bt as withSharedDrainBudget, C as refusesFinalSnapshot, Cn as forceQuitRecoveryClause, Cr as resolveUseCdkBootstrapAssets, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as exportNamesCarriedFrom, Dr as CFN_TEMPLATE_URL_LIMIT, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as DEFAULT_STATE_PREFIX, Er as CFN_TEMPLATE_BODY_LIMIT, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as WorkGraph, Fr as canonicalizeRegion, Ft as requireConfigArray, G as collectPublishedOutputNames, Gn as isCrossRegionRedirect, Gt as s3BucketWebsiteUrl, H as red, Hn as assertAssetBucketRegion, Hr as getAwsClients, Ht as s3BucketDomainName, I as toFiniteNumber, In as buildAssetRedirectMap, Ir as derivePartitionAndUrlSuffix, It as requireConfigObject, J as secretBearing, Jn as validateAssetBucketName, Jr as CrossAccountSecretRefusalError, Jt as INTRINSIC_KEYS, K as exportAliasCollisionScrubWarning, Kn as parseBootstrapMarker, Kr as CdkdError, Kt as applyRoleArnIfSet, L as formatResourceLine, Ln as createAssetRedirectResolver, Lr as AssemblyReader, Lt as requireConfigString, M as renderStatefulReason, Mn as shouldRetainResource, Mr as displaySafe, Mt as configStringRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as AssetPublisher, Nr as expectedOwnerParam, Nt as readConfigString, O as planOrphanAdoption, On as importableOutputKeys, Or as MIGRATE_TMP_PREFIX, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as stringifyValue, Pr as PARTITION_TABLE, Pt as replayWarn, Q as IAMRoleProvider, Qn as buildDockerImage, Qr as IntrinsicResolutionRefusalError, Qt as withRetry, R as bold, Rn as loadPublishableAssetManifest, Rr as processStackMessages, Rt as classifyReplaySecretRegion, S as isFinalSnapshotError, Sn as buildLockContentionMessage, Sr as resolveStateBucketWithDefaultAndSource, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tr as warnDeprecatedNoPrefixCliFlag, Tt as refStateLookupFromResource, U as yellow, Un as ensureAssetStorage, Ur as resetAwsClients, Ut as s3BucketDualStackDomainName, V as green, Vn as BOOTSTRAP_MARKER_PREFIX, Vr as AwsClients, Vt as s3BucketArn, W as collectDeclaredOutputNames, Wn as getBootstrapMarkerKey, Wr as setAwsClients, Wt as s3BucketRegionalDomainName, X as secretSafeKeyDisplay, Xn as buildDenyExternalAccessPolicy, Xr as DeployCancelledError, Xt as findSilentDropProperties, Y as secretBearingStateKeyWarning, Yn as validateContainerRepoName, Yt as findActionableSilentDrops, Z as getCurrentResourceSecrets, Zn as describeAwsFailure, Zr as DynamicReferenceRegionAmbiguousError, Zt as describeTypeWithThrottleRetry, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isThrottlingError, _n as LockManager, _r as resolveApp, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as ResourceTimeoutError, an as carriesSecretMask, ar as partitionSensitiveEnv, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as markRedactedCause, bn as UNRENDERABLE, br as resolveSkipPrefix, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as StackTerminationProtectionError, cn as errorCauseChain, cr as runDockerStreaming, ct as interruptWatchListenerCount, d as updatePartialReason, dn as maskSecretsInError, dr as AssetManifestLoader, dt as CloudControlProvider, ei as LocalStartServiceError, en as TemplateParser, er as describeDockerExecFailure, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as maskSecretsInText, fr as getDockerImageBySourceHash, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as isRetryableTransientError, gn as scrubResourceRecord, gr as getLegacyStateBucketName, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as isMarkedNonRetryable, hn as redactSecretsForState, hr as getDefaultStateBucketName, ht as deleteSkipReason, i as DeploymentEventsReader, ii as ProvisioningError, in as TEMPLATE_SOURCED_RULES, ir as getDockerCmd, it as maskDeep, j as isStatefulRecreateTargetSync, jn as orphansCarriedFrom, jr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, jt as configBooleanRefusal, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as importableOutputs, kr as findLargeInlineResources, kt as assertRegionMatch, l as replayRollback, ln as identityKeyFor, lr as escapeRegExp, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mi as withErrorHandling, mn as recoverMaskedOutput, mr as synthesisStatusMessage, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as NestedStackChildDirectDestroyError, nn as STATE_SOURCED_CROSS_GENERATION_RULES, nr as dockerSpawnEnvWithSensitive, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ResourceUpdateNotSupportedError, on as createSecretMasker, or as redactDockerArgvValues, ot as beginCommandInterruptScope, p as maskingRetryLogger, pi as normalizeAwsError, pn as recordMaskOnlyValue, pr as Synthesizer, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as readBootstrapMarkerBody, qt as DiffCalculator, r as DeployEngine, ri as PartialFailureError, rn as STATE_SOURCED_READBACK_RULES, rr as formatDockerLoginError, rt as createMaskedRetryLogger, s as planRollback, si as StackHasActiveImportsError, sn as dynamicReferenceTokens, sr as runDockerForeground, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as STATE_SOURCED_BASELINE_RULES, tr as describeDockerFailure, tt as ProviderRegistry, u as updatePartialMessage, un as isSingleDynamicReferenceToken, ur as stripControlChars, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isTransientServerError, vn as S3StateBackend, vr as resolveAutoAssetStorage, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as shellQuote, wr as stateBucketExistenceConfirmed, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as retryClassificationText, xn as buildForceUnlockCommand, xr as resolveStateBucketWithDefault, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as markNonRetryable, yn as rebuildClientForBucketRegion, yr as resolveCaptureObservedState, yt as carriesDynamicReference, z as cyan, zn as rewriteTemplateAssetReferences, zt as producerRegionsFromState } from "./deploy-engine-ClLLdy68.js";
-import { _ as withSkipPrefix, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName } from "./logger-D2Md1kTq.js";
+import { $ as collectInlinePolicyNamesManagedBySiblings, $n as buildDockerImage, $r as LocalInvokeBuildError$1, $t as DagBuilder, A as isStatefulRecreateTargetForReplace, An as importableOutputs, Ar as findLargeInlineResources, At as coerceCfnBoolean, B as gray, Bn as rewriteTemplateAssetReferences, Br as resolveBucketRegion, Bt as withSharedDrainBudget, C as refusesFinalSnapshot, Cn as buildLockContentionMessage, Cr as resolveStateBucketWithDefaultAndSource, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as DEFAULT_STATE_PREFIX, Dr as CFN_TEMPLATE_BODY_LIMIT, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as CUSTOM_RESOURCE_RESPONSE_PREFIX, Er as warnDeprecatedNoPrefixCliFlag, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as stringifyValue, Fr as canonicalizeRegion, Ft as requireConfigArray, G as collectPublishedOutputNames, Gn as getBootstrapMarkerKey, Gt as s3BucketWebsiteUrl, H as red, Hn as BOOTSTRAP_MARKER_PREFIX, Hr as getAwsClients, Ht as s3BucketDomainName, I as toFiniteNumber, In as WorkGraph, Ir as derivePartitionAndUrlSuffix, It as requireConfigObject, J as secretBearing, Jn as readBootstrapMarkerBody, Jr as CrossAccountSecretRefusalError, Jt as INTRINSIC_KEYS, K as exportAliasCollisionScrubWarning, Kn as isCrossRegionRedirect, Kr as CdkdError, Kt as applyRoleArnIfSet, L as formatResourceLine, Ln as buildAssetRedirectMap, Lr as AssemblyReader, Lt as requireConfigString, M as renderStatefulReason, Mn as orphansCarriedFrom, Mr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Mt as configStringRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as shouldRetainResource, Nr as expectedOwnerParam, Nt as readConfigString, O as planOrphanAdoption, On as exportNamesCarriedFrom, Or as CFN_TEMPLATE_URL_LIMIT, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as AssetPublisher, Pr as PARTITION_TABLE, Pt as replayWarn, Q as IAMRoleProvider, Qn as describeAwsFailure, Qr as IntrinsicResolutionRefusalError, Qt as withRetry, R as bold, Rn as createAssetRedirectResolver, Rr as processStackMessages, Rt as classifyReplaySecretRegion, S as isFinalSnapshotError, Sn as buildForceUnlockCommand, Sr as resolveStateBucketWithDefault, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as shellQuote, Tr as stateBucketExistenceConfirmed, Tt as refStateLookupFromResource, U as yellow, Un as assertAssetBucketRegion, Ur as resetAwsClients, Ut as s3BucketDualStackDomainName, V as green, Vn as AssetModeResolver, Vr as AwsClients, Vt as s3BucketArn, W as collectDeclaredOutputNames, Wn as ensureAssetStorage, Wr as setAwsClients, Wt as s3BucketRegionalDomainName, X as secretSafeKeyDisplay, Xn as validateContainerRepoName, Xr as DeployCancelledError, Xt as findSilentDropProperties, Y as secretBearingStateKeyWarning, Yn as validateAssetBucketName, Yt as findActionableSilentDrops, Z as getCurrentResourceSecrets, Zn as buildDenyExternalAccessPolicy, Zr as DynamicReferenceRegionAmbiguousError, Zt as describeTypeWithThrottleRetry, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isThrottlingError, _n as scrubResourceRecord, _r as getLegacyStateBucketName, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as ResourceTimeoutError, an as carriesSecretMask, ar as getDockerCmd, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as markRedactedCause, bn as rebuildClientForBucketRegion, br as resolveCaptureObservedState, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as StackTerminationProtectionError, cn as errorCauseChain, cr as runDockerForeground, ct as interruptWatchListenerCount, d as updatePartialReason, dn as markSameGenerationBag, dr as stripControlChars, dt as CloudControlProvider, ei as LocalStartServiceError, en as TemplateParser, er as describeDockerCapturedOutput, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as maskSecretsInError, fr as AssetManifestLoader, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as isRetryableTransientError, gn as redactSecretsForState, gr as getDefaultStateBucketName, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as isMarkedNonRetryable, hn as recoverMaskedOutput, hr as synthesisStatusMessage, ht as deleteSkipReason, i as DeploymentEventsReader, ii as ProvisioningError, in as TEMPLATE_SOURCED_RULES, ir as formatDockerLoginError, it as maskDeep, j as isStatefulRecreateTargetSync, jn as orphansAfterRollback, jr as uploadCfnTemplate, jt as configBooleanRefusal, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as importableOutputKeys, kr as MIGRATE_TMP_PREFIX, kt as assertRegionMatch, l as replayRollback, ln as identityKeyFor, lr as runDockerStreaming, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mi as withErrorHandling, mn as recordMaskOnlyValue, mr as Synthesizer, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as NestedStackChildDirectDestroyError, nn as STATE_SOURCED_CROSS_GENERATION_RULES, nr as describeDockerFailure, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ResourceUpdateNotSupportedError, on as createSecretMasker, or as partitionSensitiveEnv, ot as beginCommandInterruptScope, p as maskingRetryLogger, pi as normalizeAwsError, pn as maskSecretsInText, pr as getDockerImageBySourceHash, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as parseBootstrapMarker, qt as DiffCalculator, r as DeployEngine, ri as PartialFailureError, rn as STATE_SOURCED_READBACK_RULES, rr as dockerSpawnEnvWithSensitive, rt as createMaskedRetryLogger, s as planRollback, si as StackHasActiveImportsError, sn as dynamicReferenceTokens, sr as redactDockerArgvValues, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as STATE_SOURCED_BASELINE_RULES, tr as describeDockerExecFailure, tt as ProviderRegistry, u as updatePartialMessage, un as isSingleDynamicReferenceToken, ur as escapeRegExp, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isTransientServerError, vn as LockManager, vr as resolveApp, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as forceQuitRecoveryClause, wr as resolveUseCdkBootstrapAssets, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as retryClassificationText, xn as UNRENDERABLE, xr as resolveSkipPrefix, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as markNonRetryable, yn as S3StateBackend, yr as resolveAutoAssetStorage, yt as carriesDynamicReference, z as cyan, zn as loadPublishableAssetManifest, zt as producerRegionsFromState } from "./deploy-engine-BEpYvI14.js";
+import { _ as withSkipPrefix, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, y as displaySafe } from "./logger-CecsQ1UT.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DUhfbsEF.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-C5FQJwUN.js";
+import { t as getCdkdVersion } from "./version-C3wRsCF2.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CpxZ9sVH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -24334,9 +24334,12 @@ var SecretsManagerSecretProvider = class {
 		});
 		try {
 			let secretString;
-			const generateConfig = properties["GenerateSecretString"];
-			if (generateConfig) secretString = this.generateSecretString(generateConfig);
-			else if (properties["SecretString"] !== void 0 && properties["SecretString"] !== "") secretString = requireSecretStringShape(properties["SecretString"]);
+			const rawGenerate = properties["GenerateSecretString"];
+			if (rawGenerate != null) {
+				const generateConfig = requireConfigObject(rawGenerate, "AWS::SecretsManager::Secret GenerateSecretString");
+				secretString = this.generateSecretString(generateConfig);
+			} else if (properties["SecretString"] !== void 0 && properties["SecretString"] !== "") secretString = requireSecretStringShape(properties["SecretString"]);
+			if (secretString === void 0) this.logger.warn(`AWS::SecretsManager::Secret ${logicalId} declares no secret value (neither GenerateSecretString nor a non-empty SecretString); the secret is created with NO version. Consumers reading it will fail until a value is set.`);
 			const createParams = { Name: name };
 			if (secretString) createParams.SecretString = secretString;
 			if (properties["Description"]) createParams.Description = properties["Description"];
@@ -24365,7 +24368,7 @@ var SecretsManagerSecretProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating secret ${logicalId}: ${physicalId}`);
 		try {
-			const secretString = this.changedSecretValue(properties, previousProperties);
+			const { value: secretString, skippedGenerate } = this.changedSecretValue(properties, previousProperties);
 			const updateParams = { SecretId: physicalId };
 			if (secretString !== void 0) updateParams.SecretString = secretString;
 			const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
@@ -24420,7 +24423,8 @@ var SecretsManagerSecretProvider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Id: physicalId }
+				attributes: { Id: physicalId },
+				effectiveProperties: skippedGenerate ? this.retainPreviousGenerateBlock(logicalId, properties, previousProperties) : void 0
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -24450,8 +24454,47 @@ var SecretsManagerSecretProvider = class {
 		}
 	}
 	/**
-	* The `SecretString` an in-place update must send, or `undefined` when the
-	* value's SOURCE is unchanged (issue #2472).
+	* The bag to RECORD when the generate block was skipped: the desired
+	* properties with `GenerateSecretString` restored to the previously-applied
+	* value, or with the key dropped when the previous side cannot be vouched
+	* for either.
+	*
+	* Validated through `requireConfigObject` — the same predicate the wire read
+	* runs — rather than a hand-written `typeof` twin, so the two cannot
+	* disagree about a blank string, an explicit null or an intrinsic. The
+	* retained block is COPIED, not aliased: both engine consumers spread the
+	* answer one level deep only (the #1653 review rule).
+	*
+	* The DROP is announced rather than silent (the #1654 rule: dropping a key
+	* moves a hazard unless something still says so). A record carrying
+	* neither value source later reaches the reverse-replacement replay-create,
+	* where `create()` — which cannot see the record's history — would create
+	* the secret with NO version; the warning here is what makes that record
+	* diagnosable, and `create()` warns again when it meets one.
+	*
+	* One shape is announced rather than reconciled: a secret created from a
+	* LITERAL whose template then switches to a malformed generate block. The
+	* previous side has no block, so the key is dropped, and the record then
+	* carries neither source while AWS still holds the literal. Restoring the
+	* previous `SecretString` would be the #1612 answer, but it re-records a
+	* literal the template has REMOVED; the drop keeps the next deploy of the
+	* same template an announced UPDATE (desired block vs absent), which is the
+	* loud outcome this arm exists for.
+	*/
+	retainPreviousGenerateBlock(logicalId, properties, previousProperties) {
+		const usablePrevious = requireConfigObject(previousProperties["GenerateSecretString"], "AWS::SecretsManager::Secret GenerateSecretString", { onUnusable: () => {} });
+		const effective = { ...properties };
+		if (usablePrevious === void 0) {
+			delete effective["GenerateSecretString"];
+			this.logger.warn(`AWS::SecretsManager::Secret ${logicalId}: GenerateSecretString is dropped from the recorded properties. The desired block is unusable and the previously recorded one is absent or unusable, so the record now carries no GenerateSecretString; fix the template so the next deploy records one.`);
+		} else effective["GenerateSecretString"] = { ...usablePrevious };
+		return effective;
+	}
+	/**
+	* The `SecretString` an in-place update must send (as `value`), or
+	* `undefined` when the value's SOURCE is unchanged (issue #2472) or when a
+	* malformed `GenerateSecretString` block was SKIPPED (issue #3048,
+	* `skippedGenerate: true` — the caller records the previous block instead).
 	*
 	* The source is `GenerateSecretString` when present (CloudFormation gives it
 	* precedence over a literal) and `SecretString` otherwise. A generated value
@@ -24524,15 +24567,37 @@ var SecretsManagerSecretProvider = class {
 	* template.
 	*/
 	changedSecretValue(properties, previousProperties) {
-		const generateConfig = properties["GenerateSecretString"];
-		if (generateConfig) {
+		const rawGenerate = properties["GenerateSecretString"];
+		if (rawGenerate != null) {
+			const generateConfig = rawGenerate;
 			const previous = previousProperties["GenerateSecretString"];
-			return isDeepStrictEqual(asJson(generateConfig), asJson(previous)) || isDeepStrictEqual(asJson(this.asPersisted(generateConfig)), asJson(previous)) ? void 0 : this.generateSecretString(generateConfig);
+			if (isDeepStrictEqual(asJson(generateConfig), asJson(previous)) || isDeepStrictEqual(asJson(this.asPersisted(generateConfig)), asJson(previous))) return {
+				value: void 0,
+				skippedGenerate: false
+			};
+			const usable = requireConfigObject(generateConfig, "AWS::SecretsManager::Secret GenerateSecretString", { onUnusable: (m) => this.logger.warn(`${m} No new secret value is generated; the secret keeps the value AWS currently holds.`) });
+			if (usable === void 0) return {
+				value: void 0,
+				skippedGenerate: true
+			};
+			return {
+				value: this.generateSecretString(usable),
+				skippedGenerate: false
+			};
 		}
 		const literal = properties["SecretString"];
-		if (literal === void 0) return void 0;
-		if (isDeepStrictEqual(asJson(literal), asJson(previousProperties["SecretString"]))) return;
-		return requireSecretStringShape(literal);
+		if (literal === void 0) return {
+			value: void 0,
+			skippedGenerate: false
+		};
+		if (isDeepStrictEqual(asJson(literal), asJson(previousProperties["SecretString"]))) return {
+			value: void 0,
+			skippedGenerate: false
+		};
+		return {
+			value: requireSecretStringShape(literal),
+			skippedGenerate: false
+		};
 	}
 	/**
 	* `bag` as the state writer would persist it: every plaintext this
@@ -74401,6 +74466,22 @@ function isPhase2CreatableType(resourceType) {
 	return isCustomResourceType(resourceType);
 }
 /**
+* One spelling of "this value came from an S3 key or a state record, and is
+* about to be interpolated into a message a terminal will render" (issue
+* #3003). `cdkd state show --show-nested` reaches the walker's refusals below,
+* and cdkd's output is line-oriented, so an unsanitized value invents a line
+* that reads like a row. A `logicalId` is a KEY of the record body -- CloudFormation
+* constrains a logical id, but nothing enforces that on a record read back
+* from S3, and it is half of the child stack name derived from it.
+*
+* Module-scoped rather than local to the walker: the first cut of this change
+* guarded the walker's two refusals and left the root one, which is the shape
+* the issue is about.
+*/
+function safeSegment(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * Recursively load the cdkd-state tree rooted at `(rootStackName, region)`.
 * For every `AWS::CloudFormation::Stack` row in each level's
 * `state.resources`, derives the child's v6 state key
@@ -74436,7 +74517,7 @@ async function buildCdkdStateStackTree(rootStackName, region, stateBackend, pref
 	if (prefetchedRootState !== void 0) rootState = prefetchedRootState;
 	else {
 		const rootResult = await stateBackend.getState(rootStackName, region);
-		if (!rootResult) throw new Error(`No cdkd state found for stack '${rootStackName}' (${region}). Cannot build nested-stack tree.`);
+		if (!rootResult) throw new Error(`No cdkd state found for stack '${safeSegment(rootStackName)}' (${safeSegment(region)}). Cannot build nested-stack tree.`);
 		rootState = rootResult.state;
 	}
 	return walkCdkdStateStackTree(rootStackName, region, rootState, stateBackend);
@@ -74447,8 +74528,8 @@ async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
-		if (!childResult) throw new Error(`cdkd state is missing nested-child '${childStackName}' (${region}). Parent stack '${stackName}' lists '${logicalId}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${childStackName}/${region}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${stackName}' and re-import.`);
-		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${childStackName}' has state.region='${childResult.state.region}' but its parent '${stackName}' is being walked against region='${region}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
+		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${safeSegment(stackName)}' and re-import.`);
+		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.state.region)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
 		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend));
 	}
 	return {
@@ -76501,8 +76582,34 @@ function formatStackRef(ref) {
 * `()` would read as "no region" rather than "a region cdkd will not print".
 */
 function formatStackRefSafe(ref) {
-	const stack = displaySafe(ref.stackName, { asciiOnly: true }) || "<unrenderable>";
-	return ref.region ? `${stack} (${displaySafe(ref.region, { asciiOnly: true }) || "<unrenderable>"})` : stack;
+	return ref.region ? `${safe(ref.stackName)} (${safe(ref.region)})` : safe(ref.stackName);
+}
+/**
+* One spelling of "this value came from an S3 key or a state record, and is
+* about to be interpolated into a message a terminal will render".
+*
+* Call it for a stack name or a region. NOT every refusal in this file goes
+* through it, and this comment does not say which do -- `grep safe(` answers
+* it exactly. The sentence that used to sit here claimed all of them, and
+* three sites in `state destroy` / `state refresh-observed` disprove it by
+* interpolating a `listStacks()` region raw (go-to-k/cdkd#3027). That is the
+* same over-claiming shape `lock-manager.ts`'s twin helper records having got
+* wrong three times.
+*
+* It exists as one function rather than the expression repeated per site
+* because the failure this closes WAS the repeated form: issue #2772 guarded
+* the rendered rows and left the refusals, and the first cut of #3003 guarded
+* three refusals and left four more in these same two commands. A value
+* reaching a message is the population, not a list of call sites.
+*
+* `asciiOnly` because the population has a known charset — CloudFormation
+* constrains a stack name and AWS constrains a region, so the allowlist is a
+* no-op on every legitimate input while an S3 key admits any UTF-8. Free-form
+* text (a parser's own message, an AWS error) takes the denylist class
+* instead; `display-safe.ts`'s header draws that line.
+*/
+function safe(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
 }
 /**
 * Resolve a stack name + optional region flag against the `listStacks` index
@@ -76512,18 +76619,18 @@ function formatStackRefSafe(ref) {
 */
 function resolveSingleRegion(stackName, refs, requestedRegion) {
 	const matches = refs.filter((r) => r.stackName === stackName);
-	if (matches.length === 0) throw new Error(`No state found for stack '${stackName}'. Run 'cdkd state list' to see available stacks.`);
+	if (matches.length === 0) throw new Error(`No state found for stack '${safe(stackName)}'. Run 'cdkd state list' to see available stacks.`);
 	if (requestedRegion) {
 		const ref = matches.find((r) => r.region === requestedRegion);
 		if (!ref) {
-			const seen = matches.map((r) => r.region ?? "(legacy)").join(", ");
-			throw new Error(`No state found for stack '${stackName}' in region '${requestedRegion}'. Available regions: ${seen}.`);
+			const seen = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
+			throw new Error(`No state found for stack '${safe(stackName)}' in region '${safe(requestedRegion)}'. Available regions: ${seen.join(", ")}.`);
 		}
 		return ref;
 	}
 	if (matches.length === 1) return matches[0];
-	const regions = matches.map((r) => r.region ?? "(legacy)").join(", ");
-	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
+	const regions = matches.map((r) => r.region === void 0 ? "(legacy)" : safe(r.region));
+	throw new Error(`Stack '${safe(stackName)}' has state in multiple regions: ${regions.join(", ")}. Re-run with --stack-region <region> to disambiguate.`);
 }
 /**
 * Shared bootstrap for every `state` subcommand: build the AWS clients,
@@ -76744,9 +76851,9 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
-		if (!stateResult) throw new Error(`No state found for stack '${stackName}' (${ref.region}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		const resources = stateResult.state.resources ?? {};
 		const details = Object.entries(resources).map(([logicalId, resource]) => ({
 			logicalId,
@@ -76951,9 +77058,9 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${stackName}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
-		if (!stateResult) throw new Error(`No state found for stack '${stackName}' (${ref.region}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
+		if (!stateResult) throw new Error(`No state found for stack '${safe(stackName)}' (${safe(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
@@ -81957,7 +82064,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 				...baseContext,
 				recordedSecretValues
 			});
-			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
+			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
 		} catch (err) {
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
@@ -91753,4 +91860,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Du5rJeYT.js.map
+//# sourceMappingURL=program-CyIOIvtX.js.map