@go-to-k/cdkd 0.289.6 → 0.289.8

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DCxqZhgp.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-DWnjHtUC.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-B3I46yaG.js");
+	const { buildProgram } = await import("./program-BJxsQ7qM.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-CpmvgRtm.js → deploy-engine-zEwQVCh8.js}

@@ -1,6 +1,6 @@
-import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as displaySafe } from "./logger-BK-B0slT.js";
+import { b as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DCxqZhgp.js";
+import { t as getCdkdVersion } from "./version-DWnjHtUC.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1082,8 +1082,8 @@ var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
 	operation;
 	timeoutMs;
 	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
-		const elapsedLabel = formatDuration(elapsedMs);
-		const timeoutLabel = formatDuration(timeoutMs);
+		const elapsedLabel = formatDuration$1(elapsedMs);
+		const timeoutLabel = formatDuration$1(timeoutMs);
 		super(`Resource ${logicalId} (${resourceType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\nThis may indicate a stuck Cloud Control polling loop, hung Custom Resource, or
 slow ENI provisioning. Re-run with --resource-timeout ${resourceType}=<DURATION>\nto bump the budget for this resource type only, or --verbose to see the
 underlying provider activity.`, "RESOURCE_TIMEOUT");
@@ -1102,7 +1102,7 @@ underlying provider activity.`, "RESOURCE_TIMEOUT");
 * (`30m`, `1h30m`, `45s`). Used by {@link ResourceTimeoutError} so the
 * error message stays compact.
 */
-function formatDuration(ms) {
+function formatDuration$1(ms) {
 	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
 	const totalMinutes = Math.round(ms / 6e4);
 	if (totalMinutes < 60) return `${totalMinutes}m`;
@@ -9134,29 +9134,44 @@ var UnknownRollbackJournalVersionError = class extends Error {
 	foundVersion;
 	stackName;
 	constructor(foundVersion, stackName) {
-		super(`Rollback journal for '${stackName}' has journalVersion ${foundVersion}, but this cdkd only understands up to ${1}. Upgrade cdkd to roll this stack back.`);
+		super(`Rollback journal for '${safeJournalText(stackName)}' has journalVersion ${foundVersion}, but this cdkd only understands up to ${1}. Upgrade cdkd to roll this stack back.`);
 		this.name = "UnknownRollbackJournalVersionError";
 		this.foundVersion = foundVersion;
 		this.stackName = stackName;
 	}
 };
 /**
+* One spelling of "this value came from an S3 key or a rollback-journal record,
+* and is about to be interpolated into a message a terminal will render"
+* (issue #3064). Call it for a stack name, a parse detail, or a journal field.
+* `grep safeJournalText` answers the scope; this comment does not.
+*/
+function safeJournalText(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * Parse + validate a journal body. Throws
 * {@link UnknownRollbackJournalVersionError} on a newer version, and a plain
 * Error on a structurally-invalid body.
 */
 function parseRollbackJournal(bodyString, stackName) {
+	const shownStack = safeJournalText(stackName);
 	let parsed;
 	try {
 		parsed = JSON.parse(bodyString);
 	} catch (err) {
-		throw new Error(`Rollback journal for '${stackName}' is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+		const detail = safeJournalText(err instanceof Error ? err.message : String(err));
+		throw new Error(`Rollback journal for '${shownStack}' is not valid JSON: ${detail}`);
 	}
-	if (typeof parsed !== "object" || parsed === null) throw new Error(`Rollback journal for '${stackName}' is malformed (not an object).`);
+	if (typeof parsed !== "object" || parsed === null) throw new Error(`Rollback journal for '${shownStack}' is malformed (not an object).`);
 	const j = parsed;
-	if (typeof j.journalVersion !== "number" || j.journalVersion < 1) throw new Error(`Rollback journal for '${stackName}' has an invalid 'journalVersion' (${String(j.journalVersion)}).`);
+	if (typeof j.journalVersion !== "number" || j.journalVersion < 1) {
+		const raw = j.journalVersion;
+		const shown = safeJournalText(raw === null ? "null" : raw === void 0 ? "undefined" : raw);
+		throw new Error(`Rollback journal for '${shownStack}' has an invalid 'journalVersion' (${shown}).`);
+	}
 	if (j.journalVersion > 1) throw new UnknownRollbackJournalVersionError(j.journalVersion, stackName);
-	if (!Array.isArray(j.segments)) throw new Error(`Rollback journal for '${stackName}' is missing a 'segments' array.`);
+	if (!Array.isArray(j.segments)) throw new Error(`Rollback journal for '${shownStack}' is missing a 'segments' array.`);
 	return {
 		journalVersion: j.journalVersion,
 		stackName: j.stackName ?? stackName,
@@ -9225,18 +9240,38 @@ const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
 * two of three. `subject` now varies only the noun.
 */
 /**
-* Stand-in for a value with nothing renderable left after sanitization. Named
-* rather than inlined so the message and the command-suppression branch cannot
-* disagree about what "unrenderable" looks like.
-*/
-const UNRENDERABLE = "<unrenderable>";
-/** Render `expiresIn` without implying more precision than a clock skew allows. */
-function formatRemaining(ms) {
-	if (!Number.isFinite(ms)) return "at an unknown time";
-	if (ms <= 0) return "already expired";
-	const minutes = Math.round(ms / 6e4);
-	if (minutes < 1) return "in under a minute";
-	return `in ~${minutes}m`;
+* The ONE rendering of a lock's deadline: `expires in 1m23s` / `expired 45s
+* ago` for a finite `expiresAt`, `expires at an unknown time` otherwise
+* (issue #3085). Consumed by this module's contention refusal, by
+* `LockManager`'s three sites (the expired-lock takeover warning, the acquire
+* retry line, the final `LockError`) and by `cdkd state show`'s lock row, so
+* a record renders the same everywhere it is shown.
+*
+* Takes the RAW `expiresAt`, never a difference: the field is an unchecked
+* cast, and `Number.isFinite` on the raw value is the test `isLockExpired`
+* makes, so what this SAYS agrees with what the expiry check DOES. Subtracting
+* first (the previous `formatRemaining(info.expiresAt - Date.now())`) coerced
+* a numeric string to a real deadline here while the check called it expired
+* — the one input that still split the renderers after issue #3083. `{}`,
+* `"soon"`, an absent field, and the `NaN` that `getLockRecord` substitutes
+* for a coercion that throws (go-to-k/cdkd#2947) all land on the unknown arm.
+*
+* Seconds precision, deliberately: this module used to round to `in ~12m`
+* "without implying more precision than a clock skew allows", but the
+* `LockError` refusal that advises the same force-unlock decision already
+* printed `expires in 4m12s`, so the coarser form was a second spelling of the
+* same fact rather than a guard against skew.
+*/
+function formatLockExpiry(expiresAt) {
+	if (!Number.isFinite(expiresAt)) return "expires at an unknown time";
+	const remainingMs = expiresAt - Date.now();
+	return remainingMs > 0 ? `expires in ${formatDuration(remainingMs)}` : `expired ${formatDuration(-remainingMs)} ago`;
+}
+/** `1m23s` / `45s` from a non-negative millisecond count. */
+function formatDuration(ms) {
+	const seconds = Math.floor(ms / 1e3);
+	if (seconds < 60) return `${seconds}s`;
+	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
 }
 /**
 * Quote a value for a pasteable shell command.
@@ -9307,10 +9342,10 @@ async function buildLockContentionMessage(args) {
 		const info = await lockManager.getLockInfo(stackName, region);
 		if (info) {
 			const operation = info.operation ? `, operation: ${displaySafe(info.operation)}` : "";
-			const expires = formatRemaining(info.expiresAt - Date.now());
+			const expires = formatLockExpiry(info.expiresAt);
 			const owner = displaySafe(info.owner);
 			const holder = owner ? `held by ${owner}${operation}` : `held by an unnamed holder`;
-			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, expires ${expires}`;
+			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, ${expires}`;
 			if (owner) sawHolder = true;
 		}
 	} catch {}
@@ -10544,7 +10579,8 @@ var LockManager = class {
 							return false;
 						} else throw deleteError;
 					}
-					this.logger.warn(`Took over an EXPIRED lock for stack: ${stackName} (${region}, owner: ${existing.info.owner}, expired ${this.formatDuration(now - existing.info.expiresAt)} ago). A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended -- if it is in fact still running, both processes are now writing to the same stack.`);
+					const why = Number.isFinite(existing.info.expiresAt) ? "A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended" : `Its expiresAt is not a finite number, which cdkd treats as already expired`;
+					this.logger.warn(`Took over an EXPIRED lock for stack: ${stackName} (${region}, owner: ${existing.info.owner}, ${formatLockExpiry(existing.info.expiresAt)}). ${why} -- if it is in fact still running, both processes are now writing to the same stack.`);
 					try {
 						const retryEtag = await this.putLockObject(key, lockInfo);
 						this.logger.debug(`Lock acquired for stack: ${stackName} (${region}) after expired lock cleanup, owner: ${lockOwner}`);
@@ -11140,21 +11176,20 @@ var LockManager = class {
 			if (await this.acquireLock(stackName, region, owner, operation)) return;
 			const lockInfo = await this.getLockInfo(stackName, region);
 			if (lockInfo) {
-				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${safeSegment(stackName)}' (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${safeSegment(stackName)}' (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock ${formatLockExpiry(lockInfo.expiresAt)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
 			}
 		}
 		const lockInfo = await this.getLockInfo(stackName, region);
-		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
+		const expiry = lockInfo ? formatLockExpiry(lockInfo.expiresAt) : void 0;
 		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
 		const safeStack = safeSegment(stackName);
 		const safeRegion = safeSegment(region);
-		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
+		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, ${expiry}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 /**
@@ -12052,7 +12087,11 @@ function recordCrossStackExpression(secrets, key, expression, plaintext) {
 *
 * The `isSingleDynamicReferenceToken` shape invariant is deliberately NOT here:
 * it belongs to each writer, which is where the parameters are named and where
-* a swap could be introduced.
+* a swap could be introduced. One writer stores a NON-token on purpose:
+* {@link recordNestedStackParameterExpressions}'s sub-floor carry records a
+* parameter's literal FRAME (`port:{{resolve:...}}`, issue #3079), the same
+* string its whole-value entry writes, so a reader returning it persists what
+* the entry would have.
 */
 function storeAssociation(associations, key, expression, plaintext) {
 	const seen = associations.get(key);
@@ -12147,18 +12186,28 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * and the same generation the bag was resolved from one statement earlier. That
 * is the identical pairing `redactRollbackRecord` already makes for the record
 * it positions, so the two replay walks now agree about what their source is.
+* Since issue #3090 the `trustAnyExpression` half of that claim no longer
+* changes what THIS recorder writes for a reference the pass resolved:
+* refusal 5 asks the pair table under both rule sets, and a resolved unpinned
+* `ssm` reference has a pair (only its pin is withheld), so either ruleset
+* positions it through the span arm's empty frame. What the constants still
+* decide here is `sourceIsSameGeneration`, which a token-shaped plaintext
+* reaches (fenced by the replay call sites' own file).
 *
 * "No public expressions" carries the carve-out {@link PathSourceRules} states
 * and this note must not restate without it: `cdkd import` warns and persists
 * the RAW template intrinsic, so a public `ssm:` token CAN sit in a record. The
-* replay then CERTIFIES one the deploy default would refuse, at a cost bounded
-* to the issue #1901 class — a spurious UPDATE over a value state should hold
-* resolved, never a disclosure, since an expression is what gets persisted
-* either way. See the replay call sites for why gating on
-* {@link isKnownSecretExpression} is the wrong way to close it.
-*
-* FOUR REFUSALS, each degrading to today's behaviour (the child leaf falls to
-* the plaintext-keyed value scan):
+* replay's POSITION pass then certifies one the deploy default would refuse;
+* since issue #3090 refusal 5 refuses to RECORD it under either ruleset (a
+* token resolved as public is never paired), so the child's leaf falls to the
+* value scan. Before that the cost was bounded to the issue #1901 class — a
+* spurious UPDATE over a value state should hold resolved, never a
+* disclosure, since an expression is what gets persisted either way. See the
+* replay call sites for why gating on {@link isKnownSecretExpression} is the
+* wrong way to close it.
+*
+* FIVE REFUSALS, each degrading to today's behaviour (the child leaf falls to
+* the plaintext-keyed value scan); the fifth is stated at its line:
 *
 * 1. REFUSAL — the resolved parameter value is not a WHOLE recorded plaintext.
 *    A parameter the parent built with an `Fn::Sub` merely EMBEDS the secret,
@@ -12220,14 +12269,21 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 *         only refusal a test can see: the others coincide with (i) or with
 *         the map's own entry, as a whole-token source's would).
 *   (iii) `secrets.get(middle) === token` -- the token IS the map's survivor
-*         for the middle. Load-bearing: two framed parameters over ONE middle
-*         (`pin::` and `pin:AWSCURRENT:`) keep their own tokens on this row's
-*         record today because each reaches the span arm with the scan
-*         silent; once a `'port:q7'` entry exists the scan answers for the
-*         whole leaf and the arm's bound (`scanned === prefix + survivor +
-*         suffix`) decides. Recording only the frame whose token is the
-*         middle's survivor makes every parent leaf keep its own token by
-*         construction rather than by recording order.
+*         for the middle -- OR every framed spelling of the value in the row
+*         carries this token (issue #3079). Load-bearing: two framed
+*         parameters over ONE middle (`pin::` and `pin:AWSCURRENT:`) keep
+*         their own tokens on this row's record today because each reaches
+*         the span arm with the scan silent; once a `'port:q7'` entry exists
+*         the scan answers for the whole leaf and the arm's bound (`scanned
+*         === prefix + survivor + suffix`) decides. With the survivor's
+*         frame as the entry every same-frame leaf passes the bound and
+*         writes its own token; with a loser's, a same-frame sibling around
+*         another token would fail it and take the loser's frame -- so a
+*         loser's frame is the entry only when no such sibling exists, and
+*         then its own leaf reads the entry from the value scan after the
+*         bound refuses, which is its frame. Either way every parent leaf
+*         keeps its own token by construction rather than by recording
+*         order.
 *   (iv)  ONE FRAME per VALUE, across the whole row. Once the entry exists
 *         the scan is no longer silent on the value, so on the parent's
 *         record every leaf holding it answers against the entry through the
@@ -12280,19 +12336,43 @@ const UNFRAMED_SPELLING = Symbol("cdkd.nested-parameter.unframed-spelling");
 * refuses a middle that is itself a token, which is what a bag equal to its
 * source has.
 *
+* THE PER-NAME ASSOCIATION (issue #3079). The entry is keyed by VALUE, so over
+* one middle with TWO tokens in one frame it names one of them, and every
+* child leaf holding the value would take that one -- the loser's `{Ref}`
+* persisting the survivor's frame, which is the wrong reference the three
+* consumers below re-resolve after the sibling rotates. So beside the entry,
+* every leaf passing (i), (ii), the pair gate between (ii) and (iv), (iv)
+* and (v) -- the survivor's and the loser's alike, and whether or not (iii)
+* let its entry through -- is recorded BY NAME into {@link nestedStackParameterExpressions}, the table
+* the whole-token walk above fills, as `name -> (its own frame, the value)`.
+* The child inherits it ({@link inheritNestedStackParameterAssociations})
+* and reads it through {@link certifiedExpressionForLeaf} at all three
+* sites: the carry (`recordInheritedParameterSecrets` asks per plaintext),
+* the persist walk (`positionByCrossStackSource` on the `{Ref}` source) and
+* the diff side (`redactParametersForDiff`). Each requires the bag to HOLD
+* the value, which the entry provides -- or the child's OWN resolution of
+* the same plaintext, in which case the association answers with the leaf's
+* own frame, the right reference for it. So a FRAMED association whose value
+* (iii) refused is inert or correct, never wrong -- a claim the whole-token
+* walk's STRING-source half now earns the same way, through refusal 5 (issue
+* #3090); its intrinsic-source half rests on the reader's condition 3, less
+* the skeleton arm's own unpinned-`ssm` residual (stated on that arm).
+* The association's expression is
+* the FRAME, not a token -- the one writer into that table that stores a
+* non-token, said so on {@link storeAssociation}; its readers return it to be
+* persisted, which is exactly what the entry would have written.
+*
 * WHAT STAYS OPEN, weighed against the three live consumers named on
 * {@link positionByIntrinsicFrame} (`cdkd rollback`, `drift --revert`, a
-* consumer's cross-stack read). (a) Over one middle with TWO tokens, (iii)
-* records the survivor's frames only, never a loser's, so the loser's child
-* leaf takes the survivor's frame when the two frames MATCH (`port:` + either
-* token: the survivor's entry is the loser's whole value too) and stays
-* PLAINTEXT when they differ (`port:` + A beside `url:` + B: no entry names
-* `port:q7`). Either is the pre-#2291 answer for this shape; on a match it is
-* the wrong reference those consumers re-resolve -- after the sibling
-* rotates, a rollback or `--revert` of the child hands the sibling's
-* plaintext to the loser's live property. The PARENT's record stays per leaf
-* by (iii) and (iv). One token framed two ways (`port:` + T and `url:` + T)
-* is two values and two entries, not this shape. (b) The framed
+* consumer's cross-stack read). (a) CLOSED by the association above (was:
+* the loser's child leaf took the survivor's frame, or stayed plaintext
+* under a different frame -- the second half closed by (iii)'s second arm).
+* What remains of it: one child RESOURCE consuming BOTH parameters holds
+* ONE plaintext-keyed slot for the value, and a leaf of it the association
+* cannot reach by name -- an `Fn::Sub` EMBEDDING the `{Ref}`, positioned by
+* the value scan -- reads that slot's frame, whichever `{Ref}` resolved
+* last; a bare `{Ref}` leaf of the same resource is positioned by name and
+* is unaffected (pinned). (b) The framed
 * value is a SUBSTRING needle (7 characters here) in every child resource
 * that consumed the parameter, so an unrelated literal there containing it
 * is spliced -- the #2087 class, bounded to resources whose own resolution
@@ -12336,6 +12416,7 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		if (expression === resolvedValue) continue;
 		const seenResolvingTo = plaintextIndexOf(secrets).get(expression);
 		if (seenResolvingTo !== void 0 && seenResolvingTo !== resolvedValue) continue;
+		if (typeof sourceLeaf === "string" && resolvedPlaintextOf(secrets, expression) !== resolvedValue) continue;
 		if (table === void 0) {
 			table = /* @__PURE__ */ new Map();
 			nestedStackParameterExpressions.set(secrets, table);
@@ -12343,25 +12424,33 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 		storeAssociation(table, name, expression, resolvedValue);
 	}
 	const framesByValue = /* @__PURE__ */ new Map();
+	const tokensOf = /* @__PURE__ */ new Map();
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		if (typeof resolvedValue !== "string") continue;
 		const sourceLeaf = sourceParameters[name];
 		const frame = typeof sourceLeaf === "string" ? singleSpanFrame(resolvedValue, sourceLeaf) : void 0;
 		const frames = framesByValue.get(resolvedValue) ?? /* @__PURE__ */ new Set();
-		frames.add(frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
+		const unframed = frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle;
+		frames.add(unframed ? UNFRAMED_SPELLING : `${frame.prefix.length}:${frame.prefix}${frame.suffix}`);
 		framesByValue.set(resolvedValue, frames);
+		if (!unframed) {
+			const tokens = tokensOf.get(resolvedValue) ?? /* @__PURE__ */ new Set();
+			tokens.add(frame.token);
+			tokensOf.set(resolvedValue, tokens);
+		}
 	}
 	const rowWithoutParameters = {};
 	for (const [key, value] of Object.entries(resolvedProperties)) if (key !== "Parameters") rowWithoutParameters[key] = value;
 	const outsideLeaves = wholeStringLeavesOf(rowWithoutParameters);
 	const framed = /* @__PURE__ */ new Map();
+	const framedByName = [];
 	for (const [name, resolvedValue] of Object.entries(resolvedParameters)) {
 		const sourceLeaf = sourceParameters[name];
 		if (typeof resolvedValue !== "string" || typeof sourceLeaf !== "string") continue;
 		if (positioned[name] !== sourceLeaf) continue;
 		if (redactSecretsForState(resolvedValue, secrets) !== resolvedValue) continue;
 		const frame = singleSpanFrame(resolvedValue, sourceLeaf);
-		if (frame === void 0 || secrets.get(frame.middle) !== frame.token) continue;
+		if (frame === void 0 || resolvedPlaintextOf(secrets, frame.token) !== frame.middle) continue;
 		if (framesByValue.get(resolvedValue)?.size !== 1) continue;
 		const isNeedle = resolvedValue.length >= 4;
 		const rewrites = (leaf) => leaf === resolvedValue || isNeedle && leaf.includes(resolvedValue);
@@ -12382,9 +12471,22 @@ function recordNestedStackParameterExpressions(secrets, resourceType, resolvedPr
 			}
 		}
 		if (embedded) continue;
+		framedByName.push([
+			name,
+			sourceLeaf,
+			resolvedValue
+		]);
+		if (secrets.get(frame.middle) !== frame.token && tokensOf.get(resolvedValue)?.size !== 1) continue;
 		framed.set(resolvedValue, sourceLeaf);
 	}
 	for (const [plaintext, expression] of framed) secrets.set(plaintext, expression);
+	for (const [name, expression, plaintext] of framedByName) {
+		if (table === void 0) {
+			table = /* @__PURE__ */ new Map();
+			nestedStackParameterExpressions.set(secrets, table);
+		}
+		storeAssociation(table, name, expression, plaintext);
+	}
 }
 /**
 * Copy a parent pass's per-PARAMETER associations onto a nested-stack CHILD
@@ -28325,7 +28427,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-eIVYMrmW.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D2lf-Qdo.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -40771,5 +40873,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { collectInlinePolicyNamesManagedBySiblings as $, buildDenyExternalAccessPolicy as $n, DynamicReferenceRegionAmbiguousError as $r, describeTypeWithThrottleRetry as $t, isStatefulRecreateTargetForReplace as A, exportNamesCarriedFrom as An, CFN_TEMPLATE_URL_LIMIT as Ar, coerceCfnBoolean as At, gray as B, createAssetRedirectResolver as Bn, processStackMessages as Br, classifyReplaySecretRegion as Bt, refusesFinalSnapshot as C, retryClassificationText as Ci, UNRENDERABLE as Cn, resolveSkipPrefix as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, shellQuote as Dn, stateBucketExistenceConfirmed as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, forceQuitRecoveryClause as En, resolveUseCdkBootstrapAssets as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, shouldRetainResource as Fn, expectedOwnerParam as Fr, readConfigString as Ft, collectPublishedOutputNames as G, assertAssetBucketRegion as Gn, resetAwsClients as Gr, s3BucketDualStackDomainName as Gt, red as H, rewriteTemplateAssetReferences as Hn, resolveBucketRegion as Hr, withSharedDrainBudget as Ht, toFiniteNumber as I, AssetPublisher as In, PARTITION_TABLE as Ir, replayWarn as It, secretBearing as J, isCrossRegionRedirect as Jn, CdkdError as Jr, applyRoleArnIfSet as Jt, exportAliasCollisionScrubWarning as K, ensureAssetStorage as Kn, setAwsClients as Kr, s3BucketRegionalDomainName as Kt, formatResourceLine as L, stringifyValue as Ln, canonicalizeRegion as Lr, requireConfigArray as Lt, renderStatefulReason as M, importableOutputs as Mn, findLargeInlineResources as Mr, configBooleanRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, orphansAfterRollback as Nn, uploadCfnTemplate as Nr, configIntegerRefusal as Nt, planOrphanAdoption as O, CUSTOM_RESOURCE_RESPONSE_PREFIX as On, warnDeprecatedNoPrefixCliFlag as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, orphansCarriedFrom as Pn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Pr, configStringRefusal as Pt, IAMRoleProvider as Q, validateContainerRepoName as Qn, DeployCancelledError as Qr, findSilentDropProperties as Qt, bold as R, WorkGraph as Rn, derivePartitionAndUrlSuffix as Rr, requireConfigObject as Rt, isFinalSnapshotError as S, markRedactedCause as Si, rebuildClientForBucketRegion as Sn, resolveCaptureObservedState as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, buildLockContentionMessage as Tn, resolveStateBucketWithDefaultAndSource as Tr, refStateLookupFromResource as Tt, yellow as U, AssetModeResolver as Un, AwsClients as Ur, s3BucketArn as Ut, green as V, loadPublishableAssetManifest as Vn, clearBucketRegionCache as Vr, producerRegionsFromState as Vt, collectDeclaredOutputNames as W, BOOTSTRAP_MARKER_PREFIX as Wn, getAwsClients as Wr, s3BucketDomainName as Wt, secretSafeKeyDisplay as X, readBootstrapMarkerBody as Xn, CrossAccountSecretRefusalError as Xr, INTRINSIC_KEYS as Xt, secretBearingStateKeyWarning as Y, parseBootstrapMarker as Yn, ConfigError as Yr, DiffCalculator as Yt, getCurrentResourceSecrets as Z, validateAssetBucketName as Zn, DependencyError as Zr, findActionableSilentDrops as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isMarkedNonRetryable as _i, recoverMaskedOutput as _n, synthesisStatusMessage as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, PartialFailureError as ai, STATE_SOURCED_READBACK_RULES as an, dockerSpawnEnvWithSensitive as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, isTransientServerError as bi, LockManager as bn, resolveApp as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, ResourceUpdateNotSupportedError as ci, createSecretMasker as cn, partitionSensitiveEnv as cr, interruptWatchListenerCount as ct, updatePartialReason as d, StateError as di, identityKeyFor as dn, runDockerStreaming as dr, CloudControlProvider as dt, IntrinsicResolutionRefusalError as ei, withRetry as en, describeAwsFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, SynthesisError as fi, isSingleDynamicReferenceToken as fn, escapeRegExp$1 as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, withErrorHandling as gi, recordMaskOnlyValue as gn, Synthesizer as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, normalizeAwsError as hi, maskSecretsInText as hn, getDockerImageBySourceHash as hr, deleteSkipReason as ht, DeploymentEventsReader as i, NestedStackChildDirectDestroyError as ii, STATE_SOURCED_CROSS_GENERATION_RULES as in, describeDockerFailure as ir, maskDeep as it, isStatefulRecreateTargetSync as j, importableOutputKeys as jn, MIGRATE_TMP_PREFIX as jr, coerceCfnInteger as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, DEFAULT_STATE_PREFIX as kn, CFN_TEMPLATE_BODY_LIMIT as kr, assertRegionMatch as kt, replayRollback as l, StackHasActiveImportsError as li, dynamicReferenceTokens as ln, redactDockerArgvValues as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isCdkdError as mi, maskSecretsInError as mn, AssetManifestLoader as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LocalStartServiceError as ni, TemplateParser as nn, describeDockerCapturedOutput as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ProvisioningError as oi, TEMPLATE_SOURCED_RULES as on, formatDockerLoginError as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, formatError as pi, markSameGenerationBag as pn, stripControlChars as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, getBootstrapMarkerKey as qn, AssetError as qr, s3BucketWebsiteUrl as qt, DeployEngine as r, LockError as ri, STATE_SOURCED_BASELINE_RULES as rn, describeDockerExecFailure as rr, createMaskedRetryLogger as rt, planRollback as s, ResourceTimeoutError as si, carriesSecretMask as sn, getDockerCmd as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalInvokeBuildError as ti, DagBuilder as tn, buildDockerImage as tr, ProviderRegistry as tt, updatePartialMessage as u, StackTerminationProtectionError as ui, errorCauseChain as un, runDockerForeground as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isRetryableTransientError as vi, redactSecretsForState as vn, getDefaultStateBucketName as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, __exportAll as wi, buildForceUnlockCommand as wn, resolveStateBucketWithDefault as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, markNonRetryable as xi, S3StateBackend as xn, resolveAutoAssetStorage as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, isThrottlingError as yi, scrubResourceRecord as yn, getLegacyStateBucketName as yr, carriesDynamicReference as yt, cyan as z, buildAssetRedirectMap as zn, AssemblyReader as zr, requireConfigString as zt };
-//# sourceMappingURL=deploy-engine-CpmvgRtm.js.map
+export { collectInlinePolicyNamesManagedBySiblings as $, buildDenyExternalAccessPolicy as $n, DynamicReferenceRegionAmbiguousError as $r, describeTypeWithThrottleRetry as $t, isStatefulRecreateTargetForReplace as A, exportNamesCarriedFrom as An, CFN_TEMPLATE_URL_LIMIT as Ar, coerceCfnBoolean as At, gray as B, createAssetRedirectResolver as Bn, processStackMessages as Br, classifyReplaySecretRegion as Bt, refusesFinalSnapshot as C, retryClassificationText as Ci, buildForceUnlockCommand as Cn, resolveSkipPrefix as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, shellQuote as Dn, stateBucketExistenceConfirmed as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, formatLockExpiry as En, resolveUseCdkBootstrapAssets as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, shouldRetainResource as Fn, expectedOwnerParam as Fr, readConfigString as Ft, collectPublishedOutputNames as G, assertAssetBucketRegion as Gn, resetAwsClients as Gr, s3BucketDualStackDomainName as Gt, red as H, rewriteTemplateAssetReferences as Hn, resolveBucketRegion as Hr, withSharedDrainBudget as Ht, toFiniteNumber as I, AssetPublisher as In, PARTITION_TABLE as Ir, replayWarn as It, secretBearing as J, isCrossRegionRedirect as Jn, CdkdError as Jr, applyRoleArnIfSet as Jt, exportAliasCollisionScrubWarning as K, ensureAssetStorage as Kn, setAwsClients as Kr, s3BucketRegionalDomainName as Kt, formatResourceLine as L, stringifyValue as Ln, canonicalizeRegion as Lr, requireConfigArray as Lt, renderStatefulReason as M, importableOutputs as Mn, findLargeInlineResources as Mr, configBooleanRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, orphansAfterRollback as Nn, uploadCfnTemplate as Nr, configIntegerRefusal as Nt, planOrphanAdoption as O, CUSTOM_RESOURCE_RESPONSE_PREFIX as On, warnDeprecatedNoPrefixCliFlag as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, orphansCarriedFrom as Pn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Pr, configStringRefusal as Pt, IAMRoleProvider as Q, validateContainerRepoName as Qn, DeployCancelledError as Qr, findSilentDropProperties as Qt, bold as R, WorkGraph as Rn, derivePartitionAndUrlSuffix as Rr, requireConfigObject as Rt, isFinalSnapshotError as S, markRedactedCause as Si, rebuildClientForBucketRegion as Sn, resolveCaptureObservedState as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, forceQuitRecoveryClause as Tn, resolveStateBucketWithDefaultAndSource as Tr, refStateLookupFromResource as Tt, yellow as U, AssetModeResolver as Un, AwsClients as Ur, s3BucketArn as Ut, green as V, loadPublishableAssetManifest as Vn, clearBucketRegionCache as Vr, producerRegionsFromState as Vt, collectDeclaredOutputNames as W, BOOTSTRAP_MARKER_PREFIX as Wn, getAwsClients as Wr, s3BucketDomainName as Wt, secretSafeKeyDisplay as X, readBootstrapMarkerBody as Xn, CrossAccountSecretRefusalError as Xr, INTRINSIC_KEYS as Xt, secretBearingStateKeyWarning as Y, parseBootstrapMarker as Yn, ConfigError as Yr, DiffCalculator as Yt, getCurrentResourceSecrets as Z, validateAssetBucketName as Zn, DependencyError as Zr, findActionableSilentDrops as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isMarkedNonRetryable as _i, recoverMaskedOutput as _n, synthesisStatusMessage as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, PartialFailureError as ai, STATE_SOURCED_READBACK_RULES as an, dockerSpawnEnvWithSensitive as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, isTransientServerError as bi, LockManager as bn, resolveApp as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, ResourceUpdateNotSupportedError as ci, createSecretMasker as cn, partitionSensitiveEnv as cr, interruptWatchListenerCount as ct, updatePartialReason as d, StateError as di, identityKeyFor as dn, runDockerStreaming as dr, CloudControlProvider as dt, IntrinsicResolutionRefusalError as ei, withRetry as en, describeAwsFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, SynthesisError as fi, isSingleDynamicReferenceToken as fn, escapeRegExp$1 as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, withErrorHandling as gi, recordMaskOnlyValue as gn, Synthesizer as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, normalizeAwsError as hi, maskSecretsInText as hn, getDockerImageBySourceHash as hr, deleteSkipReason as ht, DeploymentEventsReader as i, NestedStackChildDirectDestroyError as ii, STATE_SOURCED_CROSS_GENERATION_RULES as in, describeDockerFailure as ir, maskDeep as it, isStatefulRecreateTargetSync as j, importableOutputKeys as jn, MIGRATE_TMP_PREFIX as jr, coerceCfnInteger as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, DEFAULT_STATE_PREFIX as kn, CFN_TEMPLATE_BODY_LIMIT as kr, assertRegionMatch as kt, replayRollback as l, StackHasActiveImportsError as li, dynamicReferenceTokens as ln, redactDockerArgvValues as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isCdkdError as mi, maskSecretsInError as mn, AssetManifestLoader as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LocalStartServiceError as ni, TemplateParser as nn, describeDockerCapturedOutput as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ProvisioningError as oi, TEMPLATE_SOURCED_RULES as on, formatDockerLoginError as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, formatError as pi, markSameGenerationBag as pn, stripControlChars as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, getBootstrapMarkerKey as qn, AssetError as qr, s3BucketWebsiteUrl as qt, DeployEngine as r, LockError as ri, STATE_SOURCED_BASELINE_RULES as rn, describeDockerExecFailure as rr, createMaskedRetryLogger as rt, planRollback as s, ResourceTimeoutError as si, carriesSecretMask as sn, getDockerCmd as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LocalInvokeBuildError as ti, DagBuilder as tn, buildDockerImage as tr, ProviderRegistry as tt, updatePartialMessage as u, StackTerminationProtectionError as ui, errorCauseChain as un, runDockerForeground as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isRetryableTransientError as vi, redactSecretsForState as vn, getDefaultStateBucketName as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, __exportAll as wi, buildLockContentionMessage as wn, resolveStateBucketWithDefault as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, markNonRetryable as xi, S3StateBackend as xn, resolveAutoAssetStorage as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, isThrottlingError as yi, scrubResourceRecord as yn, getLegacyStateBucketName as yr, carriesDynamicReference as yt, cyan as z, buildAssetRedirectMap as zn, AssemblyReader as zr, requireConfigString as zt };
+//# sourceMappingURL=deploy-engine-zEwQVCh8.js.map