@go-to-k/cdkd 0.290.35 → 0.290.37

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-BIpCWEQx.js";
+import { n as isVersionOnlyInvocation, t as getCdkdVersion } from "./version-COEQwjCP.js";
 
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -74,7 +74,7 @@ async function main() {
 		console.log(getCdkdVersion());
 		return;
 	}
-	const { buildProgram } = await import("./program-COiS7GZJ.js");
+	const { buildProgram } = await import("./program-CUOo1x11.js");
 	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);

package/dist/{deploy-engine-DhZtBBq0.js → deploy-engine-pVC4fG22.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BIpCWEQx.js";
+import { t as getCdkdVersion } from "./version-COEQwjCP.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9473,6 +9473,23 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	10
 ];
 /**
+* Whether `record` carries a baseline refusal no in-place UPDATE may clear.
+* Requires the marker AND the reason: a reason with no marker is not a state
+* any writer produces, and honouring it would invent a refusal.
+*/
+function hasUnverifiableParameterRefusal(record) {
+	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
+}
+/**
+* Whether `record` carries a marker with NO reason this binary knows — written
+* by an older cdkd, cause unknown. The one caller-side question is whether to read it
+* fail closed; see `observedBaselineRefusalReason`'s doc.
+*/
+function hasReasonlessBaselineRefusal(record) {
+	const reason = record?.observedBaselineRefusalReason;
+	return record?.observedBaselineRefused === true && reason !== "unverifiable-parameter" && reason !== "incomplete-resolution";
+}
+/**
 * Returns true when a recorded `DeletionPolicy` should prevent cdkd from
 * deleting the underlying AWS resource. `Retain` and `RetainExceptOnCreate`
 * both keep the resource around; `Delete` / `Snapshot` / undefined all
@@ -33135,7 +33152,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BguZAQtF.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CXLgFrPg.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -40115,6 +40132,294 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/parameter-dependence.ts
+/**
+* The PARAMETER-DEPENDENCE WALK: which resources of a raw template depend on
+* which template parameters (issues
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854),
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)).
+*
+* Pure template analysis with two consumers that must agree: `cdkd import`'s
+* ARM 4 (`src/cli/commands/import-deployed-parameters.ts` supplies the
+* divergent parameter set from `DescribeStacks`) and `cdkd deploy`'s reading of
+* a REASON-LESS `observedBaselineRefused` marker, which has no deployed values
+* at all and therefore treats every declared parameter as divergent
+* ({@link resourcesNamingDeclaredParameter}). It lives in this layer because
+* `src/deployment` may not import from `src/cli`.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the refused
+* set is closed over those targets. A plain `Ref` of a resource is NOT
+* followed: it yields the physical id, and a secret used as a resource NAME is
+* already disclosed by the identifier itself.
+*/
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+/**
+* The reading of a REASON-LESS `observedBaselineRefused` marker (issue
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)): which resources'
+* TEMPLATE definitions name a declared parameter, judged with NO deployed
+* values at hand — so every declared parameter anything names is divergent.
+* The answer is {@link computeParameterTaint}'s whole refused set: direct
+* dependents, unclassifiable bags, and attribute readers of either. Pseudo
+* parameters never count (the hit test intersects with DECLARED names) and
+* neither does a parameter nothing names, CDK's Rules-only `BootstrapVersion`
+* included.
+*
+* AN UNCLASSIFIABLE BAG COUNTS ONLY WHEN SOME DECLARED PARAMETER IS NAMED
+* SOMEWHERE in the template, exactly as in ARM 4, and deliberately: this set
+* has to cover what an older import's ARM 4 can have marked ON TEMPLATE
+* EVIDENCE (ARM 4 also read the state bags; a deploy's are resolved literals,
+* so they are not read here), and ARM 4 never ran on a template in which
+* nothing names a declared parameter. Counting the
+* bag regardless would make an old refusal of the other class sticky on every
+* CDK stack (each declares `BootstrapVersion`) and protect nothing.
+*
+* FAILS CLOSED, and never throws: a missing or unreadable template, a
+* `Resources` section that is not an object, or a walk that throws answers
+* `true` for every logical id, and says so in `failedClosed` — a cause CLASS,
+* never a template value or an error message. Absent from a readable
+* template's `Resources` answers `false` — that resource is being removed, and
+* a DELETE reads no baseline.
+*/
+function resourcesNamingDeclaredParameter(template) {
+	const everything = (failedClosed) => Object.assign(() => true, { failedClosed });
+	try {
+		if (template === void 0 || template === null || typeof template !== "object") return everything("unreadable-template");
+		const resources = template.Resources;
+		if (resources === null || typeof resources !== "object" || Array.isArray(resources)) return everything("unreadable-template");
+		const parameters = template.Parameters;
+		if (parameters !== void 0 && (parameters === null || typeof parameters !== "object" || Array.isArray(parameters))) return everything("unreadable-template");
+		const divergent = reachableDivergentParameters(template, new Set(Object.keys(parameters ?? {})), []);
+		const refused = computeParameterTaint(template, /* @__PURE__ */ new Map(), divergent).refused;
+		return Object.assign((logicalId) => refused.has(logicalId), { failedClosed: void 0 });
+	} catch {
+		return everything("walk-threw");
+	}
+}
+
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
 /**
@@ -44392,6 +44697,47 @@ var DeployEngine = class DeployEngine {
 		return Object.keys(siblings).length > 0 ? { siblings } : void 0;
 	}
 	/**
+	* Issue [#3468](https://github.com/go-to-k/cdkd/issues/3468) — the
+	* fail-closed reading of a REASON-LESS `observedBaselineRefused` marker.
+	*
+	* cdkd 0.290.35 wrote unverifiable-parameter refusals with no reason, so an
+	* absent reason cannot be read as "an UPDATE may clear it". A reason-less
+	* marker on a resource whose TEMPLATE definition names a declared parameter
+	* is stamped `'unverifiable-parameter'` here, IN MEMORY, once, before the
+	* diff: every later arm (the in-place rebuild, the metadata-only spread, the
+	* NO_CHANGE carry, the auto-refresh) then sees the explicit form and needs
+	* no rule of its own, and whatever this deploy saves holds it — the record
+	* heals into the form later binaries read directly. Nothing is saved FOR the
+	* stamp: a deploy that writes no state (`--dry-run`, no changes) re-derives
+	* it next time.
+	*
+	* The template is the RAW one `deploy()` was handed (a nested child engine
+	* gets its own), which is what the dependence walk needs. A template that
+	* cannot be read, or a walk that throws, stamps every reason-less marker
+	* (`resourcesNamingDeclaredParameter` fails closed). A record whose logical
+	* id the template no longer defines is being DELETED and is left alone.
+	*
+	* The RECORD object is replaced, not mutated (a per-record alias taken
+	* before this line keeps what was loaded); the container is updated in
+	* place, which is what lets every later reader of it see the stamp.
+	*/
+	stampReasonlessParameterRefusals(stateResources, template) {
+		let namesParameter;
+		let stamped = 0;
+		for (const [logicalId, resource] of Object.entries(stateResources)) {
+			if (!hasReasonlessBaselineRefusal(resource)) continue;
+			namesParameter ??= resourcesNamingDeclaredParameter(template);
+			if (!namesParameter(logicalId)) continue;
+			stateResources[logicalId] = {
+				...resource,
+				observedBaselineRefusalReason: "unverifiable-parameter"
+			};
+			stamped++;
+		}
+		if (namesParameter?.failedClosed !== void 0) this.logger.debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+		if (stamped > 0) this.logger.debug(`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
+	}
+	/**
 	* Kick off `provider.readCurrentState` for every resource in the
 	* loaded state that lacks `observedProperties` (e.g. state written
 	* by a pre-v3 binary, or a v3 record where a NO_CHANGE-skipped
@@ -44429,7 +44775,7 @@ var DeployEngine = class DeployEngine {
 				resource
 			});
 		}
-		if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline; a NO_CHANGE deploy does not.`);
+		if (refused > 0) this.logger.debug(`observed-properties auto-refresh SKIPPED for ${refused} resource(s) whose baseline a 'cdkd import' run refused (issue #2944): their recorded properties cannot position the redaction, so capturing an AWS readback against them could persist a resolved secret in plaintext. A deploy that actually CHANGES one of them restores its baseline, unless the refusal is an unverifiable-parameter one (only a replacement or a proving re-import discharges that); a NO_CHANGE deploy never does.`);
 		if (candidates.length === 0) return;
 		const allSiblings = {};
 		for (const [lid, res] of Object.entries(stateResources)) allSiblings[lid] = {
@@ -44501,6 +44847,7 @@ var DeployEngine = class DeployEngine {
 					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — run 'cdkd rollback ${stackName} --revert-failed' to revert it, or continue deploying to fix forward (a successful deploy clears this note).` : `A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
 				}
 			} catch {}
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
 			const outputsDigestSource = structuredClone({
@@ -44519,6 +44866,7 @@ var DeployEngine = class DeployEngine {
 			const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 			const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 			const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
+			if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
 			const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 			const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 			this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -45783,6 +46131,7 @@ var DeployEngine = class DeployEngine {
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
+					const keepsParameterRefusal = !(result.wasReplaced === true && result.physicalId !== currentResource.physicalId) && hasUnverifiableParameterRefusal(currentResource);
 					const carriedAttributes = result.attributes ?? (result.wasReplaced ? void 0 : currentResource.attributes);
 					this.registerNoEchoAttributes(logicalId, {
 						...carriedAttributes && { attributes: carriedAttributes },
@@ -45796,10 +46145,15 @@ var DeployEngine = class DeployEngine {
 						...carriedAttributes && { attributes: carriedAttributes },
 						...dependencies && dependencies.length > 0 && { dependencies },
 						...this.extractTemplateAttributes(template, logicalId),
-						provisionedBy: resultProvisionedBy
+						provisionedBy: resultProvisionedBy,
+						...keepsParameterRefusal && {
+							observedBaselineRefused: true,
+							observedBaselineRefusalReason: "unverifiable-parameter"
+						}
 					};
-					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
+					if (keepsParameterRefusal) this.logger.debug(`observedProperties capture SKIPPED for updated ${logicalId} (${resourceType}): 'cdkd import' refused its baseline because a template parameter was not provably deployed at its 'Default', and this deploy bound the same 'Default' — an in-place update cannot show that AWS no longer holds the deployed value. The refusal stands until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter.`);
+					const updateCaptureSiblings = keepsParameterRefusal ? void 0 : await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
+					if (!keepsParameterRefusal) this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
 					if (counts) {
 						if (updatePartial !== void 0) counts.updatePartial++;
@@ -46506,5 +46860,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { isExportAliasCollision as $, StackTerminationProtectionError as $i, maskSecretsInText as $n, stripControlChars as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, resolveBucketRegion as Ai, refuseMalformedResourcesForDestroy as An, AssetModeResolver as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DeployCancelledError as Bi, TemplateParser as Bn, buildDenyExternalAccessPolicy as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, expectedOwnerParam as Ci, malformedStateRefusalMessage as Cn, AssetPublisher as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, AssemblyReader as Di, refuseMalformedOutputs as Dn, createAssetRedirectResolver as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, derivePartitionAndUrlSuffix as Ei, refuseMalformedNestedChildOutputs as En, buildAssetRedirectMap as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, AssetError as Fi, findActionableSilentDrops as Fn, isCrossRegionRedirect as Fr, refStateLookupFromResource as Ft, cyan as G, LockError as Gi, carriesSecretMask as Gn, dockerSpawnEnvWithSensitive as Gr, configStringRefusal as Gt, toFiniteNumber as H, IntrinsicResolutionRefusalError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, describeDockerCapturedOutput as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, CdkdError as Ii, findSilentDropProperties as In, parseBootstrapMarker as Ir, isSettledInstanceState as It, red as J, PartialFailureError as Ji, errorCauseChain as Jn, partitionSensitiveEnv as Jr, requireConfigArray as Jt, gray as K, MalformedProducerRecordRefusalError as Ki, createSecretMasker as Kn, formatDockerLoginError as Kr, readConfigString as Kt, renderStatefulReason as L, ConfigError as Li, describeTypeWithThrottleRetry as Ln, readBootstrapMarkerBody as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, getAwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, assertAssetBucketRegion as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, resetAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, ensureAssetStorage as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, processStackMessages as Oi, refuseMalformedOutputsForDestroy as On, loadPublishableAssetManifest as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, setAwsClients as Pi, repairMalformedResourcesForReadOnly as Pn, getBootstrapMarkerKey as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, StackHasActiveImportsError as Qi, maskSecretsInError as Qn, escapeRegExp$1 as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, CrossAccountSecretRefusalError as Ri, withRetry as Rn, validateAssetBucketName as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, decodeListingKey as Si, malformedResourcesWarning as Sn, shouldRetainResource as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, canonicalizeRegion as Ti, refuseDivergentRecordRegionForDestroy as Tn, WorkGraph as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, LocalInvokeBuildError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerExecFailure as Ur, configBooleanRefusal as Ut, toCfnInteger as V, DynamicReferenceRegionAmbiguousError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDockerImage as Vr, coerceCfnBoolean as Vt, bold as W, LocalStartServiceError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ResourceTimeoutError as Xi, isSingleDynamicReferenceToken as Xn, runDockerForeground as Xr, requireConfigString as Xt, yellow as Y, ProvisioningError as Yi, identityKeyFor as Yn, redactDockerArgvValues as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, ResourceUpdateNotSupportedError as Zi, markSameGenerationBag as Zn, runDockerStreaming as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, CFN_TEMPLATE_URL_LIMIT as _i, malformedLocalOutputsWarning as _n, importableOutputKeys as _r, CloudControlProvider as _t, DeploymentEventsStore as a, withErrorHandling as aa, getLegacyStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, uploadCfnTemplate as bi, malformedRenderedContainersWarning as bn, orphansAfterRollback as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isThrottlingError as ca, resolveCaptureObservedState as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, markRedactedCause as da, resolveStateBucketWithDefaultAndSource as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, StateError as ea, AssetManifestLoader as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, retryClassificationText as fa, resolveUseCdkBootstrapAssets as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, CFN_TEMPLATE_BODY_LIMIT as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, __exportAll as ha, ssmResolvedValueType as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, normalizeAwsError as ia, getDefaultStateBucketName as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, AwsClients as ji, refuseMalformedState as jn, BOOTSTRAP_MARKER_PREFIX as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, clearBucketRegionCache as ki, refuseMalformedResourcePropertiesForOrphan as kn, rewriteTemplateAssetReferences as kr, coerceParameterTypedValue as kt, replayRollback as l, isTransientServerError as la, resolveSkipPrefix as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, safeStringify$1 as ma, warnDeprecatedNoPrefixCliFlag as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as na, Synthesizer as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, isMarkedNonRetryable as oa, resolveApp as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, describeAwsFailure as pa, stateBucketExistenceConfirmed as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, NestedStackChildDirectDestroyError as qi, dynamicReferenceTokens as qn, getDockerCmd as qr, replayWarn as qt, DeployEngine as r, isCdkdError as ra, synthesisStatusMessage as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isRetryableTransientError as sa, resolveAutoAssetStorage as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ta, getDockerImageBySourceHash as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, markNonRetryable as ua, resolveStateBucketWithDefault as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, MIGRATE_TMP_PREFIX as vi, malformedOutputsRefusalMessage as vn, importableOutputs as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, PARTITION_TABLE as wi, producerRecordKey as wn, stringifyValue as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xi, malformedResourcePropertiesWarning as xn, orphansCarriedFrom as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, findLargeInlineResources as yi, malformedOutputsWarning as yn, isReadableBag as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, DependencyError as zi, DagBuilder as zn, validateContainerRepoName as zr, resolveExplicitPhysicalId as zt };
-//# sourceMappingURL=deploy-engine-DhZtBBq0.js.map
+export { yellow as $, NestedStackChildDirectDestroyError as $i, identityKeyFor as $n, getDockerCmd as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PARTITION_TABLE as Ai, refuseMalformedNestedChildOutputs as An, stringifyValue as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, setAwsClients as Bi, findSilentDropProperties as Bn, getBootstrapMarkerKey as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CFN_TEMPLATE_URL_LIMIT as Ci, malformedOutputsWarning as Cn, importableOutputKeys as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Di, malformedStateRefusalMessage as Dn, orphansCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, uploadCfnTemplate as Ei, malformedResourcesWarning as En, orphansAfterRollback as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fi, refuseMalformedState as Fn, rewriteTemplateAssetReferences as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, DependencyError as Gi, STATE_SOURCED_BASELINE_RULES as Gn, validateContainerRepoName as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Hi, withRetry as Hn, parseBootstrapMarker as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ii, repairMalformedOutputsForReadOnly as In, AssetModeResolver as Ir, isNamelessDynamicReferenceError as It, bold as J, IntrinsicResolutionRefusalError as Ji, TEMPLATE_SOURCED_RULES as Jn, describeDockerCapturedOutput as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, DeployCancelledError as Ki, STATE_SOURCED_CROSS_GENERATION_RULES as Kn, buildDenyExternalAccessPolicy as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, AwsClients as Li, repairMalformedResourcePropertiesForReadOnly as Ln, BOOTSTRAP_MARKER_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, derivePartitionAndUrlSuffix as Mi, refuseMalformedOutputsForDestroy as Mn, buildAssetRedirectMap as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Ni, refuseMalformedResourcePropertiesForOrphan as Nn, createAssetRedirectResolver as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, decodeListingKey as Oi, producerRecordKey as On, shouldRetainResource as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pi, refuseMalformedResourcesForDestroy as Pn, loadPublishableAssetManifest as Pr, getAccountInfo as Pt, red as Q, MalformedProducerRecordRefusalError as Qi, errorCauseChain as Qn, formatDockerLoginError as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ri, repairMalformedResourcesForReadOnly as Rn, assertAssetBucketRegion as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CFN_TEMPLATE_BODY_LIMIT as Si, malformedOutputsRefusalMessage as Sn, hasUnverifiableParameterRefusal as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, findLargeInlineResources as Ti, malformedResourcePropertiesWarning as Tn, isReadableBag as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, ConfigError as Ui, DagBuilder as Un, readBootstrapMarkerBody as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, AssetError as Vi, describeTypeWithThrottleRetry as Vn, isCrossRegionRedirect as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wi, TemplateParser as Wn, validateAssetBucketName as Wr, assertRegionMatch as Wt, gray as X, LocalStartServiceError as Xi, createSecretMasker as Xn, describeDockerFailure as Xr, readConfigString as Xt, cyan as Y, LocalInvokeBuildError as Yi, carriesSecretMask as Yn, describeDockerExecFailure as Yr, configStringRefusal as Yt, green as Z, LockError as Zi, dynamicReferenceTokens as Zn, dockerSpawnEnvWithSensitive as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, markRedactedCause as _a, resolveStateBucketWithDefaultAndSource as _i, hasReadableOutputs as _n, CUSTOM_RESOURCE_RESPONSE_PREFIX as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, StackTerminationProtectionError as aa, stripControlChars as ai, s3BucketDomainName as an, recoverMaskedOutput as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, safeStringify$1 as ba, warnDeprecatedNoPrefixCliFlag as bi, malformedExportSourceWarning as bn, hasReadableExportSet as br, startInterruptWatch as bt, replayFailedOperations as c, formatError as ca, Synthesizer as ci, s3BucketWebsiteUrl as cn, LockManager as cr, IAMRoleProvider as ct, updatePartialMessage as d, withErrorHandling as da, getLegacyStateBucketName as di, applyCallerIdentityCredentials as dn, UNREPRODUCIBLE_LOCK_CLAUSE as dr, ProviderRegistry as dt, PartialFailureError as ea, partitionSensitiveEnv as ei, requireConfigString as en, isSingleDynamicReferenceToken as er, collectDeclaredOutputNames as et, updatePartialReason as f, isMarkedNonRetryable as fa, resolveApp as fi, callerEnvCredentials as fn, buildForceUnlockCommand as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, markNonRetryable as ga, resolveStateBucketWithDefault as gi, STATE_RESOURCES_MALFORMED as gn, shellQuote as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, isTransientServerError as ha, resolveSkipPrefix as hi, INTRINSIC_KEYS as hn, formatLockExpiry as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, StackHasActiveImportsError as ia, escapeRegExp$1 as ii, s3BucketArn as in, recordMaskOnlyValue as ir, secretBearing as it, isFinalSnapshotError as j, canonicalizeRegion as ji, refuseMalformedOutputs as jn, WorkGraph as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, expectedOwnerParam as ki, refuseDivergentRecordRegionForDestroy as kn, AssetPublisher as kr, IntrinsicFunctionResolver as kt, replayRollback as l, isCdkdError as la, synthesisStatusMessage as li, applyRoleArnIfSet as ln, S3StateBackend as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, isThrottlingError as ma, resolveCaptureObservedState as mi, DiffCalculator as mn, forceQuitRecoveryClause as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as na, runDockerForeground as ni, producerRegionsFromState as nn, maskSecretsInError as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, StateError as oa, AssetManifestLoader as oi, s3BucketDualStackDomainName as on, redactSecretsForState as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, isRetryableTransientError as pa, resolveAutoAssetStorage as pi, envCredentialsAreAssumedRole as pn, buildLockContentionMessage as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qi, STATE_SOURCED_READBACK_RULES as qn, buildDockerImage as qr, configBooleanRefusal as qt, DeployEngine as r, ResourceUpdateNotSupportedError as ra, runDockerStreaming as ri, withSharedDrainBudget as rn, maskSecretsInText as rr, isExportAliasCollision as rt, planRollback as s, SynthesisError as sa, getDockerImageBySourceHash as si, s3BucketRegionalDomainName as sn, scrubResourceRecord as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as ta, redactDockerArgvValues as ti, classifyReplaySecretRegion as tn, markSameGenerationBag as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, normalizeAwsError as ua, getDefaultStateBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, rebuildClientForBucketRegion as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, retryClassificationText as va, resolveUseCdkBootstrapAssets as vi, hasReadableResources as vn, DEFAULT_STATE_PREFIX as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, MIGRATE_TMP_PREFIX as wi, malformedRenderedContainersWarning as wn, importableOutputs as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, __exportAll as xa, ssmResolvedValueType as xi, malformedLocalOutputsWarning as xn, hasReasonlessBaselineRefusal as xr, CloudControlProvider as xt, keptWholeReasonText as y, describeAwsFailure as ya, stateBucketExistenceConfirmed as yi, malformedExportNamesWarning as yn, exportNamesCarriedFrom as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as zi, findActionableSilentDrops as zn, ensureAssetStorage as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-pVC4fG22.js.map