@go-to-k/cdkd 0.290.36 → 0.290.38

package/dist/{deploy-engine-tX_-qy5a.js → deploy-engine-BdYBI1uT.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-BX4pJk0T.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-BYmXwLpd.js";
+import { t as getCdkdVersion } from "./version-BeHfM5ow.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9481,6 +9481,15 @@ function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
 }
 /**
+* Whether `record` carries a marker with NO reason this binary knows — written
+* by an older cdkd, cause unknown. The one caller-side question is whether to read it
+* fail closed; see `observedBaselineRefusalReason`'s doc.
+*/
+function hasReasonlessBaselineRefusal(record) {
+	const reason = record?.observedBaselineRefusalReason;
+	return record?.observedBaselineRefused === true && reason !== "unverifiable-parameter" && reason !== "incomplete-resolution";
+}
+/**
 * Returns true when a recorded `DeletionPolicy` should prevent cdkd from
 * deleting the underlying AWS resource. `Retain` and `RetainExceptOnCreate`
 * both keep the resource around; `Delete` / `Snapshot` / undefined all
@@ -15046,7 +15055,10 @@ function positionListByCrossStackSource(bag, source, secrets) {
 function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameGeneration) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source) && (rules.trustAnyExpression || isKnownSecretExpression(source, secretExpressions))) {
-			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) return secrets.get(bag) ?? bag;
+			if (!rules.sourceIsSameGeneration && isSingleDynamicReferenceToken(bag)) {
+				if (!spanNamesResolvableService(bag)) return redactSecretsForState(bag, secrets);
+				return secrets.get(bag) ?? bag;
+			}
 			return source;
 		}
 		return positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration);
@@ -15167,7 +15179,8 @@ function subtreeHasDynamicReference(value) {
 * compiling a pattern per string leaf at the persist choke point, which walks
 * every record. Do NOT call `.exec` / `.test` on this constant — those DO
 * advance `lastIndex`, which is exactly why the shared instance is safe only
-* for `.match`.
+* for `.match`. (ONE site does, `resolvableReferenceSpans`, and it resets
+* `lastIndex` to 0 in the statement after the `exec`.)
 *
 * Widening it changes one answer, in the SAFE direction for BOTH readers.
 *
@@ -15656,6 +15669,57 @@ const SECRET_BEARING_REFERENCE_PREFIXES = [
 	"{{resolve:ssm:"
 ];
 /**
+* Does this complete `{{resolve:...}}` token name a service cdkd RESOLVES?
+*
+* The value scan spares a needle match lying inside a token, so that a
+* plaintext coinciding with a real reference's own text is not spliced into
+* it (issue #1935). That protection is owed to a REFERENCE only. A token of
+* any other service is left in place by the resolver, so text inside it is
+* ordinary persisted text, and a recorded plaintext there must be redacted
+* (issue [#2743](https://github.com/go-to-k/cdkd/issues/2743)).
+*/
+function spanNamesResolvableService(token) {
+	return SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => token.startsWith(prefix));
+}
+/**
+* The spans of `value` the value scan must not splice a needle into: every
+* complete token of a resolvable service.
+*
+* Two scans, unioned. The ordinary one ({@link dynamicReferenceSpans}) is
+* LEFTMOST, so behind an opener of an unresolvable service it reports one
+* outer span and never sees a REAL reference nested in it — which is exactly
+* the text this module writes when it redacts `{{resolve:<plaintext>}}` to
+* `{{resolve:{{resolve:secretsmanager:...}}}}`. Dropping that outer span
+* alone would leave the nested reference unprotected, and a later pass whose
+* map holds a needle occurring in the reference's own text (`password` is an
+* ordinary JSON key AND an ordinary secret value) would splice into it, again
+* on every pass. The second scan starts only at a resolvable-service opener,
+* so it finds the nested reference — and keeps it only when it is an
+* expression of the pass's own map (see the loop).
+*
+* On a leaf with no unresolvable-service opener the two scans report the same
+* spans, so every leaf issue #1935 protects is answered exactly as before.
+*/
+function resolvableReferenceSpans(value, vouchedExpressions) {
+	const spans = dynamicReferenceSpans(value).filter((span) => spanNamesResolvableService(value.slice(span.start, span.end)));
+	const starts = new Set(spans.map((span) => span.start));
+	for (const prefix of SECRET_BEARING_REFERENCE_PREFIXES) for (let at = value.indexOf(prefix); at >= 0; at = value.indexOf(prefix, at + 1)) {
+		if (starts.has(at)) continue;
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = at;
+		const match = DYNAMIC_REFERENCE_TOKEN_SCAN.exec(value);
+		DYNAMIC_REFERENCE_TOKEN_SCAN.lastIndex = 0;
+		if (match?.index !== at) continue;
+		const end = at + match[0].length;
+		if (!vouchedExpressions.has(value.slice(at, end))) continue;
+		spans.push({
+			start: at,
+			end
+		});
+		starts.add(at);
+	}
+	return spans;
+}
+/**
 * The prefixes whose SPELLING settles secret-ness, with no lookup and no
 * inference — the subset of {@link SECRET_BEARING_REFERENCE_PREFIXES} that
 * {@link expressionSecretIsInferred} treats as certain.
@@ -16060,7 +16124,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 */
 function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
 	if (typeof value === "string") {
-		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value) || sourceLiterals.has(value)) return value;
 		if (value === "") return value;
 		return mark ? POSITION_UNCERTIFIED : "***";
 	}
@@ -16362,6 +16426,16 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   security review, and the reason the rule is one predicate over the whole
 	*   leaf rather than a split.
 	* - **disjoint from every span** -> REPLACED. The ordinary embedded secret.
+	* - **inside a span whose service cdkd does not resolve** -> REPLACED (issue
+	*   [#2743](https://github.com/go-to-k/cdkd/issues/2743)). Such a span is not
+	*   a reference: `{{resolve:<plaintext>}}` is what an `Fn::Sub` putting a
+	*   resolved secret in the SERVICE position assembled, and sparing it
+	*   persisted the plaintext. The result, `{{resolve:{{resolve:...}}}}`, is
+	*   garbage but not plaintext, the same trade as the stray-opener residual
+	*   below; the REAL reference nested in it is protected again
+	*   ({@link resolvableReferenceSpans}). The cost: an untainted look-alike
+	*   token whose text coincides with a recorded secret is rewritten like any
+	*   other text, and a replay then sends the rewritten literal.
 	*
 	* Scanning the WHOLE leaf in ONE pass is also what preserves what needle
 	* PRECEDENCE there is. {@link buildNeedleRegex} sorts alternatives
@@ -16390,8 +16464,9 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	*   PLAINTEXT behind two characters any string can contain.
 	* - **a later `}}` anywhere in the leaf** -> the opener and that `}}` form
 	*   ONE span swallowing everything between them, so a needle in that region
-	*   is KEPT — the only shape where this rule redacts LESS than the code it
-	*   replaced. Narrow but real, and the reachable carrier is named rather than
+	*   is KEPT when the opener spells a resolvable service (`{{resolve:ssm:`
+	*   ...; any other opener is the unresolvable-service row above) — the only
+	*   shape where this rule redacts LESS than the code it replaced. Narrow but real, and the reachable carrier is named rather than
 	*   waved at: the resolver shares this grammar, so such a leaf could not have
 	*   resolved on the deploy path, which leaves an `observedProperties`
 	*   READBACK (arbitrary text from AWS) as the way one arrives.
@@ -16402,8 +16477,10 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	* contradicting this change's own "not repaired, not made worse" property.
 	* So the residual is documented, not fixed.
 	*/
+	let vouched;
+	const vouchedExpressions = () => vouched ??= new Set(secrets.values());
 	const scanLeaf = (value, needles) => {
-		const spans = isDynamicReferenceString(value) ? dynamicReferenceSpans(value) : [];
+		const spans = isDynamicReferenceString(value) ? resolvableReferenceSpans(value, vouchedExpressions()) : [];
 		return value.replace(needles, (match, offset) => {
 			const end = offset + match.length;
 			if (spans.some((span) => span.start <= offset && end <= span.end && (span.start !== offset || span.end !== end))) return match;
@@ -16414,7 +16491,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		if (typeof value === "string") {
 			const whole = wholeValueExpr(value);
 			if (whole !== void 0) return whole;
-			if (isSingleDynamicReferenceToken(value)) return value;
+			if (isSingleDynamicReferenceToken(value) && spanNamesResolvableService(value)) return value;
 			if (!regex) return value;
 			regex.lastIndex = 0;
 			if (!regex.test(value)) return value;
@@ -27765,7 +27842,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	/** Recursively resolve a value. */
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
-			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
+			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveTemplateLeafReferences(value, context);
 			return value;
 		}
 		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
@@ -31073,7 +31150,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	displayLeaf(value, context) {
 		return this.displayMasked(this.logTextOfLeaf(value, context), context);
 	}
+	/**
+	* Resolve the dynamic references of a PERSISTED string leaf: text read back
+	* out of a state record, a rollback journal or a producer stack's outputs.
+	* That is what every caller of this method hands it (`cdkd drift`, the
+	* rollback replay, `cdkd scrub`'s per-token delegation, the cross-stack
+	* re-resolution); a TEMPLATE leaf goes through {@link resolve}, which takes
+	* {@link resolveTemplateLeafReferences}.
+	*
+	* The distinction is load-bearing for ONE arm (issue #2743). A token of a
+	* service cdkd does not resolve is REFUSED on the template route when it
+	* holds a secret, because leaving it would send that secret to AWS for the
+	* first time. Persisted text is different on both counts: AWS already holds
+	* it, so refusing buys no confidentiality, and the refusal is DETERMINISTIC
+	* there -- a journal `previousState` holding `{{resolve:<plaintext>}}` beside
+	* the reference that resolves to it would fail its rollback op on every
+	* retry, where replaying the literal is a correct no-op. So this entry point
+	* keeps the warn-and-leave for every such token, and the value scan redacts
+	* whatever is persisted afterwards.
+	*/
 	async resolveDynamicReferences(value, context) {
+		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context, void 0, true)).result;
+	}
+	/** A TEMPLATE string leaf: the refusing route (see {@link resolveDynamicReferences}). */
+	async resolveTemplateLeafReferences(value, context) {
 		return (await this.resolveDynamicReferencesWithLogTwin(value, value, context)).result;
 	}
 	/**
@@ -31096,7 +31196,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* NEEDLE match that straddles a masked span, which is why the log lines go
 	* through `logTwinText` rather than masking the twin alone.
 	*/
-	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited) {
+	async resolveDynamicReferencesWithLogTwin(value, logTwin, context, inherited, persistedText = false) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let twin = logTwin;
@@ -31127,7 +31227,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
 						tokenLogText,
 						nameLogText
-					});
+					}, persistedText);
 					result = result.replace(fullMatch, () => foreign.result);
 					twin = twin.replace(fullMatch, () => foreign.twin);
 					const [delegated] = foreign.substitutions;
@@ -31191,6 +31291,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					isSecret = true;
 					resolved = param.value;
 				} else {
+					if (!persistedText && (tokenLogText !== fullMatch || this.maskNeedlesForLog(fullMatch, context) !== fullMatch)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.displayMasked(tokenLogText, context)}: its service is not one cdkd resolves (secretsmanager, ssm, ssm-secure), and the reference was assembled from a secret value, so leaving it as written would send that value to AWS and record it in state in the clear.`));
 					this.logger.warn(this.displayMasked(`Unsupported dynamic reference service: ${this.displayMasked(nameLogText(String(service)), context)}`, context));
 					complete = false;
 					continue;
@@ -33143,7 +33244,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DWY8_Kn4.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B70ujDSS.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -40123,6 +40224,294 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/parameter-dependence.ts
+/**
+* The PARAMETER-DEPENDENCE WALK: which resources of a raw template depend on
+* which template parameters (issues
+* [#2854](https://github.com/go-to-k/cdkd/issues/2854),
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)).
+*
+* Pure template analysis with two consumers that must agree: `cdkd import`'s
+* ARM 4 (`src/cli/commands/import-deployed-parameters.ts` supplies the
+* divergent parameter set from `DescribeStacks`) and `cdkd deploy`'s reading of
+* a REASON-LESS `observedBaselineRefused` marker, which has no deployed values
+* at all and therefore treats every declared parameter as divergent
+* ({@link resourcesNamingDeclaredParameter}). It lives in this layer because
+* `src/deployment` may not import from `src/cli`.
+*
+* TAINT THROUGH ANOTHER RESOURCE'S ATTRIBUTES IS FOLLOWED within one stack: the
+* walk records the target of every `Fn::GetAtt` / `${A.Attr}`, and the refused
+* set is closed over those targets. A plain `Ref` of a resource is NOT
+* followed: it yields the physical id, and a secret used as a resource NAME is
+* already disclosed by the identifier itself.
+*/
+/**
+* Every intrinsic the dependence walk knows how to read. An `Fn::`-prefixed
+* key OUTSIDE this list is unclassifiable: it may name a parameter in a way
+* the generic recursion cannot see, so the walk fails closed on it.
+*/
+const KNOWN_INTRINSICS = /* @__PURE__ */ new Set([
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+]);
+/** `${Name}` / `${Name.Attr}` in an `Fn::Sub` string; `${!Literal}` is an escape. */
+const SUB_VARIABLE = /\$\{([^!}][^}]*)\}/g;
+/**
+* Which names (parameters, but also resources and pseudo parameters — the
+* caller intersects with the divergent set) the RAW `Properties` of a resource
+* depend on, plus its resource-level `Condition`.
+*
+* Generic by design: instead of modelling each intrinsic's argument grammar it
+* recurses into EVERY value, so a `Ref` nested in an `Fn::Join` / `Fn::Select`
+* / `Fn::Split` operand, an `Fn::FindInMap` key, or an `Fn::Sub` variable-map
+* value is found without being named. Only the three forms that name something
+* by BARE STRING need their own arm: `Ref`, `Fn::Sub`'s template text, and a
+* condition name (`Fn::If`'s first argument, and `Condition` inside the
+* `Conditions` section), which is followed transitively through
+* `template.Conditions`.
+*
+* May throw `RangeError` on a bag deeper than the call stack; the caller wraps
+* it fail-closed, like the discard walk beside it.
+*/
+function collectParameterDependencies(properties, resourceCondition, template) {
+	const names = /* @__PURE__ */ new Set();
+	const attributeTargets = /* @__PURE__ */ new Set();
+	const visitedConditions = /* @__PURE__ */ new Set();
+	let unclassifiable = false;
+	const conditions = template.Conditions !== null && typeof template.Conditions === "object" ? template.Conditions : {};
+	const followCondition = (name) => {
+		if (typeof name !== "string") {
+			unclassifiable = true;
+			return;
+		}
+		if (visitedConditions.has(name)) return;
+		visitedConditions.add(name);
+		if (!Object.hasOwn(conditions, name)) {
+			unclassifiable = true;
+			return;
+		}
+		walk(conditions[name], true);
+	};
+	const walk = (node, inConditions) => {
+		if (node === null || typeof node !== "object") return;
+		if (Array.isArray(node)) {
+			for (const element of node) walk(element, inConditions);
+			return;
+		}
+		for (const [key, value] of Object.entries(node)) {
+			if (key === "Ref") {
+				if (typeof value === "string") names.add(value);
+				else unclassifiable = true;
+				continue;
+			}
+			if (key === "Fn::Sub") {
+				const text = Array.isArray(value) ? value[0] : value;
+				if (typeof text !== "string" || Array.isArray(value) && value.length !== 2) unclassifiable = true;
+				else for (const match of text.matchAll(SUB_VARIABLE)) {
+					const variable = (match[1] ?? "").trim();
+					names.add(variable);
+					const dot = variable.indexOf(".");
+					if (dot > 0) {
+						names.add(variable.slice(0, dot));
+						attributeTargets.add(variable.slice(0, dot));
+					}
+				}
+				if (Array.isArray(value)) walk(value[1], inConditions);
+				continue;
+			}
+			if (key === "Fn::GetAtt") {
+				const target = Array.isArray(value) ? value[0] : value;
+				if (typeof target === "string") {
+					const dot = target.indexOf(".");
+					const logicalId = Array.isArray(value) || dot <= 0 ? target : target.slice(0, dot);
+					names.add(logicalId);
+					attributeTargets.add(logicalId);
+				} else unclassifiable = true;
+				walk(value, inConditions);
+				continue;
+			}
+			if (key === "Fn::If") {
+				if (Array.isArray(value) && value.length === 3) {
+					followCondition(value[0]);
+					walk(value[1], inConditions);
+					walk(value[2], inConditions);
+				} else unclassifiable = true;
+				continue;
+			}
+			if (key === "Condition" && inConditions) {
+				followCondition(value);
+				continue;
+			}
+			if (key.startsWith("Fn::") && !KNOWN_INTRINSICS.has(key)) unclassifiable = true;
+			walk(value, inConditions);
+		}
+	};
+	walk(properties, false);
+	if (resourceCondition !== void 0) followCondition(resourceCondition);
+	return {
+		names,
+		attributeTargets,
+		unclassifiable
+	};
+}
+/**
+* The divergent parameters that ANYTHING in the template names. A declared
+* parameter nothing names cannot have shaped a resource — and CDK's
+* `BootstrapVersion` is exactly that on every default-synthesized stack: SSM
+* typed, never bound by the resolver because nothing references it, hence
+* always "divergent". Left in, it would arm the unclassifiable-shape refusal on
+* stacks whose every real parameter is proven.
+*
+* "Names" is the UNION of this module's walk and `TemplateParser`'s reference
+* scan — the same scan the resolver uses to decide an SSM-typed parameter is
+* unreferenced — so the two cannot disagree about `BootstrapVersion`. An
+* unclassifiable shape does NOT keep the whole set here: CloudFormation names a
+* parameter only through `Ref`, `Fn::Sub` text or a condition, and the generic
+* recursion reads those inside any intrinsic, known or not. A walk that THROWS
+* keeps the whole set (fail closed).
+*/
+function reachableDivergentParameters(template, divergent, rawBags) {
+	if (divergent.size === 0) return /* @__PURE__ */ new Set();
+	try {
+		const roots = [
+			rawBags,
+			template.Resources,
+			template.Outputs,
+			template.Conditions
+		];
+		const named = new Set(collectParameterDependencies(roots, void 0, template).names);
+		const parser = new TemplateParser();
+		for (const root of roots) {
+			if (root === null || typeof root !== "object") continue;
+			for (const name of parser.extractReferences(root)) named.add(name);
+		}
+		return new Set([...divergent].filter((name) => named.has(name)));
+	} catch {
+		return new Set(divergent);
+	}
+}
+/** Whether any DECLARED parameter is named by anything in the template. */
+function namesAnyDeclaredParameter(template) {
+	const declared = template.Parameters;
+	if (declared === null || typeof declared !== "object") return false;
+	const names = new Set(Object.keys(declared));
+	return names.size > 0 && reachableDivergentParameters(template, names, []).size > 0;
+}
+/**
+* The per-stack ARM 4 verdict. Each resource is judged on its TEMPLATE
+* definition (`Properties` + `Condition`) AND on the raw bag the state record
+* carries, unioned: a record preserved by a selective merge holds a previous
+* run's RESOLVED literal (`Value: 'CHANGEME'`), which names no parameter, so
+* judging it on the state bag alone would leave nothing to carry to the
+* freshly imported resource that reads its attribute. Template resources that
+* are not in state at all are judged too, for the same reason.
+*
+* Seeds are direct dependents and unclassifiable bags (a bag that cannot be
+* read cannot be vouched for, and neither can what reads its attributes); the
+* refused set is then closed over ATTRIBUTE reads, to a fixpoint.
+*/
+function computeParameterTaint(template, stateBags, divergent) {
+	const refused = /* @__PURE__ */ new Set();
+	const unclassifiable = /* @__PURE__ */ new Set();
+	const parametersHit = /* @__PURE__ */ new Set();
+	if (divergent.size === 0) return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+	const templateResources = template.Resources !== null && typeof template.Resources === "object" ? template.Resources : {};
+	const readers = /* @__PURE__ */ new Map();
+	for (const logicalId of /* @__PURE__ */ new Set([...Object.keys(templateResources), ...stateBags.keys()])) {
+		const definition = Object.hasOwn(templateResources, logicalId) ? templateResources[logicalId] : void 0;
+		const record = definition !== null && typeof definition === "object" ? definition : {};
+		try {
+			const dependencies = collectParameterDependencies([record["Properties"], stateBags.get(logicalId)], record["Condition"], template);
+			readers.set(logicalId, new Set(dependencies.attributeTargets));
+			const hits = [...dependencies.names].filter((name) => divergent.has(name));
+			for (const name of hits) parametersHit.add(name);
+			if (hits.length > 0) refused.add(logicalId);
+			else if (dependencies.unclassifiable) {
+				refused.add(logicalId);
+				unclassifiable.add(logicalId);
+			}
+		} catch {
+			refused.add(logicalId);
+			unclassifiable.add(logicalId);
+		}
+	}
+	for (let grew = refused.size > 0; grew;) {
+		grew = false;
+		for (const [logicalId, targets] of readers) {
+			if (refused.has(logicalId)) continue;
+			if (![...targets].some((target) => refused.has(target))) continue;
+			refused.add(logicalId);
+			grew = true;
+		}
+	}
+	return {
+		refused,
+		unclassifiable,
+		parametersHit
+	};
+}
+/**
+* The reading of a REASON-LESS `observedBaselineRefused` marker (issue
+* [#3468](https://github.com/go-to-k/cdkd/issues/3468)): which resources'
+* TEMPLATE definitions name a declared parameter, judged with NO deployed
+* values at hand — so every declared parameter anything names is divergent.
+* The answer is {@link computeParameterTaint}'s whole refused set: direct
+* dependents, unclassifiable bags, and attribute readers of either. Pseudo
+* parameters never count (the hit test intersects with DECLARED names) and
+* neither does a parameter nothing names, CDK's Rules-only `BootstrapVersion`
+* included.
+*
+* AN UNCLASSIFIABLE BAG COUNTS ONLY WHEN SOME DECLARED PARAMETER IS NAMED
+* SOMEWHERE in the template, exactly as in ARM 4, and deliberately: this set
+* has to cover what an older import's ARM 4 can have marked ON TEMPLATE
+* EVIDENCE (ARM 4 also read the state bags; a deploy's are resolved literals,
+* so they are not read here), and ARM 4 never ran on a template in which
+* nothing names a declared parameter. Counting the
+* bag regardless would make an old refusal of the other class sticky on every
+* CDK stack (each declares `BootstrapVersion`) and protect nothing.
+*
+* FAILS CLOSED, and never throws: a missing or unreadable template, a
+* `Resources` section that is not an object, or a walk that throws answers
+* `true` for every logical id, and says so in `failedClosed` — a cause CLASS,
+* never a template value or an error message. Absent from a readable
+* template's `Resources` answers `false` — that resource is being removed, and
+* a DELETE reads no baseline.
+*/
+function resourcesNamingDeclaredParameter(template) {
+	const everything = (failedClosed) => Object.assign(() => true, { failedClosed });
+	try {
+		if (template === void 0 || template === null || typeof template !== "object") return everything("unreadable-template");
+		const resources = template.Resources;
+		if (resources === null || typeof resources !== "object" || Array.isArray(resources)) return everything("unreadable-template");
+		const parameters = template.Parameters;
+		if (parameters !== void 0 && (parameters === null || typeof parameters !== "object" || Array.isArray(parameters))) return everything("unreadable-template");
+		const divergent = reachableDivergentParameters(template, new Set(Object.keys(parameters ?? {})), []);
+		const refused = computeParameterTaint(template, /* @__PURE__ */ new Map(), divergent).refused;
+		return Object.assign((logicalId) => refused.has(logicalId), { failedClosed: void 0 });
+	} catch {
+		return everything("walk-threw");
+	}
+}
+
 //#endregion
 //#region src/analyzer/skipped-outputs.ts
 /**
@@ -44400,6 +44789,47 @@ var DeployEngine = class DeployEngine {
 		return Object.keys(siblings).length > 0 ? { siblings } : void 0;
 	}
 	/**
+	* Issue [#3468](https://github.com/go-to-k/cdkd/issues/3468) — the
+	* fail-closed reading of a REASON-LESS `observedBaselineRefused` marker.
+	*
+	* cdkd 0.290.35 wrote unverifiable-parameter refusals with no reason, so an
+	* absent reason cannot be read as "an UPDATE may clear it". A reason-less
+	* marker on a resource whose TEMPLATE definition names a declared parameter
+	* is stamped `'unverifiable-parameter'` here, IN MEMORY, once, before the
+	* diff: every later arm (the in-place rebuild, the metadata-only spread, the
+	* NO_CHANGE carry, the auto-refresh) then sees the explicit form and needs
+	* no rule of its own, and whatever this deploy saves holds it — the record
+	* heals into the form later binaries read directly. Nothing is saved FOR the
+	* stamp: a deploy that writes no state (`--dry-run`, no changes) re-derives
+	* it next time.
+	*
+	* The template is the RAW one `deploy()` was handed (a nested child engine
+	* gets its own), which is what the dependence walk needs. A template that
+	* cannot be read, or a walk that throws, stamps every reason-less marker
+	* (`resourcesNamingDeclaredParameter` fails closed). A record whose logical
+	* id the template no longer defines is being DELETED and is left alone.
+	*
+	* The RECORD object is replaced, not mutated (a per-record alias taken
+	* before this line keeps what was loaded); the container is updated in
+	* place, which is what lets every later reader of it see the stamp.
+	*/
+	stampReasonlessParameterRefusals(stateResources, template) {
+		let namesParameter;
+		let stamped = 0;
+		for (const [logicalId, resource] of Object.entries(stateResources)) {
+			if (!hasReasonlessBaselineRefusal(resource)) continue;
+			namesParameter ??= resourcesNamingDeclaredParameter(template);
+			if (!namesParameter(logicalId)) continue;
+			stateResources[logicalId] = {
+				...resource,
+				observedBaselineRefusalReason: "unverifiable-parameter"
+			};
+			stamped++;
+		}
+		if (namesParameter?.failedClosed !== void 0) this.logger.debug(`The template's parameter dependence could not be judged (${namesParameter.failedClosed}): every observed-baseline refusal recorded without a reason is treated as an unverifiable-parameter refusal (${stamped} stamped).`);
+		if (stamped > 0) this.logger.debug(`${stamped} resource(s) carry an observed-baseline refusal recorded without a reason by an older cdkd, and their template definition reads a template parameter: treated as an unverifiable-parameter refusal (kept until the resource is replaced or re-imported against a CloudFormation stack that proves the parameter).`);
+	}
+	/**
 	* Kick off `provider.readCurrentState` for every resource in the
 	* loaded state that lacks `observedProperties` (e.g. state written
 	* by a pre-v3 binary, or a v3 record where a NO_CHANGE-skipped
@@ -44509,6 +44939,7 @@ var DeployEngine = class DeployEngine {
 					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — run 'cdkd rollback ${stackName} --revert-failed' to revert it, or continue deploying to fix forward (a successful deploy clears this note).` : `A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
 				}
 			} catch {}
+			this.stampReasonlessParameterRefusals(currentState.resources, template);
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
 			const outputsDigestSource = structuredClone({
@@ -44527,6 +44958,7 @@ var DeployEngine = class DeployEngine {
 			const effectiveTemplate = this.templateParser.filterResourcesByCondition(template, conditions);
 			const orphanCountBeforeAdoption = (currentState.orphans ?? []).length;
 			const orphanPlan = await this.adoptRollbackOrphans(currentState, effectiveTemplate);
+			if (Object.keys(orphanPlan.adopted).length > 0) this.stampReasonlessParameterRefusals(currentState.resources, template);
 			const orphansChanged = Object.keys(orphanPlan.adopted).length > 0 || (currentState.orphans ?? []).length !== orphanCountBeforeAdoption;
 			const resourceTypes = new Set(Object.values(effectiveTemplate.Resources || {}).map((r) => r.Type).filter((type) => type !== "AWS::CDK::Metadata"));
 			this.providerRegistry.validateResourceTypes(resourceTypes);
@@ -46520,5 +46952,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { isExportAliasCollision as $, StackHasActiveImportsError as $i, maskSecretsInText as $n, escapeRegExp$1 as $r, withSharedDrainBudget as $t, makeCanonicalizePropertiesFn as A, clearBucketRegionCache as Ai, refuseMalformedResourcesForDestroy as An, rewriteTemplateAssetReferences as Ar, getAccountInfo as At, isWarmThroughputDecrease as B, DependencyError as Bi, TemplateParser as Bn, validateContainerRepoName as Br, assertRegionMatch as Bt, PRE_DELETE_SNAPSHOT_TYPES as C, decodeListingKey as Ci, malformedStateRefusalMessage as Cn, shouldRetainResource as Cr, disableInstanceApiTermination as Ct, isFinalSnapshotError as D, derivePartitionAndUrlSuffix as Di, refuseMalformedOutputs as Dn, buildAssetRedirectMap as Dr, carriesFetchableDynamicReference as Dt, createPreDeleteFinalSnapshot as E, canonicalizeRegion as Ei, refuseMalformedNestedChildOutputs as En, WorkGraph as Er, carriesDynamicReference as Et, isStatefulRecreateTargetForReplace as F, setAwsClients as Fi, findActionableSilentDrops as Fn, getBootstrapMarkerKey as Fr, refStateLookupFromResource as Ft, cyan as G, LocalStartServiceError as Gi, carriesSecretMask as Gn, describeDockerFailure as Gr, configStringRefusal as Gt, toFiniteNumber as H, DynamicReferenceRegionAmbiguousError as Hi, STATE_SOURCED_CROSS_GENERATION_RULES as Hn, buildDockerImage as Hr, coerceCfnInteger as Ht, isStatefulRecreateTargetSync as I, AssetError as Ii, findSilentDropProperties as In, isCrossRegionRedirect as Ir, isSettledInstanceState as It, red as J, NestedStackChildDirectDestroyError as Ji, errorCauseChain as Jn, getDockerCmd as Jr, requireConfigArray as Jt, gray as K, LockError as Ki, createSecretMasker as Kn, dockerSpawnEnvWithSensitive as Kr, readConfigString as Kt, renderStatefulReason as L, CdkdError as Li, describeTypeWithThrottleRetry as Ln, parseBootstrapMarker as Lr, WAFv2WebACLProvider as Lt, makeSiblingClaimReader as M, AwsClients as Mi, repairMalformedOutputsForReadOnly as Mn, BOOTSTRAP_MARKER_PREFIX as Mr, isNamelessDynamicReferenceError as Mt, planOrphanAdoption as N, getAwsClients as Ni, repairMalformedResourcePropertiesForReadOnly as Nn, assertAssetBucketRegion as Nr, isUnboundTemplateParameter as Nt, refusesFinalSnapshot as O, AssemblyReader as Oi, refuseMalformedOutputsForDestroy as On, createAssetRedirectResolver as Or, cfnRefValueFromPhysicalId as Ot, MULTI_REGION_RECREATE_BLOCKED_TYPES as P, resetAwsClients as Pi, repairMalformedResourcesForReadOnly as Pn, ensureAssetStorage as Pr, parameterTypeMayLoseSecretIdentity as Pt, exportAliasCollisionScrubWarning as Q, ResourceUpdateNotSupportedError as Qi, maskSecretsInError as Qn, runDockerStreaming as Qr, producerRegionsFromState as Qt, WARM_THROUGHPUT_MEMBERS as R, ConfigError as Ri, withRetry as Rn, readBootstrapMarkerBody as Rr, normalizeAwsTagsToCfn as Rt, ATOMIC_FINAL_SNAPSHOT_TYPES as S, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Si, malformedResourcesWarning as Sn, orphansCarriedFrom as Sr, deleteSkipReason as St, ccRoutedFinalSnapshotError as T, PARTITION_TABLE as Ti, refuseDivergentRecordRegionForDestroy as Tn, stringifyValue as Tr, IntrinsicFunctionResolver as Tt, formatResourceLine as U, IntrinsicResolutionRefusalError as Ui, STATE_SOURCED_READBACK_RULES as Un, describeDockerCapturedOutput as Ur, configBooleanRefusal as Ut, toCfnInteger as V, DeployCancelledError as Vi, STATE_SOURCED_BASELINE_RULES as Vn, buildDenyExternalAccessPolicy as Vr, coerceCfnBoolean as Vt, bold as W, LocalInvokeBuildError as Wi, TEMPLATE_SOURCED_RULES as Wn, describeDockerExecFailure as Wr, configIntegerRefusal as Wt, collectDeclaredOutputNames as X, ProvisioningError as Xi, isSingleDynamicReferenceToken as Xn, redactDockerArgvValues as Xr, requireConfigString as Xt, yellow as Y, PartialFailureError as Yi, identityKeyFor as Yn, partitionSensitiveEnv as Yr, requireConfigObject as Yt, collectPublishedOutputNames as Z, ResourceTimeoutError as Zi, markSameGenerationBag as Zn, runDockerForeground as Zr, classifyReplaySecretRegion as Zt, bagHoldsSecretExpression as _, CFN_TEMPLATE_BODY_LIMIT as _i, malformedLocalOutputsWarning as _n, hasUnverifiableParameterRefusal as _r, CloudControlProvider as _t, DeploymentEventsStore as a, normalizeAwsError as aa, getDefaultStateBucketName as ai, applyRoleArnIfSet as an, S3StateBackend as ar, collectInlinePolicyNamesManagedBySiblings as at, mergeNoChangeOutputs as b, findLargeInlineResources as bi, malformedRenderedContainersWarning as bn, isReadableBag as br, UNSPECIFIED_SKIP_REASON as bt, replayFailedOperations as c, isRetryableTransientError as ca, resolveAutoAssetStorage as ci, callerEnvCredentials as cn, buildForceUnlockCommand as cr, wouldReturnToSdkProvider as ct, updatePartialMessage as d, markNonRetryable as da, resolveStateBucketWithDefault as di, INTRINSIC_KEYS as dn, formatLockExpiry as dr, maskerOrIdentity as dt, StackTerminationProtectionError as ea, stripControlChars as ei, s3BucketArn as en, recordMaskOnlyValue as er, secretBearing as et, updatePartialReason as f, markRedactedCause as fa, resolveStateBucketWithDefaultAndSource as fi, STATE_RESOURCES_MALFORMED as fn, shellQuote as fr, beginCommandInterruptScope as ft, computeImplicitDeleteEdges as g, __exportAll as ga, ssmResolvedValueType as gi, malformedExportSourceWarning as gn, hasReadableExportSet as gr, startInterruptWatch as gt, IMPLICIT_DELETE_DEPENDENCIES as h, safeStringify$1 as ha, warnDeprecatedNoPrefixCliFlag as hi, malformedExportNamesWarning as hn, exportNamesCarriedFrom as hr, isInterruptedWaitError as ht, DeploymentEventsReader as i, isCdkdError as ia, synthesisStatusMessage as ii, s3BucketWebsiteUrl as in, LockManager as ir, IAMRoleProvider as it, extractDeploymentEventError as j, resolveBucketRegion as ji, refuseMalformedState as jn, AssetModeResolver as jr, isImpossibleEmptyStoredAttribute as jt, unsupportedFinalSnapshotError as k, processStackMessages as ki, refuseMalformedResourcePropertiesForOrphan as kn, loadPublishableAssetManifest as kr, coerceParameterTypedValue as kt, replayRollback as l, isThrottlingError as la, resolveCaptureObservedState as li, envCredentialsAreAssumedRole as ln, buildLockContentionMessage as lr, createMaskedRetryLogger as lt, maskingRetryLogger as m, describeAwsFailure as ma, stateBucketExistenceConfirmed as mi, hasReadableResources as mn, DEFAULT_STATE_PREFIX as mr, interruptWatchListenerCount as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, SynthesisError as na, getDockerImageBySourceHash as ni, s3BucketDualStackDomainName as nn, redactSecretsForState as nr, secretSafeKeyDisplay as nt, planFailedOps as o, withErrorHandling as oa, getLegacyStateBucketName as oi, AWS_CREDENTIAL_ENV_KEYS as on, rebuildClientForBucketRegion as or, clearOnUpdateRemoval as ot, withResourceDeadline as p, retryClassificationText as pa, resolveUseCdkBootstrapAssets as pi, hasReadableOutputs as pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as pr, endCommandInterruptScope as pt, green as q, MalformedProducerRecordRefusalError as qi, dynamicReferenceTokens as qn, formatDockerLoginError as qr, replayWarn as qt, DeployEngine as r, formatError as ra, Synthesizer as ri, s3BucketRegionalDomainName as rn, scrubResourceRecord as rr, getCurrentResourceSecrets as rt, planRollback as s, isMarkedNonRetryable as sa, resolveApp as si, applyCallerIdentityCredentials as sn, UNREPRODUCIBLE_LOCK_CLAUSE as sr, ProviderRegistry as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StateError as ta, AssetManifestLoader as ti, s3BucketDomainName as tn, recoverMaskedOutput as tr, secretBearingStateKeyWarning as tt, resolveReplacementOldType as u, isTransientServerError as ua, resolveSkipPrefix as ui, DiffCalculator as un, forceQuitRecoveryClause as ur, maskDeep as ut, isSecretBearingReferenceString as v, CFN_TEMPLATE_URL_LIMIT as vi, malformedOutputsRefusalMessage as vn, importableOutputKeys as vr, isWaitAbandonedError as vt, buildFinalSnapshotIdentifier as w, expectedOwnerParam as wi, producerRecordKey as wn, AssetPublisher as wr, isTerminationProtectionPropagationError as wt, bindingSkippedOutputs as x, uploadCfnTemplate as xi, malformedResourcePropertiesWarning as xn, orphansAfterRollback as xr, deleteIndeterminateGuards as xt, keptWholeReasonText as y, MIGRATE_TMP_PREFIX as yi, malformedOutputsWarning as yn, importableOutputs as yr, slowCcOperationTimeoutMs as yt, coerceWarmThroughput as z, CrossAccountSecretRefusalError as zi, DagBuilder as zn, validateAssetBucketName as zr, resolveExplicitPhysicalId as zt };
-//# sourceMappingURL=deploy-engine-tX_-qy5a.js.map
+export { yellow as $, NestedStackChildDirectDestroyError as $i, identityKeyFor as $n, getDockerCmd as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, PARTITION_TABLE as Ai, refuseMalformedNestedChildOutputs as An, stringifyValue as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, setAwsClients as Bi, findSilentDropProperties as Bn, getBootstrapMarkerKey as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CFN_TEMPLATE_URL_LIMIT as Ci, malformedOutputsWarning as Cn, importableOutputKeys as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Di, malformedStateRefusalMessage as Dn, orphansCarriedFrom as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, uploadCfnTemplate as Ei, malformedResourcesWarning as En, orphansAfterRollback as Er, deleteSkipReason as Et, extractDeploymentEventError as F, clearBucketRegionCache as Fi, refuseMalformedState as Fn, rewriteTemplateAssetReferences as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, DependencyError as Gi, STATE_SOURCED_BASELINE_RULES as Gn, validateContainerRepoName as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, CdkdError as Hi, withRetry as Hn, parseBootstrapMarker as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, resolveBucketRegion as Ii, repairMalformedOutputsForReadOnly as In, AssetModeResolver as Ir, isNamelessDynamicReferenceError as It, bold as J, IntrinsicResolutionRefusalError as Ji, TEMPLATE_SOURCED_RULES as Jn, describeDockerCapturedOutput as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, DeployCancelledError as Ki, STATE_SOURCED_CROSS_GENERATION_RULES as Kn, buildDenyExternalAccessPolicy as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, AwsClients as Li, repairMalformedResourcePropertiesForReadOnly as Ln, BOOTSTRAP_MARKER_PREFIX as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, derivePartitionAndUrlSuffix as Mi, refuseMalformedOutputsForDestroy as Mn, buildAssetRedirectMap as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, AssemblyReader as Ni, refuseMalformedResourcePropertiesForOrphan as Nn, createAssetRedirectResolver as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, decodeListingKey as Oi, producerRecordKey as On, shouldRetainResource as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, processStackMessages as Pi, refuseMalformedResourcesForDestroy as Pn, loadPublishableAssetManifest as Pr, getAccountInfo as Pt, red as Q, MalformedProducerRecordRefusalError as Qi, errorCauseChain as Qn, formatDockerLoginError as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, getAwsClients as Ri, repairMalformedResourcesForReadOnly as Rn, assertAssetBucketRegion as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CFN_TEMPLATE_BODY_LIMIT as Si, malformedOutputsRefusalMessage as Sn, hasUnverifiableParameterRefusal as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, findLargeInlineResources as Ti, malformedResourcePropertiesWarning as Tn, isReadableBag as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, ConfigError as Ui, DagBuilder as Un, readBootstrapMarkerBody as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, AssetError as Vi, describeTypeWithThrottleRetry as Vn, isCrossRegionRedirect as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, CrossAccountSecretRefusalError as Wi, TemplateParser as Wn, validateAssetBucketName as Wr, assertRegionMatch as Wt, gray as X, LocalStartServiceError as Xi, createSecretMasker as Xn, describeDockerFailure as Xr, readConfigString as Xt, cyan as Y, LocalInvokeBuildError as Yi, carriesSecretMask as Yn, describeDockerExecFailure as Yr, configStringRefusal as Yt, green as Z, LockError as Zi, dynamicReferenceTokens as Zn, dockerSpawnEnvWithSensitive as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, markRedactedCause as _a, resolveStateBucketWithDefaultAndSource as _i, hasReadableOutputs as _n, CUSTOM_RESOURCE_RESPONSE_PREFIX as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, StackTerminationProtectionError as aa, stripControlChars as ai, s3BucketDomainName as an, recoverMaskedOutput as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, safeStringify$1 as ba, warnDeprecatedNoPrefixCliFlag as bi, malformedExportSourceWarning as bn, hasReadableExportSet as br, startInterruptWatch as bt, replayFailedOperations as c, formatError as ca, Synthesizer as ci, s3BucketWebsiteUrl as cn, LockManager as cr, IAMRoleProvider as ct, updatePartialMessage as d, withErrorHandling as da, getLegacyStateBucketName as di, applyCallerIdentityCredentials as dn, UNREPRODUCIBLE_LOCK_CLAUSE as dr, ProviderRegistry as dt, PartialFailureError as ea, partitionSensitiveEnv as ei, requireConfigString as en, isSingleDynamicReferenceToken as er, collectDeclaredOutputNames as et, updatePartialReason as f, isMarkedNonRetryable as fa, resolveApp as fi, callerEnvCredentials as fn, buildForceUnlockCommand as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, markNonRetryable as ga, resolveStateBucketWithDefault as gi, STATE_RESOURCES_MALFORMED as gn, shellQuote as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, isTransientServerError as ha, resolveSkipPrefix as hi, INTRINSIC_KEYS as hn, formatLockExpiry as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, StackHasActiveImportsError as ia, escapeRegExp$1 as ii, s3BucketArn as in, recordMaskOnlyValue as ir, secretBearing as it, isFinalSnapshotError as j, canonicalizeRegion as ji, refuseMalformedOutputs as jn, WorkGraph as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, expectedOwnerParam as ki, refuseDivergentRecordRegionForDestroy as kn, AssetPublisher as kr, IntrinsicFunctionResolver as kt, replayRollback as l, isCdkdError as la, synthesisStatusMessage as li, applyRoleArnIfSet as ln, S3StateBackend as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, isThrottlingError as ma, resolveCaptureObservedState as mi, DiffCalculator as mn, forceQuitRecoveryClause as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceTimeoutError as na, runDockerForeground as ni, producerRegionsFromState as nn, maskSecretsInError as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, StateError as oa, AssetManifestLoader as oi, s3BucketDualStackDomainName as on, redactSecretsForState as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, isRetryableTransientError as pa, resolveAutoAssetStorage as pi, envCredentialsAreAssumedRole as pn, buildLockContentionMessage as pr, createMaskedRetryLogger as pt, formatResourceLine as q, DynamicReferenceRegionAmbiguousError as qi, STATE_SOURCED_READBACK_RULES as qn, buildDockerImage as qr, configBooleanRefusal as qt, DeployEngine as r, ResourceUpdateNotSupportedError as ra, runDockerStreaming as ri, withSharedDrainBudget as rn, maskSecretsInText as rr, isExportAliasCollision as rt, planRollback as s, SynthesisError as sa, getDockerImageBySourceHash as si, s3BucketRegionalDomainName as sn, scrubResourceRecord as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ProvisioningError as ta, redactDockerArgvValues as ti, classifyReplaySecretRegion as tn, markSameGenerationBag as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, normalizeAwsError as ua, getDefaultStateBucketName as ui, AWS_CREDENTIAL_ENV_KEYS as un, rebuildClientForBucketRegion as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, retryClassificationText as va, resolveUseCdkBootstrapAssets as vi, hasReadableResources as vn, DEFAULT_STATE_PREFIX as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, MIGRATE_TMP_PREFIX as wi, malformedRenderedContainersWarning as wn, importableOutputs as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, __exportAll as xa, ssmResolvedValueType as xi, malformedLocalOutputsWarning as xn, hasReasonlessBaselineRefusal as xr, CloudControlProvider as xt, keptWholeReasonText as y, describeAwsFailure as ya, stateBucketExistenceConfirmed as yi, malformedExportNamesWarning as yn, exportNamesCarriedFrom as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, resetAwsClients as zi, findActionableSilentDrops as zn, ensureAssetStorage as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-BdYBI1uT.js.map