@go-to-k/cdkd 0.299.4 → 0.299.6

package/dist/{provider-classes-SNKb1al7.js → provider-classes-Dnof5qun.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-Bj7qH5Ph.js";
-import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-DtvlUugx.js";
-import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-Pn2m0R67.js";
+import { B as safeMsg, F as displaySafe, I as displayStackName, L as isPasteableIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displayIdent, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as plainIdentOr } from "./aws-failure-text-BEQfs6za.js";
+import { $ as protectedReplacementAdvice, $n as isAmbiguousOutcomeError, $t as credentialFingerprint, A as isQuotableImportValue, B as isTerminalDeleteFailure, Bn as withheldTargetClause, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Gt as injectiveKeyPrefix, H as observeThenDisableProtection, In as plainOrDescribed, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as hasClauseBreak, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as isInertUnquoted, O as isPlainImportJson, P as remedyLogicalId, Pn as pasteableCommand, Q as pasteableAwsCommand, Qt as clientDefaultsFor, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKey, X as WITHHELD_AWS_COMMAND, Xn as markReplayMayCollide, Xt as ambientClientDefaults, Y as UNNAMEABLE_ID_CLAUSE, Yn as markNameCollision, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _ as RecentIdSet, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isMarkedNonRetryable, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as markRedactedCause, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, en as AccountIdUnavailableError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gn as ProvisioningError, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as THROTTLING_ERROR_NAMES, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as commandHole, jt as markAuxiliaryFailure, k as isPlainImportValue, lr as wrapMaskedAwsError, lt as compositeIdFormatMessage, nn as CdkdError, nr as isTransientServerError, o as readPrincipalLists, or as isThrottlingError, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, sr as markNonRetryable, tr as isRetryableTransientError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vn as ResourceUpdateNotSupportedError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as shellQuote } from "./iam-policy-targets-dAY3-gXJ.js";
 import { s as ambientRegion } from "./aws-client-defaults-DBXBcg0J.js";
-import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-DWIbDQdg.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DTQlG8qe.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B4_qJpAO.js";
-import { RDSProvider } from "./rds-provider-B9gz-giS.js";
-import { NeptuneProvider } from "./neptune-provider-Bkrw65eO.js";
-import { ASGProvider } from "./asg-provider-BtUUjRnI.js";
+import { $ as S3_AUTO_DELETE_OBJECTS_TAG, Ao as sameLambdaFunctionAddress, At as withNestedStackContext, Br as isTerminationProtectionPropagationError, Bt as awaitInFlightSibling, C as withApiLimit, Ci as getAccountInfo, Co as requireConfigString, Do as withRetry, Fr as withIndeterminateGuard, G as deleteBudgetKey, H as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ho as passedNoEchoParametersOf, Hr as reDisableInstanceApiTermination, Ht as getStackRecords, Ii as passedParameterClassesOf, Ir as isWaitAbandonedError, J as DELETE_INDEX_WAIT_PROCEED_NOTE, K as resolveDynamoDbDeleteBudgetClock, Lr as markWaitAbandoned, Ml as displayAssemblyPath, Ni as parseWebACLArn, Nl as renderAssemblyPathEscape, Oo as canonicalLambdaFunctionName, Or as slowCcOperationTimeoutMs, Pl as resolveAssemblyPath, Pr as deleteSkipReason, Q as ECR_AUTO_DELETE_IMAGES_TAG, Qa as findSilentDropProperties, Ra as refuseMalformedResourcesForDestroy, S as lookupEachName, So as requireConfigObject, Sr as getCurrentResourceSecrets, Ss as recordAttributeIdCopy, St as getNestedRevertRun, Ts as carriesSecretMask, Tt as revertNestedChildFromJournal, U as beginDeleteWait, Ui as accountArgs, Ur as reEnableInstanceApiTermination, V as DynamoDBGlobalTableProvider, Vr as observeThenDisableInstanceApiTermination, W as compensateRemovedDeletionProtection, X as deleteTableWithIndexBusyRetry, Xa as withheldAccountClause, Y as INDEX_SETTLE_POLL_INTERVAL_MS, Yo as hasMaskableValues, Z as waitForIndexesSettled, _l as decodeListingKey, _o as configIntegerRefusal, ar as DBPROXY_TAGS_WHAT, b as chunks, bl as canonicalizeRegion, bo as replayWarn, bs as recoverMaskedOutput, c as isAbsoluteAssetPath, ci as outputReferenceProvenanceOf, cn as redactedDeleteAddressFields, cr as readTagList, cs as snapshotPassProvenance, di as s3BucketArn, do as isWarmThroughputDecrease, dr as tagPlanWarning, eo as withoutSilentDropProperties, er as earliestDefined, et as hasCdkAutoDeleteTag, fi as s3BucketDomainName, fo as toCfnInteger, fr as definedAttributes, fs as withoutPhysicalNameCopies, go as configBooleanRefusal, hc as rewriteTemplateAssetReferences, hi as s3BucketWebsiteUrl, ho as coerceCfnInteger, in as getCurrentProducerRegions, ir as acquireIdempotencyToken, jl as describeFileReadFailure, ko as lambdaFunctionNameForMask, kr as unchangedBehindSecretReference, kt as getCurrentNestedStackContext, l as listNestedTemplateRows, ln as redactedDeleteAddressSkip, lo as WARM_THROUGHPUT_MEMBERS, lr as refuseMalformedDesiredTags, ls as redactSecretsForState, mi as s3BucketRegionalDomainName, mo as coerceCfnBoolean, ms as dynamicReferenceTokens, nr as reserveStackCreateToken, nt as getPriorAttempts, oi as isSettledInstanceState, on as REDACTED_DELETE_ADDRESS_SKIP_REASON, or as DBPROXY_TAG_OPTIONS, os as markSameGenerationBag, pi as s3BucketDualStackDomainName, po as toFiniteNumber, pr as stringifyIfAssigned, q as resolveDynamoDbDeleteBudgetMs, rt as markRefusedBeforeApplying, s as findNestedTemplateTreeDefect, sn as isRedactedRecordedValue, sr as planTagDiff, ss as recordReferenceProvenanceEntry, t as DeployEngine, tt as isTruthyCfnBoolean, u as renderNestedTemplateTreeDefect, uc as stringifyValue, uo as coerceWarmThroughput$1, ur as tagMapAsList, va as refuseMalformedNestedChildOutputs, vo as configStringRefusal, x as isAccessDeniedError, xl as derivePartitionAndUrlSuffix, xo as requireConfigArray, xs as physicalNameCopiesOf, yo as readConfigString, zr as ec2InstanceProtectionSite } from "./deploy-engine-DZhdwU1d.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DIo2_z0s.js";
+import { a as resolveSecretDerivedPrincipals, i as isResolvableSecretPrincipalList, n as runDestroyForStack, o as canonicalizeIpProtocolValue, r as holdsUnprovenSecretPrincipalToken, s as resolvedResourceTimeoutMs, t as canonicalizeIpv4Cidr } from "./program-CvyqGZ2h.js";
+import { RDSProvider } from "./rds-provider--_cLSeij.js";
+import { NeptuneProvider } from "./neptune-provider-eZd5MtAD.js";
+import { ASGProvider } from "./asg-provider-SsXASjNc.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -379,7 +379,10 @@ var IAMPolicyProvider = class {
 			const values = Object.fromEntries(malformedKinds.map((k) => [k, recordedLists[k]]));
 			const memo = optIn.retryMemo;
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals(values, context?.expectedRegion, {
+				regions: optIn.importedProducerRegions,
+				complete: optIn.producerRegionsIncomplete !== true
+			}, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved) {
 				roles = resolved.lists["Roles"] ?? targets.wellFormed.roles;
@@ -396,7 +399,7 @@ var IAMPolicyProvider = class {
 		}
 		if (malformedKinds.length > 0 && !resolvedFromSecret) {
 			const plainKinds = malformedKinds.filter((k) => !secretDerivedKinds.includes(k));
-			const repair = secretDerivedKinds.length === 0 ? `Repair ${plainKinds.join(" / ")} in state.json to a list of role / group / user names and re-run, or delete the inline policy by hand.` : `The recorded ${secretDerivedKinds.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json` + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : `:`) + ` cdkd will keep skipping this record` + (plainKinds.length > 0 ? `, whatever is repaired in the recorded ${plainKinds.join(" / ")}` : "") + `. Remove the inline policy from its principals by hand (a principal this stack also deletes takes its inline policies with it), then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.`;
+			const repair = secretDerivedKinds.length === 0 ? `Repair ${plainKinds.join(" / ")} in state.json to a list of role / group / user names and re-run, or delete the inline policy by hand.` : `The recorded ${secretDerivedKinds.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json` + (resolutionAttempted ? optIn?.producerRegionsIncomplete === true && secretDerivedKinds.some((k) => holdsUnprovenSecretPrincipalToken(recordedLists[k], optIn.recordedRegions)) ? "; this nested stack was destroyed without its parent, so a reference with no recorded region is not resolved (it may name the parent's region): destroy it through its top-level stack, or" : "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : `:`) + ` cdkd will keep skipping this record` + (plainKinds.length > 0 ? `, whatever is repaired in the recorded ${plainKinds.join(" / ")}` : "") + `. Remove the inline policy from its principals by hand (a principal this stack also deletes takes its inline policies with it), then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.`;
 			this.logger.warn(`The state record for IAM policy ${logicalId} holds ${malformedKinds.join(" / ")} that is not a list of IAM names — skipping deletion rather than guessing which principals it names. No AWS call is issued, so the inline policy is LEFT ATTACHED wherever it is. ${repair} ${DEPLOY_SKIP_CAVEAT$3}`);
 			return {
 				outcome: "skipped",
@@ -2503,7 +2506,10 @@ var IAMUserGroupProvider = class {
 		const resolutionAttempted = "malformed" in read && optIn !== void 0 && isResolvableSecretPrincipalList(properties["Users"]);
 		if (resolutionAttempted) {
 			const reused = memo?.resolved;
-			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, optIn.importedProducerRegions, optIn.recordedRegions);
+			const resolved = reused ?? await resolveSecretDerivedPrincipals({ Users: properties["Users"] }, context?.expectedRegion, {
+				regions: optIn.importedProducerRegions,
+				complete: optIn.producerRegionsIncomplete !== true
+			}, optIn.recordedRegions);
 			if (resolved && memo) memo.resolved = resolved;
 			if (resolved?.lists["Users"] !== void 0) {
 				users = resolved.lists["Users"];
@@ -2514,7 +2520,7 @@ var IAMUserGroupProvider = class {
 			}
 		}
 		if ("malformed" in read && users === void 0) {
-			const repair = read.secretDerived.length > 0 ? "The recorded Users is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json" + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : ":") + ` cdkd will keep skipping this record. Remove the users from the group by hand, then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "Repair the recorded Users in state.json to a list of user names and re-run, or remove the users from the group by hand.";
+			const repair = read.secretDerived.length > 0 ? "The recorded Users is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json" + (resolutionAttempted ? optIn?.producerRegionsIncomplete === true && holdsUnprovenSecretPrincipalToken(properties["Users"], optIn.recordedRegions) ? "; this nested stack was destroyed without its parent, so a reference with no recorded region is not resolved (it may name the parent's region): destroy it through its top-level stack, or" : "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : ":") + ` cdkd will keep skipping this record. Remove the users from the group by hand, then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "Repair the recorded Users in state.json to a list of user names and re-run, or remove the users from the group by hand.";
 			this.logger.warn(safeMsg`The state record for UserToGroupAddition ${logicalId} holds a Users that is not a list of IAM user names — skipping deletion rather than guessing which users it names. No AWS call is issued, so the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). ${repair} ${DEPLOY_SKIP_CAVEAT$2}`);
 			return {
 				outcome: "skipped",
@@ -33632,7 +33638,8 @@ function enforceIcebergTableInputAbsent(logicalId, resourceType, properties, opt
 	throw new ProvisioningError(icebergTableInputRefusalMessage(logicalId, key, "create"), resourceType, logicalId);
 }
 function icebergTableInputRefusalMessage(logicalId, key, mode) {
-	return `AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ${mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue.` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds. The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member, so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns. A CREATE of this table would be refused outright."}\n  Measured against AWS: glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
+	const lead = mode === "create" ? `cannot be deployed by AWS in any shape, so cdkd refuses it before calling Glue.` : mode === "create-replay" ? "cannot be deployed by AWS in any shape, so cdkd normally refuses it before calling Glue — but this create is REPLAYING a historical cdkd STATE record (a rollback reverse-replacement re-creating the OLD table), not your template, and refusing would leave that table unrestorable with no template-side remedy, only a hand-edit of state.json. cdkd therefore warns and proceeds. The re-created table is DEGRADED exactly as the original was: under the CFn spelling IcebergTableInput the AWS SDK serializer drops the unknown member, so the table comes back without its Iceberg metadata; under the SDK spelling CreateIcebergTableInput the value IS sent and Glue rejects the call, failing this one rollback operation. Either way, fix it forward with 'cdkd deploy' using the working shape below." : "cannot be deployed by AWS in any shape and is IGNORED on update — cdkd does not wire Glue's update-only UpdateOpenTableFormatInput shape, so it forwards nothing here and only warns. A CREATE of this table would be refused outright.";
+	return safeMsg`AWS::Glue::Table ${logicalId}: OpenTableFormatInput.IcebergInput.${key} ` + `${lead}\n  Measured against AWS: glue:CreateTable — the API cdkd calls — rejects every Iceberg table spec ("Location information cannot be null while creating an iceberg table" without a TableInput.StorageDescriptor, "Table metadata information present at multiple parts of input request" with one), and CloudFormation rolls the same template back with "Table metadata is expected only via TableInput or via IcebergTableInputProperties inside OpenTableFormatInput" — a property name that exists in neither the CFn registry schema (IcebergInput.IcebergTableInput) nor @aws-sdk/client-glue (IcebergInput.CreateIcebergTableInput).\n  Working shape — put the table metadata in TableInput and leave IcebergInput carrying only the create-time directive:\n    TableInput: { Name, TableType: 'EXTERNAL_TABLE', StorageDescriptor: { Location: 's3://your-bucket/prefix/', Columns: [...] } }\n    OpenTableFormatInput: { IcebergInput: { MetadataOperation: 'CREATE' } }   // Version: '2' is also accepted\n  Glue then writes the Iceberg metadata itself — the created table comes back with Parameters.table_type = ICEBERG and a populated Parameters.metadata_location.`;
 }
 function buildEncryptionConfiguration(input) {
 	const result = {};
@@ -42578,7 +42585,7 @@ var CodeCommitRepositoryProvider = class {
 		const known = [recordedId, this.renamesStarted.get(oldName)].filter((id) => id !== void 0);
 		const holder = await this.getRepositoryMetadata(newName);
 		if (holder?.repositoryId !== void 0 && known.includes(holder.repositoryId)) return;
-		const intro = `CodeCommit Repository ${logicalId} no longer exists under the name cdkd recorded, and the repository holding the desired RepositoryName is not this resource's`;
+		const intro = safeMsg`CodeCommit Repository ${logicalId} no longer exists under the name cdkd recorded, and ` + `the repository holding the desired RepositoryName is not this resource's`;
 		if (known.length > 0) throw this.wrapNotThisRepositoryError(logicalId, resourceType, oldName, "desired-name");
 		throw markNonRetryable(new ProvisioningError(`${intro} as far as cdkd can verify (its record holds no RepositoryId, and this run started no rename of this resource) — nothing was sent to that repository. If it is this resource's repository (an earlier deploy renamed it and stopped before recording the new name), first confirm it is yours (\`aws codecommit get-repository\` shows its id, ARN, description and creation date), and re-adopt it only then; otherwise choose a RepositoryName no other repository holds.\nRe-adopt with:\n` + pasteableCommand("cdkd import", [
 			{ hole: "stack" },
@@ -42592,7 +42599,7 @@ var CodeCommitRepositoryProvider = class {
 	}
 	wrapNotThisRepositoryError(logicalId, resourceType, physicalId, which) {
 		const remedy = which === "desired-name" ? "The repository holding the desired RepositoryName is not this resource's (its repository id is not the one cdkd holds for this resource) — nothing was sent to that repository. If this resource's repository was renamed outside cdkd and you can find it, set RepositoryName to its current name: cdkd adopts it by the repository id it holds. If it was deleted outside cdkd, drop this resource's record and set RepositoryName to a name no repository holds, so the next deploy creates a new repository (fill in the resource's construct path):\n" + pasteableCommand("cdkd orphan", [{ hole: "constructPath" }]).command : "The repository cdkd recorded for this resource no longer holds its recorded name (it was deleted or renamed outside cdkd), and the repository now holding that name is not this resource's (its repository id is not the one cdkd holds) — nothing was sent to that repository. Changing RepositoryName does not clear this. Leave that repository alone. If the recorded repository was renamed and you can find it, re-adopt it under its new name with cdkd import (--resource, --force) instead; otherwise drop this resource's record and set RepositoryName to a name no repository holds, so the next deploy creates a new repository (fill in the resource's construct path):\n" + pasteableCommand("cdkd orphan", [{ hole: "constructPath" }]).command;
-		return markNonRetryable(new ProvisioningError(`CodeCommit Repository ${logicalId}: ${remedy}`, resourceType, logicalId, physicalId));
+		return markNonRetryable(new ProvisioningError(safeMsg`CodeCommit Repository ${logicalId}: ` + remedy, resourceType, logicalId, physicalId));
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting CodeCommit Repository ${logicalId}: ${physicalId}`);
@@ -42638,7 +42645,7 @@ var CodeCommitRepositoryProvider = class {
 		const liveId = holder?.repositoryId;
 		if (liveId === void 0) return this.proceedUnconfirmed(logicalId, "GetRepository returned no repository id");
 		if (liveId === recordedId) return void 0;
-		throw markNonRetryable(new ProvisioningError(`CodeCommit Repository ${logicalId}: the repository holding the name cdkd recorded for this resource is not this resource's (its repository id is not the one cdkd holds; the recorded repository was deleted or renamed outside cdkd) — cdkd did not delete it. Leave that repository alone. If cdkd still records this resource under that name (a destroy, or a deploy removing the resource), drop that record and re-run; a later deploy that creates this resource again needs a RepositoryName no repository holds (fill in the resource's construct path):\n` + pasteableCommand("cdkd orphan", [{ hole: "constructPath" }]).command, resourceType, logicalId, physicalId));
+		throw markNonRetryable(new ProvisioningError(safeMsg`CodeCommit Repository ${logicalId}: the repository holding the name cdkd recorded for ` + "this resource is not this resource's (its repository id is not the one cdkd holds; the recorded repository was deleted or renamed outside cdkd) — cdkd did not delete it. Leave that repository alone. If cdkd still records this resource under that name (a destroy, or a deploy removing the resource), drop that record and re-run; a later deploy that creates this resource again needs a RepositoryName no repository holds (fill in the resource's construct path):\n" + pasteableCommand("cdkd orphan", [{ hole: "constructPath" }]).command, resourceType, logicalId, physicalId));
 	}
 	proceedUnconfirmed(logicalId, reason) {
 		this.logger.warn(safeMsg`Could not confirm that CodeCommit Repository ${logicalId} is the repository cdkd recorded: ${reason.replace(/[.\s]+$/, "")}. Proceeding with the delete.`);
@@ -44141,7 +44148,7 @@ var S3TablesProvider = class {
 		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: ${compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId)}. Cannot derive the table ARN for the tag update, and refusing to silently drop it.`, resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
-		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update. If the table was deleted out-of-band, drop just this resource's record with the command below, filling in the construct path the CDK app gave this resource — its aws:cdk:path Metadata entry in the synthesized template.\nClean up with: cdkd orphan ${commandHole("constructPath")}`, resourceType, logicalId, physicalId);
+		if (!resourceArn) throw new ProvisioningError(safeMsg`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone ` + `or state is out-of-sync. Refusing to silently drop the tag update. If the table was deleted out-of-band, drop just this resource's record with the command below, filling in the construct path the CDK app gave this resource — its aws:cdk:path Metadata entry in the synthesized template.\nClean up with: cdkd orphan ${commandHole("constructPath")}`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
 			await this.getClient().send(new UntagResourceCommand$27({
 				resourceArn,
@@ -44642,7 +44649,10 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.profile && { profile: ctx.destroyOptions.profile },
 			...ctx.destroyOptions?.statePrefix !== void 0 && { statePrefix: ctx.destroyOptions.statePrefix },
 			...deleteContext?.removeProtection === true && { removeProtection: true },
-			...deleteContext?.resolveSecretDerivedPrincipals !== void 0 && { resolveSecretDerivedPrincipals: { inheritedProducerRegions: deleteContext.resolveSecretDerivedPrincipals.importedProducerRegions } },
+			...deleteContext?.resolveSecretDerivedPrincipals !== void 0 && { resolveSecretDerivedPrincipals: {
+				inheritedProducerRegions: deleteContext.resolveSecretDerivedPrincipals.importedProducerRegions,
+				...deleteContext.resolveSecretDerivedPrincipals.producerRegionsIncomplete === true && { producerRegionsIncomplete: true }
+			} },
 			...deleteContext?.stackDestroy === true && { stackDestroy: true },
 			...ctx.destroyOptions?.purgeStateHistory === true && { purgeStateHistory: true },
 			...childNoEchoReresolver !== void 0 && { noEchoReresolver: childNoEchoReresolver },
@@ -45224,4 +45234,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-SNKb1al7.js.map
+//# sourceMappingURL=provider-classes-Dnof5qun.js.map