@go-to-k/cdkd 0.283.18 → 0.283.20

package/dist/{deploy-engine-B-0iA5XV.js → deploy-engine-ISOKkuun.js}

@@ -5557,7 +5557,7 @@ var AssetModeResolver = class {
 * non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
 * character class, and no caller embeds into one.
 */
-function escapeRegExp(value) {
+function escapeRegExp$1(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -5582,11 +5582,11 @@ function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
 * scope and left verbatim.
 */
 function isDefaultBootstrapBucketName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp$1(region)}$`).test(name);
 }
 /** §8 scope rule, container-image leg (`cdk-<qualifier>-container-assets-…`). */
 function isDefaultBootstrapRepoName(name, accountId, region) {
-	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp(region)}$`).test(name);
+	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp$1(region)}$`).test(name);
 }
 /**
 * Build the §6 asset-location mapping table from a stack's asset manifest.
@@ -5613,7 +5613,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 	const addForms = (rawName, flattened, target) => {
 		sources.set(flattened, target);
 		if (rawName !== flattened) sources.set(rawName, target);
-		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp(region)}$`);
+		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp$1(region)}$`);
 		for (const suffix of [
 			"-${AWS::AccountId}-${AWS::Region}",
 			`-\${AWS::AccountId}-${region}`,
@@ -5669,7 +5669,7 @@ function buildAssetRedirectMap(manifest, marker, accountId, region, partition =
 * with the deploy account+region bootstrap shape — accepted as pathological.
 */
 function buildBoundaryRegex(source) {
-	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp(source)}(?![A-Za-z0-9_-])`, "g");
+	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp$1(source)}(?![A-Za-z0-9_-])`, "g");
 }
 function rewriteString(value, map, counter) {
 	let result = value;
@@ -9816,6 +9816,95 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
+//#endregion
+//#region src/deployment/secret-redaction.ts
+/** Fixed marker substituted for a secret value in log / error output. */
+const SECRET_MASK = "***";
+/**
+* A resolved secret value shorter than this is NOT used as a redaction needle:
+* a 1-2 character plaintext (e.g. a secret whose JSON key holds `"0"`) would
+* match incidental characters everywhere and mangle unrelated state. Such a
+* value is still masked at the exact leaf where it was the WHOLE value (handled
+* by the caller), but is not scanned for as a substring. Real secrets are far
+* longer than this, so the bound only excludes degenerate cases.
+*/
+const MIN_NEEDLE_LENGTH = 4;
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Build a single alternation regex matching any recorded secret value, longest
+* first so an overlapping shorter secret cannot pre-empt a longer match. Returns
+* `undefined` when there is nothing worth scanning for.
+*/
+function buildNeedleRegex(values) {
+	const needles = Array.from(new Set(values)).filter((v) => v.length >= MIN_NEEDLE_LENGTH).sort((a, b) => b.length - a.length);
+	if (needles.length === 0) return void 0;
+	return new RegExp(needles.map(escapeRegExp).join("|"), "g");
+}
+/**
+* Deep-clone `bag`, replacing every occurrence of a recorded secret value with
+* the unresolved `{{resolve:...}}` expression it came from. A string whose WHOLE
+* value equals a secret is replaced by that secret's expression exactly; a
+* string that merely CONTAINS one (an `Fn::Join` / `Fn::Sub` result) has the
+* secret substring replaced in place. Returns the input by identity when there
+* is nothing to redact, so callers can persist the original object unchanged in
+* the common no-secret case.
+*/
+function redactSecretsForState(bag, secrets) {
+	if (secrets.size === 0) return bag;
+	const regex = buildNeedleRegex(secrets.keys());
+	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
+	const walk = (value) => {
+		if (typeof value === "string") {
+			const whole = wholeValueExpr(value);
+			if (whole !== void 0) return whole;
+			if (!regex) return value;
+			regex.lastIndex = 0;
+			if (!regex.test(value)) return value;
+			regex.lastIndex = 0;
+			return value.replace(regex, (m) => secrets.get(m) ?? "***");
+		}
+		if (Array.isArray(value)) return value.map(walk);
+		if (value !== null && typeof value === "object") {
+			const out = {};
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
+			return out;
+		}
+		return value;
+	};
+	return walk(bag);
+}
+/**
+* Redact resolved secret plaintext out of one resource state record's
+* `properties` / `attributes` / `observedProperties`, replacing each secret
+* value with its unresolved expression. Returns a NEW record when any field
+* changed, or the input by identity when there are no secrets — so callers can
+* detect a no-op cheaply. Shared by the deploy engine's save choke point and
+* the `cdkd scrub` command so both scrub the same three fields identically.
+*/
+function scrubResourceRecord(record, secrets) {
+	if (secrets.size === 0) return record;
+	const next = { ...record };
+	next.properties = redactSecretsForState(record.properties, secrets);
+	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets);
+	return next;
+}
+/**
+* Replace every recorded secret value inside `text` with {@link SECRET_MASK}.
+* Used on log lines and error messages where a resolved secret could otherwise
+* be echoed. Whole-value and embedded matches are both masked. Returns `text`
+* unchanged when there is nothing to mask.
+*/
+function maskSecretsInText(text, secrets) {
+	if (secrets.size === 0) return text;
+	if (text !== "" && secrets.has(text)) return "***";
+	const regex = buildNeedleRegex(secrets.keys());
+	if (!regex) return text;
+	return text.replace(regex, "***");
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -11770,7 +11859,7 @@ var IntrinsicFunctionResolver = class {
 	*/
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
-			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value);
+			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
 		if (Array.isArray(value)) return (await Promise.all(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
@@ -12373,8 +12462,8 @@ var IntrinsicFunctionResolver = class {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
 		}))).join(delimiter);
-		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result);
-		this.logger.debug(`Resolved Fn::Join: ${result}`);
+		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
+		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
 	/**
@@ -12459,8 +12548,8 @@ var IntrinsicFunctionResolver = class {
 			const entry = replacements[cursor++];
 			return entry ? entry.replacement : whole;
 		});
-		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result);
-		this.logger.debug(`Resolved Fn::Sub: ${result}`);
+		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
+		this.logger.debug(`Resolved Fn::Sub: ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
 	/**
@@ -12478,7 +12567,7 @@ var IntrinsicFunctionResolver = class {
 			return `{{Fn::Select:${index}:OutOfBounds}}`;
 		}
 		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(result)}`);
+		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
 		return result;
 	}
 	/**
@@ -12620,7 +12709,7 @@ var IntrinsicFunctionResolver = class {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 		}
 		const result = resolvedValue.split(delimiter);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(result)}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
 		return result;
 	}
 	/**
@@ -13128,7 +13217,7 @@ var IntrinsicFunctionResolver = class {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
-		this.logger.debug(`Resolved Fn::Base64: ${resolvedValue} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(resolvedValue, context)} -> ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
 	/**
@@ -13195,7 +13284,16 @@ var IntrinsicFunctionResolver = class {
 	*
 	* Results are cached to avoid repeated API calls.
 	*/
-	async resolveDynamicReferences(value) {
+	/**
+	* Mask any resolved secret value out of a string bound for a log line, using
+	* the secrets recorded on the resolution pass (GHSA fix). No-op when the pass
+	* recorded no secrets.
+	*/
+	maskSecretsForLog(text, context) {
+		const secrets = context?.recordedSecretValues;
+		return secrets ? maskSecretsInText(text, secrets) : text;
+	}
+	async resolveDynamicReferences(value, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
 		let match;
@@ -13205,12 +13303,16 @@ var IntrinsicFunctionResolver = class {
 			inner: match[1]
 		});
 		for (const { fullMatch, inner } of matches) {
+			const service = inner.split(":")[0];
+			const isSecret = service === "secretsmanager";
+			if (isSecret && context?.skipDynamicReferences) continue;
 			if (fullMatch in cachedDynamicReferences) {
-				result = result.replace(fullMatch, cachedDynamicReferences[fullMatch]);
+				const cached = cachedDynamicReferences[fullMatch];
+				if (isSecret && cached) context?.recordedSecretValues?.set(cached, fullMatch);
+				result = result.replace(fullMatch, cached);
 				continue;
 			}
 			const parts = inner.split(":");
-			const service = parts[0];
 			let resolved;
 			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
 			else if (service === "ssm") resolved = await this.resolveSSMReference(parts);
@@ -13219,6 +13321,7 @@ var IntrinsicFunctionResolver = class {
 				continue;
 			}
 			cachedDynamicReferences[fullMatch] = resolved;
+			if (isSecret && resolved) context?.recordedSecretValues?.set(resolved, fullMatch);
 			result = result.replace(fullMatch, resolved);
 		}
 		return result;
@@ -14182,7 +14285,13 @@ var CloudControlProvider = class {
 					};
 				}
 			}
-			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch)}`);
+			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch.map((op) => {
+				const anyOp = op;
+				return {
+					op: anyOp.op,
+					path: anyOp.path
+				};
+			}))}`);
 			const updateResponse = await this.cloudControlClient.send(new UpdateResourceCommand({
 				TypeName: resourceType,
 				Identifier: physicalId,
@@ -14212,7 +14321,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D8Ln3-ij.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-k-TEX_Ej.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -20765,6 +20874,61 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * just announced and leaving the record describing something AWS does not
 * hold.
 */
+/**
+* Re-resolve dynamic-reference SECRET expressions
+* (`{{resolve:secretsmanager:...}}`) in a property bag being REPLAYED to a
+* provider during rollback (GHSA fix, issue #1899 review).
+*
+* The rollback journal — and the state record the replay writes — store the
+* redacted EXPRESSION, never the plaintext. But a `provider.update()` /
+* `create()` / `delete()` call must receive the concrete secret value the
+* reference points at, exactly as the forward deploy did; replaying the literal
+* `{{resolve:...}}` string would corrupt the resource (e.g. a Lambda env var or
+* Cognito `client_secret`). Rollback is synth-free, so re-resolve straight from
+* the expression string here.
+*
+* Records each `plaintext -> expression` into `secrets` so the caller can redact
+* the persisted state record back to the expression — the same
+* resolve-for-provider + redact-for-state split the deploy engine applies at its
+* save choke point. A bag with no `{{resolve:...}}` string resolves to a
+* structural copy of itself (secrets stays empty), so the non-secret rollback
+* path is behaviourally unchanged. Only secretsmanager references are recorded
+* (plain `ssm` is public config, stored resolved — it never appears as an
+* expression in the journal), matching the resolver's own `isSecret` gate.
+*/
+async function resolveReplayProps(props, resolver, secrets) {
+	if (props === void 0) return void 0;
+	const ctx = {
+		template: { Resources: {} },
+		resources: {},
+		recordedSecretValues: secrets
+	};
+	const walk = async (v) => {
+		if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, ctx) : v;
+		if (Array.isArray(v)) {
+			const out = new Array(v.length);
+			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i]);
+			return out;
+		}
+		if (v !== null && typeof v === "object") {
+			const out = {};
+			for (const [k, val] of Object.entries(v)) out[k] = await walk(val);
+			return out;
+		}
+		return v;
+	};
+	return await walk(props);
+}
+/**
+* Redact resolved secret plaintext back out of a post-rollback state record
+* (GHSA fix). The record's `properties` may be the provider's
+* `effectiveProperties`, which can echo the value we just resolved for the
+* provider call — so scrub it with the same per-op secrets map before it is
+* persisted. No-op when the op resolved no secret.
+*/
+function redactRollbackRecord(record, secrets) {
+	return secrets.size > 0 ? scrubResourceRecord(record, secrets) : record;
+}
 async function updateWithRollbackRetry(provider, args, logicalId, logger, isInterrupted) {
 	if (provider.disableOuterRetry) return await provider.update(...args);
 	return await withRetry(() => provider.update(...args), logicalId, {
@@ -20822,6 +20986,7 @@ function recordedPropertiesAfterReplayCreate(restored, result) {
 async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds, result, afterOp, isInterrupted) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
+	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	/**
 	* The route a CREATE-rollback arm resolved for this op (issue #1366) —
 	* hoisted so the shared catch's ROLLBACK_RESOURCE_FAILED reports the route
@@ -20946,6 +21111,8 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
+				const secrets = /* @__PURE__ */ new Map();
+				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets) ?? {};
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
@@ -20959,7 +21126,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 				let deletedNewFirst = false;
 				let createResult;
 				try {
-					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
+					createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 						...RECREATE_RETRY_SCHEDULE,
 						logger,
 						...isInterrupted && {
@@ -20982,7 +21149,7 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					delete stateResources[op.logicalId];
 					await afterOp?.(op.logicalId);
 					try {
-						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...prev.properties }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
+						createResult = await withRetry(() => createProvider.create(op.logicalId, op.resourceType, { ...resolvedPrevProps }, REPLAYING_STATE_CREATE_CONTEXT), op.logicalId, {
 							...RECREATE_RETRY_SCHEDULE,
 							logger,
 							...isInterrupted && {
@@ -21001,12 +21168,12 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					result.warnings++;
 				}
 				const { observedProperties: _staleObserved, ...prevRecord } = prev;
-				stateResources[op.logicalId] = {
+				stateResources[op.logicalId] = redactRollbackRecord({
 					...prevRecord,
 					physicalId: createResult.physicalId,
 					attributes: createResult.attributes ?? {},
 					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
-				};
+				}, secrets);
 				await afterOp?.(op.logicalId);
 				if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
@@ -21047,14 +21214,17 @@ async function replaySingle(op, stateResources, stackName, ctx, orphanLogicalIds
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
 				});
+				const secrets = /* @__PURE__ */ new Map();
+				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets);
+				const currentProps = await resolveReplayProps(current.properties, resolver, secrets);
 				const revertResult = await updateWithRollbackRetry(provider, [
 					op.logicalId,
 					current.physicalId,
 					op.resourceType,
-					previousState.properties,
-					current.properties
+					desiredProps ?? {},
+					currentProps ?? {}
 				], op.logicalId, logger, isInterrupted);
-				stateResources[op.logicalId] = recordAfterRollbackUpdate(previousState, revertResult);
+				stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(previousState, revertResult), secrets);
 				logger.info(`  Rollback: ${op.logicalId} restored successfully`);
 				await afterOp?.(op.logicalId);
 				ctx.recordEvent?.({
@@ -21102,6 +21272,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		remainingFailedOps: []
 	};
 	const { logger } = ctx;
+	const resolver = new IntrinsicFunctionResolver(ctx.region);
 	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_STARTED",
@@ -21183,14 +21354,17 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
+					const secrets = /* @__PURE__ */ new Map();
+					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets);
+					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
 						op.resourceType,
-						prev.properties,
-						op.attemptedProperties ?? current.properties
+						desiredProps ?? {},
+						attemptedProps ?? {}
 					], op.logicalId, logger, options.isInterrupted);
-					stateResources[op.logicalId] = recordAfterRollbackUpdate(prev, revertFailedResult);
+					stateResources[op.logicalId] = redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets);
 					logger.info(`  Rollback: ${op.logicalId} reverted successfully`);
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
@@ -21316,7 +21490,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.283.18";
+	return "0.283.20";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21913,6 +22087,30 @@ var DeployEngine = class {
 	*/
 	recordedOutputReads = [];
 	/**
+	* PER-RESOURCE map of resolved SECRET dynamic-reference values
+	* (plaintext -> `{{resolve:...}}` expression) the resolver records for each
+	* resource's own resolution (GHSA fix). Keyed by logicalId. Per-resource, NOT
+	* session-wide, because a session-wide map cross-contaminates: if resource A
+	* resolves a `{{resolve:...:SecretString}}` whole-secret reference to value V,
+	* and resource B (e.g. the `AWS::SecretsManager::Secret` that OWNS the secret)
+	* carries V as its own LITERAL property, a session-wide value scan would
+	* wrongly rewrite B's literal to A's expression — a false positive that shows
+	* up as a permanent spurious diff. Redacting each resource only with the
+	* secrets substituted during ITS OWN resolution scopes the value match
+	* correctly. Kept on the engine (not just the resolver context) so the async
+	* observed-property capture — which drains after the context is gone — can
+	* still redact an AWS-readback secret (Cognito `client_secret`). Reset per
+	* `deploy()`. See `secret-redaction.ts`.
+	*/
+	perResourceSecrets = /* @__PURE__ */ new Map();
+	/**
+	* Resolved secrets recorded while resolving the stack OUTPUTS (a `CfnOutput`
+	* whose Value resolves a `{{resolve:...}}` reference). Separate from the
+	* per-resource maps for the same anti-cross-contamination reason. Reset per
+	* `deploy()`.
+	*/
+	outputSecrets = /* @__PURE__ */ new Map();
+	/**
 	* Per-logical-id snapshot of the intrinsic-RESOLVED desired properties
 	* each CREATE / UPDATE attempted (issue #1198). Written just before the
 	* provider call; read only when the op FAILS, to journal the failed op's
@@ -21953,6 +22151,8 @@ var DeployEngine = class {
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
+		this.perResourceSecrets = /* @__PURE__ */ new Map();
+		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -21972,7 +22172,63 @@ var DeployEngine = class {
 			stackName,
 			...this.exportIndexStore && { exportIndex: this.exportIndexStore },
 			recordedImports: this.recordedImports,
-			recordedOutputReads: this.recordedOutputReads
+			recordedOutputReads: this.recordedOutputReads,
+			recordedSecretValues: /* @__PURE__ */ new Map()
+		};
+	}
+	/**
+	* Redact resolved secret plaintext out of a bag about to be PERSISTED to
+	* state, replacing each secret value with the unresolved `{{resolve:...}}`
+	* expression it came from (GHSA fix; see `secret-redaction.ts`). No-op when
+	* the deploy recorded no secrets. The bag sent to the AWS API is the
+	* un-redacted resolved bag; only the persisted copy is rewritten.
+	*/
+	/**
+	* Bag-level redaction of a single properties bag against a specific secrets
+	* map (GHSA fix). Used by the UPDATE no-op re-check so a resolved-plaintext
+	* bag is compared against the expression-bearing stored bag on equal footing.
+	*/
+	redactPropsWith(props, secrets) {
+		if (secrets.size === 0) return props;
+		return redactSecretsForState(props, secrets);
+	}
+	/**
+	* Redact resolved secret plaintext out of rollback-journal operations (GHSA
+	* fix). Each op may carry resolved `properties` / `attemptedProperties` and a
+	* `previousState` snapshot (whose `properties` / `attributes` /
+	* `observedProperties` also hold resolved values). Each op is redacted with
+	* the secrets recorded for ITS OWN resource (`perResourceSecrets`), so a
+	* whole-secret value from one resource cannot rewrite another's literal.
+	* Preserves ops that carry none of those fields, or whose resource recorded
+	* no secret.
+	*/
+	redactOperationsForJournal(operations) {
+		return operations.map((op) => {
+			const secrets = this.perResourceSecrets.get(op.logicalId);
+			if (!secrets || secrets.size === 0) return op;
+			const next = { ...op };
+			if (next.properties) next.properties = redactSecretsForState(next.properties, secrets);
+			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(next.attemptedProperties, secrets);
+			if (next.previousState) {
+				const prev = { ...next.previousState };
+				prev.properties = redactSecretsForState(prev.properties, secrets);
+				if (prev.attributes) prev.attributes = redactSecretsForState(prev.attributes, secrets);
+				if (prev.observedProperties) prev.observedProperties = redactSecretsForState(prev.observedProperties, secrets);
+				next.previousState = prev;
+			}
+			return next;
+		});
+	}
+	redactStateForPersist(state) {
+		const resources = {};
+		for (const [logicalId, record] of Object.entries(state.resources)) {
+			const secrets = this.perResourceSecrets.get(logicalId);
+			resources[logicalId] = secrets ? scrubResourceRecord(record, secrets) : record;
+		}
+		return {
+			...state,
+			resources,
+			outputs: this.outputSecrets.size > 0 ? redactSecretsForState(state.outputs, this.outputSecrets) : state.outputs
 		};
 	}
 	/**
@@ -21981,12 +22237,21 @@ var DeployEngine = class {
 	* constructed with `options.parentStackInfo` (= it's deploying a
 	* nested-stack child). Returns the state unchanged for top-level
 	* deploys so the three v6 fields stay absent from non-child state files.
+	*
+	* ALSO the single choke point where resolved SECRET plaintext is redacted out
+	* of the persisted state (GHSA fix): every `stateBackend.saveState` call in
+	* this engine wraps its state through here, so redacting `resources` once here
+	* covers `properties` / `attributes` / `observedProperties` across every
+	* create / update / replacement / rollback / observed-capture path uniformly —
+	* including the async observed-capture drain that runs after the resolver
+	* context is gone (which is why the secret map is session-wide).
 	*/
 	withParentInfo(state) {
-		if (!this.options.parentStackInfo) return state;
+		const redacted = this.redactStateForPersist(state);
+		if (!this.options.parentStackInfo) return redacted;
 		const { parentStack, parentLogicalId, parentRegion } = this.options.parentStackInfo;
 		return {
-			...state,
+			...redacted,
 			parentStack,
 			parentLogicalId,
 			parentRegion
@@ -22241,13 +22506,14 @@ var DeployEngine = class {
 				conditions
 			}, stackName);
 			diffResolverContext.bestEffort = true;
+			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry));
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions);
+					const resolvedOutputs = this.redactPropsWith(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions), this.outputSecrets);
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
@@ -22575,6 +22841,7 @@ var DeployEngine = class {
 		let outputs;
 		try {
 			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+			outputs = this.redactPropsWith(outputs, this.outputSecrets);
 		} catch (outputError) {
 			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
 			await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "no-rollback-failure", currentEtag === void 0);
@@ -22730,6 +22997,8 @@ var DeployEngine = class {
 	*/
 	async writeRollbackJournalSegment(stackName, completedOperations, failedOperations, reason, initialDeploy) {
 		if (completedOperations.length === 0 && failedOperations.length === 0) return;
+		const redactedCompleted = this.redactOperationsForJournal(completedOperations);
+		const redactedFailed = this.redactOperationsForJournal(failedOperations);
 		try {
 			const segment = {
 				...this.options.eventRecorder?.runId !== void 0 && { runId: this.options.eventRecorder.runId },
@@ -22738,8 +23007,8 @@ var DeployEngine = class {
 				initialDeploy,
 				...this.options.roleArn && { roleArn: this.options.roleArn },
 				cdkdVersion: getCdkdVersion(),
-				operations: completedOperations,
-				...failedOperations.length > 0 && { failedOperations }
+				operations: redactedCompleted,
+				...redactedFailed.length > 0 && { failedOperations: redactedFailed }
 			};
 			await this.stateBackend.appendRollbackJournalSegment(stackName, this.stackRegion, segment);
 			this.logger.debug(`Rollback journal segment written (${reason})`);
@@ -22846,10 +23115,29 @@ var DeployEngine = class {
 	recordEvent(event) {
 		if (!this.options.eventRecorder) return;
 		try {
-			this.options.eventRecorder.record(event);
+			this.options.eventRecorder.record(this.maskSecretsInEvent(event));
 		} catch {}
 	}
 	/**
+	* Mask any resolved secret value out of an event's human-authored text before
+	* it is persisted to `deployments/*.jsonl` (which outlives `cdkd destroy`)
+	* — GHSA fix. An AWS validation error can quote the offending property value
+	* (`Value '<secret>' at 'X' failed to satisfy ...`), and a provider `reason`
+	* is provider-authored prose; both reach the event store as `error.message` /
+	* `reason`. No-op when the deploy recorded no secrets.
+	*/
+	maskSecretsInEvent(event) {
+		const secrets = event.logicalId ? this.perResourceSecrets.get(event.logicalId) : void 0;
+		if (!secrets || secrets.size === 0) return event;
+		const next = { ...event };
+		if (next.error?.message) next.error = {
+			...next.error,
+			message: maskSecretsInText(next.error.message, secrets)
+		};
+		if (next.reason) next.reason = maskSecretsInText(next.reason, secrets);
+		return next;
+	}
+	/**
 	* Issue #1002 PR 2 — §7 step 3 post-resolution audit (defense in depth).
 	* No-op in legacy mode (`options.assetRedirect` unset). In cdkd-assets
 	* mode, a resolved property still naming a mapped SOURCE (CDK bootstrap)
@@ -22949,6 +23237,7 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
@@ -22990,9 +23279,11 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+				this.perResourceSecrets.set(logicalId, updateSecrets);
 				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				this.attemptedResolvedProps.set(logicalId, resolvedProps);
-				if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
+				if (JSON.stringify(this.redactPropsWith(resolvedProps, updateSecrets)) === JSON.stringify(currentProps)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 						this.logger.info(`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -23518,6 +23809,7 @@ var DeployEngine = class {
 				outputs[outputKey] = void 0;
 			}
 		}
+		if (context.recordedSecretValues) for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
 		return outputs;
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -23532,5 +23824,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { coerceCfnBoolean as $, resolveStateBucketWithDefault as $t, cyan as A, MissingCdkCliError as An, AssetModeResolver as At, findSilentDropProperties as B, formatError as Bn, getDockerCmd as Bt, makeCanonicalizePropertiesFn as C, ConfigError as Cn, stringifyValue as Ct, renderStatefulReason as D, LocalMigrateError as Dn, loadPublishableAssetManifest as Dt, isStatefulRecreateTargetSync as E, LocalInvokeBuildError as En, createAssetRedirectResolver as Et, IAMRoleProvider as F, ResourceUpdateNotSupportedError as Fn, validateAssetBucketName as Ft, IntrinsicFunctionResolver as G, isRetryableTransientError as Gn, Synthesizer as Gt, slowCcOperationTimeoutMs as H, normalizeAwsError as Hn, runDockerStreaming as Ht, collectInlinePolicyNamesManagedBySiblings as I, StackHasActiveImportsError as In, validateContainerRepoName as It, refStateLookupFromResource as J, __exportAll as Jn, getLegacyStateBucketName as Jt, cfnRefValueFromPhysicalId as K, isThrottlingError as Kn, synthesisStatusMessage as Kt, clearOnUpdateRemoval as L, StackTerminationProtectionError as Ln, buildDenyExternalAccessPolicy as Lt, green as M, PartialFailureError as Mn, ensureAssetStorage as Mt, red as N, ProvisioningError as Nn, getBootstrapMarkerKey as Nt, formatResourceLine as O, LocalStartServiceError as On, rewriteTemplateAssetReferences as Ot, yellow as P, ResourceTimeoutError as Pn, parseBootstrapMarker as Pt, assertRegionMatch as Q, resolveSkipPrefix as Qt, ProviderRegistry as R, StateError as Rn, buildDockerImage as Rt, unsupportedFinalSnapshotError as S, CdkdError as Sn, AssetPublisher as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, DeployCancelledError as Tn, buildAssetRedirectMap as Tt, disableInstanceApiTermination as U, withErrorHandling as Un, AssetManifestLoader as Ut, CloudControlProvider as V, isCdkdError as Vn, runDockerForeground as Vt, isTerminationProtectionPropagationError as W, isMarkedNonRetryable as Wn, getDockerImageBySourceHash as Wt, normalizeAwsTagsToCfn as X, resolveAutoAssetStorage as Xt, WAFv2WebACLProvider as Y, resolveApp as Yt, resolveExplicitPhysicalId as Z, resolveCaptureObservedState as Zt, buildFinalSnapshotIdentifier as _, AwsClients as _n, TemplateParser as _t, DeploymentEventsStore as a, CFN_TEMPLATE_URL_LIMIT as an, requireConfigObject as at, isFinalSnapshotError as b, setAwsClients as bn, rebuildClientForBucketRegion as bt, replayFailedOperations as c, uploadCfnTemplate as cn, s3BucketDomainName as ct, deleteSkipReason as d, canonicalizeRegion as dn, s3BucketWebsiteUrl as dt, resolveStateBucketWithDefaultAndSource as en, configBooleanRefusal as et, withResourceDeadline as f, derivePartitionAndUrlSuffix as fn, applyRoleArnIfSet as ft, PRE_DELETE_SNAPSHOT_TYPES as g, resolveBucketRegion as gn, DagBuilder as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, clearBucketRegionCache as hn, withRetry as ht, DeploymentEventsReader as i, CFN_TEMPLATE_BODY_LIMIT as in, requireConfigArray as it, gray as j, NestedStackChildDirectDestroyError as jn, BOOTSTRAP_MARKER_PREFIX as jt, bold as k, LockError as kn, escapeRegExp as kt, replayRollback as l, expectedOwnerParam as ln, s3BucketDualStackDomainName as lt, computeImplicitDeleteEdges as m, processStackMessages as mn, describeTypeWithThrottleRetry as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, stateBucketExistenceConfirmed as nn, readConfigString as nt, planFailedOps as o, MIGRATE_TMP_PREFIX as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, AssemblyReader as pn, DiffCalculator as pt, getAccountInfo as q, markNonRetryable as qn, getDefaultStateBucketName as qt, DeployEngine as r, warnDeprecatedNoPrefixCliFlag as rn, replayWarn as rt, planRollback as s, findLargeInlineResources as sn, s3BucketArn as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveUseCdkBootstrapAssets as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, PARTITION_TABLE as un, s3BucketRegionalDomainName as ut, ccRoutedFinalSnapshotError as v, getAwsClients as vn, LockManager as vt, extractDeploymentEventError as w, DependencyError as wn, WorkGraph as wt, refusesFinalSnapshot as x, AssetError as xn, shouldRetainResource as xt, createPreDeleteFinalSnapshot as y, resetAwsClients as yn, S3StateBackend as yt, findActionableSilentDrops as z, SynthesisError as zn, formatDockerLoginError as zt };
-//# sourceMappingURL=deploy-engine-B-0iA5XV.js.map
+export { coerceCfnBoolean as $, resolveCaptureObservedState as $t, cyan as A, LocalStartServiceError as An, rewriteTemplateAssetReferences as At, findSilentDropProperties as B, StateError as Bn, buildDockerImage as Bt, makeCanonicalizePropertiesFn as C, AssetError as Cn, shouldRetainResource as Ct, renderStatefulReason as D, DeployCancelledError as Dn, buildAssetRedirectMap as Dt, isStatefulRecreateTargetSync as E, DependencyError as En, WorkGraph as Et, IAMRoleProvider as F, ProvisioningError as Fn, getBootstrapMarkerKey as Ft, IntrinsicFunctionResolver as G, withErrorHandling as Gn, AssetManifestLoader as Gt, slowCcOperationTimeoutMs as H, formatError as Hn, getDockerCmd as Ht, collectInlinePolicyNamesManagedBySiblings as I, ResourceTimeoutError as In, parseBootstrapMarker as It, refStateLookupFromResource as J, isThrottlingError as Jn, synthesisStatusMessage as Jt, cfnRefValueFromPhysicalId as K, isMarkedNonRetryable as Kn, getDockerImageBySourceHash as Kt, clearOnUpdateRemoval as L, ResourceUpdateNotSupportedError as Ln, validateAssetBucketName as Lt, green as M, MissingCdkCliError as Mn, AssetModeResolver as Mt, red as N, NestedStackChildDirectDestroyError as Nn, BOOTSTRAP_MARKER_PREFIX as Nt, formatResourceLine as O, LocalInvokeBuildError as On, createAssetRedirectResolver as Ot, yellow as P, PartialFailureError as Pn, ensureAssetStorage as Pt, assertRegionMatch as Q, resolveAutoAssetStorage as Qt, ProviderRegistry as R, StackHasActiveImportsError as Rn, validateContainerRepoName as Rt, unsupportedFinalSnapshotError as S, setAwsClients as Sn, rebuildClientForBucketRegion as St, MULTI_REGION_RECREATE_BLOCKED_TYPES as T, ConfigError as Tn, stringifyValue as Tt, disableInstanceApiTermination as U, isCdkdError as Un, runDockerForeground as Ut, CloudControlProvider as V, SynthesisError as Vn, formatDockerLoginError as Vt, isTerminationProtectionPropagationError as W, normalizeAwsError as Wn, runDockerStreaming as Wt, normalizeAwsTagsToCfn as X, __exportAll as Xn, getLegacyStateBucketName as Xt, WAFv2WebACLProvider as Y, markNonRetryable as Yn, getDefaultStateBucketName as Yt, resolveExplicitPhysicalId as Z, resolveApp as Zt, buildFinalSnapshotIdentifier as _, clearBucketRegionCache as _n, withRetry as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as an, requireConfigObject as at, isFinalSnapshotError as b, getAwsClients as bn, LockManager as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as cn, scrubResourceRecord as ct, deleteSkipReason as d, expectedOwnerParam as dn, s3BucketDualStackDomainName as dt, resolveSkipPrefix as en, configBooleanRefusal as et, withResourceDeadline as f, PARTITION_TABLE as fn, s3BucketRegionalDomainName as ft, PRE_DELETE_SNAPSHOT_TYPES as g, processStackMessages as gn, describeTypeWithThrottleRetry as gt, ATOMIC_FINAL_SNAPSHOT_TYPES as h, AssemblyReader as hn, DiffCalculator as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as in, requireConfigArray as it, gray as j, LockError as jn, escapeRegExp$1 as jt, bold as k, LocalMigrateError as kn, loadPublishableAssetManifest as kt, replayRollback as l, findLargeInlineResources as ln, s3BucketArn as lt, computeImplicitDeleteEdges as m, derivePartitionAndUrlSuffix as mn, applyRoleArnIfSet as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveStateBucketWithDefaultAndSource as nn, readConfigString as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as on, requireConfigString as ot, IMPLICIT_DELETE_DEPENDENCIES as p, canonicalizeRegion as pn, s3BucketWebsiteUrl as pt, getAccountInfo as q, isRetryableTransientError as qn, Synthesizer as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as rn, replayWarn as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as sn, redactSecretsForState as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefault as tn, configStringRefusal as tt, UNSPECIFIED_SKIP_REASON as u, uploadCfnTemplate as un, s3BucketDomainName as ut, ccRoutedFinalSnapshotError as v, resolveBucketRegion as vn, DagBuilder as vt, extractDeploymentEventError as w, CdkdError as wn, AssetPublisher as wt, refusesFinalSnapshot as x, resetAwsClients as xn, S3StateBackend as xt, createPreDeleteFinalSnapshot as y, AwsClients as yn, TemplateParser as yt, findActionableSilentDrops as z, StackTerminationProtectionError as zn, buildDenyExternalAccessPolicy as zt };
+//# sourceMappingURL=deploy-engine-ISOKkuun.js.map