@go-to-k/cdkd 0.283.32 → 0.283.33

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getAccountInfo, $t as runDockerForeground, A as cyan, An as getAwsClients, At as S3StateBackend, B as stateKeySecretExposure, Bn as LocalStartServiceError, Bt as escapeRegExp, C as makeCanonicalizePropertiesFn, Cn as canonicalizeRegion, Ct as DiffCalculator, D as renderStatefulReason, Dt as DagBuilder, E as isStatefulRecreateTargetSync, En as processStackMessages, Et as withRetry, F as collectDeclaredOutputNames, Ft as WorkGraph, G as findActionableSilentDrops, Gn as ProvisioningError, Gt as getBootstrapMarkerKey, H as collectInlinePolicyNamesManagedBySiblings, Hn as MissingCdkCliError, Ht as AssetModeResolver, I as collectPublishedOutputNames, It as buildAssetRedirectMap, J as slowCcOperationTimeoutMs, Jn as StackHasActiveImportsError, Jt as validateContainerRepoName, K as findSilentDropProperties, Kn as ResourceTimeoutError, Kt as parseBootstrapMarker, L as exportAliasCollisionScrubWarning, Ln as DeployCancelledError, Lt as createAssetRedirectResolver, M as green, Mn as setAwsClients, Mt as shouldRetainResource, N as red, Nt as AssetPublisher, O as formatResourceLine, On as resolveBucketRegion, Ot as TemplateParser, P as yellow, Pn as CdkdError, Pt as stringifyValue, Q as cfnRefValueFromPhysicalId, Qt as getDockerCmd, R as isExportAliasCollision, Rn as LocalInvokeBuildError$1, Rt as loadPublishableAssetManifest, S as unsupportedFinalSnapshotError, Sn as PARTITION_TABLE, St as applyRoleArnIfSet, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as AssemblyReader, Tt as describeTypeWithThrottleRetry, U as clearOnUpdateRemoval, Un as NestedStackChildDirectDestroyError, Ut as BOOTSTRAP_MARKER_PREFIX, V as IAMRoleProvider, Vt as stripControlChars, W as ProviderRegistry, Wn as PartialFailureError, Wt as ensureAssetStorage, X as isTerminationProtectionPropagationError, Xt as buildDockerImage, Y as disableInstanceApiTermination, Yn as StackTerminationProtectionError, Yt as buildDenyExternalAccessPolicy, Z as IntrinsicFunctionResolver, Zt as formatDockerLoginError, _ as buildFinalSnapshotIdentifier, _n as CFN_TEMPLATE_URL_LIMIT, _t as s3BucketArn, a as DeploymentEventsStore, an as getDefaultStateBucketName, ar as markNonRetryable, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as uploadCfnTemplate, bt as s3BucketRegionalDomainName, c as replayFailedOperations, cn as resolveAutoAssetStorage, ct as readConfigString, d as deleteSkipReason, dn as resolveStateBucketWithDefault, dt as requireConfigObject, en as runDockerStreaming, er as normalizeAwsError, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveStateBucketWithDefaultAndSource, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as CFN_TEMPLATE_BODY_LIMIT, gt as scrubResourceRecord, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as warnDeprecatedNoPrefixCliFlag, ht as redactSecretsForState, i as DeploymentEventsReader, in as synthesisStatusMessage, ir as isThrottlingError, it as assertRegionMatch, j as gray, jn as resetAwsClients, jt as rebuildClientForBucketRegion, k as bold, kn as AwsClients, kt as LockManager, l as replayRollback, ln as resolveCaptureObservedState, lt as replayWarn, m as computeImplicitDeleteEdges, mn as stateBucketExistenceConfirmed, mt as TEMPLATE_SOURCED_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerImageBySourceHash, nr as isMarkedNonRetryable, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as getLegacyStateBucketName, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveUseCdkBootstrapAssets, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ResourceUpdateNotSupportedError, qt as validateAssetBucketName, r as DeployEngine, rn as Synthesizer, rr as isRetryableTransientError, rt as resolveExplicitPhysicalId, s as planRollback, sn as resolveApp, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetManifestLoader, tr as withErrorHandling, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveSkipPrefix, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as MIGRATE_TMP_PREFIX, vt as s3BucketDomainName, w as extractDeploymentEventError, wn as derivePartitionAndUrlSuffix, wt as INTRINSIC_KEYS, x as refusesFinalSnapshot, xn as expectedOwnerParam, xt as s3BucketWebsiteUrl, y as createPreDeleteFinalSnapshot, yn as findLargeInlineResources, yt as s3BucketDualStackDomainName, z as secretBearingStateKeyWarning, zn as LocalMigrateError, zt as rewriteTemplateAssetReferences } from "./deploy-engine-rYTNzst0.js";
+import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-Cg54H4pJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CVoisQ0L.js";
+import { t as ASGProvider } from "./asg-provider-ID5-zAwf.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -60644,6 +60644,325 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 	};
 }
 /**
+* Does any string anywhere in `value` carry a `{{resolve:...}}` dynamic
+* reference?
+*
+* Cheap pre-check so the overwhelming majority of resources — which reference
+* no secret at all — never build a resolver context and never pay a deep clone
+* of their property bag.
+*/
+function containsDynamicReference(value) {
+	if (typeof value === "string") return value.includes("{{resolve:");
+	if (Array.isArray(value)) return value.some(containsDynamicReference);
+	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference);
+	return false;
+}
+/**
+* Byte-for-byte the threshold `secret-redaction.ts` applies when it builds its
+* substring needles (`MIN_NEEDLE_LENGTH`). Copied rather than imported because
+* that constant is module-private there and this file may not widen its
+* exports; the two must agree or this function would call a leaf secret-bearing
+* that `redactSecretsForState` will not redact.
+*/
+const MIN_SECRET_NEEDLE_LENGTH = 4;
+/**
+* Does `value` hold a plaintext this pass has recorded as a secret?
+*
+* Two branches with deliberately different strictness, and the asymmetry is the
+* point. A WHOLE-value match is exact evidence at any length, so it is accepted
+* unconditionally. A SUBSTRING match is only evidence when the plaintext is
+* long enough to be distinctive: a 1-3 character secret (a JSON key holding
+* `"0"`) occurs inside unrelated values constantly, and accepting it would mark
+* half the resource's paths secret-bearing — masking values that are not
+* secrets and, worse, making `--accept` refuse them.
+*
+* So this errs toward NOT marking on the substring branch, and that direction
+* is chosen rather than inherited: `redactSecretsForState` applies the same
+* threshold when it builds needles, so a sub-threshold plaintext is not
+* substituted there either. Marking a path this function's caller cannot
+* actually redact would produce a `***` with no mechanism behind it.
+*/
+function carriesRecordedSecret(value, secrets) {
+	if (value === "") return false;
+	if (secrets.has(value)) return true;
+	for (const plaintext of secrets.keys()) if (plaintext.length >= MIN_SECRET_NEEDLE_LENGTH && value.includes(plaintext)) return true;
+	return false;
+}
+/**
+* Is this unresolvable token one whose value is a SECRET by definition?
+*
+* `ssm-secure` is the only such spelling, and it is decidable with no lookup:
+* CloudFormation defines exactly three dynamic-reference services (`ssm`,
+* `ssm-secure`, `secretsmanager`), cdkd resolves the other two, and
+* `ssm-secure` is the encrypted one.
+*
+* Anything else reaching the survivor arm is not a CloudFormation dynamic
+* reference at all — it is text that merely looks like one — and treating it as
+* secret is not the safe direction it appears to be: the path would be masked
+* to `***`, refused by `--accept`, and pinned to the live value by
+* {@link preserveLiveValuesAtUnresolvedTokens}, which is permanently stuck
+* drift with no remedy the user can apply. Such a token is still REPORTED; it
+* just does not claim to be a secret.
+*/
+function isSecretBySpelling(token) {
+	return token.startsWith("{{resolve:ssm-secure:");
+}
+/**
+* Every `{{resolve:...}}` token still present in `value`.
+*
+* Used to NAME an unresolvable reference without quoting the string it sits in.
+* That string is a partially substituted leaf: `resolveDynamicReferences`
+* substitutes token by token, so a leaf holding two references comes back with
+* the resolvable one already replaced by its PLAINTEXT. Interpolating it into a
+* log line prints the secret — from the command whose purpose is not to. A
+* token is a reference NAME and carries no value, so it is always safe to show.
+*/
+function survivingDynamicReferences(value) {
+	return value.match(/\{\{resolve:[^}]+\}\}/g) ?? [];
+}
+/**
+* Record the dotted path of every leaf holding a `{{resolve:...}}` string.
+*
+* The OFFLINE seed for {@link SecretPathSet}: it needs no AWS call, so it is
+* what remains when resolution fails. Issue #1900's mechanism applied to
+* positions instead of values — the record's own bags already say WHERE the
+* references are, and that is the half of the answer a failed lookup does not
+* take away.
+*
+* Necessarily coarser than the resolved answer, because a `{{resolve:ssm:...}}`
+* naming a plain `String` parameter is PUBLIC config and only the resolver's
+* TYPE verdict can say so. Marking such a path secret-bearing over-masks it,
+* which is why the seed is used ONLY on the failure path, where the alternative
+* is not masking at all.
+*/
+function collectDynamicReferencePaths(value, into, path = "") {
+	if (typeof value === "string") {
+		if (value.includes("{{resolve:")) into.add(path);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, i) => collectDynamicReferencePaths(item, into, path === "" ? String(i) : `${path}.${i}`));
+		return;
+	}
+	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
+}
+/**
+* Re-resolve the SECRET dynamic references (`{{resolve:secretsmanager:...}}`,
+* and an `{{resolve:ssm:...}}` naming a `SecureString`) held by a bag read back
+* out of cdkd STATE (issue #1914).
+*
+* State stores the unresolved EXPRESSION — that is the GHSA-p5qg-v9gv-hc7w
+* redaction — while a provider's `readCurrentState` snapshot necessarily holds
+* the resolved PLAINTEXT, because that is what AWS was given at deploy time.
+* Nothing in `cdkd drift` reconciled the two, and all three of the command's
+* modes broke on it: the comparison reported permanent phantom drift and
+* printed the plaintext as the AWS-current side, `--accept` persisted that
+* plaintext back into `state.json`, and `--revert` shipped the literal
+* `{{resolve:...}}` string to the live resource.
+*
+* The counterpart of the rollback replay's `resolveReplayProps`
+* (`src/deployment/rollback-executor.ts`), and for the same reason: both
+* commands are synth-free, so the expression string in the persisted record is
+* the only thing there is to resolve from. Every plaintext is recorded into
+* `secrets` so the caller can redact it back out of anything it PRINTS or
+* PERSISTS, and every path that produced one into `secretPaths` so the caller
+* can act on a value it does NOT recognise there — see {@link redactDriftChanges}.
+*
+* A `{{resolve:...}}` token that SURVIVES the pass is reported through
+* `onUnresolved` and left in place — it is not an error. The resolver's
+* unsupported-service arm (`ssm-secure:` is the live example) warns and returns
+* the literal, and `cdkd deploy` resolves through the very same code, so AWS is
+* ALREADY holding that literal string and state records it. Replaying it is
+* therefore a correct no-op, and failing the resource over it would take every
+* other drifted property on that resource down with it (plus exit 2). The
+* report exists so the user learns cdkd is shipping a token it cannot resolve,
+* which is a real thing to know and not a reason to stop.
+*
+* Only the TOKENS are reported, never the leaf that held them: the leaf is
+* partially substituted by this point, so a mixed `secretsmanager` +
+* `ssm-secure` string comes back carrying real plaintext.
+*
+* Returns the input by identity when it holds no dynamic reference, so the
+* non-secret path is unchanged down to object identity.
+*/
+async function resolveStateSecretExpressions(props, resolver, secrets, options = {}) {
+	if (!containsDynamicReference(props)) return props;
+	const { secretPaths, onUnresolved } = options;
+	const ctx = {
+		template: { Resources: {} },
+		resources: {},
+		recordedSecretValues: secrets
+	};
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return v;
+			const resolved = await resolver.resolveDynamicReferences(v, ctx);
+			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
+			if (survivors.length > 0) {
+				if (survivors.some(isSecretBySpelling)) secretPaths?.add(path);
+				onUnresolved?.(survivors, path);
+			}
+			if (carriesRecordedSecret(resolved, secrets)) secretPaths?.add(path);
+			return resolved;
+		}
+		if (Array.isArray(v)) {
+			const out = new Array(v.length);
+			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i], path === "" ? String(i) : `${path}.${i}`);
+			return out;
+		}
+		if (v !== null && typeof v === "object") {
+			const out = {};
+			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
+			return out;
+		}
+		return v;
+	};
+	return await walk(props, "");
+}
+/**
+* Is a drift reported at `path` positioned on, or above, a known secret?
+*
+* The PREFIX direction is the one that matters: a secret sits at a leaf (or at
+* an array the comparator never descends), while a drift can be reported at any
+* ancestor of it — `Environment` rather than
+* `Environment.Variables.SECRET_PASSWORD` — whenever the two sides disagree
+* about the shape rather than the value. The reverse containment is checked too
+* and costs nothing.
+*/
+function isSecretBearingPath(path, secretPaths) {
+	if (secretPaths.size === 0) return false;
+	for (const secretPath of secretPaths) if (secretPath === path || secretPath.startsWith(`${path}.`) || path.startsWith(`${secretPath}.`)) return true;
+	return false;
+}
+/**
+* Redact one side of a drift entry.
+*
+* Two passes, and the second is the one issue #1914's review turned up. The
+* VALUE pass rewrites any recorded plaintext back onto its own
+* `{{resolve:...}}` expression, which is exact and is all that is needed while
+* the secret AWS holds is the secret the reference resolves to today.
+*
+* It stops being enough the moment those two differ, and they differ for the
+* most ordinary reason there is: a Secrets Manager ROTATION. The deployed
+* resource then still holds the PREVIOUS secret while the re-resolved baseline
+* holds the new one, so the path drifts and the AWS side matches no key in a
+* map built from today's value — it is a real secret that would be printed
+* verbatim and persisted by `--accept`. An out-of-band edit is
+* indistinguishable from it at this layer, so the POSITION decides: at a path
+* known to carry a secret, the only value ever shown is the expression itself,
+* and anything else becomes {@link SECRET_MASK}.
+*
+* `undefined` and `null` are exempt — an absent or null key discloses nothing,
+* and masking them would turn "AWS does not have this key" into "AWS has
+* something secret here", which is both wrong and less useful.
+*/
+function redactDriftValue(value, secrets, secretBearing) {
+	const redacted = redactSecretsForState(value, secrets);
+	if (!secretBearing) return redacted;
+	if (redacted === void 0 || redacted === null) return redacted;
+	if (typeof redacted === "string" && isWholeDynamicReference(redacted)) return redacted;
+	return "***";
+}
+/**
+* Is the WHOLE string a single `{{resolve:...}}` token and nothing else?
+*
+* Byte-for-byte `secret-redaction.ts`'s `isSingleDynamicReferenceToken`,
+* including the `[^{}]*` character class. The difference from `[^}]+` is
+* narrow and worth stating correctly: it is a `{` INSIDE the token, e.g.
+* `{{resolve:ssm:/a{b}}`. (A previous version of this comment claimed
+* `{{resolve:a}}{{resolve:b}}` would pass under `[^}]+` — it would not, since
+* `[^}]+` cannot span the `}` in the middle either.) Matching the sibling
+* exactly is what matters here: this predicate decides whether a value may be
+* shown INSTEAD of `SECRET_MASK`, and `redactByPath` uses its copy to decide
+* whether a leaf is already an expression, so a disagreement would let one of
+* them treat as a token what the other treats as data. Copied rather than
+* imported because that helper is module-private and this file may not widen
+* that module's exports.
+*/
+function isWholeDynamicReference(value) {
+	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+}
+/**
+* Why `--accept` must not persist this drift, or `undefined` when it may.
+*
+* Shared by the WRITE (`runAccept`) and the PLAN (`printAcceptPlan`) so the two
+* cannot disagree — a `--dry-run` that promises a write the real run refuses is
+* worse than either behaviour on its own.
+*
+* Two refusals, both about a value cdkd could not identify rather than about
+* secrecy as such:
+*
+* - A masked VALUE says AWS holds something at a known-secret path that is not
+*   what the reference resolves to. Writing `***` would corrupt the baseline
+*   and make the next deploy push the literal mask at AWS.
+* - A masked PATH says the readback answered with a map KEYED by a secret.
+*   `setAtPath` would then create a key literally named `***` — and when
+*   `awsValue` is `undefined` it would INSERT that key rather than removing the
+*   real one, so the value check alone does not cover it.
+*
+* The path check is what makes the value exemptions safe: `redactDriftValue`
+* lets `undefined` / `null` / a whole expression through unmasked, which is
+* right for a value and says nothing about the path it sits at.
+*/
+function acceptRefusalReason(change, maskedPaths) {
+	if (!maskedPaths.has(change.path)) return void 0;
+	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
+	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
+	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
+}
+/**
+* Redact resolved secret plaintext out of the drift entries that get REPORTED
+* (issue #1914).
+*
+* Both sides need it, for different reasons. `stateValue` comes from the
+* re-resolved comparison baseline, so at a secret leaf it now holds the
+* plaintext the state record deliberately does not store. `awsValue` is the
+* live readback, which holds that plaintext by construction. Either one
+* reaching `writeHumanReport` / `writeJsonReport` / the `--accept` and
+* `--revert` plans is the disclosure the redaction exists to prevent.
+*
+* Redacting `awsValue` also settles what `--accept` PERSISTS: that is the value
+* it writes into the baseline, so a secret one arrives at the state write
+* already carrying its expression — or, when it could not be recognised, as
+* {@link SECRET_MASK}, which `runAccept` refuses to persist.
+*
+* The PATH is redacted too. `redactSecretsForState` walks values and never
+* object KEYS, so a readback that answers with a map keyed by a secret (a
+* Lambda env var NAMED with one) renders as
+* `Environment.Variables.<plaintext>` in every printer. It is masked here
+* rather than assumed impossible, and a masked path also marks the change
+* secret-bearing, so `--accept` will not write a key it can no longer name.
+*
+* Returns the input array by identity when there is nothing to act on.
+*/
+function redactDriftChanges(changes, secrets, secretPaths) {
+	if (secrets.size === 0 && secretPaths.size === 0) return {
+		changes,
+		maskedPaths: /* @__PURE__ */ new Set()
+	};
+	const maskedPaths = /* @__PURE__ */ new Set();
+	const redacted = [];
+	for (const change of changes) {
+		const maskedPath = maskSecretsInText(change.path, secrets);
+		const positionIsSecret = isSecretBearingPath(change.path, secretPaths);
+		const nameCarriesSecret = maskedPath !== change.path;
+		const secretBearing = positionIsSecret || nameCarriesSecret;
+		if (secretPaths.has(change.path) && change.awsValue === void 0) continue;
+		const stateValue = redactDriftValue(change.stateValue, secrets, secretBearing);
+		const awsValue = redactDriftValue(change.awsValue, secrets, secretBearing);
+		if (maskedPath !== change.path || secretBearing && awsValue === "***" || secretBearing && change.awsValue === void 0) maskedPaths.add(maskedPath);
+		redacted.push({
+			path: maskedPath,
+			stateValue,
+			awsValue
+		});
+	}
+	return {
+		changes: redacted,
+		maskedPaths
+	};
+}
+/**
 * Run drift detection for one stack and shape the per-resource outcomes
 * into a {@link StackDriftReport}. The state object + etag are stored on
 * the report so `--accept` can write back without a re-read, and
@@ -60656,6 +60975,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 	return await withStackName(stackName, async () => {
 		const outcomes = [];
 		const state = result.state;
+		const logger = getLogger();
+		const secretResolver = new IntrinsicFunctionResolver(region);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 		for (const [logicalId, resource] of entries) {
 			if (providerRegistry.shouldSkipResource(resource.resourceType)) continue;
@@ -60715,19 +61036,46 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+			const secrets = /* @__PURE__ */ new Map();
+			const secretPaths = /* @__PURE__ */ new Set();
+			const seededSecretPaths = /* @__PURE__ */ new Set();
+			collectDynamicReferencePaths(baseline, seededSecretPaths);
+			if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+			const unresolvedTokens = /* @__PURE__ */ new Set();
+			const noteUnresolved = (tokens) => {
+				for (const token of tokens) unresolvedTokens.add(token);
+			};
+			let comparisonBaseline = baseline;
+			let secretResolutionFailed = false;
+			try {
+				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolver, secrets, {
+					secretPaths,
+					onUnresolved: noteUnresolved
+				});
+				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolver, secrets, {
+					secretPaths,
+					onUnresolved: noteUnresolved
+				});
+			} catch (err) {
+				secretResolutionFailed = true;
+				comparisonBaseline = baseline;
+				logger.warn(`${logicalId} (${resource.resourceType}): could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				secrets.clear();
+			}
+			if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
-			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
+			const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
 			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
 			const canonicalized = provider.canonicalizeDriftProperties ? {
 				baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
 				aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
 			} : protocolNormalized;
-			const changes = calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
+			const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
-			});
-			if (changes.length === 0) outcomes.push({
+			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+			if (reported.changes.length === 0) outcomes.push({
 				kind: "clean",
 				logicalId,
 				resourceType: resource.resourceType
@@ -60736,8 +61084,10 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				kind: "drifted",
 				logicalId,
 				resourceType: resource.resourceType,
-				changes,
-				awsProperties: aws
+				...reported,
+				awsProperties: aws,
+				secrets,
+				referencesUnresolved: secretResolutionFailed || unresolvedTokens.size > 0
 			});
 		}
 		return {
@@ -60779,6 +61129,20 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 	}
 	return { siblings };
 }
+/**
+* Read the value at a dotted path, or `undefined` when any segment is missing.
+* The read counterpart of {@link setAtPath}, and it parses the same subset:
+* the drift comparator only synthesizes paths through plain objects.
+*/
+function getAtPath(source, path) {
+	if (path.length === 0) return source;
+	let cursor = source;
+	for (const segment of path.split(".")) {
+		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) return void 0;
+		cursor = cursor[segment];
+	}
+	return cursor;
+}
 function setAtPath(target, path, value) {
 	if (path.length === 0) return;
 	const segments = path.split(".");
@@ -60831,13 +61195,27 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				const hasObserved = existing.observedProperties !== void 0;
 				const baselineSource = hasObserved ? existing.observedProperties : existing.properties ?? {};
 				const newBaseline = JSON.parse(JSON.stringify(baselineSource));
-				for (const change of outcome.changes) setAtPath(newBaseline, change.path, change.awsValue);
+				const accepted = [];
+				for (const change of outcome.changes) {
+					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
+					if (refusal !== void 0) {
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift ${report.stackName} --revert' to push the referenced value back to AWS, or re-deploy if the reference changed.`);
+						continue;
+					}
+					setAtPath(newBaseline, change.path, change.awsValue);
+					accepted.push(change);
+				}
+				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+				for (const change of accepted) {
+					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) continue;
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — cdkd state holds an unresolved '{{resolve:...}}' reference at that property, and the reference wins over an accepted value. Change the template if that reference is wrong.`);
+				}
 				resources[outcome.logicalId] = hasObserved ? {
 					...existing,
-					observedProperties: newBaseline
+					observedProperties: redactedBaseline
 				} : {
 					...existing,
-					properties: newBaseline
+					properties: redactedBaseline
 				};
 			}
 			const newState = {
@@ -61198,6 +61576,57 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 	return merged;
 }
 /**
+* Replace every leaf of a revert payload that still holds a `{{resolve:...}}`
+* token with the value AWS currently has at that position (issue #1914,
+* round-3 review).
+*
+* The round-3 change downgraded an unresolvable reference from a per-resource
+* failure to a warning, on the premise that `cdkd deploy` resolves through the
+* resolver's same unsupported-service arm — so AWS already holds the literal
+* and replaying it is a no-op. **That premise holds only for records cdkd
+* deployed.** CloudFormation resolves `ssm-secure` SERVER-side, so a record
+* adopted by `cdkd import --migrate-from-cloudformation` has the literal token
+* in state while the live resource holds the PLAINTEXT. `diffAt` skips such a
+* leaf, so it never drifts — but `buildRevertNewProperties` overlays the whole
+* top-level subtree when any SIBLING key drifts, which would push the literal
+* token over a resolved value. That is defect 1 of this issue surviving in a
+* narrower case, on a live AWS write.
+*
+* Deciding by PROVENANCE would need a flag state does not carry. Deciding by
+* what AWS actually holds needs nothing and is exact in both directions: for a
+* cdkd-deployed record AWS holds the token, so copying it back is the same
+* no-op the premise described; for a migrated record AWS holds the resolved
+* value, which is left untouched.
+*
+* Falls back to KEEPING the token wherever AWS has nothing at that position —
+* that is what `cdkd deploy` sends, so it is the safe residual rather than
+* dropping a property the resource may require. Array descent is positional
+* and bails to that same residual on any length mismatch, since a reordered
+* readback cannot be positioned against.
+*/
+function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
+	const walk = (value, live) => {
+		if (typeof value === "string" && value.includes("{{resolve:")) {
+			if (!isWholeDynamicReference(value)) return value;
+			if (live === void 0) return value;
+			if (typeof live === "string" && live.length >= MIN_SECRET_NEEDLE_LENGTH && isSecretBySpelling(value)) secrets.set(live, value);
+			return live;
+		}
+		if (Array.isArray(value)) {
+			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
+			return value.map((item, i) => walk(item, liveItems?.[i]));
+		}
+		if (value !== null && typeof value === "object") {
+			const liveObject = isPlainRecord(live) ? live : void 0;
+			const out = {};
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k]);
+			return out;
+		}
+		return value;
+	};
+	return walk(send, awsProperties);
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -61371,11 +61800,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	let totalFailed = 0;
 	let totalUnsupported = 0;
 	let totalSucceeded = 0;
+	let totalUnresolvable = 0;
 	for (const report of reports) {
 		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
+		const revertSecretResolver = new IntrinsicFunctionResolver(report.region);
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -61388,28 +61819,53 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					resourceType: outcome.resourceType,
 					provisionedBy: stateResource.provisionedBy
 				}).provider;
-				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
-				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
+				const secrets = /* @__PURE__ */ new Map();
+				const revertBaseline = stateResource.observedProperties ?? stateResource.properties ?? {};
+				const unresolvedTokens = /* @__PURE__ */ new Set();
+				const noteUnresolved = (tokens) => {
+					for (const token of tokens) unresolvedTokens.add(token);
+				};
+				let desiredProperties;
 				try {
-					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
+					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+				} catch (err) {
+					totalUnresolvable++;
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not re-resolve the dynamic reference(s) this resource's state records — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
+				const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
+				if (unrevertablePaths.length > 0) logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cannot revert ${unrevertablePaths.join(", ")} — cdkd cannot name the property, so it is left as AWS has it. ROTATE the secret that leaked into the property name.`);
+				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert. Where a token is EMBEDDED in a longer string, that string is written with the token literal, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
+				let newProperties;
+				try {
+					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
+					newProperties = unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid;
+				} catch (err) {
+					totalFailed++;
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
+				try {
+					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)) } });
 					totalSucceeded++;
 					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, delta);
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, STATE_SOURCED_READBACK_RULES));
 						}
 					} catch (captureErr) {
-						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${captureErr instanceof Error ? captureErr.message : String(captureErr)}`);
+						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
 					}
 				} catch (err) {
 					if (err instanceof ResourceUpdateNotSupportedError) {
 						totalUnsupported++;
-						logger.warn(`  ⊘ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not revert — ${err.message}`);
+						logger.warn(`  ⊘ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not revert — ${maskSecretsInText(err.message, secrets)}`);
 						return;
 					}
 					totalFailed++;
-					const msg = err instanceof Error ? err.message : String(err);
+					const msg = maskSecretsInText(err instanceof Error ? err.message : String(err), secrets);
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 				}
 			}), concurrency);
@@ -61467,10 +61923,11 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	}
 	const summaryParts = [`${totalSucceeded} reverted`];
 	if (totalUnsupported > 0) summaryParts.push(`${totalUnsupported} update-not-supported`);
+	if (totalUnresolvable > 0) summaryParts.push(`${totalUnresolvable} reference-unresolvable`);
 	if (totalFailed > 0) summaryParts.push(`${totalFailed} failed`);
 	logger.info(`\nRevert summary: ${summaryParts.join(", ")}.`);
 	if (totalUnsupported > 0) logger.warn(`${totalUnsupported} resource(s) cannot be reverted in place — re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`);
-	if (totalFailed > 0 || totalUnsupported > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
+	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} whose dynamic reference(s) could not be resolved — those never reached provider.update; grant the caller secretsmanager:GetSecretValue / ssm:GetParameter, or fix the reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
 }
 /**
 * Print the planned state mutations for `--accept` (no AWS calls). One
@@ -61485,7 +61942,14 @@ function printAcceptPlan(reports) {
 		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
 			process.stdout.write(`  ~ ${o.logicalId} (${o.resourceType})\n`);
-			for (const change of o.changes) process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+			for (const change of o.changes) {
+				const refusal = acceptRefusalReason(change, o.maskedPaths);
+				if (refusal !== void 0) {
+					process.stdout.write(`    ${change.path}: SKIPPED — ${refusal}\n`);
+					continue;
+				}
+				process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+			}
 		}
 	}
 }
@@ -61506,20 +61970,23 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				if (preserved.length > 0) {
+				const cannotMaskKeys = o.referencesUnresolved;
+				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (!cannotMaskKeys && preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
-					for (const path of preserved) process.stdout.write(`        ${path}\n`);
+					for (const path of preserved) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
 					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
 					process.stdout.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (unbaselined.length > 0) {
+				if (o.referencesUnresolved && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
-					for (const path of unbaselined) process.stdout.write(`        ${path}\n`);
+					for (const path of unbaselined) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
 					process.stdout.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
 				}
 			}
@@ -80414,7 +80881,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.32");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.33");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;