@go-to-k/cdkd 0.283.32 → 0.283.34

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as getAccountInfo, $t as runDockerForeground, A as cyan, An as getAwsClients, At as S3StateBackend, B as stateKeySecretExposure, Bn as LocalStartServiceError, Bt as escapeRegExp, C as makeCanonicalizePropertiesFn, Cn as canonicalizeRegion, Ct as DiffCalculator, D as renderStatefulReason, Dt as DagBuilder, E as isStatefulRecreateTargetSync, En as processStackMessages, Et as withRetry, F as collectDeclaredOutputNames, Ft as WorkGraph, G as findActionableSilentDrops, Gn as ProvisioningError, Gt as getBootstrapMarkerKey, H as collectInlinePolicyNamesManagedBySiblings, Hn as MissingCdkCliError, Ht as AssetModeResolver, I as collectPublishedOutputNames, It as buildAssetRedirectMap, J as slowCcOperationTimeoutMs, Jn as StackHasActiveImportsError, Jt as validateContainerRepoName, K as findSilentDropProperties, Kn as ResourceTimeoutError, Kt as parseBootstrapMarker, L as exportAliasCollisionScrubWarning, Ln as DeployCancelledError, Lt as createAssetRedirectResolver, M as green, Mn as setAwsClients, Mt as shouldRetainResource, N as red, Nt as AssetPublisher, O as formatResourceLine, On as resolveBucketRegion, Ot as TemplateParser, P as yellow, Pn as CdkdError, Pt as stringifyValue, Q as cfnRefValueFromPhysicalId, Qt as getDockerCmd, R as isExportAliasCollision, Rn as LocalInvokeBuildError$1, Rt as loadPublishableAssetManifest, S as unsupportedFinalSnapshotError, Sn as PARTITION_TABLE, St as applyRoleArnIfSet, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as AssemblyReader, Tt as describeTypeWithThrottleRetry, U as clearOnUpdateRemoval, Un as NestedStackChildDirectDestroyError, Ut as BOOTSTRAP_MARKER_PREFIX, V as IAMRoleProvider, Vt as stripControlChars, W as ProviderRegistry, Wn as PartialFailureError, Wt as ensureAssetStorage, X as isTerminationProtectionPropagationError, Xt as buildDockerImage, Y as disableInstanceApiTermination, Yn as StackTerminationProtectionError, Yt as buildDenyExternalAccessPolicy, Z as IntrinsicFunctionResolver, Zt as formatDockerLoginError, _ as buildFinalSnapshotIdentifier, _n as CFN_TEMPLATE_URL_LIMIT, _t as s3BucketArn, a as DeploymentEventsStore, an as getDefaultStateBucketName, ar as markNonRetryable, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as uploadCfnTemplate, bt as s3BucketRegionalDomainName, c as replayFailedOperations, cn as resolveAutoAssetStorage, ct as readConfigString, d as deleteSkipReason, dn as resolveStateBucketWithDefault, dt as requireConfigObject, en as runDockerStreaming, er as normalizeAwsError, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveStateBucketWithDefaultAndSource, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as CFN_TEMPLATE_BODY_LIMIT, gt as scrubResourceRecord, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as warnDeprecatedNoPrefixCliFlag, ht as redactSecretsForState, i as DeploymentEventsReader, in as synthesisStatusMessage, ir as isThrottlingError, it as assertRegionMatch, j as gray, jn as resetAwsClients, jt as rebuildClientForBucketRegion, k as bold, kn as AwsClients, kt as LockManager, l as replayRollback, ln as resolveCaptureObservedState, lt as replayWarn, m as computeImplicitDeleteEdges, mn as stateBucketExistenceConfirmed, mt as TEMPLATE_SOURCED_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerImageBySourceHash, nr as isMarkedNonRetryable, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as getLegacyStateBucketName, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveUseCdkBootstrapAssets, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ResourceUpdateNotSupportedError, qt as validateAssetBucketName, r as DeployEngine, rn as Synthesizer, rr as isRetryableTransientError, rt as resolveExplicitPhysicalId, s as planRollback, sn as resolveApp, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetManifestLoader, tr as withErrorHandling, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveSkipPrefix, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as MIGRATE_TMP_PREFIX, vt as s3BucketDomainName, w as extractDeploymentEventError, wn as derivePartitionAndUrlSuffix, wt as INTRINSIC_KEYS, x as refusesFinalSnapshot, xn as expectedOwnerParam, xt as s3BucketWebsiteUrl, y as createPreDeleteFinalSnapshot, yn as findLargeInlineResources, yt as s3BucketDualStackDomainName, z as secretBearingStateKeyWarning, zn as LocalMigrateError, zt as rewriteTemplateAssetReferences } from "./deploy-engine-rYTNzst0.js";
+import { $ as getAccountInfo, $t as formatDockerLoginError, A as cyan, An as resolveBucketRegion, At as TemplateParser, B as stateKeySecretExposure, Bn as LocalInvokeBuildError$1, Bt as loadPublishableAssetManifest, C as makeCanonicalizePropertiesFn, Cn as expectedOwnerParam, Ct as s3BucketWebsiteUrl, D as renderStatefulReason, Dn as AssemblyReader, Dt as describeTypeWithThrottleRetry, E as isStatefulRecreateTargetSync, En as derivePartitionAndUrlSuffix, Et as INTRINSIC_KEYS, F as collectDeclaredOutputNames, Ft as AssetPublisher, G as findActionableSilentDrops, Gn as NestedStackChildDirectDestroyError, Gt as BOOTSTRAP_MARKER_PREFIX, H as collectInlinePolicyNamesManagedBySiblings, Hn as LocalStartServiceError, Ht as escapeRegExp, I as collectPublishedOutputNames, In as CdkdError, It as stringifyValue, J as slowCcOperationTimeoutMs, Jn as ResourceTimeoutError, Jt as parseBootstrapMarker, K as findSilentDropProperties, Kn as PartialFailureError, Kt as ensureAssetStorage, L as exportAliasCollisionScrubWarning, Lt as WorkGraph, M as green, Mn as getAwsClients, Mt as S3StateBackend, N as red, Nn as resetAwsClients, Nt as rebuildClientForBucketRegion, O as formatResourceLine, On as processStackMessages, Ot as withRetry, P as yellow, Pn as setAwsClients, Pt as shouldRetainResource, Q as cfnRefValueFromPhysicalId, Qt as buildDockerImage, R as isExportAliasCollision, Rt as buildAssetRedirectMap, S as unsupportedFinalSnapshotError, Sn as uploadCfnTemplate, St as s3BucketRegionalDomainName, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as canonicalizeRegion, Tt as DiffCalculator, U as clearOnUpdateRemoval, Ut as stripControlChars, V as IAMRoleProvider, Vn as LocalMigrateError, Vt as rewriteTemplateAssetReferences, W as ProviderRegistry, Wn as MissingCdkCliError, Wt as AssetModeResolver, X as isTerminationProtectionPropagationError, Xn as StackHasActiveImportsError, Xt as validateContainerRepoName, Y as disableInstanceApiTermination, Yn as ResourceUpdateNotSupportedError, Yt as validateAssetBucketName, Z as IntrinsicFunctionResolver, Zn as StackTerminationProtectionError, Zt as buildDenyExternalAccessPolicy, _ as buildFinalSnapshotIdentifier, _n as warnDeprecatedNoPrefixCliFlag, _t as redactSecretsForState, a as DeploymentEventsStore, an as Synthesizer, ar as isRetryableTransientError, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as MIGRATE_TMP_PREFIX, bt as s3BucketDomainName, c as replayFailedOperations, cn as getLegacyStateBucketName, ct as readConfigString, d as deleteSkipReason, dn as resolveCaptureObservedState, dt as requireConfigObject, en as getDockerCmd, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveSkipPrefix, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as stateBucketExistenceConfirmed, gt as maskSecretsInText, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveUseCdkBootstrapAssets, ht as TEMPLATE_SOURCED_RULES, i as DeploymentEventsReader, in as getDockerImageBySourceHash, ir as isMarkedNonRetryable, it as assertRegionMatch, j as gray, jn as AwsClients, jt as LockManager, k as bold, kt as DagBuilder, l as replayRollback, ln as resolveApp, lt as replayWarn, m as computeImplicitDeleteEdges, mn as resolveStateBucketWithDefaultAndSource, mt as STATE_SOURCED_READBACK_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as runDockerStreaming, nr as normalizeAwsError, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as synthesisStatusMessage, or as isThrottlingError, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveStateBucketWithDefault, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ProvisioningError, qt as getBootstrapMarkerKey, r as DeployEngine, rn as AssetManifestLoader, rr as withErrorHandling, rt as resolveExplicitPhysicalId, s as planRollback, sn as getDefaultStateBucketName, sr as markNonRetryable, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as runDockerForeground, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveAutoAssetStorage, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as CFN_TEMPLATE_BODY_LIMIT, vt as scrubResourceRecord, w as extractDeploymentEventError, wn as PARTITION_TABLE, wt as applyRoleArnIfSet, x as refusesFinalSnapshot, xn as findLargeInlineResources, xt as s3BucketDualStackDomainName, y as createPreDeleteFinalSnapshot, yn as CFN_TEMPLATE_URL_LIMIT, yt as s3BucketArn, z as secretBearingStateKeyWarning, zn as DeployCancelledError, zt as createAssetRedirectResolver } from "./deploy-engine-DlEg9thJ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CVoisQ0L.js";
+import { t as ASGProvider } from "./asg-provider-B1AQpZfU.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -14282,27 +14282,15 @@ function hasTransitionalIndex(indexes) {
 * Deliberately NOT keyed on the exception NAME: AWS reports this as a plain
 * `ResourceInUseException`, which is the same name it uses for genuinely
 * terminal conflicts (deleting a table that is `CREATING`, creating one that
-* already exists). Retrying on the name would turn those into a 47s stall
-* before the same failure.
+* already exists). Retrying on the name would spend the WHOLE budget on them —
+* a full settle poll plus a backoff step per attempt, i.e. minutes — before
+* failing identically.
 */
 const INDEX_BUSY_DELETE_MESSAGE = /cannot delete table while indexes are being/i;
 function isIndexBusyDeleteError(message) {
 	return INDEX_BUSY_DELETE_MESSAGE.test(message);
 }
 /**
-* Retry budget for the index-busy `DeleteTable` refusal (issue #1830).
-*
-* Left at `withRetry`'s own default of 8 rather than raised. Named rather than
-* inlined because passing it at all is what opts this call out of
-* `withRetry`'s dense IAM-propagation schedule, which would be wrong for a
-* condition measured in seconds-to-minutes rather than sub-second.
-*
-* The count MULTIPLIES the per-attempt re-arm poll below, so the two have to
-* be read together — see {@link DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS} for the
-* arithmetic and for why the poll is not a 15-minute one.
-*/
-const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
-/**
 * `DescribeTable` polls (~1s apart) the index-busy `DeleteTable` retry spends
 * re-arming BEFORE each retry (issue #1830) — it returns on the first one that
 * reports every index settled.
@@ -14310,30 +14298,57 @@ const DELETE_INDEX_BUSY_MAX_RETRIES = 8;
 * Bounded well under the 15-minute default `GlobalTable`'s pre-delete #1521
 * gate uses, because THAT default is sized for a wait that runs once while
 * this one runs per retry: the caller's wall clock is
-* `DELETE_INDEX_BUSY_MAX_RETRIES x this + withRetry's ~47s of backoff`, and
-* `destroy-runner.ts` runs the delete under a per-resource deadline (30 min by
-* default; neither DynamoDB provider declares a `getMinResourceTimeoutMs` to
-* lift it). At 900 polls the product was ~2h, so a genuinely stuck index
-* produced a 30-minute wait ending in a generic `ResourceTimeoutError` that
-* never mentions indexes. At 60 the LOOP's worst case is ~8.8 min and the user
-* gets AWS's own actionable sentence instead.
+* `its retry budget x this x ~1.2s per poll + withRetry's backoff`, and `destroy-runner.ts` runs the delete under a per-resource
+* deadline (30 min by default; neither DynamoDB provider declares a
+* `getMinResourceTimeoutMs` to lift it). At 900 polls the product would be
+* ~4.2h, so a genuinely stuck index would produce a 30-minute wait ending in a
+* generic `ResourceTimeoutError` that never mentions indexes. At 60 the LOOP's
+* worst case is ~18.4 min on `AWS::DynamoDB::Table` and ~10.4 min on
+* `AWS::DynamoDB::GlobalTable` — see {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES}
+* for every term of that product and for why the two budgets differ — and the
+* user gets AWS's own actionable sentence instead.
 *
 * **What that deadline actually wraps**, since the arithmetic depends on it:
 * NOT one `delete()` but `destroy-runner.ts`'s whole outer retry loop, which
 * calls `delete()` up to 4 times (`maxAttempts = 3`) inside the one deadline.
-* Four times ~8.8 min would blow straight through 30 min. It does not, and the
+* Four times ~18.4 min would blow straight through 30 min. It does not, and the
 * reason is load-bearing rather than incidental: that outer loop only retries
 * when `isRetryableTransientError` says so, and this refusal matches no entry
 * in `RETRYABLE_ERROR_MESSAGE_PATTERNS` (verified against the real classifier —
 * both AWS's raw sentence and the `Failed to delete DynamoDB table ...` wrap
 * return false), so the outer loop runs `delete()` exactly ONCE for it and the
 * budget below is not re-multiplied. Adding this message to those patterns
-* would silently make the worst case ~35 min — over the deadline.
+* would silently make the worst case ~74 min on `AWS::DynamoDB::Table` — well
+* over the deadline.
 *
 * The FIRST attempt is unaffected — it does not re-arm at all.
 */
 const DELETE_INDEX_BUSY_REARM_MAX_ATTEMPTS = 60;
 /**
+* Sleep between two `DescribeTable` polls of {@link waitForIndexesSettled}.
+*
+* Named rather than inlined because it is the unit every poll budget on the
+* DynamoDB DELETE path is denominated in — a poll count only becomes a wall
+* clock through this, and the deadline arguments at
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES} multiply it. Each of those counts
+* READS it, which is what makes the claim checkable rather than a convention:
+* this module's 60-poll re-arm; `GlobalTable`'s 900-poll #1521 pre-delete gate
+* (and the same 900-poll default its auto-scaling caller takes, since both go
+* through `waitForIndexesActive` -> {@link waitForIndexesSettled});
+* `GlobalTable`'s `waitForReplicaGone` and `waitForTableGone` at 600 polls
+* each; and the `Table` provider's 60-poll `waitForTableActiveAfterUpdate`.
+*
+* Deliberately NOT claimed for the whole file: `waitForReplicaActive` keeps its
+* own `1000`, and is left alone because it runs on the CREATE / UPDATE path,
+* which no arithmetic here prices.
+*
+* It is a FLOOR on the per-poll cost, never the whole of it — each poll also
+* pays a `DescribeTable` round trip, which is why the live run's 60-poll
+* re-arm took ~72s and not 60s, and why the arithmetic above prices a poll at
+* ~1.2s.
+*/
+const INDEX_SETTLE_POLL_INTERVAL_MS = 1e3;
+/**
 * What proceeding costs when a DELETE-path index-settle wait ends WITHOUT
 * confirming — passed as {@link waitForIndexesSettled}'s `proceedNote` by every
 * delete-path caller (`GlobalTable`'s #1521 pre-delete gate, and the #1830 /
@@ -14371,7 +14386,7 @@ async function waitForIndexesSettled(opts) {
 			const message = err instanceof Error ? err.message : String(err);
 			if (isThrottlingError(err)) {
 				logger.debug(`DescribeTable throttled while waiting for indexes on ${tableName} (attempt ${attempt}/${maxAttempts}); still waiting: ${message}`);
-				await new Promise((resolve) => setTimeout(resolve, 1e3));
+				await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 				continue;
 			}
 			if (err instanceof ResourceNotFoundException$1) {
@@ -14383,9 +14398,10 @@ async function waitForIndexesSettled(opts) {
 			logger.warn(`DescribeTable failed (${errorName}) while waiting for indexes on ${tableName} (${logicalId}), so cdkd stopped waiting; ${proceedNote} Re-run with --verbose for AWS's own message.`);
 			return;
 		}
-		await new Promise((resolve) => setTimeout(resolve, 1e3));
+		await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 	}
-	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~1s apart, so a little over ${maxAttempts}s of wall clock); ${proceedNote}`);
+	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
+	logger.warn(`Indexes on ${tableName} (${logicalId}) did not all reach ACTIVE within ${maxAttempts} DescribeTable polls (~${pollSeconds}s apart, so a little over ${maxAttempts * pollSeconds}s of wall clock); ${proceedNote}`);
 }
 /**
 * The ONE line the retry prints at default verbosity, for both providers.
@@ -14395,15 +14411,50 @@ async function waitForIndexesSettled(opts) {
 * and the bounded budget above can end in a timeout that has to be diagnosable
 * from an ordinary run's output.
 *
-* `attemptNumber` is the attempt now STARTING (2 for the first retry). The
-* remaining-attempt count is DERIVED from it and never spelled out: `withRetry`
-* runs `1 + maxRetries` attempts in total, and writing the number by hand is
-* how this line came to promise 8 further attempts when 7 were left.
+* `attemptNumber` is the attempt now STARTING (2 for the first retry), and
+* `maxRetries` is the CALLER's budget — the two types no longer share one (see
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES}), so a module-level constant here
+* would print the other type's promise. The remaining-attempt count is DERIVED
+* from the pair and never spelled out: `withRetry` runs `1 + maxRetries`
+* attempts in total, and writing the number by hand is how this line came to
+* promise 8 further attempts when 7 were left. Both figures are CLAMPED — the
+* attempt count at zero, the minutes at one, since the announced attempt
+* re-arms too: the function is exported, and an `attemptNumber` past the budget
+* otherwise printed "up to 0 more attempts" and then went negative.
 *
 * The per-attempt settle budget is attached to "this attempt plus the N more"
 * rather than to the N alone, because the re-arm runs before the attempt this
-* very line announces too — 8 re-arms for 7 remaining attempts. Saying "N more
-* attempts, each preceded by ..." made one sentence quote two different counts.
+* very line announces too — 14 re-arms for 13 remaining attempts on the `Table`
+* budget. Saying "N more attempts, each preceded by ..." made one sentence
+* quote two different counts.
+*
+* It also states how long the loop will keep GOING, as a floor (issue #1950).
+* At the `Table` budget the loop can run for the better part of twenty minutes,
+* and a user watching a destroy sit on one table for that long needs to tell
+* SETTLING from STUCK — an attempt count alone does not say how long it will
+* take.
+*
+* The wording is "will not give up for at least ~N more minutes", NOT "can keep
+* retrying for at least ~N". The re-arm returns on the first `DescribeTable`
+* that reports the indexes settled, so a table clearing in 90s prints this line
+* and then finishes immediately: read as a floor on the WAIT it would push the
+* user toward Ctrl-C, which is the opposite of what the line is for. It is a
+* floor on cdkd's PATIENCE, which is what the reader needs to decide whether to
+* keep waiting.
+*
+* A floor rather than an estimate because {@link INDEX_SETTLE_POLL_INTERVAL_MS}
+* is only the sleep: each poll also pays a `DescribeTable` round trip and
+* `withRetry` sleeps its backoff between attempts, so the true patience is
+* longer than the figure printed.
+*
+* The floor is conditioned on those waits RUNNING, which the sentence says out
+* loud rather than assuming. {@link waitForIndexesSettled} returns early on any
+* non-throttle `DescribeTable` failure (a describe-denied principal that can
+* still delete, say) and returns at once whenever the GSI-status proxy
+* disagrees with AWS's real refusal predicate — the gap named above. In those
+* runs every remaining retry pays only backoff, and cdkd gives up in ~1.6 min
+* having announced ~14. Unconditional, the figure would be plainly false
+* there.
 *
 * It must NOT carry AWS's own sentence: the `dynamodb-globaltable` integ greps
 * the destroy log for `Cannot delete table while indexes are being` to prove
@@ -14411,8 +14462,10 @@ async function waitForIndexesSettled(opts) {
 * the refusal having happened.
 */
 function indexBusyRetryWarning(opts) {
-	const remainingAttempts = 9 - opts.attemptNumber;
-	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~1s apart — a little over a minute of settling — before its DeleteTable). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`;
+	const remainingAttempts = Math.max(0, 1 + opts.maxRetries - opts.attemptNumber);
+	const settleFloorMinutes = Math.max(1, Math.round((remainingAttempts + 1) * 60 * INDEX_SETTLE_POLL_INTERVAL_MS / 6e4));
+	const pollSeconds = INDEX_SETTLE_POLL_INTERVAL_MS / 1e3;
+	return `DynamoDB ${opts.typeLabel} ${opts.logicalId}: AWS refused DeleteTable on ${opts.physicalId} because a global secondary index is still being created, updated or deleted — application auto-scaling can start an index capacity change at any moment, including during this destroy. Waiting for the index to settle and retrying (this attempt plus up to ${remainingAttempts} more attempts; each one first waits up to ${60} DescribeTable polls ~${pollSeconds}s apart before its DeleteTable, so cdkd will not give up for at least ~${settleFloorMinutes} more minutes while those settle waits run). Nothing is wrong with the table; a large index backfill can outlast this budget, in which case the destroy fails with AWS's own message and re-running it succeeds once the index is ACTIVE.`;
 }
 /**
 * Issue the caller's `DeleteTable`, retrying ONLY the transient index-busy
@@ -14430,11 +14483,19 @@ function indexBusyRetryWarning(opts) {
 * index backfill outlasts any fixed backoff grid, while a settle poll returns
 * on its first `DescribeTable` once the index is ACTIVE.
 *
+* `maxRetries` is the CALLER's, not this module's: the two DynamoDB types have
+* different amounts of the per-resource deadline left by the time they reach
+* this loop, so they carry different budgets (see
+* {@link TABLE_DELETE_INDEX_BUSY_MAX_RETRIES} for both derivations). Passing it
+* rather than reading a module constant is also what keeps the two providers'
+* budgets visible at their call sites.
+*
 * `sleepSeam` is read per SLEEP rather than once when the options bag is built,
 * so a test that installs the no-op from INSIDE the first refusal — i.e. after
 * `delete()` has already built the bag — still gets it. A value captured at
 * construction time would be `undefined` there and would silently pay
-* `withRetry`'s real ~47s schedule. Passing `sleep` unconditionally is safe:
+* `withRetry`'s real backoff schedule (95s of sleep at the `Table` budget, 47s
+* at the `GlobalTable` one, on top of a full settle poll per attempt). Passing `sleep` unconditionally is safe:
 * `withRetry`'s dense-schedule detection keys on `maxRetries` /
 * `initialDelayMs` / `maxDelayMs` / `isRetryable`, all of which this caller
 * already sets.
@@ -14447,13 +14508,14 @@ async function deleteTableWithIndexBusyRetry(opts) {
 				typeLabel: opts.typeLabel,
 				logicalId: opts.logicalId,
 				physicalId: opts.physicalId,
-				attemptNumber: deleteAttempts
+				attemptNumber: deleteAttempts,
+				maxRetries: opts.maxRetries
 			}));
 			await opts.reArm();
 		}
 		await opts.deleteTable();
 	}, opts.logicalId, {
-		maxRetries: 8,
+		maxRetries: opts.maxRetries,
 		isRetryable: (message) => isIndexBusyDeleteError(message),
 		logger: opts.logger,
 		sleep: (ms) => opts.sleepSeam.sleep ? opts.sleepSeam.sleep(ms) : new Promise((resolve) => setTimeout(resolve, ms))
@@ -14992,7 +15054,8 @@ function desiredIndexEntriesByName(value) {
 * Test seam for the index-busy `DeleteTable` retry's backoff (issue #1931),
 * mirroring the sibling provider's export of the same name. Production leaves
 * `sleep` undefined so `withRetry`'s real schedule applies; a test injects a
-* no-op so the ~47s budget does not have to be waited out.
+* no-op so the ~95s of backoff at this type's budget
+* (`TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`) does not have to be waited out.
 *
 * One seam PER PROVIDER rather than one on the shared module: a `Table` test
 * that silences this backoff must not also silence the `GlobalTable` one, since
@@ -15210,7 +15273,7 @@ var DynamoDBTableProvider = class {
 				}
 				await this.dynamoDBClient.send(new UpdateTableCommand(updateInput));
 				if (billingMode !== liveBillingMode) await this.waitForTableAndIndexesActive(physicalId, BILLING_FLIP_ACTIVE_WAIT_ATTEMPTS);
-				else await this.waitForTableActiveAfterUpdate(physicalId, TABLE_ACTIVE_WAIT_ATTEMPTS);
+				else await this.waitForTableActiveAfterUpdate(physicalId, 60);
 				this.logger.debug(`Updated BillingMode/ProvisionedThroughput/TableClass on DynamoDB table ${physicalId}`);
 			}
 			if (JSON.stringify(properties["OnDemandThroughput"]) !== JSON.stringify(previousProperties["OnDemandThroughput"])) {
@@ -15338,6 +15401,7 @@ var DynamoDBTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "table",
+				maxRetries: 14,
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
@@ -15697,10 +15761,10 @@ var DynamoDBTableProvider = class {
 	* blanket raise would turn every genuinely wedged capacity edit into a
 	* 10-minute hang.
 	*/
-	async waitForTableActiveAfterUpdate(tableName, maxAttempts = TABLE_ACTIVE_WAIT_ATTEMPTS) {
+	async waitForTableActiveAfterUpdate(tableName, maxAttempts = 60) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
 			if ((await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.TableStatus === "ACTIVE") return;
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		}
 		throw new Error(`Table ${tableName} did not reach ACTIVE status within ${maxAttempts} seconds after UpdateTable`);
 	}
@@ -17783,6 +17847,7 @@ var DynamoDBGlobalTableProvider = class {
 				logicalId,
 				physicalId,
 				typeLabel: "GlobalTable",
+				maxRetries: 8,
 				logger: this.logger,
 				deleteTable: async () => {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: physicalId }));
@@ -18456,10 +18521,10 @@ var DynamoDBGlobalTableProvider = class {
 	* Delete replica update. Replica deletion typically takes 1–5 min;
 	* cap at 10 min.
 	*/
-	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = 600) {
+	async waitForReplicaGone(tableName, region, logicalId, maxAttempts = REPLICA_GONE_WAIT_ATTEMPTS) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			if (!(await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }))).Table?.Replicas?.find((r) => r.RegionName === region)) return;
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
@@ -18480,7 +18545,7 @@ var DynamoDBGlobalTableProvider = class {
 	async waitForTableGone(tableName, logicalId, maxAttempts = 600) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
 			await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: tableName }));
-			await new Promise((resolve) => setTimeout(resolve, 1e3));
+			await new Promise((resolve) => setTimeout(resolve, INDEX_SETTLE_POLL_INTERVAL_MS));
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$1) return;
 			throw err;
@@ -18575,10 +18640,33 @@ function autoScalingResourceId(tableName, indexName) {
 */
 const autoScalingRetryDelays = {};
 /**
+* Polls `waitForReplicaGone` spends waiting for a replica to disappear.
+*
+* Named rather than inlined because it is a TERM of the per-resource deadline
+* arithmetic on this type's delete path (see
+* `GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`), which prices it through
+* {@link INDEX_SETTLE_POLL_INTERVAL_MS} — the sleep this loop now reads rather
+* than spelling its own `1000`, so the two cannot drift while that arithmetic
+* claims they agree.
+*/
+const REPLICA_GONE_WAIT_ATTEMPTS = 600;
+/**
+* Polls `waitForTableGone` spends confirming the table is actually gone.
+*
+* EXPORTED, unlike its replica sibling, because the delete-path budget fence
+* reads it: this wait runs AFTER the index-busy retry loop and only when that
+* loop SUCCEEDS, which is what keeps it out of the loop's own worst case and
+* puts it into the late-success one (both spelled out on
+* `GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`).
+*/
+const TABLE_GONE_WAIT_ATTEMPTS = 600;
+/**
 * Test seam for the index-busy `DeleteTable` retry's backoff (issue #1830),
 * mirroring {@link autoScalingRetryDelays}. Production leaves `sleep`
 * undefined so `withRetry`'s real schedule applies; a test injects a no-op so
-* the ~47s budget does not have to be waited out. Kept SEPARATE from the
+* the ~47s of backoff at this type's budget
+* (`GLOBAL_TABLE_DELETE_INDEX_BUSY_MAX_RETRIES`) does not have to be waited
+* out. Kept SEPARATE from the
 * auto-scaling seam so a test can slow one path without silencing the other.
 */
 const deleteTableRetryDelays = {};
@@ -60644,6 +60732,325 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 	};
 }
 /**
+* Does any string anywhere in `value` carry a `{{resolve:...}}` dynamic
+* reference?
+*
+* Cheap pre-check so the overwhelming majority of resources — which reference
+* no secret at all — never build a resolver context and never pay a deep clone
+* of their property bag.
+*/
+function containsDynamicReference(value) {
+	if (typeof value === "string") return value.includes("{{resolve:");
+	if (Array.isArray(value)) return value.some(containsDynamicReference);
+	if (value !== null && typeof value === "object") return Object.values(value).some(containsDynamicReference);
+	return false;
+}
+/**
+* Byte-for-byte the threshold `secret-redaction.ts` applies when it builds its
+* substring needles (`MIN_NEEDLE_LENGTH`). Copied rather than imported because
+* that constant is module-private there and this file may not widen its
+* exports; the two must agree or this function would call a leaf secret-bearing
+* that `redactSecretsForState` will not redact.
+*/
+const MIN_SECRET_NEEDLE_LENGTH = 4;
+/**
+* Does `value` hold a plaintext this pass has recorded as a secret?
+*
+* Two branches with deliberately different strictness, and the asymmetry is the
+* point. A WHOLE-value match is exact evidence at any length, so it is accepted
+* unconditionally. A SUBSTRING match is only evidence when the plaintext is
+* long enough to be distinctive: a 1-3 character secret (a JSON key holding
+* `"0"`) occurs inside unrelated values constantly, and accepting it would mark
+* half the resource's paths secret-bearing — masking values that are not
+* secrets and, worse, making `--accept` refuse them.
+*
+* So this errs toward NOT marking on the substring branch, and that direction
+* is chosen rather than inherited: `redactSecretsForState` applies the same
+* threshold when it builds needles, so a sub-threshold plaintext is not
+* substituted there either. Marking a path this function's caller cannot
+* actually redact would produce a `***` with no mechanism behind it.
+*/
+function carriesRecordedSecret(value, secrets) {
+	if (value === "") return false;
+	if (secrets.has(value)) return true;
+	for (const plaintext of secrets.keys()) if (plaintext.length >= MIN_SECRET_NEEDLE_LENGTH && value.includes(plaintext)) return true;
+	return false;
+}
+/**
+* Is this unresolvable token one whose value is a SECRET by definition?
+*
+* `ssm-secure` is the only such spelling, and it is decidable with no lookup:
+* CloudFormation defines exactly three dynamic-reference services (`ssm`,
+* `ssm-secure`, `secretsmanager`), cdkd resolves the other two, and
+* `ssm-secure` is the encrypted one.
+*
+* Anything else reaching the survivor arm is not a CloudFormation dynamic
+* reference at all — it is text that merely looks like one — and treating it as
+* secret is not the safe direction it appears to be: the path would be masked
+* to `***`, refused by `--accept`, and pinned to the live value by
+* {@link preserveLiveValuesAtUnresolvedTokens}, which is permanently stuck
+* drift with no remedy the user can apply. Such a token is still REPORTED; it
+* just does not claim to be a secret.
+*/
+function isSecretBySpelling(token) {
+	return token.startsWith("{{resolve:ssm-secure:");
+}
+/**
+* Every `{{resolve:...}}` token still present in `value`.
+*
+* Used to NAME an unresolvable reference without quoting the string it sits in.
+* That string is a partially substituted leaf: `resolveDynamicReferences`
+* substitutes token by token, so a leaf holding two references comes back with
+* the resolvable one already replaced by its PLAINTEXT. Interpolating it into a
+* log line prints the secret — from the command whose purpose is not to. A
+* token is a reference NAME and carries no value, so it is always safe to show.
+*/
+function survivingDynamicReferences(value) {
+	return value.match(/\{\{resolve:[^}]+\}\}/g) ?? [];
+}
+/**
+* Record the dotted path of every leaf holding a `{{resolve:...}}` string.
+*
+* The OFFLINE seed for {@link SecretPathSet}: it needs no AWS call, so it is
+* what remains when resolution fails. Issue #1900's mechanism applied to
+* positions instead of values — the record's own bags already say WHERE the
+* references are, and that is the half of the answer a failed lookup does not
+* take away.
+*
+* Necessarily coarser than the resolved answer, because a `{{resolve:ssm:...}}`
+* naming a plain `String` parameter is PUBLIC config and only the resolver's
+* TYPE verdict can say so. Marking such a path secret-bearing over-masks it,
+* which is why the seed is used ONLY on the failure path, where the alternative
+* is not masking at all.
+*/
+function collectDynamicReferencePaths(value, into, path = "") {
+	if (typeof value === "string") {
+		if (value.includes("{{resolve:")) into.add(path);
+		return;
+	}
+	if (Array.isArray(value)) {
+		value.forEach((item, i) => collectDynamicReferencePaths(item, into, path === "" ? String(i) : `${path}.${i}`));
+		return;
+	}
+	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
+}
+/**
+* Re-resolve the SECRET dynamic references (`{{resolve:secretsmanager:...}}`,
+* and an `{{resolve:ssm:...}}` naming a `SecureString`) held by a bag read back
+* out of cdkd STATE (issue #1914).
+*
+* State stores the unresolved EXPRESSION — that is the GHSA-p5qg-v9gv-hc7w
+* redaction — while a provider's `readCurrentState` snapshot necessarily holds
+* the resolved PLAINTEXT, because that is what AWS was given at deploy time.
+* Nothing in `cdkd drift` reconciled the two, and all three of the command's
+* modes broke on it: the comparison reported permanent phantom drift and
+* printed the plaintext as the AWS-current side, `--accept` persisted that
+* plaintext back into `state.json`, and `--revert` shipped the literal
+* `{{resolve:...}}` string to the live resource.
+*
+* The counterpart of the rollback replay's `resolveReplayProps`
+* (`src/deployment/rollback-executor.ts`), and for the same reason: both
+* commands are synth-free, so the expression string in the persisted record is
+* the only thing there is to resolve from. Every plaintext is recorded into
+* `secrets` so the caller can redact it back out of anything it PRINTS or
+* PERSISTS, and every path that produced one into `secretPaths` so the caller
+* can act on a value it does NOT recognise there — see {@link redactDriftChanges}.
+*
+* A `{{resolve:...}}` token that SURVIVES the pass is reported through
+* `onUnresolved` and left in place — it is not an error. The resolver's
+* unsupported-service arm (`ssm-secure:` is the live example) warns and returns
+* the literal, and `cdkd deploy` resolves through the very same code, so AWS is
+* ALREADY holding that literal string and state records it. Replaying it is
+* therefore a correct no-op, and failing the resource over it would take every
+* other drifted property on that resource down with it (plus exit 2). The
+* report exists so the user learns cdkd is shipping a token it cannot resolve,
+* which is a real thing to know and not a reason to stop.
+*
+* Only the TOKENS are reported, never the leaf that held them: the leaf is
+* partially substituted by this point, so a mixed `secretsmanager` +
+* `ssm-secure` string comes back carrying real plaintext.
+*
+* Returns the input by identity when it holds no dynamic reference, so the
+* non-secret path is unchanged down to object identity.
+*/
+async function resolveStateSecretExpressions(props, resolver, secrets, options = {}) {
+	if (!containsDynamicReference(props)) return props;
+	const { secretPaths, onUnresolved } = options;
+	const ctx = {
+		template: { Resources: {} },
+		resources: {},
+		recordedSecretValues: secrets
+	};
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return v;
+			const resolved = await resolver.resolveDynamicReferences(v, ctx);
+			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
+			if (survivors.length > 0) {
+				if (survivors.some(isSecretBySpelling)) secretPaths?.add(path);
+				onUnresolved?.(survivors, path);
+			}
+			if (carriesRecordedSecret(resolved, secrets)) secretPaths?.add(path);
+			return resolved;
+		}
+		if (Array.isArray(v)) {
+			const out = new Array(v.length);
+			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i], path === "" ? String(i) : `${path}.${i}`);
+			return out;
+		}
+		if (v !== null && typeof v === "object") {
+			const out = {};
+			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
+			return out;
+		}
+		return v;
+	};
+	return await walk(props, "");
+}
+/**
+* Is a drift reported at `path` positioned on, or above, a known secret?
+*
+* The PREFIX direction is the one that matters: a secret sits at a leaf (or at
+* an array the comparator never descends), while a drift can be reported at any
+* ancestor of it — `Environment` rather than
+* `Environment.Variables.SECRET_PASSWORD` — whenever the two sides disagree
+* about the shape rather than the value. The reverse containment is checked too
+* and costs nothing.
+*/
+function isSecretBearingPath(path, secretPaths) {
+	if (secretPaths.size === 0) return false;
+	for (const secretPath of secretPaths) if (secretPath === path || secretPath.startsWith(`${path}.`) || path.startsWith(`${secretPath}.`)) return true;
+	return false;
+}
+/**
+* Redact one side of a drift entry.
+*
+* Two passes, and the second is the one issue #1914's review turned up. The
+* VALUE pass rewrites any recorded plaintext back onto its own
+* `{{resolve:...}}` expression, which is exact and is all that is needed while
+* the secret AWS holds is the secret the reference resolves to today.
+*
+* It stops being enough the moment those two differ, and they differ for the
+* most ordinary reason there is: a Secrets Manager ROTATION. The deployed
+* resource then still holds the PREVIOUS secret while the re-resolved baseline
+* holds the new one, so the path drifts and the AWS side matches no key in a
+* map built from today's value — it is a real secret that would be printed
+* verbatim and persisted by `--accept`. An out-of-band edit is
+* indistinguishable from it at this layer, so the POSITION decides: at a path
+* known to carry a secret, the only value ever shown is the expression itself,
+* and anything else becomes {@link SECRET_MASK}.
+*
+* `undefined` and `null` are exempt — an absent or null key discloses nothing,
+* and masking them would turn "AWS does not have this key" into "AWS has
+* something secret here", which is both wrong and less useful.
+*/
+function redactDriftValue(value, secrets, secretBearing) {
+	const redacted = redactSecretsForState(value, secrets);
+	if (!secretBearing) return redacted;
+	if (redacted === void 0 || redacted === null) return redacted;
+	if (typeof redacted === "string" && isWholeDynamicReference(redacted)) return redacted;
+	return "***";
+}
+/**
+* Is the WHOLE string a single `{{resolve:...}}` token and nothing else?
+*
+* Byte-for-byte `secret-redaction.ts`'s `isSingleDynamicReferenceToken`,
+* including the `[^{}]*` character class. The difference from `[^}]+` is
+* narrow and worth stating correctly: it is a `{` INSIDE the token, e.g.
+* `{{resolve:ssm:/a{b}}`. (A previous version of this comment claimed
+* `{{resolve:a}}{{resolve:b}}` would pass under `[^}]+` — it would not, since
+* `[^}]+` cannot span the `}` in the middle either.) Matching the sibling
+* exactly is what matters here: this predicate decides whether a value may be
+* shown INSTEAD of `SECRET_MASK`, and `redactByPath` uses its copy to decide
+* whether a leaf is already an expression, so a disagreement would let one of
+* them treat as a token what the other treats as data. Copied rather than
+* imported because that helper is module-private and this file may not widen
+* that module's exports.
+*/
+function isWholeDynamicReference(value) {
+	return /^\{\{resolve:[^{}]*\}\}$/.test(value);
+}
+/**
+* Why `--accept` must not persist this drift, or `undefined` when it may.
+*
+* Shared by the WRITE (`runAccept`) and the PLAN (`printAcceptPlan`) so the two
+* cannot disagree — a `--dry-run` that promises a write the real run refuses is
+* worse than either behaviour on its own.
+*
+* Two refusals, both about a value cdkd could not identify rather than about
+* secrecy as such:
+*
+* - A masked VALUE says AWS holds something at a known-secret path that is not
+*   what the reference resolves to. Writing `***` would corrupt the baseline
+*   and make the next deploy push the literal mask at AWS.
+* - A masked PATH says the readback answered with a map KEYED by a secret.
+*   `setAtPath` would then create a key literally named `***` — and when
+*   `awsValue` is `undefined` it would INSERT that key rather than removing the
+*   real one, so the value check alone does not cover it.
+*
+* The path check is what makes the value exemptions safe: `redactDriftValue`
+* lets `undefined` / `null` / a whole expression through unmasked, which is
+* right for a value and says nothing about the path it sits at.
+*/
+function acceptRefusalReason(change, maskedPaths) {
+	if (!maskedPaths.has(change.path)) return void 0;
+	if (change.path.includes("***")) return "its property NAME came back carrying a secret value, so cdkd cannot name the key to write — and no redaction pass can clear it either, since they all walk values and never keys. ROTATE the secret; that is the only remedy";
+	if (change.awsValue === void 0) return "AWS no longer reports it, and accepting an absence DELETES the key — which at or above a secret dynamic reference would erase the reference out of cdkd state. Use --revert to push it back, or re-deploy";
+	return "it carries a secret dynamic reference and the value AWS currently holds is not the one the reference resolves to";
+}
+/**
+* Redact resolved secret plaintext out of the drift entries that get REPORTED
+* (issue #1914).
+*
+* Both sides need it, for different reasons. `stateValue` comes from the
+* re-resolved comparison baseline, so at a secret leaf it now holds the
+* plaintext the state record deliberately does not store. `awsValue` is the
+* live readback, which holds that plaintext by construction. Either one
+* reaching `writeHumanReport` / `writeJsonReport` / the `--accept` and
+* `--revert` plans is the disclosure the redaction exists to prevent.
+*
+* Redacting `awsValue` also settles what `--accept` PERSISTS: that is the value
+* it writes into the baseline, so a secret one arrives at the state write
+* already carrying its expression — or, when it could not be recognised, as
+* {@link SECRET_MASK}, which `runAccept` refuses to persist.
+*
+* The PATH is redacted too. `redactSecretsForState` walks values and never
+* object KEYS, so a readback that answers with a map keyed by a secret (a
+* Lambda env var NAMED with one) renders as
+* `Environment.Variables.<plaintext>` in every printer. It is masked here
+* rather than assumed impossible, and a masked path also marks the change
+* secret-bearing, so `--accept` will not write a key it can no longer name.
+*
+* Returns the input array by identity when there is nothing to act on.
+*/
+function redactDriftChanges(changes, secrets, secretPaths) {
+	if (secrets.size === 0 && secretPaths.size === 0) return {
+		changes,
+		maskedPaths: /* @__PURE__ */ new Set()
+	};
+	const maskedPaths = /* @__PURE__ */ new Set();
+	const redacted = [];
+	for (const change of changes) {
+		const maskedPath = maskSecretsInText(change.path, secrets);
+		const positionIsSecret = isSecretBearingPath(change.path, secretPaths);
+		const nameCarriesSecret = maskedPath !== change.path;
+		const secretBearing = positionIsSecret || nameCarriesSecret;
+		if (secretPaths.has(change.path) && change.awsValue === void 0) continue;
+		const stateValue = redactDriftValue(change.stateValue, secrets, secretBearing);
+		const awsValue = redactDriftValue(change.awsValue, secrets, secretBearing);
+		if (maskedPath !== change.path || secretBearing && awsValue === "***" || secretBearing && change.awsValue === void 0) maskedPaths.add(maskedPath);
+		redacted.push({
+			path: maskedPath,
+			stateValue,
+			awsValue
+		});
+	}
+	return {
+		changes: redacted,
+		maskedPaths
+	};
+}
+/**
 * Run drift detection for one stack and shape the per-resource outcomes
 * into a {@link StackDriftReport}. The state object + etag are stored on
 * the report so `--accept` can write back without a re-read, and
@@ -60656,6 +61063,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 	return await withStackName(stackName, async () => {
 		const outcomes = [];
 		const state = result.state;
+		const logger = getLogger();
+		const secretResolver = new IntrinsicFunctionResolver(region);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 		for (const [logicalId, resource] of entries) {
 			if (providerRegistry.shouldSkipResource(resource.resourceType)) continue;
@@ -60715,19 +61124,46 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const baseline = useObserved ? resource.observedProperties : resource.properties ?? {};
+			const secrets = /* @__PURE__ */ new Map();
+			const secretPaths = /* @__PURE__ */ new Set();
+			const seededSecretPaths = /* @__PURE__ */ new Set();
+			collectDynamicReferencePaths(baseline, seededSecretPaths);
+			if (useObserved) collectDynamicReferencePaths(resource.properties ?? {}, seededSecretPaths);
+			const unresolvedTokens = /* @__PURE__ */ new Set();
+			const noteUnresolved = (tokens) => {
+				for (const token of tokens) unresolvedTokens.add(token);
+			};
+			let comparisonBaseline = baseline;
+			let secretResolutionFailed = false;
+			try {
+				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolver, secrets, {
+					secretPaths,
+					onUnresolved: noteUnresolved
+				});
+				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolver, secrets, {
+					secretPaths,
+					onUnresolved: noteUnresolved
+				});
+			} catch (err) {
+				secretResolutionFailed = true;
+				comparisonBaseline = baseline;
+				logger.warn(`${logicalId} (${resource.resourceType}): could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				secrets.clear();
+			}
+			if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
 			const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
-			const normalized = await canonicalizePrincipalUniqueIds(baseline, aws, resolvePrincipalUniqueId);
+			const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
 			const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
 			const canonicalized = provider.canonicalizeDriftProperties ? {
 				baseline: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.baseline),
 				aws: provider.canonicalizeDriftProperties(resource.resourceType, protocolNormalized.aws)
 			} : protocolNormalized;
-			const changes = calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
+			const reported = redactDriftChanges(calculateResourceDrift(canonicalized.baseline, canonicalized.aws, {
 				ignorePaths: observedIgnorePaths.length ? [...ignorePaths, ...observedIgnorePaths] : ignorePaths,
 				unionWalkObjects: useObserved,
 				unorderedPaths
-			});
-			if (changes.length === 0) outcomes.push({
+			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+			if (reported.changes.length === 0) outcomes.push({
 				kind: "clean",
 				logicalId,
 				resourceType: resource.resourceType
@@ -60736,8 +61172,10 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				kind: "drifted",
 				logicalId,
 				resourceType: resource.resourceType,
-				changes,
-				awsProperties: aws
+				...reported,
+				awsProperties: aws,
+				secrets,
+				referencesUnresolved: secretResolutionFailed || unresolvedTokens.size > 0
 			});
 		}
 		return {
@@ -60779,6 +61217,20 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 	}
 	return { siblings };
 }
+/**
+* Read the value at a dotted path, or `undefined` when any segment is missing.
+* The read counterpart of {@link setAtPath}, and it parses the same subset:
+* the drift comparator only synthesizes paths through plain objects.
+*/
+function getAtPath(source, path) {
+	if (path.length === 0) return source;
+	let cursor = source;
+	for (const segment of path.split(".")) {
+		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) return void 0;
+		cursor = cursor[segment];
+	}
+	return cursor;
+}
 function setAtPath(target, path, value) {
 	if (path.length === 0) return;
 	const segments = path.split(".");
@@ -60831,13 +61283,27 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				const hasObserved = existing.observedProperties !== void 0;
 				const baselineSource = hasObserved ? existing.observedProperties : existing.properties ?? {};
 				const newBaseline = JSON.parse(JSON.stringify(baselineSource));
-				for (const change of outcome.changes) setAtPath(newBaseline, change.path, change.awsValue);
+				const accepted = [];
+				for (const change of outcome.changes) {
+					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
+					if (refusal !== void 0) {
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift ${report.stackName} --revert' to push the referenced value back to AWS, or re-deploy if the reference changed.`);
+						continue;
+					}
+					setAtPath(newBaseline, change.path, change.awsValue);
+					accepted.push(change);
+				}
+				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+				for (const change of accepted) {
+					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) continue;
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — cdkd state holds an unresolved '{{resolve:...}}' reference at that property, and the reference wins over an accepted value. Change the template if that reference is wrong.`);
+				}
 				resources[outcome.logicalId] = hasObserved ? {
 					...existing,
-					observedProperties: newBaseline
+					observedProperties: redactedBaseline
 				} : {
 					...existing,
-					properties: newBaseline
+					properties: redactedBaseline
 				};
 			}
 			const newState = {
@@ -61198,6 +61664,57 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 	return merged;
 }
 /**
+* Replace every leaf of a revert payload that still holds a `{{resolve:...}}`
+* token with the value AWS currently has at that position (issue #1914,
+* round-3 review).
+*
+* The round-3 change downgraded an unresolvable reference from a per-resource
+* failure to a warning, on the premise that `cdkd deploy` resolves through the
+* resolver's same unsupported-service arm — so AWS already holds the literal
+* and replaying it is a no-op. **That premise holds only for records cdkd
+* deployed.** CloudFormation resolves `ssm-secure` SERVER-side, so a record
+* adopted by `cdkd import --migrate-from-cloudformation` has the literal token
+* in state while the live resource holds the PLAINTEXT. `diffAt` skips such a
+* leaf, so it never drifts — but `buildRevertNewProperties` overlays the whole
+* top-level subtree when any SIBLING key drifts, which would push the literal
+* token over a resolved value. That is defect 1 of this issue surviving in a
+* narrower case, on a live AWS write.
+*
+* Deciding by PROVENANCE would need a flag state does not carry. Deciding by
+* what AWS actually holds needs nothing and is exact in both directions: for a
+* cdkd-deployed record AWS holds the token, so copying it back is the same
+* no-op the premise described; for a migrated record AWS holds the resolved
+* value, which is left untouched.
+*
+* Falls back to KEEPING the token wherever AWS has nothing at that position —
+* that is what `cdkd deploy` sends, so it is the safe residual rather than
+* dropping a property the resource may require. Array descent is positional
+* and bails to that same residual on any length mismatch, since a reordered
+* readback cannot be positioned against.
+*/
+function preserveLiveValuesAtUnresolvedTokens(send, awsProperties, secrets) {
+	const walk = (value, live) => {
+		if (typeof value === "string" && value.includes("{{resolve:")) {
+			if (!isWholeDynamicReference(value)) return value;
+			if (live === void 0) return value;
+			if (typeof live === "string" && live.length >= MIN_SECRET_NEEDLE_LENGTH && isSecretBySpelling(value)) secrets.set(live, value);
+			return live;
+		}
+		if (Array.isArray(value)) {
+			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
+			return value.map((item, i) => walk(item, liveItems?.[i]));
+		}
+		if (value !== null && typeof value === "object") {
+			const liveObject = isPlainRecord(live) ? live : void 0;
+			const out = {};
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k]);
+			return out;
+		}
+		return value;
+	};
+	return walk(send, awsProperties);
+}
+/**
 * Build the `newProperties` object passed to `provider.update` during
 * `--revert`. Strategy:
 *
@@ -61371,11 +61888,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	let totalFailed = 0;
 	let totalUnsupported = 0;
 	let totalSucceeded = 0;
+	let totalUnresolvable = 0;
 	for (const report of reports) {
 		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
+		const revertSecretResolver = new IntrinsicFunctionResolver(report.region);
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -61388,28 +61907,53 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					resourceType: outcome.resourceType,
 					provisionedBy: stateResource.provisionedBy
 				}).provider;
-				const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
-				const newProperties = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
+				const secrets = /* @__PURE__ */ new Map();
+				const revertBaseline = stateResource.observedProperties ?? stateResource.properties ?? {};
+				const unresolvedTokens = /* @__PURE__ */ new Set();
+				const noteUnresolved = (tokens) => {
+					for (const token of tokens) unresolvedTokens.add(token);
+				};
+				let desiredProperties;
+				try {
+					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+				} catch (err) {
+					totalUnresolvable++;
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not re-resolve the dynamic reference(s) this resource's state records — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
+				const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
+				if (unrevertablePaths.length > 0) logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cannot revert ${unrevertablePaths.join(", ")} — cdkd cannot name the property, so it is left as AWS has it. ROTATE the secret that leaked into the property name.`);
+				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert. Where a token is EMBEDDED in a longer string, that string is written with the token literal, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
+				let newProperties;
+				try {
+					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
+					newProperties = unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties, secrets) : overlaid;
+				} catch (err) {
+					totalFailed++;
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
 				try {
-					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(msg) } });
+					const updateResult = await withRetry(() => provider.update(outcome.logicalId, stateResource.physicalId, outcome.resourceType, newProperties, outcome.awsProperties, { desiredFromAwsReadback: true }), outcome.logicalId, { logger: { debug: (msg) => logger.debug(maskSecretsInText(msg, secrets)) } });
 					totalSucceeded++;
 					logger.info(`  ✓ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted.`);
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, delta);
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, STATE_SOURCED_READBACK_RULES));
 						}
 					} catch (captureErr) {
-						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${captureErr instanceof Error ? captureErr.message : String(captureErr)}`);
+						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
 					}
 				} catch (err) {
 					if (err instanceof ResourceUpdateNotSupportedError) {
 						totalUnsupported++;
-						logger.warn(`  ⊘ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not revert — ${err.message}`);
+						logger.warn(`  ⊘ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not revert — ${maskSecretsInText(err.message, secrets)}`);
 						return;
 					}
 					totalFailed++;
-					const msg = err instanceof Error ? err.message : String(err);
+					const msg = maskSecretsInText(err instanceof Error ? err.message : String(err), secrets);
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 				}
 			}), concurrency);
@@ -61467,10 +62011,11 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	}
 	const summaryParts = [`${totalSucceeded} reverted`];
 	if (totalUnsupported > 0) summaryParts.push(`${totalUnsupported} update-not-supported`);
+	if (totalUnresolvable > 0) summaryParts.push(`${totalUnresolvable} reference-unresolvable`);
 	if (totalFailed > 0) summaryParts.push(`${totalFailed} failed`);
 	logger.info(`\nRevert summary: ${summaryParts.join(", ")}.`);
 	if (totalUnsupported > 0) logger.warn(`${totalUnsupported} resource(s) cannot be reverted in place — re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`);
-	if (totalFailed > 0 || totalUnsupported > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
+	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} whose dynamic reference(s) could not be resolved — those never reached provider.update; grant the caller secretsmanager:GetSecretValue / ssm:GetParameter, or fix the reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
 }
 /**
 * Print the planned state mutations for `--accept` (no AWS calls). One
@@ -61485,7 +62030,14 @@ function printAcceptPlan(reports) {
 		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
 			process.stdout.write(`  ~ ${o.logicalId} (${o.resourceType})\n`);
-			for (const change of o.changes) process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+			for (const change of o.changes) {
+				const refusal = acceptRefusalReason(change, o.maskedPaths);
+				if (refusal !== void 0) {
+					process.stdout.write(`    ${change.path}: SKIPPED — ${refusal}\n`);
+					continue;
+				}
+				process.stdout.write(`    ${change.path}: ${formatScalar(change.stateValue)} -> ${formatScalar(change.awsValue)}\n`);
+			}
 		}
 	}
 }
@@ -61506,20 +62058,23 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				if (preserved.length > 0) {
+				const cannotMaskKeys = o.referencesUnresolved;
+				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (!cannotMaskKeys && preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
 					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
-					for (const path of preserved) process.stdout.write(`        ${path}\n`);
+					for (const path of preserved) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
 					const othersRevert = stateResource.observedProperties === void 0 ? "" : `Every other tag reverts normally. `;
 					process.stdout.write(`      ${othersRevert}A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n`);
 				}
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (unbaselined.length > 0) {
+				if (o.referencesUnresolved && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
-					for (const path of unbaselined) process.stdout.write(`        ${path}\n`);
+					for (const path of unbaselined) process.stdout.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
 					process.stdout.write(`      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed ${report.stackName}' (or re-deploy) to populate observedProperties if you want them reverted too.\n`);
 				}
 			}
@@ -80414,7 +80969,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.32");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.34");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;