@go-to-k/cdkd 0.284.7 → 0.284.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-CJncZQEi.js";
+import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-CY2fx4K1.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DOdJgPLS.js";
+import { t as ASGProvider } from "./asg-provider-B09ceB1r.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -58723,6 +58723,18 @@ function containsSecretDynamicReference(value) {
 	if (value !== null && typeof value === "object") return Object.values(value).some(containsSecretDynamicReference);
 	return false;
 }
+/**
+* Does this template carry a secret-bearing dynamic reference ANYWHERE?
+*
+* Exported for the DELETED nested-child path (issue #1948 review): that node
+* diffs its state against an EMPTY template, so it can compute nothing about
+* secrets from its own input and would render a pre-GHSA child's whole stored
+* bag in full. The caller passes the PARENT's answer instead — see
+* `diff-recursive.ts`'s `buildDeletedSubtree`.
+*/
+function templateHasSecretDynamicReference(template) {
+	return containsSecretDynamicReference(template);
+}
 /** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
 function valuesEqual(a, b) {
 	if (a === b) return true;
@@ -58772,13 +58784,21 @@ function valuesEqual(a, b) {
 * resolver runs with `skipDynamicReferences`, so a `{{resolve:...}}` reference
 * is never resolved to plaintext in the first place and the bag already holds
 * the expression that state stores post-redaction.
+*
+* `storedOutputs` is the bag currently in state. It is consulted for exactly
+* one decision — the LITERAL `Export.Name` of a secret-bearing stack, see issue
+* #1942 at that branch — and never merged into the result: everything else here
+* previews what the template says, and reading state anywhere else would make
+* the preview agree with the past instead of with the next deploy.
 */
-async function resolveTemplateOutputs(template, resolveFn, conditions) {
+async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs) {
 	const logger = getLogger().child("OutputsDiff");
-	const outputs = {};
+	const outputs = Object.create(null);
 	const exportNames = /* @__PURE__ */ new Set();
 	const failedKeys = /* @__PURE__ */ new Set();
 	const secretSourceKeys = /* @__PURE__ */ new Set();
+	const declaredKeys = /* @__PURE__ */ new Set();
+	const templateHasSecretReference = containsSecretDynamicReference(template);
 	let resolutionFailed = false;
 	const publishedOutputNames = collectPublishedOutputNames(template.Outputs ?? {}, conditions);
 	if (!template.Outputs) return {
@@ -58786,6 +58806,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		exportNames,
 		failedKeys,
 		secretSourceKeys,
+		declaredKeys,
+		templateHasSecretReference,
 		resolutionFailed
 	};
 	/**
@@ -58799,6 +58821,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
 	};
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
+		declaredKeys.add(outputKey);
+		if (typeof output.Export?.Name === "string") declaredKeys.add(output.Export.Name);
 		if (!containsSecretDynamicReference(output.Value)) continue;
 		secretSourceKeys.add(outputKey);
 		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
@@ -58838,11 +58862,15 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 			}
 			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
 			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
-			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) {
-				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret`);
+			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
+				outputs[exportName] = value;
+				exportNames.add(exportName);
+			} else {
+				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
 				failedKeys.add(exportName);
 				resolutionFailed = true;
-			} else {
+			}
+			else {
 				outputs[exportName] = value;
 				exportNames.add(exportName);
 			}
@@ -58854,6 +58882,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		exportNames,
 		failedKeys,
 		secretSourceKeys,
+		declaredKeys,
+		templateHasSecretReference,
 		resolutionFailed
 	};
 }
@@ -58883,24 +58913,73 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 *   {@link isSecretDynamicReference} (this resolver runs with
 *   `skipDynamicReferences`) while the stored side is not; and
 * - `secretSourceKeys` — the template itself declares the key's value as such a
-*   reference. This one reaches cases the first cannot: a
-*   condition-skipped secret output, or one deleted from the template, has NO
-*   desired side at all and would otherwise print in full as a REMOVE row.
+*   reference. This one reaches a case the first cannot: a condition-skipped
+*   secret output has NO desired side at all and would otherwise print in full
+*   as a REMOVE row.
 *
 * A hit on either makes the WHOLE record suspect, not just that key: the
 * record was written by a pre-GHSA binary, so every value in it is unredacted.
 * Withholding is therefore record-level. The change is still REPORTED — only
 * the value is withheld — so `--fail` and the exports story are unaffected.
-*/
-function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set()) {
+*
+* ## The key today's template cannot account for (issue #1948)
+*
+* Neither signal above covers an output DELETED from the template, and an
+* earlier revision of this note claimed `secretSourceKeys` did — a false
+* coverage claim, which is exactly what lets a reader conclude the case is
+* handled. It structurally cannot: that set is built from DECLARATIONS, and a
+* deleted output declares nothing, so a record whose ONLY secret-bearing output
+* has since been removed is judged not-legacy and its stored pre-GHSA plaintext
+* renders as the `old:` side of a REMOVE row.
+*
+* The signal has to come from the STORED bag, and the honest statement about
+* the stored bag is that the case is UNDECIDABLE there: post-GHSA a secret
+* output stores its `{{resolve:...}}` EXPRESSION, but pre-GHSA it stores a
+* plaintext, and a plaintext is indistinguishable from an ordinary string. So
+* this is a REFUSAL rather than a detection — a stored key the template cannot
+* account for has its value withheld — bounded by two gates that keep it off
+* the common benign case (deleting an output is a normal refactor):
+*
+* - `templateHasSecretReference` — the template must still prove this stack
+*   handles secrets AT ALL (anywhere, `Resources` included). An ordinary stack
+*   with no secret reference keeps printing its REMOVE values.
+* - no stored value is itself a secret-bearing expression. One that is proves
+*   the LAST write was post-GHSA, and the bag is rewritten wholesale by
+*   `resolveOutputs` on every deploy, so every other value in it is redacted
+*   too. This exonerates the record.
+*
+*   That reasoning holds for a DEPLOY write and is weaker for a `cdkd scrub`
+*   one, which rewrites `state.outputs` IN PLACE: scrub redacts what it has a
+*   needle or a template position for, and its own docs admit it can leave a
+*   plaintext it has neither for — so a scrubbed bag holding one redacted key
+*   can exonerate a deleted key's surviving plaintext. Recorded rather than
+*   closed: removing the exoneration would withhold values on every clean
+*   post-GHSA record in a secret-handling stack, which is the larger harm.
+*
+* Withholding here is PER-KEY, unlike the record-level arms above, and the
+* asymmetry follows from what each concludes: those conclude the record was
+* written by a pre-GHSA binary (a claim about the whole bag), while this one
+* concludes only that THIS key is undecidable. So a secret-handling stack that
+* deletes an ordinary output withholds that one row's value and prints the
+* rest.
+*
+* Residual, stated because the gate is what buys the low false-positive rate:
+* a stack whose ONLY secret reference WAS the deleted output has no secret left
+* in its template, so nothing here fires. Closing it would mean withholding
+* every REMOVE value on every stack, which is a worse trade.
+*/
+function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set(), unaccountableScan = {}) {
 	const changes = [];
 	const currentBag = current ?? {};
 	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
 		if (typeof oldValue === "string" && isSecretDynamicReference(oldValue)) return false;
 		return containsSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
 	});
+	const recordProvesPostGhsa = Object.values(currentBag).some((v) => typeof v === "string" && isSecretDynamicReference(v));
+	const declaredKeys = unaccountableScan.declaredKeys ?? /* @__PURE__ */ new Set();
+	const unaccountable = (name) => unaccountableScan.templateHasSecretReference === true && !recordProvesPostGhsa && !declaredKeys.has(name) && !Object.prototype.hasOwnProperty.call(desired, name);
 	const push = (change) => {
-		if (legacyRecord && change.changeType !== "ADD") {
+		if (change.changeType !== "ADD" && (legacyRecord || unaccountable(change.name))) {
 			const { oldValue: _dropped, ...rest } = change;
 			changes.push({
 				...rest,
@@ -59911,7 +59990,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 * Pure with respect to AWS state mutation — only reads state (the resolver
 * may read producer state for `Fn::ImportValue` / `Fn::GetStackOutput`).
 */
-async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback) {
+async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
+	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate } = options;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	let mergedParameters = parameters;
 	let parametersBound = false;
@@ -59953,11 +60033,17 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		skipDynamicReferences: true
 	});
 	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
-	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs);
 	let outputChanges = [];
 	if (resolved.resolutionFailed) {
-		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
-	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys);
+		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
+			declaredKeys: resolved.declaredKeys,
+			templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
+		}).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
+	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
+		declaredKeys: resolved.declaredKeys,
+		templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
+	});
 	return {
 		changes,
 		outputChanges
@@ -60022,9 +60108,15 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
-	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, parameters, canonicalizeProperties, cfnFallback);
+	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
+	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+		...parameters && { parameters },
+		...canonicalizeProperties && { canonicalizeProperties },
+		...cfnFallback !== void 0 && { cfnFallback },
+		inheritSecretBearingTemplate: false
+	});
 	const node = {
 		stackName,
 		displayName,
@@ -60058,13 +60150,14 @@ async function buildDiffTree(args) {
 			parameters: childParameters,
 			...canonicalizeProperties && { canonicalizeProperties },
 			...assetRedirect && { assetRedirect },
-			...cfnFallback !== void 0 && { cfnFallback }
+			...cfnFallback !== void 0 && { cfnFallback },
+			parentHasSecretReference: secretBearingAbove
 		}));
 	}
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove));
 	}
 	return node;
 }
@@ -60074,9 +60167,9 @@ async function buildDiffTree(args) {
 * (state vs empty template), recursing into state-listed grandchildren
 * (also all DELETE).
 */
-async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator) {
+async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference) {
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
-	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator);
+	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, { inheritSecretBearingTemplate: parentHasSecretReference });
 	const node = {
 		stackName,
 		displayName: stackName,
@@ -60088,7 +60181,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference));
 	}
 	return node;
 }
@@ -60318,25 +60411,19 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		delete: deleteCount
 	};
 }
-/** Stand-in printed instead of a withheld legacy-plaintext output value. */
-const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run `cdkd scrub`>";
 /**
-* Strip characters that let a template-controlled string manipulate the
-* TERMINAL rather than merely appear in it: C0 (incl. ESC, so no ANSI sequence
-* survives), DEL, C1 (the 8-bit CSI forms some terminals still honor), and the
-* bidi / format overrides that visually reorder a rendered line.
-*
-* Applied only on the human-render path. The `--json` payload is deliberately
-* left byte-faithful: it is a machine interface, an export NAME is data a
-* consumer may match on, and silently mutating it there would trade a real
-* correctness regression for a display concern belonging to whatever renders
-* the JSON. `JSON.stringify` already escapes everything below 0x20.
+* Stand-in printed instead of a withheld stored output value.
 *
-* The helper itself now lives in `src/utils/regexp.ts` — `outputs-export-alias`
-* prints the same class of string and had grown a second copy.
+* Worded as a POSSIBILITY because both reasons the value is withheld are
+* suspicions rather than detections — a record that LOOKS pre-GHSA, and a
+* stored key today's template cannot account for (issue #1948), which is
+* undecidable by construction. Stating it as a fact would be wrong on the
+* benign half of each, and `cdkd scrub` finding nothing is the expected
+* outcome there.
 */
+const REDACTED_LEGACY_PLAINTEXT = "<redacted: may be legacy plaintext in state — run `cdkd scrub`>";
 /**
-* The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
+* The guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
 * only, deliberately NOT C0.
 *
 * `JSON.stringify` escapes every character below 0x20 that occurs INSIDE a
@@ -67888,13 +67975,13 @@ async function stateResourcesCommand(stackName, options) {
 			for (const detail of details) {
 				lines.push(detail.logicalId);
 				lines.push(`  Type: ${detail.resourceType}`);
-				lines.push(`  PhysicalID: ${detail.physicalId}`);
+				lines.push(`  PhysicalID: ${stripControlChars(detail.physicalId)}`);
 				lines.push(`  Dependencies: ${detail.dependencies.length > 0 ? detail.dependencies.join(", ") : "(none)"}`);
 				const attrEntries = Object.entries(detail.attributes);
 				if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 				else {
 					lines.push("  Attributes:");
-					for (const [k, v] of attrEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+					for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 				}
 				lines.push("");
 			}
@@ -67914,11 +68001,31 @@ async function stateResourcesCommand(stackName, options) {
 *
 * Scalar values render as-is; objects/arrays are JSON-encoded inline so a
 * resource block stays compact even when an attribute is structured.
+*
+* Control characters are stripped HERE rather than at each call site (issue
+* #1948 review), because every caller has the same provenance problem and the
+* same answer: an Outputs value, a resource PROPERTY and a provider-returned
+* ATTRIBUTE are all values cdkd resolved or read back, none of them passed a
+* CloudFormation validator, and all three land in the same terminal. Doing it
+* once means a future caller cannot forget — the half-applied version of this
+* guard is what the review caught.
+*
+* The FULL class (C0 included), unlike `diff-recursive`'s
+* `stripDisplayOnlyChars`: that narrower guard exists to protect a
+* PRETTY-PRINTED payload's structural newlines, and this function never
+* pretty-prints — `JSON.stringify` is called without an indent, so a newline
+* here is content injected by the value, not layout.
+*
+* Only the human path routes through this; `--json` serializes the state
+* record directly and stays byte-faithful, which is the same split
+* `renderOutputChangeLines` makes.
 */
 function formatAttributeValue(value) {
 	if (value === null) return "null";
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return String(value);
-	return JSON.stringify(value);
+	if (value === void 0) return "undefined";
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return stripControlChars(String(value));
+	const json = JSON.stringify(value);
+	return json === void 0 ? "(unserializable)" : stripControlChars(json);
 }
 /**
 * Render a duration in milliseconds as `1m23s` / `45s`.
@@ -68020,7 +68127,7 @@ function renderStateBlock(state, lockInfo) {
 	if (outputEntries.length > 0) {
 		lines.push("");
 		lines.push("Outputs:");
-		for (const [k, v] of outputEntries) lines.push(`  ${k}: ${formatAttributeValue(v)}`);
+		for (const [k, v] of outputEntries) lines.push(`  ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 	}
 	const resourceEntries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 	lines.push("");
@@ -68029,7 +68136,7 @@ function renderStateBlock(state, lockInfo) {
 		lines.push("");
 		lines.push(logicalId);
 		lines.push(`  Type: ${resource.resourceType}`);
-		lines.push(`  PhysicalID: ${resource.physicalId}`);
+		lines.push(`  PhysicalID: ${stripControlChars(resource.physicalId)}`);
 		const provisionedBy = resource.provisionedBy ?? "(sdk, legacy default)";
 		lines.push(`  ProvisionedBy: ${provisionedBy}`);
 		const deps = resource.dependencies ?? [];
@@ -68038,13 +68145,13 @@ function renderStateBlock(state, lockInfo) {
 		if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 		else {
 			lines.push("  Attributes:");
-			for (const [k, v] of attrEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of attrEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 		}
 		const propEntries = Object.entries(resource.properties ?? {});
 		if (propEntries.length === 0) lines.push("  Properties: (none)");
 		else {
 			lines.push("  Properties:");
-			for (const [k, v] of propEntries) lines.push(`    ${k}: ${formatAttributeValue(v)}`);
+			for (const [k, v] of propEntries) lines.push(`    ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 		}
 	}
 	return lines;
@@ -68715,6 +68822,19 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 	}
 }
 /**
+* The secrets map every redaction on this command's paths gets, and it is
+* EMPTY by construction (issue #1926).
+*
+* `cdkd state refresh-observed` neither synthesizes a template nor resolves a
+* dynamic reference, so no plaintext is ever recorded here and a VALUE scan
+* would have no needles at all. That is the issue #1900 shape, and it is why
+* the PATH pass has to carry the redaction on its own — see the call site.
+*
+* Shared rather than constructed per resource because nothing writes to it:
+* `redactSecretsForState` only reads its argument.
+*/
+const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Refresh the `observedProperties` of every resource in one stack
 * record. Returns counts so the caller can aggregate across `--all`.
 *
@@ -68793,7 +68913,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						unsupported++;
 						return;
 					}
-					resource.observedProperties = observed;
+					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -68834,7 +68954,7 @@ async function confirmRefresh(prompt) {
 * Create the `state refresh-observed` subcommand.
 */
 function createStateRefreshObservedCommand() {
-	const cmd = new Command("refresh-observed").description("Refresh observedProperties for every resource in a stack by calling provider.readCurrentState — populates the drift baseline for stacks deployed before state schema v3, without redeploying.").argument("[stacks...]", "Stack name(s) to refresh (physical CloudFormation names)").option("--all", "Refresh every stack in the state bucket", false).option("--dry-run", "Print the per-stack refresh count without writing state", false).addOption(stackRegionOption$1()).action(withErrorHandling(stateRefreshObservedCommand));
+	const cmd = new Command("refresh-observed").description("Refresh observedProperties for every resource in a stack by calling provider.readCurrentState — populates the drift baseline for stacks deployed before state schema v3, without redeploying. Run cdkd scrub first on state written by a pre-GHSA binary: the readback is redacted by POSITION against the record, so a record whose own properties still hold plaintext has nothing to redact from.").argument("[stacks...]", "Stack name(s) to refresh (physical CloudFormation names)").option("--all", "Refresh every stack in the state bucket", false).option("--dry-run", "Print the per-stack refresh count without writing state", false).addOption(stackRegionOption$1()).action(withErrorHandling(stateRefreshObservedCommand));
 	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -82361,7 +82481,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.9");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;