@go-to-k/cdkd 0.284.7 → 0.284.9

package/dist/{deploy-engine-CJncZQEi.js → deploy-engine-CY2fx4K1.js}

@@ -296,6 +296,182 @@ function isThrottlingError(error) {
 	return false;
 }
 /**
+* HTTP status codes that indicate a TRANSIENT SERVER-side failure worth
+* retrying (issue #2026).
+*
+* Mirrors `@smithy/service-error-classification`'s own
+* `TRANSIENT_ERROR_STATUS_CODES` (`[500, 502, 503, 504]`), which is what the
+* AWS SDK's default retry strategy treats as transient. Deliberately a
+* SEPARATE set from {@link RETRYABLE_HTTP_STATUS_CODES} rather than an
+* extension of it, because that one is consumed by {@link isThrottlingError},
+* which SEVEN call sites across four files pass as a deliberately NARROW
+* `isRetryable`: `describe-type.ts:67` (which states the intent outright --
+* "retry ONLY throttle-shaped failures"), `dynamodb-globaltable-provider.ts`
+* (x4), `export.ts:1744`, and `intrinsic-function-resolver.ts:5216`. Widening
+* the shared set would have silently converted every one of them from "retry
+* throttles" into "retry throttles and server errors", which none of them
+* asked for.
+*
+* Three FURTHER sites call it as a bare classification rather than as a retry
+* filter -- `drift.ts:518`, `export.ts:1755`, `dynamodb-index-busy-delete.ts:381`
+* -- and they make the case stronger, not weaker: `drift.ts` would have started
+* returning `undefined` (reporting "cannot compare") for a resource whose read
+* merely 500'd, and the index poll would have waited a server error out as
+* though it were a throttle.
+*
+* Measured, not inferred. `tests/integration/iam-propagation-stress` against
+* real AWS (us-east-1, 2026-08-19 08:57:30Z, round 11 of 11) produced:
+*
+*   StressQueuePolicyDC3E35C3: gave up after 5 IAM-propagation retries over
+*   5.75s of propagation backoff - Failed to create SQS queue policy
+*   StressQueuePolicyDC3E35C3: UnknownError
+*   [name=InternalFailure http=500 requestId=ebf581cc-6072-5ffc-943a-e33312488615]
+*
+* SQS answered a `SetQueueAttributes` mid-propagation with HTTP 500
+* `InternalFailure` and an empty message body -- hence the `UnknownError`
+* placeholder, which matches no message pattern. With 500 absent from every
+* status set, `withRetry` classified it non-retryable and threw at 5.75s of a
+* 47.75s budget the sequence needed roughly 10s of.
+*
+* Why 502 and 504 come along rather than only the measured 500: they are the
+* same class (a gateway or timeout between AWS's edge and the service), the
+* SDK groups all four, and adding only the one status seen would leave the
+* identical defect behind for its siblings.
+*
+* Note the SDK has ALREADY retried these before cdkd sees them (default
+* `maxAttempts` is 3), so a 5xx reaching this classifier is one that persisted
+* across the SDK's own attempts. That is an argument FOR retrying it here, not
+* against: the eventual-consistency window this schedule exists to cover is
+* measured in seconds, while the SDK's three attempts span well under one.
+*
+* ACCEPTED RISK, stated rather than discovered later: this makes a
+* NON-IDEMPOTENT create retryable on a 500 that may have succeeded
+* server-side. `EC2Provider.createInstance` issues `RunInstances` with no
+* `ClientToken` (only four providers use one at all), and
+* `IAMAccessKeyProvider` mints an unnamed key, so a replay can leave a
+* resource that is absent from state and therefore from destroy. The class is
+* PRE-EXISTING -- the SDK's own three attempts already reach it, and 503 was
+* already retryable here -- but this widens the window from ~1s to the full
+* schedule. Judged worth it because the alternative is the measured failure
+* (a deploy that dies outright on a transient 500), and because the durable
+* remedy is per-provider idempotency tokens rather than a blanket refusal to
+* retry server errors. Tracked in issue #2039.
+*/
+const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
+	500,
+	502,
+	503,
+	504
+]);
+/**
+* Walk the error + its `.cause` chain (bounded, same depth 5 as
+* {@link isThrottlingError}) looking for a transient SERVER-side HTTP status
+* ({@link TRANSIENT_SERVER_ERROR_STATUS_CODES}) on `$metadata`.
+*
+* The walk is what makes it work in practice: providers wrap the AWS error in
+* a `ProvisioningError`, so the `$metadata` carrying the status sits one link
+* down, and the wrapper's interpolated message is all a message-based
+* classifier can see. In the measured failure that message was the literal
+* `UnknownError`, so the status was the ONLY usable evidence in the whole
+* error.
+*/
+function isTransientServerError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Collect {@link RetryClassificationSignals} from an error and its bounded
+* `.cause` chain — the SAME walk, to the same depth 5, that
+* {@link isThrottlingError} performs, so the line reports what the classifier
+* genuinely saw rather than a second opinion gathered differently.
+*
+* The signals are taken from the first link carrying a `$metadata` object,
+* because that link IS the AWS SDK error by construction: `$metadata` is
+* attached by the SDK's own `deserializeMetadata`, so nothing else can carry
+* it. When no link has one, the fallback is the deepest name found BELOW depth
+* 0 -- which keeps the field useful for the wrapped-network-error case, where
+* the name is all that survives.
+*
+* Excluding depth 0 from that fallback is deliberate and is what stops the
+* suffix from being noise. The error `withRetry` is handed is the provider's
+* own wrapper by construction (every provider catches the AWS error and
+* rethrows a `ProvisioningError`), so its `name` is a cdkd class name and says
+* nothing about the service. Reporting it produced the actively misleading
+* ` [name=ProvisioningError no-$metadata]` on a wrapper carrying no cause at
+* all -- a suffix asserting the SDK never parsed a response, about an error
+* that never came from the SDK.
+*
+* Nothing is lost in the case this helper exists for. A degenerate
+* `UnknownError` message can only be produced by `decorateServiceException`,
+* i.e. by a smithy `ServiceException`, and those always carry `$metadata` --
+* so that case is answered by the FIRST branch and never reaches this
+* fallback.
+*
+* Known narrowness: the first link with a NUMERIC status wins, so an outer
+* link carrying a 400 that wraps a cause carrying a 500 reports the 400 while
+* `isTransientServerError` retried on the 500. Left as-is because cdkd's own
+* wrappers carry no `$metadata` at all, so producing that shape takes two
+* stacked SDK errors -- but it is the same "must not contradict the
+* classifier" case one link further out, and is the thing to revisit if such a
+* chain is ever observed. A cdkd module deliberately importing no other module, this one
+* cannot ask `error instanceof CdkdError` directly: `error-handler.ts` imports
+* `markNonRetryable` from here, so the dependency only runs one way.
+*/
+function describeRetryClassificationSignals(error) {
+	let current = error;
+	let deepestName;
+	let sawMetadata = false;
+	let metadataName;
+	let metadataRequestId;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
+		const metadata = current.$metadata;
+		if (metadata != null && typeof metadata === "object" && !Array.isArray(metadata)) {
+			const { httpStatusCode, requestId } = metadata;
+			const linkName = typeof name === "string" && name !== "" ? name : void 0;
+			if (!sawMetadata) {
+				sawMetadata = true;
+				metadataName = linkName;
+				metadataRequestId = typeof requestId === "string" && requestId !== "" ? requestId : void 0;
+			}
+			if (typeof httpStatusCode === "number") return {
+				name: linkName ?? deepestName,
+				httpStatusCode,
+				requestId: (typeof requestId === "string" && requestId !== "" ? requestId : void 0) ?? metadataRequestId,
+				noMetadata: false
+			};
+		}
+		current = current.cause;
+	}
+	return {
+		name: metadataName ?? deepestName,
+		requestId: metadataRequestId,
+		noMetadata: !sawMetadata
+	};
+}
+/**
+* Render {@link describeRetryClassificationSignals} as a compact log suffix.
+*
+* Returns `''` when there is nothing to say (no name and no metadata), so a
+* caller can append unconditionally without emitting an empty bracket pair.
+*/
+function formatRetryClassificationSignals(error) {
+	const signals = describeRetryClassificationSignals(error);
+	if (signals.name === void 0 && signals.httpStatusCode === void 0 && signals.requestId === void 0) return "";
+	const parts = [];
+	if (signals.name !== void 0) parts.push(`name=${signals.name}`);
+	if (signals.httpStatusCode !== void 0) parts.push(`http=${signals.httpStatusCode}`);
+	if (signals.requestId !== void 0) parts.push(`requestId=${signals.requestId}`);
+	if (signals.noMetadata) parts.push("no-$metadata");
+	return ` [${parts.join(" ")}]`;
+}
+/**
 * Determine whether an AWS error should be retried.
 *
 * Checks (in order):
@@ -307,11 +483,16 @@ function isThrottlingError(error) {
 *      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
 *      429, so the name check carries most of the weight). See
 *      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
+*   2. Transient SERVER-side HTTP status (500 / 502 / 503 / 504) on the error
+*      or any wrapped cause — see {@link isTransientServerError}. Ahead of the
+*      message patterns because it is the only check that still works when the
+*      response carried NO message (issue #2026).
+*   3. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
 function isRetryableTransientError(error, message) {
 	if (isMarkedNonRetryable(error)) return false;
 	if (isThrottlingError(error)) return true;
+	if (isTransientServerError(error)) return true;
 	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
 /**
@@ -8748,6 +8929,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 	let sawPropagation = false;
 	let propagationRetries = 0;
 	let propagationSleptMs = 0;
+	let serverErrorRetries = 0;
 	for (let attempt = 0; attempt <= attemptCeiling; attempt++) try {
 		return await operation();
 	} catch (error) {
@@ -8759,11 +8941,14 @@ async function withRetry(operation, logicalId, opts = {}) {
 		if (propagation) sawPropagation = true;
 		const attemptLimit = sawPropagation ? 26 : maxRetries;
 		if (!retryable || attempt >= attemptLimit) {
-			if (propagationRetries > 0) {
+			if (propagationRetries > 0 || serverErrorRetries > 0) {
 				const budgetExhausted = sawPropagation && attempt >= attemptLimit;
-				const summary = `${logicalId}: gave up after ${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""} - ${message}`;
+				const spent = [];
+				if (propagationRetries > 0) spent.push(`${propagationRetries} IAM-propagation ${propagationRetries === 1 ? "retry" : "retries"} over ${(propagationSleptMs / 1e3).toFixed(2)}s of propagation backoff${budgetExhausted ? " (the full propagation budget)" : ""}`);
+				if (serverErrorRetries > 0) spent.push(`${serverErrorRetries} transient server-error ${serverErrorRetries === 1 ? "retry" : "retries"} (HTTP 5xx)`);
+				const summary = () => `${logicalId}: gave up after ${spent.join(" and ")} - ${message}` + formatRetryClassificationSignals(error);
 				try {
-					opts.logger?.warn?.(summary);
+					opts.logger?.warn?.(summary());
 				} catch {}
 			}
 			throw error;
@@ -8778,7 +8963,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 		if (propagation) {
 			propagationRetries++;
 			propagationSleptMs = backoffThroughThisAttemptMs;
-		}
+		} else if (opts.isRetryable === void 0 && isTransientServerError(error)) serverErrorRetries++;
 	}
 	throw lastError;
 }
@@ -10604,13 +10789,227 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions));
 	}
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
-		const out = {};
+		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions) : redactSecretsForState(v, secrets);
 		return out;
 	}
 	return redactSecretsForState(bag, secrets);
 }
 /**
+* Is this rules constant one whose BAG is an AWS readback and whose SOURCE is a
+* persisted STATE bag?
+*
+* Today that is {@link STATE_SOURCED_READBACK_RULES} alone: the path where the
+* secrets map can be EMPTY by construction (nothing was resolved), so the value
+* scan has no needles and POSITION is the only mechanism left. Derived from the
+* flags rather than compared against the constant so a future one with the same
+* shape is covered automatically. `trustAnyExpression` says the source is a
+* persisted record (holding no PUBLIC reference, so any `{{resolve:...}}` in it
+* is by construction a secret); `!descendArrays` says the bag came back from
+* AWS and may be reordered.
+*
+* `sourceIsSameGeneration` is the third conjunct and it is the one that took a
+* measurement to get right. Without it this also selected
+* {@link STATE_SOURCED_CROSS_GENERATION_RULES} — `cdkd scrub`'s observed walk,
+* whose `properties` have ALREADY been repositioned onto TODAY's template — and
+* taking a source subtree there rewrote a baseline holding the DEPLOYED
+* `:AWSPREVIOUS` reference onto the template's edited `:AWSCURRENT` one. That
+* is precisely the issue #1917 hazard, and `cdkd drift --revert` pushes the
+* baseline to AWS, so it would have applied a reference the stack never
+* deployed. A refusal may only take a source that is the same generation as the
+* bag beside it.
+*
+* A TEMPLATE-sourced caller is deliberately excluded: its source can carry a
+* public `ssm:` reference whose resolved value must STAY resolved (issue
+* #1901), and it always has a populated map, so the value scan already covers
+* the shapes below. So is the rollback replay
+* ({@link STATE_DERIVED_RULES}) — full map, and its bag descends positionally
+* because it was produced by resolving the source.
+*/
+function isReadbackProjectedFromState(rules) {
+	return rules.trustAnyExpression && !rules.descendArrays && rules.sourceIsSameGeneration;
+}
+/**
+* Does this subtree carry a dynamic reference anywhere?
+*
+* A BOOLEAN, not the occurrence COUNTS an earlier revision collected. The
+* counts existed to decide whether a bag "covered" every reference its source
+* carried, which was the vouching rule for taking a source array wholesale —
+* and that rule is gone (see the array arm), so counting would be a
+* measurement nothing reads.
+*/
+function subtreeHasDynamicReference(value) {
+	if (isDynamicReferenceString(value)) return true;
+	if (Array.isArray(value)) return value.some(subtreeHasDynamicReference);
+	if (isPlainObject$2(value)) return Object.values(value).some(subtreeHasDynamicReference);
+	return false;
+}
+/** Every complete `{{resolve:...}}` token inside a string. */
+function dynamicReferenceTokens(value) {
+	return value.match(/\{\{resolve:[^{}]*\}\}/g) ?? [];
+}
+/**
+* Does this MIXED leaf embed a reference that may be PUBLIC config?
+*
+* A plain `{{resolve:ssm:...}}` is classified by the parameter's TYPE, not by
+* its spelling (issue #1901): a `String` / `StringList` parameter is public and
+* is legitimately persisted RESOLVED. Substituting the expression over it gives
+* the drift baseline a value AWS does not hold, which is phantom drift on
+* ordinary config — and `--revert` then pushes the literal expression.
+*
+* `trustAnyExpression` is what would otherwise wave this through, and its
+* premise ("a persisted STATE bag holds no public expression") is documented as
+* FALSE in one place: `cdkd import`'s warn path can leave one there. The
+* whole-token arm accepts that risk knowingly and `cdkd drift --accept`
+* re-checks its write; the MIXED arm added later has no such re-check, so it
+* declines instead.
+*
+* A reference the resolver RECORDED as secret is kept: that is the ssm
+* `SecureString` case, where the verdict came off the same `GetParameter`
+* response that carried the value. `{{resolve:ssm-secure:` does not match this
+* prefix at all (the next character is `-`), so it is never refused here.
+*
+* The verdict store only carries signal where something RESOLVED, so this
+* splits on whether a secrets map exists at all.
+*
+* WITH a map, a pass resolved this bag: the engine's change detection walks
+* every template property with `skipDynamicReferences`, which only flips
+* `decrypt` on the ssm branch — the `GetParameter` still runs, a definitive
+* `SecureString` is recorded, and a parameter that comes back public has its
+* memo RETRACTED. Absence from the store is then real evidence of a public
+* parameter, and the resolved value is kept.
+*
+* WITHOUT one, absence means only that the question was never asked HERE. It
+* does not mean nothing was resolved: the deploy path resolves every template
+* property with `skipDynamicReferences`, which records or retracts the
+* `SecureString` verdict even for an UNCHANGED resource -- that bag simply is
+* not the one this call receives. The leaf is treated as
+* secret-bearing and refused. That is not merely the cautious branch, it is the
+* SAME premise the whole-token arm one level up already acts on: a PUBLIC
+* `String` / `StringList` reference is persisted RESOLVED (issue #1901), so a
+* `{{resolve:ssm:` token that SURVIVES in a persisted state bag is a
+* SecureString by construction. An earlier revision applied a stricter rule to
+* a MIXED leaf than to a whole token on the identical source, and that
+* inconsistency is what persisted a decrypted secret.
+*
+* ACCEPTED CONSEQUENCE, recorded rather than papered over: on the empty-map
+* paths a genuinely PUBLIC ssm mixed leaf is now OVER-redacted, so the baseline
+* no longer matches AWS and `cdkd drift` reports a phantom on it. That is
+* reachable only through the one documented hole in the premise above — `cdkd
+* import`'s warn path, which can leave a public expression in state. The trade
+* is deliberate and asymmetric: under-redaction persists a decrypted secret,
+* which is a disclosure and is what this lane exists to prevent, while
+* over-redaction is visible, recoverable and discloses nothing. Closing it
+* properly needs a real TYPE classification on these paths, which is issue
+* [#2012](https://github.com/go-to-k/cdkd/issues/2012)'s mechanism; the
+* over-redaction itself is tracked as issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036).
+*
+* `tests/integration/secrets-dynamic-ref` is the end-to-end proof on BOTH
+* paths, and it is the only place the empty-map defect surfaced: Phase 1g
+* covers the populated-map deploy and Phase 1f the empty-map command.
+*/
+function mixedLeafMayCarryPublicReference(source, secrets) {
+	if (secrets.size === 0) return false;
+	return dynamicReferenceTokens(source).some((token) => token.startsWith("{{resolve:ssm:") && !isRecordedSecretExpression(token));
+}
+/**
+* Refuse to persist a readback leaf the path pass could not CERTIFY, at any
+* position the STATE source proves is secret-bearing (issue #1926 review).
+*
+* {@link redactByPath} substitutes only where the source leaf is a WHOLE
+* `{{resolve:...}}` token. On the paths {@link isReadbackProjectedFromState}
+* selects the secrets map may be EMPTY, so its value-scan fallback is a no-op,
+* and four shapes reached `state.json` holding the DECRYPTED value. Measured
+* against this module before this pass existed — three by `cdkd state
+* refresh-observed`, and the same three by a plain `cdkd deploy`, whose
+* `drainObservedCaptures` baseline reaches the persist choke point with exactly
+* this configuration. `cdkd scrub` is NOT one of them: its observed walk is
+* CROSS-generation, so {@link isReadbackProjectedFromState} excludes it by
+* design:
+*
+* ```text
+*   source leaf in the STATE record                  before        now
+*   -----------------------------------------------  ------------  ---------------
+*   `postgres://u:{{resolve:...}}@h` (MIXED string)   LEAK          take source
+*   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
+*   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          LEAK (#2012)
+*   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          LEAK (#2012)
+*   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
+*   an observed KEY the source does not carry         LEAK          LEAK (#2012)
+*   whole `{{resolve:...}}` token                     ok            ok
+*   `Environment[]` keyed by `Name` (issue #1915)     ok            ok
+*   PUBLIC ssm MIXED leaf, POPULATED map               ok            ok
+*   PUBLIC ssm MIXED leaf, EMPTY map                   ok            over-redacts
+* ```
+*
+* The last row is the price of the row above it and is tracked as issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036): with no map nothing was
+* resolved, so nothing distinguishes a public parameter from a `SecureString`
+* and the leaf is refused. Phantom drift, not a disclosure — see
+* {@link mixedLeafMayCarryPublicReference} for why that is the right way to be
+* wrong here.
+*
+* What this pass closes is the row POSITION can actually justify: a leaf whose
+* KEY the source carries, where the source is the same generation and the only
+* thing the older code lacked was the willingness to substitute a leaf that was
+* not a WHOLE token. Everything it takes is the record's own value at the
+* record's own path.
+*
+* The four residual rows are one root cause, not four: no needle and no
+* position, so nothing distinguishes a resolved secret from an ordinary
+* literal. They are NOT closed by taking the source subtree, which an earlier
+* revision did and the issue #1915 fences correctly rejected — measured, it
+* rewrote `{Name:'', Value:'an-unrelated-literal'}` onto the expression and
+* turned an AWS-reported `[{Value:'x'}]` into `[{Name:'db', Value:<expr>}]`,
+* fabricating drift-baseline content AWS never reported that `cdkd drift
+* --revert` then pushes to the live resource. Redaction may not buy itself a
+* fabricated baseline.
+*
+* The MIXED row is the shape this module itself calls DOMINANT for CDK — an
+* `Fn::Join` around `secret.secretValueFromJson(...)`.
+*
+* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it does close, for
+* the same reason the whole-token arm does: a mask is not a value `cdkd drift`
+* can re-resolve, so it would report a permanent phantom — and `cdkd drift
+* --revert` pushes the BASELINE to AWS, so a masked baseline would write the
+* literal `***` onto the live resource (the issue #1498 / #1501 class).
+*
+* KNOWN RESIDUAL, the last row: an observed KEY the source object does not
+* carry has no source leaf to take and no needle to match. It is NOT refused
+* the way an unpaired array ELEMENT is, and the asymmetry is deliberate rather
+* than an oversight — an extra array element is a PEER of the secret-bearing
+* ones (another `Environment` entry), so suspicion is warranted and extras are
+* rare, while an extra object KEY is a different FIELD entirely (`Runtime`,
+* `FunctionArn`, `LastModified`) and is the NORM in an AWS readback. Refusing
+* those would empty the drift baseline of every secret-bearing resource.
+* Tracked as issue [#2012](https://github.com/go-to-k/cdkd/issues/2012).
+*/
+function refuseUncertifiedReadbackPositions(bag, source, secrets) {
+	if (isDynamicReferenceString(source) && typeof bag === "string") {
+		if (isSingleDynamicReferenceToken(source)) return source;
+		if (mixedLeafMayCarryPublicReference(source, secrets)) return bag;
+		return source;
+	}
+	if (!subtreeHasDynamicReference(source)) return bag;
+	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets) : v;
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(source)) {
+		const key = identityKeyFor(bag, source);
+		if (key === void 0) return bag;
+		const sourceByIdentity = /* @__PURE__ */ new Map();
+		for (const item of source) sourceByIdentity.set(item[key], item);
+		return bag.map((item) => {
+			const partner = sourceByIdentity.get(item[key]);
+			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets);
+		});
+	}
+	return bag;
+}
+/**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
 * the unresolved `{{resolve:...}}` expression it came from. A string whose WHOLE
 * value equals a secret is replaced by that secret's expression exactly; a
@@ -10621,7 +11020,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions) {
 */
 function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RULES) {
 	if (secrets.size === 0 && source === void 0) return bag;
-	if (source !== void 0) return redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
+	if (source !== void 0) {
+		const positioned = redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
+		return isReadbackProjectedFromState(rules) ? refuseUncertifiedReadbackPositions(positioned, source, secrets) : positioned;
+	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
 	const walk = (value) => {
@@ -10637,7 +11039,7 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
-			const out = {};
+			const out = Object.create(null);
 			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
 			return out;
 		}
@@ -15643,7 +16045,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DOdJgPLS.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-B09ceB1r.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -23221,7 +23623,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.7";
+	return "0.284.9";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25690,4 +26092,4 @@ var DeployEngine = class {
 
 //#endregion
 export { IntrinsicFunctionResolver as $, StackHasActiveImportsError as $n, validateContainerRepoName as $t, formatResourceLine as A, AssemblyReader as An, describeTypeWithThrottleRetry as At, isExportAliasCollision as B, ConfigError as Bn, WorkGraph as Bt, refusesFinalSnapshot as C, MIGRATE_TMP_PREFIX as Cn, s3BucketDomainName as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, PARTITION_TABLE as Dn, applyRoleArnIfSet as Dt, extractDeploymentEventError as E, expectedOwnerParam as En, s3BucketWebsiteUrl as Et, red as F, getAwsClients as Fn, S3StateBackend as Ft, clearOnUpdateRemoval as G, LocalStartServiceError as Gn, escapeRegExp$1 as Gt, stateKeySecretExposure as H, DeployCancelledError as Hn, createAssetRedirectResolver as Ht, yellow as I, resetAwsClients as In, rebuildClientForBucketRegion as It, findSilentDropProperties as J, NestedStackChildDirectDestroyError as Jn, BOOTSTRAP_MARKER_PREFIX as Jt, ProviderRegistry as K, LockError as Kn, stripControlChars as Kt, collectDeclaredOutputNames as L, setAwsClients as Ln, shouldRetainResource as Lt, cyan as M, clearBucketRegionCache as Mn, DagBuilder as Mt, gray as N, resolveBucketRegion as Nn, TemplateParser as Nt, isStatefulRecreateTargetSync as O, canonicalizeRegion as On, DiffCalculator as Ot, green as P, AwsClients as Pn, LockManager as Pt, isTerminationProtectionPropagationError as Q, ResourceUpdateNotSupportedError as Qn, validateAssetBucketName as Qt, collectPublishedOutputNames as R, AssetError as Rn, AssetPublisher as Rt, isFinalSnapshotError as S, CFN_TEMPLATE_URL_LIMIT as Sn, s3BucketArn as St, makeCanonicalizePropertiesFn as T, uploadCfnTemplate as Tn, s3BucketRegionalDomainName as Tt, IAMRoleProvider as U, LocalInvokeBuildError as Un, loadPublishableAssetManifest as Ut, secretBearingStateKeyWarning as V, DependencyError as Vn, buildAssetRedirectMap as Vt, collectInlinePolicyNamesManagedBySiblings as W, LocalMigrateError as Wn, rewriteTemplateAssetReferences as Wt, slowCcOperationTimeoutMs as X, ProvisioningError as Xn, getBootstrapMarkerKey as Xt, CloudControlProvider as Y, PartialFailureError as Yn, ensureAssetStorage as Yt, disableInstanceApiTermination as Z, ResourceTimeoutError as Zn, parseBootstrapMarker as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, resolveStateBucketWithDefaultAndSource as _n, TEMPLATE_SOURCED_RULES as _t, DeploymentEventsStore as a, runDockerStreaming as an, normalizeAwsError as ar, resolveExplicitPhysicalId as at, ccRoutedFinalSnapshotError as b, warnDeprecatedNoPrefixCliFlag as bn, redactSecretsForState as bt, replayFailedOperations as c, Synthesizer as cn, isRetryableTransientError as cr, configBooleanRefusal as ct, updatePartialReason as d, getLegacyStateBucketName as dn, __exportAll as dr, replayWarn as dt, buildDenyExternalAccessPolicy as en, StackTerminationProtectionError as er, cfnRefValueFromPhysicalId as et, UNSPECIFIED_SKIP_REASON as f, resolveApp as fn, requireConfigArray as ft, computeImplicitDeleteEdges as g, resolveStateBucketWithDefault as gn, STATE_SOURCED_READBACK_RULES as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveSkipPrefix as hn, STATE_SOURCED_CROSS_GENERATION_RULES as ht, DeploymentEventsReader as i, runDockerForeground as in, isCdkdError as ir, normalizeAwsTagsToCfn as it, bold as j, processStackMessages as jn, withRetry as jt, renderStatefulReason as k, derivePartitionAndUrlSuffix as kn, INTRINSIC_KEYS as kt, replayRollback as l, synthesisStatusMessage as ln, isThrottlingError as lr, configStringRefusal as lt, withResourceDeadline as m, resolveCaptureObservedState as mn, requireConfigString as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatDockerLoginError as nn, SynthesisError as nr, refStateLookupFromResource as nt, planFailedOps as o, AssetManifestLoader as on, withErrorHandling as or, assertRegionMatch as ot, deleteSkipReason as p, resolveAutoAssetStorage as pn, requireConfigObject as pt, findActionableSilentDrops as q, MissingCdkCliError as qn, AssetModeResolver as qt, DeployEngine as r, getDockerCmd as rn, formatError as rr, WAFv2WebACLProvider as rt, planRollback as s, getDockerImageBySourceHash as sn, isMarkedNonRetryable as sr, coerceCfnBoolean as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, buildDockerImage as tn, StateError as tr, getAccountInfo as tt, updatePartialMessage as u, getDefaultStateBucketName as un, markNonRetryable as ur, readConfigString as ut, PRE_DELETE_SNAPSHOT_TYPES as v, resolveUseCdkBootstrapAssets as vn, createSecretMasker as vt, unsupportedFinalSnapshotError as w, findLargeInlineResources as wn, s3BucketDualStackDomainName as wt, createPreDeleteFinalSnapshot as x, CFN_TEMPLATE_BODY_LIMIT as xn, scrubResourceRecord as xt, buildFinalSnapshotIdentifier as y, stateBucketExistenceConfirmed as yn, maskSecretsInText as yt, exportAliasCollisionScrubWarning as z, CdkdError as zn, stringifyValue as zt };
-//# sourceMappingURL=deploy-engine-CJncZQEi.js.map
+//# sourceMappingURL=deploy-engine-CY2fx4K1.js.map