@go-to-k/cdkd 0.285.3 → 0.285.4

package/dist/{deploy-engine-3lJaFGjA.js → deploy-engine-3EmPzxSN.js}

@@ -1,6 +1,6 @@
 import { d as generateResourceName, f as generateResourceNameWithFallback, g as withStackName, m as looksLikeCdkdGeneratedName, n as getLogger, o as getLiveRenderer, p as getCurrentStackName, u as applyDefaultNameForFallback } from "./logger-Dz3Le2Pw.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-B4YqJKXh.js";
+import { t as getCdkdVersion } from "./version-Dlq6xZAQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11096,22 +11096,35 @@ function dynamicReferenceSpans(value) {
 * a MIXED leaf than to a whole token on the identical source, and that
 * inconsistency is what persisted a decrypted secret.
 *
-* ACCEPTED CONSEQUENCE, recorded rather than papered over: on the empty-map
-* paths a genuinely PUBLIC ssm mixed leaf is now OVER-redacted, so the baseline
-* no longer matches AWS and `cdkd drift` reports a phantom on it. That is
-* reachable only through the one documented hole in the premise above — `cdkd
-* import`'s warn path, which can leave a public expression in state. The trade
-* is deliberate and asymmetric: under-redaction persists a decrypted secret,
-* which is a disclosure and is what this lane exists to prevent, while
-* over-redaction is visible, recoverable and discloses nothing. Closing it
-* properly needs a real TYPE classification on these paths, which is issue
-* [#2012](https://github.com/go-to-k/cdkd/issues/2012)'s mechanism; the
-* over-redaction itself is tracked as issue
-* [#2036](https://github.com/go-to-k/cdkd/issues/2036).
-*
-* `tests/integration/secrets-dynamic-ref` is the end-to-end proof on BOTH
-* paths, and it is the only place the empty-map defect surfaced: Phase 1g
-* covers the populated-map deploy and Phase 1f the empty-map command.
+* NOT CLOSED here. Issue
+* [#2036](https://github.com/go-to-k/cdkd/issues/2036) tracks the price this
+* refusal pays: a genuinely PUBLIC ssm mixed leaf is OVER-redacted on the
+* empty-map paths, so the baseline no longer matches AWS. Giving the empty-map
+* path POSITIVE evidence (a store of PROVEN-public verdicts, which the
+* resolver's own `pinSecretVerdict` retraction already computes) was drafted in
+* PR #2415 and WITHDRAWN there: such a store is keyed on the bare expression
+* and lives for the whole process, so on a `cdkd deploy --all` spanning regions
+* a verdict recorded where the parameter is a plain `String` un-redacts a
+* SecureString of the same name in another region — measured, and the
+* un-redacting direction, which is worse than the over-redaction it fixes. Any
+* revival must key the verdict by SCOPE (region + account) at the READ side.
+*
+* The residual is therefore the whole population an empty map describes, which
+* is the state issue #2036 records. Refusing is still the right way to be wrong
+* here: under-redaction persists a decrypted secret, a disclosure and the thing
+* this lane exists to prevent, while over-redaction is visible, recoverable and
+* discloses nothing.
+*
+* `tests/integration/secrets-dynamic-ref` is the end-to-end proof, and it is
+* the only place the empty-map defect surfaced — every unit assertion passed.
+* Three of its phases pin a DIFFERENT map state for the same two leaves, which
+* is what makes the split observable rather than asserted: Phase 1 is the
+* populated-map deploy (the resource is being created), Phase 1g the EMPTY-map
+* deploy (the resource is UNCHANGED, so it has no per-resource map but the
+* resolver has still classified the parameter this run), and Phase 1f the
+* empty-map command, which classifies nothing and therefore still refuses. An
+* earlier revision of this sentence called Phase 1g the populated-map case,
+* which is the opposite of what that phase is built to reach.
 */
 function mixedLeafMayCarryPublicReference(source, secrets) {
 	if (secrets.size === 0) return false;
@@ -11267,7 +11280,9 @@ function anchorSignature(source) {
 *
 * Two conditions, both required:
 *
-* 1. the key sets (objects) or index counts (arrays) match, and
+* 1. every SOURCE key is present in the bag (objects) or the index counts match
+*    (arrays) — see the object arm for why containment rather than equality,
+*    and which of the two directions is the fabrication guard, and
 * 2. every position whose SOURCE carries no dynamic reference is deep-equal on
 *    both sides -- the *anchors*.
 *
@@ -11307,9 +11322,7 @@ function anchorsCorroboratePairing(bag, source, anchors) {
 	if (isDynamicReferenceString(source)) return typeof bag === "string";
 	if (isPlainObject$2(source)) {
 		if (!isPlainObject$2(bag)) return false;
-		const sourceKeys = Object.keys(source);
-		if (sourceKeys.length !== Object.keys(bag).length) return false;
-		return sourceKeys.every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
+		return Object.keys(source).every((k) => Object.hasOwn(bag, k) && anchorsCorroboratePairing(bag[k], source[k], anchors));
 	}
 	if (Array.isArray(source)) {
 		if (!Array.isArray(bag) || bag.length !== source.length) return false;
@@ -11398,6 +11411,394 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 	return true;
 }
 /**
+* Marks a position one of the POSITION passes DECIDED, in the parallel tree
+* {@link refuseUncertifiedReadbackPositions} builds when asked to `mark`.
+*
+* A SENTINEL rather than a value comparison, and that distinction was a
+* security blocker on PR #2415. {@link preferPositionDecisions} first inferred
+* "not decided" from `refused === bag`, which cannot tell an UNDECIDED position
+* from one the pass decided IN FAVOUR of the value already there. Two shapes
+* hit it, both fabricating a baseline `cdkd drift --revert` then pushes:
+*
+* - the resolver's unsupported-service arm leaves an `{{resolve:ssm-secure:`
+*   token LITERAL, so AWS echoes it back and the source leaf EQUALS the bag
+*   leaf. The string arm returns `source` — a decision — and the equality made
+*   it look like no decision at all. (A BARE such token takes the whole-token
+*   arm and one embedded in text takes the mixed-leaf arm; both decide, and
+*   both were misread.)
+* - the empty-map arm that deliberately KEEPS a leaf returns `bag` by design.
+*
+* A symbol cannot be produced by any walk of JSON, so no readback value can
+* impersonate it.
+*/
+const POSITION_DECIDED = Symbol("position decided by a position pass");
+/**
+* Record one (plaintext -> expression) pair, or strike the plaintext out.
+*
+* Below {@link MIN_NEEDLE_LENGTH} nothing is recorded, and this floor DECIDES
+* rather than mirrors. {@link buildNeedleRegex} applies the same threshold, so
+* a short needle is dropped from the SUBSTRING arm either way — but the value
+* scan's other arm is a WHOLE-VALUE lookup (`secrets.get(leaf)`) that matches
+* at ANY length, so without this line a two-character derived plaintext would
+* still rewrite every leaf equal to it. That is the false redaction with a
+* blast radius {@link expressionMaySeedANeedle} exists to bound, arriving by
+* length instead of by provenance: a public config value of `us` or `dev` is
+* exactly the kind of short plaintext a readback carries in a dozen unrelated
+* fields.
+*/
+function learnNeedle(collector, plaintext, expression) {
+	if (plaintext.length < 4) return;
+	if (collector.poisoned.has(plaintext)) return;
+	if (expressionSecretIsInferred(expression)) collector.inferred.add(plaintext);
+	const already = collector.needles.get(plaintext);
+	if (already === void 0) {
+		collector.needles.set(plaintext, expression);
+		return;
+	}
+	if (already === expression) return;
+	collector.needles.delete(plaintext);
+	collector.poisoned.add(plaintext);
+}
+/**
+* The `{{resolve:<service>:` prefixes whose resolved value IS a secret,
+* whatever the parameter or secret is called.
+*
+* `ssm` is in the list and `ssm-secure` is spelled separately, because
+* `startsWith('{{resolve:ssm:')` is FALSE for `{{resolve:ssm-secure:` — the
+* next character is `-`. The two are disjoint tests, not one with a prefix
+* relationship, which is the trap `mixedLeafMayCarryPublicReference`'s own
+* comment already records from the other direction.
+*/
+const SECRET_BEARING_REFERENCE_PREFIXES = [
+	"{{resolve:secretsmanager:",
+	"{{resolve:ssm-secure:",
+	"{{resolve:ssm:"
+];
+/**
+* The prefixes whose SPELLING settles secret-ness, with no lookup and no
+* inference — the subset of {@link SECRET_BEARING_REFERENCE_PREFIXES} that
+* {@link expressionSecretIsInferred} treats as certain.
+*
+* An ALLOWLIST rather than "the admission list minus `{{resolve:ssm:`", and the
+* difference is what happens to the NEXT entry someone adds. Subtracting makes a
+* new prefix default to CERTAIN, i.e. to the WIDER blast radius, which is the
+* wrong direction to fail in; listing makes it default to inferred until someone
+* deliberately promotes it.
+*/
+const SPELLED_SECRET_REFERENCE_PREFIXES = ["{{resolve:secretsmanager:", "{{resolve:ssm-secure:"];
+/**
+* Is this expression's secret-ness INFERRED rather than spelled?
+*
+* SPELLING, and ONLY spelling. `secretsmanager:` and `ssm-secure:` say what they
+* are, in a way that is true in every region and every account. A bare
+* `{{resolve:ssm:` token is not: it is accepted as secret-bearing on the #1901
+* premise (a public `String` is persisted RESOLVED, so a token SURVIVING in a
+* state bag is a `SecureString`), which is sound for the leaf itself and NOT
+* sound as a licence to rewrite every other leaf that merely CONTAINS the value.
+*
+* A RECORDED verdict deliberately does NOT promote one, even though it is a real
+* `GetParameter` answer. {@link recordedSecretExpressions} is keyed on the bare
+* expression and lives for the whole process, so on a `cdkd deploy --all` a
+* verdict pinned where the parameter is a `SecureString` is inherited where it
+* is a plain `String` — and the `skipDynamicReferences` diff path skips the
+* lookup on a `true` verdict, so the second region never retracts it. That is
+* the SAME region blindness this PR withdrew issue #2036's public store for; a
+* secret-direction verdict is safe to inherit for ADMISSION (it can only
+* over-redact a leaf) and is not safe for BLAST RADIUS. The cost of ignoring it
+* here is the substring arm for a verdict-backed, same-region ssm
+* `SecureString` on the empty-map path — a strict subset of the population the
+* no-verdict case already concedes, and in the same direction.
+*
+* The difference is a `--revert` WRITE. Measured on this module: a bare `ssm`
+* token whose value is `production` turned `my-production-logs` into
+* `my-{{resolve:ssm:/app/env}}-logs`, exactly the failure
+* {@link expressionMaySeedANeedle}'s own doc names — and if that parameter is in
+* fact public, the baseline now holds a value AWS never reported, which `cdkd
+* drift --revert` re-resolves and pushes, renaming the live bucket the day the
+* parameter changes.
+*
+* So evidence strength decides BLAST RADIUS, not admission: an inferred needle
+* still closes issue #2012's two rows, because both are WHOLE-VALUE positions
+* (an unpaired element and an observed key both hold the plaintext and nothing
+* else). Only the substring arm is withheld. Issue #2036's withdrawn verdict
+* store is what would promote these to certain; until it returns, scoped by
+* region and account, this is the honest bound.
+*/
+function expressionSecretIsInferred(expression) {
+	return !SPELLED_SECRET_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+/**
+* May this expression's resolved value be used as a REDACTION NEEDLE?
+*
+* A stricter question than "may this expression be persisted at this position",
+* which is what `trustAnyExpression` answers, and the difference is the whole
+* reason this predicate exists. Persisting a source leaf VERBATIM is bounded to
+* that one position; promoting the value it replaced to a needle rewrites EVERY
+* leaf in the record that equals it, so a wrong answer here is a false
+* redaction with a blast radius rather than a mislabelled leaf.
+*
+* Two classes, and each was measured rather than reasoned about:
+*
+* - a NON-SECRET SERVICE. `isSingleDynamicReferenceToken` accepts any
+*   `{{resolve:<anything>}}` spelling, and the resolver's unsupported-service
+*   arm WARNS and returns the literal — so AWS holds the token text itself and
+*   the leaf beside it is ordinary data. `cdkd drift`'s own
+*   `--revert does not register a live value for a look-alike spelling` case
+*   pins exactly this for its sibling registration path
+*   (`{{resolve:notaservice:/x}}`), and this predicate is what keeps the two
+*   commands answering it the same way.
+* - a plain `ssm` reference is ACCEPTED, on the same
+*   #1901 premise the whole-token arm one level up already acts on: a public
+*   `String` / `StringList` parameter is persisted RESOLVED, so a
+*   `{{resolve:ssm:` token SURVIVING in a persisted state bag is a
+*   `SecureString` by construction. Requiring a recorded verdict instead would
+*   make the needle unavailable on `cdkd state refresh-observed`, whose process
+*   resolves nothing and therefore records nothing — i.e. it would fail exactly
+*   where issue #2012 is reported. A PROVEN-public verdict would refine this,
+*   and issue #2036's store was to supply one; PR #2415 withdrew it as a
+*   cross-region disclosure, so a genuinely public parameter's resolved value
+*   CAN still seed a needle here. Bounded by the per-record scope and by
+*   {@link MIN_NEEDLE_LENGTH}, and visible as over-redaction rather than as a
+*   leak.
+*/
+function expressionMaySeedANeedle(expression) {
+	return isRecordedSecretExpression(expression) || SECRET_BEARING_REFERENCE_PREFIXES.some((prefix) => expression.startsWith(prefix));
+}
+/**
+* Learn from a position whose SOURCE is a WHOLE `{{resolve:...}}` token.
+*
+* This is the strongest needle available on a readback path, and it asserts
+* nothing the walk was not already asserting: the caller is about to persist
+* `expression` OVER `bag` at this very position, which is the claim that `bag`
+* is that expression's resolved value. Reading the same claim back out as a
+* needle is free.
+*
+* TWO refusals, both narrow and both necessary:
+*
+* - a bag leaf that is ITSELF a complete token is not a plaintext at all. It is
+*   a record that was already redacted (a re-scrub, a second
+*   `refresh-observed`), and pairing it with itself would put a `{{resolve:...}}`
+*   string in the needle set, where the value scan's own token guard would then
+*   have to keep stepping over it.
+* - a token that does not name a SECRET-BEARING reference at all — see
+*   {@link expressionMaySeedANeedle}.
+*/
+function learnWholeTokenNeedle(collector, bag, source) {
+	if (isSingleDynamicReferenceToken(bag)) return;
+	if (!expressionMaySeedANeedle(source)) return;
+	learnNeedle(collector, bag, source);
+}
+/**
+* Learn from a MIXED leaf — a reference embedded in surrounding text, which
+* this module calls the DOMINANT CDK shape (an `Fn::Join` around
+* `secret.secretValueFromJson(...)`).
+*
+* The caller is about to persist `source` over `bag`, i.e. it has already
+* decided the two are the same leaf one resolution apart. Extracting the
+* plaintext is then arithmetic rather than inference, PROVIDED the extraction
+* is unambiguous, which is what the guards below establish:
+*
+* - EXACTLY ONE span. With two references the text between them cannot be
+*   split between the two resolved values without guessing. This one is
+*   CONSERVATIVE rather than a correctness guard, and saying so is what stops
+*   the next reader treating it as load-bearing: with two RESOLVED references
+*   the frame check below refuses independently, because the computed SUFFIX
+*   would then contain a whole `{{resolve:...}}` token and a resolved readback
+*   cannot end with one. The shape it genuinely decides is a second reference
+*   that survives LITERALLY in the readback — the resolver's
+*   unsupported-service arm (`ssm-secure:`) produces exactly that — where the
+*   extraction would in fact be right and is declined anyway. Measured: a
+*   both-resolved fixture leaves this line unfenced.
+* - the source's literal PREFIX and SUFFIX must both be present at the ends of
+*   the bag. That is what proves the leaf really is this source resolved; AWS
+*   normalising any of the surrounding text refuses instead of yielding a
+*   needle sliced at the wrong offsets.
+* - the two must not overlap, and something must remain between them.
+*
+* Anchoring at the ENDS rather than searching is deliberate: a secret whose own
+* text repeats the suffix (`abc@h` inside `postgres://u:abc@h@h`) still slices
+* correctly, while an `indexOf` scan would cut it short.
+*/
+function learnMixedLeafNeedle(collector, bag, source) {
+	const spans = dynamicReferenceSpans(source);
+	if (spans.length !== 1) return;
+	const [span] = spans;
+	const token = source.slice(span.start, span.end);
+	if (!expressionMaySeedANeedle(token)) return;
+	const prefix = source.slice(0, span.start);
+	const suffix = source.slice(span.end);
+	if (bag.length <= prefix.length + suffix.length) return;
+	if (!bag.startsWith(prefix) || !bag.endsWith(suffix)) return;
+	const plaintext = bag.slice(prefix.length, bag.length - suffix.length);
+	if (isSingleDynamicReferenceToken(plaintext)) return;
+	learnNeedle(collector, plaintext, token);
+}
+/**
+* Read the mark tree one level down. It has the SAME shape as `refused` by
+* construction (one function, one set of inputs), but this stays defensive: a
+* missing level yields `undefined`, which reads as "not decided" and therefore
+* lets the scan act. That is the same answer the pre-mark code gave, so a shape
+* surprise cannot silently start SUPPRESSING redaction — but it fails toward
+* SCANNING, which is the fabrication direction the mark tree exists to stop.
+* Both are stated because neither default is free; the shapes are identical by
+* construction (one function, one set of inputs), so this arm is a backstop
+* rather than a policy.
+*/
+function asChild(marks, key) {
+	return isPlainObject$2(marks) && hasPlainPrototype(marks) ? marks[key] : void 0;
+}
+/** The array-arm twin of {@link asChild}; same fail-open, same reason. */
+function asIndex(marks, index) {
+	return Array.isArray(marks) ? marks[index] : void 0;
+}
+/**
+* Merge the DERIVED-needle value scan back over the two POSITION passes, so the
+* scan can only ever ADD a rewrite and never EDIT one.
+*
+* WHY THIS EXISTS AT ALL. Issue #2012's fix has been through both orderings and
+* each has its own way of turning a redaction fix into a fabricated baseline —
+* the two are mirror images, which is why the answer is a merge rather than a
+* third choice of order:
+*
+* - SCAN FIRST (the first revision): a needle rewrites a frame LITERAL that
+*   happens to embed a learned plaintext, {@link unkeyedArrayPairsByAnchors} is
+*   then re-run against the SCANNED bag, the anchor no longer deep-equals its
+*   source, the whole array refuses, and a sibling MIXED leaf that position
+*   ALREADY redacted persists in plaintext. Under-redaction.
+* - SCAN LAST, unrestricted (the second): the scan now runs over leaves whose
+*   content came from the SOURCE. A needle occurring in the literal FRAME of a
+*   source-taken mixed leaf is replaced, so
+*   `postgres://appuser:{{resolve:secretsmanager:...}}@h/db` becomes
+*   `postgres://{{resolve:ssm:/app/db-user}}:{{resolve:...}}@h/db` when
+*   `appuser` is also some whole-token position's resolved value — a reference
+*   the template never had at that offset. `cdkd drift --revert` re-resolves the
+*   baseline before pushing it, so once that parameter's value changes the
+*   revert writes a DIFFERENT user to the live resource. Fabricated baseline,
+*   which is the bar {@link refuseUncertifiedReadbackPositions} refuses to break
+*   at its own bottom.
+*
+* THE RULE. A position the passes DECIDED is theirs; a position they left alone
+* belongs to the scan. Expressed as a walk over their OUTPUT rather than as a
+* second copy of their pairing logic, because a mirror of `identityKeyFor` /
+* `unkeyedArrayPairsByAnchors` would drift from the original and a needle
+* applied at a MIS-paired position is a false redaction everywhere it matches.
+* The shapes line up position-for-position for free: neither pass adds a key,
+* an element, or a scalar-over-container, so `refused` is `bag`'s own shape with
+* some leaves replaced.
+*
+* `typeof bag === 'string'` at the leaf: a derived needle can only ever rewrite
+* a STRING, so for every other leaf the two answers agree and taking `refused`
+* is free.
+*
+* KEEPING A NON-PLAIN LEAF INTACT takes the prototype guard on the object arm,
+* NOT that leaf rule, and an earlier revision of this comment claimed the
+* opposite — measured wrong. The scan's own walk rebuilds objects and turns a
+* `Date` the provider readback carries (`LastModified`) into `{}`; that
+* flattening predates this module's derived needles on the POPULATED-map path
+* (issue #2427). The object arm runs FIRST here and `isPlainObject` admits a
+* `Date`, so without `hasPlainPrototype` this walk did the flattening ITSELF —
+* newly extending #2427 to the EMPTY-map path, where the unchanged-resource
+* `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
+* the result to the live resource. With the guard a non-plain leaf falls
+* through to `refused`. That is the position passes' own answer — usually the
+* bag by identity, though NOT universally: their object arm has no prototype
+* guard of its own, so a non-plain leaf whose source subtree carries a
+* reference is already flattened one function earlier. Same defect as issue
+* #2427, one layer up, and out of this lane's scope.
+*
+* The net effect is byte-identical to the FIRST ordering on every input where
+* the un-certification did not fire — which is the whole point: it keeps that
+* ordering's intent and drops only its defect.
+*/
+function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(refused) && isPlainObject$2(scanned)) {
+		const out = Object.create(null);
+		for (const [k, v] of Object.entries(refused)) out[k] = preferPositionDecisions(scanned[k], v, bag[k], asChild(marks, k), inferred);
+		return out;
+	}
+	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
+	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
+	return scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+}
+/**
+* DERIVED NEEDLES (issue [#2012](https://github.com/go-to-k/cdkd/issues/2012)):
+* the secrets map an empty-map readback path can build from its OWN two bags,
+* with no resolution, no AWS call and no new permission.
+*
+* THE PROBLEM THIS ANSWERS. On the readback paths the secrets map is empty by
+* construction (nothing was resolved), so the value scan has no needles and
+* POSITION is the only mechanism. Two shapes have no position to argue from and
+* kept their plaintext: an UNPAIRED array element beside a paired one, and an
+* observed KEY the source does not carry. Both are places {@link redactByPath}
+* ALREADY delegates to the value scan — it is the scan that had nothing to say.
+*
+* WHAT MAKES A NEEDLE AVAILABLE WITHOUT FETCHING. The same record almost always
+* carries the same secret at a position the pass DOES certify: the paired
+* sibling, the key the source does carry. Certifying such a position IS the
+* assertion that AWS's value there is that expression's resolved form — the
+* pass acts on it by persisting the expression over it. Reading that assertion
+* back out gives a plaintext, and a plaintext is exactly what the value scan
+* was missing. Issue #2012's own direction was to RESOLVE the record's
+* expressions to get one, which would have made `cdkd state refresh-observed`
+* and every deploy's observed capture FETCH secrets: a new IAM requirement, a
+* new failure mode and a new place plaintext lives. None of that is needed —
+* AWS already handed us the plaintext, in the very bag being redacted.
+*
+* `redactByPath`'s own comment argued the opposite direction and was right
+* about it: seeding the scan from the SOURCE's expressions cannot work, because
+* a scan needs PLAINTEXT needles. This seeds it from the BAG's values, which is
+* the half that exists.
+*
+* SCOPE, and why each bound is where it is:
+*
+* - ONLY the readback-projected rules. Every other caller either has a real map
+*   or has a source of a different generation, where a value learned from one
+*   generation must not rewrite the other.
+* - ONLY when the map is EMPTY, and this bound is load-bearing for a reason
+*   that is not obvious: {@link crossStackAssociations} and
+*   {@link nestedStackParameterExpressions} are `WeakMap`s keyed by the
+*   RecordedSecretValues INSTANCE, so handing the pipeline a different Map
+*   object would silently lose every association that pass recorded. With an
+*   empty map there are none to lose (an association is only ever recorded for
+*   a plaintext that map holds).
+* - the pairs are scoped to ONE record, exactly as `perResourceSecrets` is on
+*   the deploy path, so one resource's secret can never rewrite another's
+*   coinciding literal.
+*
+* WHERE THE RESULT IS APPLIED, and this is a SEQUENCING claim rather than a
+* scoping one: the returned map is handed to a plain VALUE pass over the RAW
+* bag, whose result is then MERGED over the output of both position passes by
+* {@link preferPositionDecisions}. It reaches neither position pass. Both naive
+* orderings are wrong and that function's doc has the measurements: scanning
+* FIRST lets a needle rewrite a frame LITERAL and un-certify an anchor pairing
+* (under-redaction), scanning LAST over their output lets one rewrite a literal
+* inside a leaf they took from SOURCE (a fabricated baseline). The merge is what
+* makes "a derived needle can only ADD rewrites" literally true.
+*
+* Returns `undefined` when nothing is learned, so the no-secret path skips the
+* scan and the merge entirely and stays byte-identical to the position passes'
+* own output.
+*/
+function deriveReadbackNeedles(bag, source, secrets, rules) {
+	if (!isReadbackProjectedFromState(rules)) return void 0;
+	if (secrets.size > 0) return void 0;
+	if (!subtreeHasDynamicReference(source)) return void 0;
+	const collector = {
+		needles: /* @__PURE__ */ new Map(),
+		poisoned: /* @__PURE__ */ new Set(),
+		inferred: /* @__PURE__ */ new Set()
+	};
+	refuseUncertifiedReadbackPositions(bag, source, secrets, collector);
+	if (collector.needles.size === 0) return void 0;
+	const certain = /* @__PURE__ */ new Map();
+	const inferred = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of collector.needles) (collector.inferred.has(plaintext) ? inferred : certain).set(plaintext, expression);
+	return {
+		certain,
+		inferred
+	};
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -11482,39 +11883,59 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 * --revert` pushes the BASELINE to AWS, so a masked baseline would write the
 * literal `***` onto the live resource (the issue #1498 / #1501 class).
 *
-* KNOWN RESIDUAL, the last row: an observed KEY the source object does not
-* carry has no source leaf to take and no needle to match. It is NOT refused
-* the way an unpaired array ELEMENT is, and the asymmetry is deliberate rather
-* than an oversight — an extra array element is a PEER of the secret-bearing
-* ones (another `Environment` entry), so suspicion is warranted and extras are
-* rare, while an extra object KEY is a different FIELD entirely (`Runtime`,
-* `FunctionArn`, `LastModified`) and is the NORM in an AWS readback. Refusing
-* those would empty the drift baseline of every secret-bearing resource.
-* Tracked as issue [#2012](https://github.com/go-to-k/cdkd/issues/2012).
-*/
-function refuseUncertifiedReadbackPositions(bag, source, secrets) {
+* The last two rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
+* #2012) — see {@link deriveReadbackNeedles}. Neither has a position to argue
+* from: an unpaired array element and an observed KEY the source does not carry
+* are both positions with no source leaf to take. What they never lacked was a
+* VALUE — the same plaintext usually sits at a position this pass DOES certify,
+* and certifying it is already an assertion that the value is that expression's
+* resolved form. Reading that assertion back out as a needle turns the value
+* scan on for the rest of the record without resolving anything.
+*
+* The extra-KEY asymmetry stays as it was and is worth restating, because the
+* needle does not replace it: an extra array element is a PEER of the
+* secret-bearing ones (another `Environment` entry), while an extra object KEY
+* is a different FIELD entirely (`Runtime`, `FunctionArn`, `LastModified`) and
+* is the NORM in an AWS readback. Refusing those wholesale would empty the
+* drift baseline of every secret-bearing resource, which is why they are
+* value-scanned rather than refused.
+*
+* `learn` is the LEARN PASS's collector and is `undefined` on the substituting
+* pass. It changes NO verdict — every branch below decides exactly what it
+* decided before — it only records the (plaintext, expression) pairs the
+* certified positions establish. Deriving them through this function rather
+* than a second walk is deliberate: the pairing rules (identity keys, anchor
+* corroboration, the refusals) are subtle enough that a mirror of them would
+* drift, and a needle learned from a MIS-paired position is a false redaction
+* everywhere it then matches.
+*/
+function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
-		if (isSingleDynamicReferenceToken(source)) return source;
-		if (mixedLeafMayCarryPublicReference(source, secrets)) return bag;
-		return source;
+		if (isSingleDynamicReferenceToken(source)) {
+			if (learn) learnWholeTokenNeedle(learn, bag, source);
+			return mark ? POSITION_DECIDED : source;
+		}
+		if (mixedLeafMayCarryPublicReference(source, secrets)) return mark ? POSITION_DECIDED : bag;
+		if (learn) learnMixedLeafNeedle(learn, bag, source);
+		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
 	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets) : v;
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, learn, mark) : v;
 		return out;
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key === void 0) {
 			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets));
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, learn, mark));
 		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
 		return bag.map((item) => {
 			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets);
+			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets, learn, mark);
 		});
 	}
 	return bag;
@@ -11532,7 +11953,12 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	if (secrets.size === 0 && source === void 0) return bag;
 	if (source !== void 0) {
 		const positioned = redactByPath(bag, source, secrets, rules, new Set(secrets.values()));
-		return isReadbackProjectedFromState(rules) ? refuseUncertifiedReadbackPositions(positioned, source, secrets) : positioned;
+		if (!isReadbackProjectedFromState(rules)) return positioned;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
+		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
+		if (derived === void 0) return refused;
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
+		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(secrets.keys());
 	const wholeValueExpr = (s) => s === "" ? void 0 : secrets.get(s);
@@ -20729,7 +21155,7 @@ var CloudControlProvider = class {
 		await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D3bSjRiw.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-sRJzRAe_.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -32718,4 +33144,4 @@ var DeployEngine = class {
 
 //#endregion
 export { maskerOrIdentity as $, CFN_TEMPLATE_BODY_LIMIT as $n, maskSecretsInText as $t, renderStatefulReason as A, describeAwsFailure as An, PartialFailureError as Ar, requireConfigString as At, exportAliasCollisionScrubWarning as B, Synthesizer as Bn, normalizeAwsError as Br, INTRINSIC_KEYS as Bt, isFinalSnapshotError as C, getBootstrapMarkerKey as Cn, DynamicReferenceRegionAmbiguousError as Cr, coerceCfnBoolean as Ct, extractDeploymentEventError as D, validateAssetBucketName as Dn, LockError as Dr, replayWarn as Dt, makeCanonicalizePropertiesFn as E, readBootstrapMarkerBody as En, LocalStartServiceError as Er, readConfigString as Et, green as F, partitionSensitiveEnv as Fn, StackTerminationProtectionError as Fr, s3BucketDualStackDomainName as Ft, IAMRoleProvider as G, resolveAutoAssetStorage as Gn, isTransientServerError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, secretBearingStateKeyWarning as H, getDefaultStateBucketName as Hn, isMarkedNonRetryable as Hr, withRetry as Ht, red as I, runDockerForeground as In, StateError as Ir, s3BucketRegionalDomainName as It, ProviderRegistry as J, resolveStateBucketWithDefault as Jn, retryClassificationText as Jr, createSecretMasker as Jt, collectInlinePolicyNamesManagedBySiblings as K, resolveCaptureObservedState as Kn, markNonRetryable as Kr, STATE_SOURCED_READBACK_RULES as Kt, yellow as L, runDockerStreaming as Ln, SynthesisError as Lr, s3BucketWebsiteUrl as Lt, bold as M, dockerSpawnEnvWithSensitive as Mn, ResourceTimeoutError as Mr, producerRegionsFromState as Mt, cyan as N, formatDockerLoginError as Nn, ResourceUpdateNotSupportedError as Nr, s3BucketArn as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, validateContainerRepoName as On, MissingCdkCliError as Or, requireConfigArray as Ot, gray as P, getDockerCmd as Pn, StackHasActiveImportsError as Pr, s3BucketDomainName as Pt, maskDeep as Q, warnDeprecatedNoPrefixCliFlag as Qn, maskSecretsInError as Qt, collectDeclaredOutputNames as R, AssetManifestLoader as Rn, formatError as Rr, applyRoleArnIfSet as Rt, createPreDeleteFinalSnapshot as S, ensureAssetStorage as Sn, DeployCancelledError as Sr, assertRegionMatch as St, unsupportedFinalSnapshotError as T, parseBootstrapMarker as Tn, LocalMigrateError as Tr, configStringRefusal as Tt, stateKeySecretExposure as U, getLegacyStateBucketName as Un, isRetryableTransientError as Ur, DagBuilder as Ut, isExportAliasCollision as V, synthesisStatusMessage as Vn, withErrorHandling as Vr, describeTypeWithThrottleRetry as Vt, getCurrentResourceSecrets as W, resolveApp as Wn, isThrottlingError as Wr, TemplateParser as Wt, findSilentDropProperties as X, resolveUseCdkBootstrapAssets as Xn, errorCauseChain as Xt, findActionableSilentDrops as Y, resolveStateBucketWithDefaultAndSource as Yn, __exportAll as Yr, dynamicReferenceTokens as Yt, createMaskedRetryLogger as Z, stateBucketExistenceConfirmed as Zn, isSingleDynamicReferenceToken as Zt, computeImplicitDeleteEdges as _, escapeRegExp$1 as _n, AssetError as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, rebuildClientForBucketRegion as an, expectedOwnerParam as ar, isInterruptedWaitError as at, buildFinalSnapshotIdentifier as b, BOOTSTRAP_MARKER_PREFIX as bn, CrossAccountSecretRefusalError as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, importableOutputs as cn, derivePartitionAndUrlSuffix as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, stringifyValue as dn, clearBucketRegionCache as dr, IntrinsicFunctionResolver as dt, redactSecretsForState as en, CFN_TEMPLATE_URL_LIMIT as er, CUSTOM_RESOURCE_RESPONSE_PREFIX as et, UNSPECIFIED_SKIP_REASON as f, WorkGraph as fn, resolveBucketRegion as fr, carriesDynamicReference as ft, IMPLICIT_DELETE_DEPENDENCIES as g, rewriteTemplateAssetReferences as gn, setAwsClients as gr, isUnboundTemplateParameter as gt, maskingRetryLogger as h, loadPublishableAssetManifest as hn, resetAwsClients as hr, getAccountInfo as ht, DeploymentEventsReader as i, S3StateBackend as in, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as ir, interruptWatchListenerCount as it, formatResourceLine as j, buildDockerImage as jn, ProvisioningError as jr, classifyReplaySecretRegion as jt, isStatefulRecreateTargetSync as k, buildDenyExternalAccessPolicy as kn, NestedStackChildDirectDestroyError as kr, requireConfigObject as kt, replayRollback as l, shouldRetainResource as ln, AssemblyReader as lr, disableInstanceApiTermination as lt, withResourceDeadline as m, createAssetRedirectResolver as mn, getAwsClients as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, LockManager as nn, findLargeInlineResources as nr, beginCommandInterruptScope as nt, planFailedOps as o, exportNamesCarriedFrom as on, PARTITION_TABLE as or, startInterruptWatch as ot, deleteSkipReason as p, buildAssetRedirectMap as pn, AwsClients as pr, cfnRefValueFromPhysicalId as pt, clearOnUpdateRemoval as q, resolveSkipPrefix as qn, markRedactedCause as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, displaySafe as rn, uploadCfnTemplate as rr, endCommandInterruptScope as rt, planRollback as s, importableOutputKeys as sn, canonicalizeRegion as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, scrubResourceRecord as tn, MIGRATE_TMP_PREFIX as tr, DEFAULT_STATE_PREFIX as tt, updatePartialMessage as u, AssetPublisher as un, processStackMessages as ur, isTerminationProtectionPropagationError as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, stripControlChars as vn, CdkdError as vr, refStateLookupFromResource as vt, refusesFinalSnapshot as w, isCrossRegionRedirect as wn, LocalInvokeBuildError as wr, configBooleanRefusal as wt, ccRoutedFinalSnapshotError as x, assertAssetBucketRegion as xn, DependencyError as xr, resolveExplicitPhysicalId as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetModeResolver as yn, ConfigError as yr, WAFv2WebACLProvider as yt, collectPublishedOutputNames as z, getDockerImageBySourceHash as zn, isCdkdError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-3lJaFGjA.js.map
+//# sourceMappingURL=deploy-engine-3EmPzxSN.js.map