@go-to-k/cdkd 0.288.2 → 0.288.4

package/dist/{deploy-engine-Cxt3gn8N.js → deploy-engine-BiPxTgKT.js}

@@ -1,8 +1,8 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BRByznpy.js";
+import { t as getCdkdVersion } from "./version-BmM4QJ9t.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
@@ -4017,6 +4017,18 @@ async function expectedOwnerParam(client) {
 * A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
 * should pass `asciiOnly`, which is a positive allowlist and therefore has no
 * such residual at all.
+*
+* ONE CALLER DELIBERATELY GOES WIDER, and it is recorded here so an editor of
+* the residual note above knows a second module now disagrees with it.
+* `src/deployment/outputs-export-alias.ts` deletes a class derived from
+* `\p{Cc}` / `\p{Cf}` / `\p{Zl}` / `\p{Zp}` /
+* `\p{Default_Ignorable_Code_Point}`, because on THAT path the subject is a possibly
+* secret-bearing name in an operator's log: a plaintext split by a zero-width
+* character is READ as if it were contiguous, so it is disclosed without any
+* paste, and the command-forgery reasoning above does not transfer (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)). Nothing here changes
+* -- widening this helper would alter every caller that merely wants a
+* terminal-safe string.
 */
 function displaySafe(value, opts) {
 	if (value === void 0 || value === null) return "";
@@ -9101,6 +9113,18 @@ function importableOutputs(state) {
 function exportNamesCarriedFrom(previous) {
 	return previous.exportNames === void 0 ? {} : { exportNames: previous.exportNames };
 }
+/**
+* The `skippedOutputs` field to write when a save carries the PREVIOUS
+* record's `outputs` bag forward instead of re-resolving it (issue #2740). The
+* record describes that bag — which keys the deploy that wrote it could not
+* resolve — so it travels with the bag, exactly like {@link
+* exportNamesCarriedFrom}: absent stays absent, present stays as it was. A
+* writer that re-resolves outputs does NOT call this; it writes the set the
+* resolution produced, or omits the field when nothing was skipped.
+*/
+function skippedOutputsCarriedFrom(previous) {
+	return previous.skippedOutputs === void 0 ? {} : { skippedOutputs: previous.skippedOutputs };
+}
 
 //#endregion
 //#region src/types/rollback-journal.ts
@@ -16687,6 +16711,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			"RoleArn"
 		]),
 		silentDrop: /* @__PURE__ */ new Map([
+			["CapacityProviderConfiguration", "not yet implemented by cdkd"],
 			["FilesystemConfigurations", "not yet implemented by cdkd"],
 			["RequestHeaderConfiguration", "not yet implemented by cdkd"],
 			["Tags", "not yet implemented by cdkd"]
@@ -16805,7 +16830,8 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		silentDrop: /* @__PURE__ */ new Map([
 			["EvaluationCriteria", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
 			["EvaluationInterval", "Absent from both the SDK PutMetricAlarm input and the aws-cdk-lib CfnAlarm L1 (a newer CFn-schema-only property ahead of SDK/CDK support); no wire path to forward it and no CDK app can emit it."],
-			["EvaluationWindow", "not yet implemented by cdkd"]
+			["EvaluationWindow", "not yet implemented by cdkd"],
+			["WarmUpConfiguration", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
@@ -17633,7 +17659,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 	}],
 	["AWS::Glue::Connection", {
 		handled: /* @__PURE__ */ new Set(["CatalogId", "ConnectionInput"]),
-		silentDrop: /* @__PURE__ */ new Map(),
+		silentDrop: /* @__PURE__ */ new Map([["Tags", "not yet implemented by cdkd"]]),
 		createOnlyDrops: /* @__PURE__ */ new Set()
 	}],
 	["AWS::Glue::Crawler", {
@@ -18197,7 +18223,6 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 			["UseLatestRestorableTime", "not yet implemented by cdkd"]
 		]),
 		createOnlyDrops: /* @__PURE__ */ new Set([
-			"AvailabilityZones",
 			"ClusterScalabilityType",
 			"DBSystemId",
 			"EngineMode",
@@ -19897,6 +19922,113 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
+//#endregion
+//#region src/deployment/drain-budget.ts
+/**
+* The drain BUDGET for one intrinsic resolution (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Its own module rather than a corner of `intrinsic-function-resolver.ts`,
+* and that is forced rather than tidy: 70+ unit files `vi.mock` the resolver
+* module, and the ones that REPLACE its exports rather than spreading
+* `...actual` see no new export -- so an opener declared there, whether as a
+* resolver method or as a module-level function, reddens most of
+* `tests/unit/deployment` the moment `deploy-engine.ts` imports it (measured,
+* both ways). A module the engine and the resolver both import, and nobody
+* mocks, is the shape that works.
+*/
+/**
+* Named `drainDeadlines` from when it held one, and kept because the name is
+* cited from several comments and a rename is churn this issue does not need.
+* It holds a {@link DrainBudget} -- remaining WAIT, not an instant.
+*/
+const drainDeadlines = new AsyncLocalStorage();
+/**
+* Run `fn` under ONE drain budget (issue #2563), inheriting the caller's if
+* there is one.
+*
+* A module-level function rather than a resolver METHOD, deliberately: the
+* engine's callers mock the resolver wholesale, and a new method on that
+* surface would make every such mock throw before it resolved anything
+* (measured -- most of `tests/unit/deployment` red).
+*
+* Why a caller needs this. `resolve` opens a budget per CALL, and a caller
+* that resolves in a LOOP therefore gets one cap per iteration: the outputs
+* pass walks `template.Outputs` sequentially, so the DRAIN WAIT it could
+* spend before `saveState`, with the S3 lock held, was `#outputs x` the cap
+* rather than the cap. CloudFormation allows 200 outputs. Wrapping the loop
+* here bounds the total drain WAIT under it at one budget.
+*
+* The budget is REMAINING milliseconds of wait, not a deadline, and that
+* distinction is the whole of it: an absolute deadline is spent by wall
+* clock, so ordinary resolution time between drains burns it although
+* nothing drained -- an output failing with a 5 ms sibling would leave a
+* later one with zero grace after 60 s of clean AWS work. Charged only while
+* a drain is actually waiting, and only once for nested drains whose waits
+* overlap, an iteration that spent nothing keeps its full grace.
+*
+* WHAT IT DOES NOT BOUND, since the cap is not a deadline on the pass: the
+* cap is armed by a REJECTION and bounds only the extra wait a drain takes
+* after one. Ordinary resolution time is outside it entirely -- a lookup
+* that hangs with no sibling rejection anywhere is unbounded here exactly
+* as it was before this issue, and `withResourceDeadline` does not reach
+* the outputs pass. So this wrap bounds aggregate drain grace, not the
+* hold.
+*
+* THE TRADE, stated because it is real: iterations that actually WAIT spend
+* the shared budget, so a later one can find it exhausted and its drain get
+* no grace. That is the same exposure issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814) records for nesting,
+* now reachable across a loop as well -- and on the `Export.Name` leg the
+* cost is a DROPPED write rather than a late one, since that block's
+* `nameSecrets` is a per-iteration local. What bounds it is that only real
+* waiting spends the budget: reaching zero takes a full cap of drain wait
+* inside one pass, not merely a slow pass. It is taken deliberately -- an
+* unbounded hold on a deploy's state save costs a first deploy every
+* resource it just created -- and the caller chooses, since a loop that
+* would rather buy grace per iteration simply does not wrap.
+*
+* `evaluateConditions` deliberately does NOT wrap its loop: a failed
+* condition is downgraded and evaluation continues, it runs before any
+* resource is provisioned, and one condition's slow parts should
+* not spend the next one's budget. Its aggregate is `#conditions x` the cap,
+* with the deploy lock already held -- less severe than the outputs pass,
+* where the state save is the thing waiting, but not lock-free.
+*
+* The other resolve LOOPS in the tree, assessed rather than assumed -- and
+* the first version of this note got two of them wrong, so each is stated
+* with what was checked:
+*
+* - `cdkd scrub` (`scrub.ts`): lock acquired above, `saveState` downstream,
+*   and its resolve loops -- the resources loop, two output loops, and
+*   `resolveCrossStackReads`, a per-leaf loop the other three each invoke.
+*   One budget is hoisted over all of them. That wrap is INLINE rather than
+*   around a callee, so the callee-keyed table in
+*   `intrinsic-resolver-concurrent-drain.test.ts` cannot see it; an
+*   owner-keyed case in that same file fences it instead.
+* - `cdkd import` (`import.ts`): `acquireLock` at the root and per child,
+*   `resolveImportedProperties` loops the resources, `saveState` follows.
+*   WRAPPED at both call sites.
+* - `cdkd export` (`export.ts`): child locks acquired before
+*   `buildResolvedParametersPerStack`, which loops `resolve` over the
+*   intrinsic parameters. WRAPPED.
+* - `diff-recursive.ts`: loops `resolve` over a parent's parameters with no
+*   lock and no state write -- a read-only diff. LEFT per-call, since a
+*   shared budget would buy no safety and would spend one resolution's
+*   grace on the next.
+*
+* The drain is what issue #2563 adds, so the wait in all four is new and
+* bounding it where it can hold something is part of adding it.
+*/
+async function withSharedDrainBudget(fn) {
+	if (drainDeadlines.getStore() !== void 0) return await fn();
+	return await drainDeadlines.run({
+		remaining: void 0,
+		waiting: 0,
+		since: void 0
+	}, fn);
+}
+
 //#endregion
 //#region src/deployment/secret-region-classification.ts
 /**
@@ -22120,6 +22252,170 @@ const MAX_LISTED_AVAILABLE_OUTPUTS = 10;
 */
 const dynamicReferenceRetryDelays = {};
 /**
+* How long {@link allSettledKeepingFirstRejection} waits for the remaining
+* parts AFTER a rejection is in hand. Double the largest FIXED wait in this
+* file (the `Fn::GetAtt` `Ipv6CidrBlocks` poll's sleep budget, 15 attempts
+* x 2 s), which makes it a hang guard rather than a schedule — not a
+* guarantee that healthy work fits inside it; see the function's own note.
+*
+* It is the budget for one CALL of {@link IntrinsicFunctionResolver.resolve}
+* and everything nested under it: nested drains share the REMAINING wait, so
+* a template's nesting depth cannot multiply it. It is NOT a bound on a caller
+* that resolves in a LOOP -- each iteration opens its own budget unless the
+* caller wraps the loop in {@link withSharedDrainBudget}, which the outputs
+* pass does and `evaluateConditions` deliberately does not (its aggregate is
+* `#conditions x` this, before any resource is provisioned but with the
+* deploy lock already held).
+*/
+const DRAIN_AFTER_REJECTION_MS = 6e4;
+/** Sentinel for "the cap expired", distinguishable from any resolved value. */
+const CAP_EXPIRED = Symbol("drain-cap-expired");
+/**
+* Test seam: overriding `ms` lets a unit test drive the cap without a real
+* minute of waiting (mirrors {@link dynamicReferenceRetryDelays}).
+*/
+const concurrentDrainCap = {};
+/**
+* `Promise.all`'s RESULT and its choice of error, with `Promise.allSettled`'s
+* TIMING: every promise started here has settled before this returns, and
+* before it throws unless the cap below expires first (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Why the resolver needs that. Resolving a secret dynamic reference RECORDS
+* `plaintext -> expression` into `context.recordedSecretValues` just before
+* its promise settles, and that map is what every masking and redaction site
+* downstream uses as its needle set. Under a bare `Promise.all` a rejecting
+* part surfaces IMMEDIATELY, so a caller's `catch` / `finally` can run while a
+* sibling part is still in flight: `DeployEngine`'s `Export.Name` block copies
+* its private map into the pass map in exactly such a `finally`, and the
+* sibling's recording then lands in the private map after the copy and reaches
+* nothing. Draining here fixes it for every caller at once, which a
+* consumer-side drain cannot — `cdkd scrub`'s shared-map view (issue
+* [#2531](https://github.com/go-to-k/cdkd/issues/2531)) lets a late write land
+* whenever it happens but still cannot make it land before the next consumer
+* runs.
+*
+* THE ERROR IS SELECTED BY TIME, NOT BY INPUT ORDER, which is what `Promise.all`
+* does and what a naive `Promise.allSettled` + "first rejected entry" would
+* silently change: with two parts rejecting out of input order, the entry scan
+* reports the LATER one. Each promise gets its own `catch`, so the callbacks
+* fire in rejection order and the first assignment wins.
+*
+* Every input is `catch`-ed, so nothing here can raise an unhandled rejection
+* while the drain waits.
+*
+* THE WAIT IS CAPPED ONCE A REJECTION IS IN HAND. The drain exists to let a
+* sibling finish RECORDING, and that is worth a wait — but `resolveOutputs`
+* runs at `deploy-engine.ts`'s worst moment: after every resource has been
+* created in AWS, before the final `saveState`, with the S3 lock held and its
+* heartbeat pushing `expiresAt` forward. An unbounded wait there costs a deploy
+* its state and its lock, and on a FIRST deploy (`currentEtag` undefined, so
+* the incremental saves were no-ops) every created resource becomes invisible
+* to cdkd. Nothing else bounds it: `withRetry` caps ATTEMPTS not duration, no
+* `requestTimeout` is configured, and `withResourceDeadline` wraps
+* `provisionResourceBody` — which does bound the resource path, property
+* resolution included, but not the outputs pass. So once a rejection is
+* recorded the remaining settles race {@link DRAIN_AFTER_REJECTION_MS}, and the
+* recorded rejection is thrown when it expires.
+*
+* The cap is a HANG GUARD, and it does not claim to be more. It is sized
+* against the largest fixed wait in this file — the `Fn::GetAtt`
+* `Ipv6CidrBlocks` poll's sleep budget, 15 attempts x 2 s, about 30 s — but
+* that budget is a floor, not a ceiling: the poll also awaits 15 AWS calls,
+* and one part can drive several lookups in sequence through object
+* properties or `Fn::Sub` variables. Two healthy shapes measured on review
+* already exceed 60 s — three sequential `Ipv6CidrBlocks` polls in one part
+* is 3 x (15 x 2 s) = 90 s with no hang and no throttling, and five throttled
+* dynamic references is 5 x (1+2+4+8 s) = 75 s at
+* `MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES` = 4. Healthy work CAN therefore
+* outlast the cap, and when it does its recording lands after the rejection
+* was released, which is the window this whole function exists to close.
+* Nothing here cancels that sibling — it keeps running and can record
+* arbitrarily later — so what the cap bounds is the WAIT, not the lateness.
+* That is the trade taken deliberately: a bounded wait with a late record
+* still possible beyond it, against an unbounded hold on a deploy's state
+* save.
+*
+* AND A DRAIN CAN GET NO GRACE AT ALL. The budget is shared REMAINING wait,
+* so a drain that arms once it is spent gets
+* `Math.max(0, remaining - openWindow)` = 0 and releases its rejection on the
+* next macrotask. That applies to any drain NOT ALREADY ARMED when a rejection
+* reaches it: the ordinary case is an inner drain that spends the full budget
+* and throws, whose every not-yet-armed ancestor then arms against an
+* exhausted remaining-wait budget. What it does NOT mean is that a fast sibling is exposed: a
+* sibling still pending at that moment has itself been running at least the
+* budget. What it means is that the sibling's own RECORDING gets no wait --
+* a lookup begun late inside a long-running part is fast in itself and still
+* lands after the rejection was released. That reasoning covers the NESTED
+* ancestor case; a caller that wraps a LOOP widens it, because a later
+* iteration starts FRESH siblings against a budget an earlier one already
+* spent and those need not be long-running at all. So the exposure does not
+* require the "healthy work slower than 60 s" shape the sizing paragraph
+* describes; that shape is the cheapest way to reach it with no nesting and
+* no wrapped loop, not the floor.
+* Residual: issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814).
+*
+* ONE REMAINING CONSEQUENCE, deliberate and pinned by a case rather than only
+* described: the earliest-in-time rule holds PER INVOCATION, not across
+* NESTED resolutions. For a join whose parts are `[listWithAnEarlyFailure,
+* laterFailure]`, the inner list's drain holds its own rejection while its
+* slow sibling finishes, so the outer join captures the later failure first
+* and reports that instead. That is not only cosmetic: the retry classifiers
+* DO read the message (`retryClassificationText` feeds
+* `isRetryableTransientError`, whose `RETRYABLE_ERROR_MESSAGE_PATTERNS` is an
+* explicit substring table), so swapping which failure surfaces can swap a
+* transient verdict for a terminal one. What does not change is that the
+* resolution FAILS: both are genuine failures of the same resolve, and the
+* selection was already timing-dependent — `Promise.all` reports whichever
+* lost the race. The drain adds a systematic bias toward the SHALLOWER
+* failure where the old race was arbitrary. Residual: issue
+* [#2805](https://github.com/go-to-k/cdkd/issues/2805).
+*/
+async function allSettledKeepingFirstRejection(promises) {
+	let rejection;
+	const shared = drainDeadlines.getStore();
+	let armCap;
+	const guarded = promises.map((promise) => promise.catch((error) => {
+		if (rejection === void 0) {
+			rejection = { error };
+			armCap?.();
+		}
+	}));
+	let capTimer;
+	let charged = false;
+	const capped = new Promise((resolve) => {
+		armCap = () => {
+			const budget = concurrentDrainCap.ms ?? DRAIN_AFTER_REJECTION_MS;
+			let wait = budget;
+			if (shared !== void 0) {
+				shared.remaining ??= budget;
+				const openWindow = shared.since === void 0 ? 0 : Date.now() - shared.since;
+				wait = Math.max(0, shared.remaining - openWindow);
+				if (shared.waiting === 0) shared.since = Date.now();
+				shared.waiting += 1;
+				charged = true;
+			}
+			capTimer = setTimeout(() => resolve(CAP_EXPIRED), wait);
+		};
+	});
+	try {
+		const outcome = await Promise.race([Promise.all(guarded), capped]);
+		if (rejection !== void 0) throw rejection.error;
+		if (outcome === CAP_EXPIRED) throw markNonRetryable(/* @__PURE__ */ new Error("drain cap expired with no rejection recorded"));
+		return outcome;
+	} finally {
+		if (capTimer !== void 0) clearTimeout(capTimer);
+		if (charged && shared !== void 0) {
+			shared.waiting -= 1;
+			if (shared.waiting === 0 && shared.since !== void 0) {
+				shared.remaining = Math.max(0, (shared.remaining ?? 0) - (Date.now() - shared.since));
+				shared.since = void 0;
+			}
+		}
+	}
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -23022,7 +23318,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Resolve all intrinsic functions in a value
 	*/
 	async resolve(value, context) {
-		return await this.resolveValue(value, context);
+		return await withSharedDrainBudget(() => this.resolveValue(value, context));
 	}
 	/**
 	* Evaluate all conditions in the template
@@ -23064,7 +23360,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		};
 		for (const name of Object.keys(templateConditions)) try {
-			await evaluateByName(name);
+			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
 			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
@@ -23080,7 +23376,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await Promise.all(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
@@ -23693,6 +23989,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "ApiId": return physicalId;
 			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
+			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
+			case "ApiId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
 			case "Id": return physicalId;
@@ -23902,7 +24203,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
-		let result = (await Promise.all(values.map(async (v) => {
+		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
 		}))).join(delimiter);
@@ -26642,7 +26943,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DUlRn84u.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-TexsJufw.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31119,6 +31420,134 @@ function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
 */
 const MIN_SECRET_NEEDLE = 4;
 /**
+* Characters deleted before any secret containment test on this path, and
+* deleted from the text that gets PRINTED — ONE class, because the verdict and
+* the printed text have to live in the same string space (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)).
+*
+* WHY A THIRD CLASS RATHER THAN EITHER SANITISER'S. `stripControlChars`
+* DELETES its class; `displaySafe` REPLACES its own with a space. Composing
+* them — which is what every site here used to do — leaves three different
+* strings in play: the raw key the verdict was taken from, the sanitised key
+* that was printed, and the masked one in between. A recorded secret split by
+* a DELETED character is absent from the raw key and contiguous in the printed
+* one, so the verdict said `safe` over text that held the plaintext; a secret
+* split by a REPLACED one is absent from both and prints one character short
+* of the plaintext, which a `not.toContain(SECRET)` assertion cannot see.
+* Measured across both classes: eight of ten characters reconstituted the
+* secret verbatim, and the remaining two printed it minus one character.
+*
+* So the fix is not another arm on the check — it is removing the second and
+* third string. Everything below happens in `canonicalForSecretScan` space.
+*
+* THE CLASS IS DERIVED FROM UNICODE CATEGORIES, NOT ENUMERATED. A hand list
+* was written first -- both sanitisers' classes plus the four residuals
+* `display-safe.ts` names -- and review measured it arbitrary: `U+2060`
+* (WORD JOINER) verdicted `safe` and printed visibly-contiguous plaintext
+* while `U+FEFF` was caught, and `U+2060` is the character Unicode itself
+* designates as the replacement for `U+FEFF` in that role. Eight more did the
+* same (`U+00AD`, `U+180E`, `U+FE0F`, `U+3164`, `U+2061`, `U+FFFB`, `U+115F`,
+* `U+17B4`). A list of the invisibles somebody happened to think of is not a
+* boundary; the general categories are.
+*
+* - `\p{Cc}` control and `\p{Cf}` format: the C0 / C1 and DEL ranges, the bidi
+*   marks / embeddings / overrides / isolates, the zero-width set, `U+FEFF`,
+*   `U+00AD`, `U+061C`, and the invisible-operator block.
+* - `\p{Zl}` / `\p{Zp}`: `U+2028` / `U+2029`, the two `displaySafe` REPLACES.
+* - `\p{Default_Ignorable_Code_Point}`: Unicode's own INTENT-TO-BE-IGNORED
+*   property, which carries the variation selectors, the Mongolian free
+*   variation selectors, the Hangul fillers and `U+034F` COMBINING GRAPHEME
+*   JOINER.
+*
+* - `\p{Me}` ENCLOSING marks. The same zero-advance-width shape as `\p{Mn}`
+*   below, and INCLUDED rather than deferred because the cost argument that
+*   defers `\p{Mn}` does not transfer: `\p{Me}` is about a dozen code points
+*   with no legitimate use in a resource name.
+*
+* NAMED RESIDUAL, because `\p{Default_Ignorable_Code_Point}` is Unicode's
+* INTENT-TO-BE-IGNORED property and NOT "everything that renders as nothing"
+* -- an earlier revision of this comment claimed the latter and review refuted
+* it. NONSPACING marks (`\p{Mn}`) carry zero advance width, so a secret split
+* by one renders contiguous while this class keeps it: measured with `U+09BC`,
+* which verdicts `safe` AND publishes the alias. Not widened here, because
+* `\p{Mn}` is the diacritics of Devanagari, Arabic, Hebrew and Vietnamese and
+* deleting it would mangle legitimate names for every user. Tracked as issue
+* [#2889](https://github.com/go-to-k/cdkd/issues/2889), which also carries the
+* homoglyph question. `origin/main` behaves identically, so this is a recorded
+* residual rather than something this change introduced.
+*
+* THE THIRD BULLET REPLACED A HAND TAIL, and the hand tail was measured
+* leaking. A first cut listed the ranges by hand -- `FE00-FE0F`,
+* `E0100-E01EF`, `180B-180D`, `115F`, `1160`, `3164`, `FFA0`, `17B4`, `17B5`
+* -- and review found `U+034F` outside it, printing `hunter2hunter2` in a
+* `warn` line under a `safe` verdict. It also spelled `180B-180D` while
+* calling itself "the Mongolian FVS", missing `U+180F`, which Unicode 14
+* added. Naming the PROPERTY is what makes the next such addition arrive
+* covered instead of arriving as another finding.
+*
+* WIDENED HERE AND NOT IN `display-safe.ts` because the two files answer
+* different questions. `displaySafe` is about a terminal rendering a value,
+* and its recorded reason for keeping these is command forgery -- where a
+* character that renders as nothing changes nothing. That reason does not
+* transfer to a secret: a plaintext split by an invisible character is READ by
+* a human exactly as if it were contiguous, so disclosure needs no paste.
+*
+* `tests/unit/deployment/secret-scan-class-superset.test.ts` fences this as a
+* SUPERSET of both sanitisers' classes by SCANNING CODE POINTS rather than by
+* comparing source text, so a future edit to either sanitiser that this class
+* does not cover reds -- the failure mode a hand list has and a derivation
+* does not.
+*/
+const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
+/**
+* The one string space in which this module tests for, masks, and prints a
+* possibly-secret-bearing name.
+*
+* `.trim()` mirrors `displaySafe`, whose trim this replaces on these paths. It
+* is applied to the TEXT only -- see {@link canonicalNeedle}, where trimming
+* would silently shorten a recorded secret.
+*/
+function canonicalForSecretScan(text) {
+	return text.replace(SECRET_SCAN_INVISIBLES, "").trim();
+}
+/**
+* A recorded secret as a NEEDLE in canonical space.
+*
+* STRIPPED BUT NOT TRIMMED. That is not an oversight of the symmetry with
+* {@link canonicalForSecretScan} but the deliberate asymmetry between a
+* haystack and a needle: whitespace at the edge of a recorded secret is part
+* of the secret and sits in the MIDDLE of a longer key, so trimming the needle
+* stops it matching there. Measured -- a recorded `"ab  "` embedded in
+* `x-ab  -y` was masked before this change and came back `safe` after it.
+*
+* Canonicalising the needle at all is what let the raw-key fallback arm go
+* away: a secret whose own plaintext carries a stripped character used to
+* survive in the raw key and be destroyed in the sanitised one, so it could be
+* DETECTED only from the raw form and MASKED in neither -- a permanent
+* `withheld`. Here it is both found and masked.
+*/
+function canonicalNeedle(plaintext) {
+	return plaintext.replace(SECRET_SCAN_INVISIBLES, "");
+}
+/**
+* The recorded secrets as NEEDLES, keyed by their canonical form.
+*
+* A needle whose canonical form is EMPTY is dropped: canonicalisation can turn
+* a non-empty recorded value into `''`, and `maskEveryOccurrence` splitting on
+* `''` interleaves the mask between every character of the key. The resolver
+* never records an empty secret, so nothing upstream guards this. Measured
+* without the guard: `OrdinaryKey` came back as
+* `O***r***d***i***n***a***r***y***K***e***y`.
+*/
+function canonicalNeedles(secrets) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) out.set(needle, expression);
+	}
+	return out;
+}
+/**
 * Which recorded secrets are visible in `text`, or `undefined` when none is.
 *
 * ONE rule for both callers below, because they were inconsistent and the
@@ -31143,8 +31572,14 @@ const MIN_SECRET_NEEDLE = 4;
 */
 function secretsPresentIn(text, secrets) {
 	if (!secrets || secrets.size === 0) return void 0;
+	const haystack = canonicalForSecretScan(text);
 	const exposure = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) if (text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext)) exposure.set(plaintext, expression);
+	for (const [plaintext, expression] of secrets) {
+		const needle = canonicalNeedle(plaintext);
+		const canonicalHit = haystack === needle || needle.length >= MIN_SECRET_NEEDLE && haystack.includes(needle);
+		const rawHit = text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext);
+		if (canonicalHit || rawHit) exposure.set(plaintext, expression);
+	}
 	return exposure.size > 0 ? exposure : void 0;
 }
 /**
@@ -31234,10 +31669,76 @@ function maskEveryOccurrence(text, exposure) {
 * unchanged. stderr is a reader like any other, so the invariant is absolute: a
 * message must never claim a masking it did not perform.
 */
-function secretBearingExportNameWarning(outputKey, exportName, exposure) {
-	const masked = stripControlChars(maskEveryOccurrence(exportName, exposure));
-	const shown = masked === stripControlChars(exportName) ? "" : `(masked: "${masked}") `;
-	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets) {
+	const corpus = secrets ?? exposure;
+	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
+	const shown = name.kind === "masked" ? `(masked: "${name.text}") ` : "";
+	const ownerForceMask = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of exposure) if (plaintext === outputKey || canonicalNeedle(plaintext) === canonicalForSecretScan(outputKey) || plaintext.length >= MIN_SECRET_NEEDLE) ownerForceMask.set(plaintext, expression);
+	return `Output ${displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask))} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+}
+/**
+* Test `key` for recorded secret plaintext and return how it may be shown.
+*
+* Reuses {@link stateKeySecretExposure} and the same `maskEveryOccurrence` the
+* warnings below use, rather than restating either: two spellings of "is this
+* key safe to print" would disagree on the boundary cases those two encode
+* (the whole-key match for a sub-floor needle, longest-needle-first masking).
+*
+* CANONICAL SPACE, not a composition of the two sanitisers. An earlier
+* revision of this comment described running `stripControlChars` and then
+* `displaySafe`, with a table of what each one touches and a note that the
+* ORDER was load-bearing. That composition WAS the defect (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)): it leaves three
+* strings in play -- the raw key the verdict came from, the sanitised key that
+* was printed, and the masked one between them -- and `stripControlChars`
+* DELETES, so a plaintext split by one of its characters is absent from the
+* first and contiguous in the second. See {@link SECRET_SCAN_INVISIBLES} for
+* the class that replaced it and why it is derived rather than enumerated.
+*/
+function secretSafeKeyDisplay(key, secrets, forceMask) {
+	const shown = canonicalForSecretScan(key);
+	const exposure = stateKeySecretExposure(key, secrets);
+	const mask = canonicalNeedles(forceMask);
+	for (const [plaintext, expression] of exposure ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) mask.set(needle, expression);
+	}
+	if (mask.size === 0) return {
+		kind: "safe",
+		text: shown
+	};
+	const masked = maskEveryOccurrence(shown, mask);
+	if (masked === shown) return exposure ? { kind: "withheld" } : {
+		kind: "safe",
+		text: shown
+	};
+	if (stateKeySecretExposure(masked, secrets)) return { kind: "withheld" };
+	return {
+		kind: "masked",
+		text: masked
+	};
+}
+/**
+* The display for a name plus the verdict its CALLER needs, as one value.
+*
+* Exists so a caller cannot take the verdict from one call and the text from
+* another — the shape of the bug in {@link secretSafeKeyDisplay}'s own callers
+* (issue #2874), one level up.
+*/
+function secretBearing(display) {
+	return display.kind !== "safe";
+}
+/**
+* What a message prints in place of a name it may not show.
+*
+* Deliberately not name-shaped and never quoted as if it were a key: a reader
+* has to be able to tell this is the tool declining, not an odd export name.
+*/
+const WITHHELD_NAME_DISPLAY = "<name withheld: contains a secret>";
+/** The text of a display, or {@link WITHHELD_NAME_DISPLAY} when there is none. */
+function displayTextOrWithheld(display) {
+	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
 }
 /**
 * Warning for a state KEY that already holds secret plaintext — the residue an
@@ -31250,8 +31751,9 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure) {
 * redeploy, which rewrites `state.outputs` wholesale and republishes the index.
 * Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
 */
-function secretBearingStateKeyWarning(stackName, key, exposure) {
-	return `State for ${stripControlChars(stackName)} holds an output KEY containing a secret (masked: "${stripControlChars(maskEveryOccurrence(key, exposure))}") — cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+function secretBearingStateKeyWarning(stackName, display) {
+	const clause = display.kind === "masked" ? `(masked: "${display.text}") ` : `(the name is withheld: masking it would leave the secret readable) `;
+	return `State for ${canonicalForSecretScan(stackName)} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
 }
 /**
 * Warning for an `Export.Name` colliding with an output NAME it does not own.
@@ -31260,13 +31762,18 @@ function secretBearingStateKeyWarning(stackName, key, exposure) {
 * says which value survives — the export is skipped, so the key keeps the
 * output's own value.
 *
-* No masking here, and none is needed: the name printed is one that MATCHED a
-* declared output name, i.e. template text, and a name carrying a secret is
-* refused by {@link secretBearingExportNameWarning} before this is reached.
-*/
-function exportAliasCollisionWarning(outputKey, exportName) {
-	const shown = stripControlChars(exportName);
-	const from = stripControlChars(outputKey);
+* MASKED HERE, and the bound that used to excuse it is named rather than
+* relied on. This message prints a name that MATCHED a declared output name --
+* template text -- and a secret-bearing `Export.Name` is refused by
+* {@link secretBearingExportNameWarning} upstream. But that is SOMEBODY ELSE'S
+* VERDICT, and this site is reached from exactly the arm taken when it MISSED:
+* before issue [#2874](https://github.com/go-to-k/cdkd/issues/2874)
+* canonicalised the containment scan, it missed for eight of ten invisible
+* characters, and this message printed the plaintext verbatim.
+*/
+function exportAliasCollisionWarning(outputKey, exportName, secrets) {
+	const shown = displayTextOrWithheld(secretSafeKeyDisplay(exportName, secrets));
+	const from = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, secrets));
 	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
 }
 /**
@@ -31281,12 +31788,12 @@ function exportAliasCollisionWarning(outputKey, exportName) {
 * {@link collectDeclaredOutputNames}.
 */
 function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const mask = (name) => {
-		const exposure = secretsPresentIn(name, secrets);
-		return stripControlChars(exposure ? maskEveryOccurrence(name, exposure) : name);
-	};
-	const shown = mask(exportName);
-	return `Output ${mask(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+	const nameDisplay = (name) => secretSafeKeyDisplay(name, secrets);
+	const exportDisplay = nameDisplay(exportName);
+	const shown = displayTextOrWithheld(exportDisplay);
+	const storedUnder = exportDisplay.kind === "withheld" ? "the stored value under that name" : `the stored value under "${shown}"`;
+	const ownerDisplay = nameDisplay(outputKey);
+	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
 //#endregion
@@ -32682,6 +33189,397 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
+//#endregion
+//#region src/analyzer/skipped-outputs.ts
+/**
+* The record `cdkd deploy` leaves behind for an Output it could NOT resolve
+* and SKIPPED, and the digest `cdkd diff` compares it against (issue
+* [#2740](https://github.com/go-to-k/cdkd/issues/2740)).
+*
+* The deploy side (`DeployEngine.handleOutputResolutionFailure`, default arm)
+* warns, stores `undefined` for the key and moves on, so a re-resolved
+* `state.outputs` lacks it (the no-change path keeps the previous bag whole
+* when any output fails, so a key that resolved on an EARLIER deploy can keep
+* its value beside a record — the reader checks absence first and ignores the
+* record then). The diff side resolves outputs with `skipDynamicReferences`, so a
+* failure that happens INSIDE a secret lookup — a JSON key the secret does not
+* hold, a reference assembled from another secret's value — does not reproduce
+* there: the value assembles into its token, the key is absent from state, and
+* `computeOutputsDiff` pushed an `ADD` the deploy would never perform, on every
+* run of an unchanged stack. The diff cannot tell from assembly alone that the
+* deploy would fail (a composed string carrying a secret reference is a
+* legitimate output), so it learns what the deploy learned instead:
+* `StackState.skippedOutputs` maps each skipped key to a digest of the
+* template inputs its resolution read, and the diff trusts the record only
+* while that digest is unchanged.
+*
+* ## What the digest covers, and why
+*
+* `skippedOutputDigest` hashes the output's OWN entry (`Value`, `Export`,
+* `Condition`, whatever else it declares) together with every top-level
+* template section EXCEPT `Resources` and `Outputs`:
+*
+* - The entry itself: repairing the `Value` expression is the obvious repair.
+*   The `Export.Name` is in it too, because the alias pass routes an
+*   `Export.Name` failure through the same handler, which blanks the output's
+*   own key even when its value resolved — so a repaired or removed export
+*   name must invalidate the record as well.
+* - `Parameters` (a `Ref`-built reference repaired through a parameter
+*   default), `Conditions` (an `Fn::If` whose branch flips), `Mappings` (an
+*   `Fn::FindInMap`-built key), and the remaining sections for the same
+*   reason, spelled as one rule rather than a list that drifts: everything an
+*   output's resolution can read besides resources. One VALUE inside them is
+*   excluded — the `Default` of a `NoEcho: true` parameter, hashed as a
+*   constant; see `withNoEchoDefaultsMasked` for why. That is the POSITION,
+*   not the parameter: its `AllowedValues`, and any literal an author puts in
+*   `Conditions`, `Rules` or `Metadata`, are hashed as before.
+* - NOT `Resources`: hashing the section would invalidate the record on every
+*   unrelated resource edit. The output CAN be repaired from that side —
+*   `collectSkippedOutputs` records both skip arms, and the quiet one is an
+*   `Fn::GetAtt` whose attribute `constructAttribute` could not build — so a
+*   digest alone would keep binding while the next deploy publishes the row
+*   and its `Export.Name`, the phantom's inverse. {@link
+*   bindingSkippedOutputs} closes that with the CHANGE MAP rather than the
+*   digest: a key whose entry references a logical id with a pending resource
+*   change does not bind. The diff has that map (it ran the resource diff
+*   first); the deploy does not need it, because a stack with any resource
+*   change takes the path that re-resolves every output and rewrites the
+*   record. REFERENCE, not repair: whether an edit could actually make the
+*   output resolvable is undecidable from a template, so an unrelated edit to
+*   a referenced resource un-binds too and the key can preview as an `ADD`
+*   again. The cost is bounded — a run with a changed resource is already
+*   reporting that row, so `--fail` exits 1 regardless — while the case it
+*   buys depends on whether the diff can resolve the output at all. For an
+*   output reading an attribute that does not exist yet — the SECOND skip arm
+*   this record covers, not the secret lookup issue #2740 was filed on — it is
+*   the VERDICT and not the row: unresolvable in
+*   both readings, so bound the diff reports the outputs settled while the
+*   next deploy is about to publish that key and its `Export.Name`. For an
+*   output the diff CAN resolve, whose reference is to a name rather than to
+*   a pending attribute (an `Fn::Sub` over an SSM parameter's name, say), the
+*   row IS the difference and reappears as an `ADD` the moment the record
+*   stops binding.
+* - NOT the sibling `Outputs`: a CloudFormation output cannot reference
+*   another output, so a sibling change cannot repair this one, and excluding
+*   them keeps an unrelated output edit from producing a one-run phantom.
+*
+* What the digest CANNOT see is a repair outside the template — the secret
+* gained the JSON key, the SSM parameter was created, a parameter VALUE
+* handed to the engine rather than declared changed (a nested stack's inputs
+* from its parent, `DeployEngineOptions.parameters`; `Parameters`
+* DECLARATIONS are hashed, supplied values are not), or **cdkd itself was
+* upgraded**: the quiet skip arm is `constructAttribute` returning nothing,
+* so a provider that gains that attribute repairs the output while neither
+* the template nor any resource moves.
+*
+* They are blind spots for three different reasons, and only the first is
+* about knowledge. The secret's key set and the SSM parameter's existence
+* need the external lookup the diff deliberately refuses to make. A supplied
+* parameter VALUE is not one of those — a nested stack's inputs are resolved
+* and forwarded to the child diff (`resolveChildStackParameters`) — it is
+* simply outside what the digest hashes, because hashing values would make
+* the record depend on a caller's arguments rather than on the template. And
+* the writing binary's version is knowable and merely unstored: keeping it
+* beside the digest and un-binding on mismatch would close that one. All four
+* end the same way: the record keeps binding until the next deploy re-resolves
+* the output, and that deploy publishes the key — unless a SIBLING output is
+* still unresolved on a run with no resource change, where the engine keeps
+* the previous outputs bag wholesale and the key stays unpublished for a
+* further run (go-to-k/cdkd#2771, pre-existing and not introduced here).
+* Documented as the accepted limitation in `docs/cli-diff.md`; it is narrower
+* than the pre-#2740 behaviour, where the diff was wrong on EVERY run.
+*
+* A repair on the RESOURCE side is NOT on that list either, but the reason is
+* narrower than it first looks. The change map above closes it only when the
+* repair arrives WITH a template resource change, which is what makes the
+* resource show on the diff at all. An OUT-OF-BAND state write does not:
+* every writer that rebuilds state outside a deploy DROPS the record rather
+* than carry it (one enumerated exception, the partial-destroy snapshot, is
+* explained with the field) — `cdkd import` refreshes `attributes` for the
+* resources it imports, `cdkd drift --accept` rewrites the properties an
+* attribute may be built from, `cdkd rollback`'s replacement arm rebuilds a
+* record with the attributes a FRESH create returned, and the rest are listed
+* with the field.
+* Dropping returns those keys to pre-#2740 behaviour until the next deploy
+* recomputes the record — a row where the diff can resolve them, the ordinary
+* whole-section suppression where it cannot — which is what keeps a
+* resource-side repair out of the list above.
+*
+* The rule is flat and it is meant to be: EVERY writer that rebuilds state
+* outside a deploy drops the record, the partial-destroy snapshot being the
+* one enumerated exception — the full list lives with the field, in
+* `StackState.skippedOutputs`. Three per-writer arguments for carrying it were
+* written during review, which is the reason for the flat rule rather than an
+* aside: two were shown wrong (substituting a value repairs an output whose
+* enclosing intrinsic was choking on what was there; scrubbing a plaintext
+* back to its expression rewrites a string outputs read verbatim) and the
+* third — deleting a property EXPOSING an attribute of the same name — could
+* not be settled either way, which argues for flatness at least as strongly.
+*
+* ## Where the digest must be taken from
+*
+* The template AS HANDED to the engine / to `computeStackDiff` — before
+* parameter binding, condition evaluation or any output resolution. The
+* INVARIANT, and the reason both callers `structuredClone` rather than pass
+* their live object: **no resolution may be visible to the digest, on either
+* side, and both sides must take it at the same point of their own flow.**
+* Two independent reasons, neither of which depends on any particular
+* resolver doing the writing: a digest that could see a resolved value would
+* (1) differ between the two sides, which computes a record the diff can
+* never re-derive, and (2) fingerprint a secret into `state.json`, since a
+* resolved value can be a decrypted one.
+*
+* The clone is therefore NOT dead weight even while no resolver mutates its
+* input. It used to be load-bearing against a live rewrite — `resolveSub`
+* substituted into the caller's two-argument `Fn::Sub` variable map until
+* go-to-k/cdkd#2764 gave it a fresh object — and the protection was never
+* derived from that call site: it is derived from the invariant above, which
+* a future in-place optimisation anywhere in either flow would silently
+* violate. `tests/unit/cli/diff-recursive-skipped-outputs.test.ts` pins the
+* current no-mutation contract from the other direction (the template handed
+* to `computeStackDiff` comes back byte-identical), so reintroducing a
+* rewrite reds a test rather than moving a digest;
+* `tests/unit/deployment/deploy-engine-skipped-outputs.test.ts` INJECTS a
+* rewrite through its resolver mock and requires the recorded digest to equal
+* a fresh parse's, which pins the ordering itself.
+*
+* Given that contract the hash covers template text only. It is over
+* canonical JSON (object keys sorted at every level), so a template
+* re-serialised with keys in another order digests identically.
+*
+* ## What the diff does with a binding record
+*
+* It previews the key as ABSENT — no row — because that is exactly what the
+* deploy will leave in state. It does NOT flag the section as failed: a
+* sibling output that genuinely changed still renders, and `--fail` still
+* exits 1 for it. A record whose digest no longer matches is simply ignored:
+* the output is previewed under the ordinary rules again (usually an `ADD`;
+* an intrinsic `Export.Name` the diff still cannot resolve keeps omitting the
+* section, as before), the next deploy re-decides it —
+* publishing it if the repair took, or recording it again under the new
+* digest — and the diff follows that decision.
+*/
+/**
+* JSON with object keys sorted at every level. Arrays keep their order (an
+* `Fn::Join` list is positional). `undefined` members are dropped, as
+* `JSON.stringify` drops them, so a parsed template and its in-memory twin
+* digest identically.
+*/
+function canonicalJson(value) {
+	return JSON.stringify(value, (_key, v) => {
+		if (v !== null && typeof v === "object" && !Array.isArray(v)) {
+			const sorted = Object.create(null);
+			for (const k of Object.keys(v).sort()) sorted[k] = v[k];
+			return sorted;
+		}
+		return v;
+	});
+}
+/** The constant a `NoEcho` `Default` is hashed as. Its text is irrelevant; that
+* it is CONSTANT is the point. */
+const NO_ECHO_DEFAULT_MASK = "<cdkd:noecho-default>";
+/**
+* `Parameters` with every `NoEcho: true` parameter's `Default` replaced by a
+* constant, for hashing only.
+*
+* The pre-resolution snapshot already keeps RESOLVED secret values out of the
+* digest. An authored `Default` under `NoEcho: true` is not one of those — it
+* is template text, and it went into the hash. With the rest of the
+* non-`Resources` sections known, a reader of `state.json` holds a confirm
+* ORACLE for a low-entropy default: guess it, recompute, compare.
+*
+* This does NOT claim the value is otherwise absent from state — a parameter a
+* resource reads can persist its RESOLVED default in that resource's
+* properties, and parameter `NoEcho` is outside the state-redaction model
+* either way. What it claims is narrower and still worth having: this record
+* must not ADD an oracle of its own for the case where the value is not
+* already there.
+*
+* The cost, stated rather than hidden: changing ONLY such a default no longer
+* moves the digest, so the record keeps binding through that edit until the
+* next deploy re-resolves the output. That is the same bounded staleness the
+* documented blind spots carry.
+*
+* Everything else about the parameter is still hashed — its `Type`, its
+* `AllowedValues`, the `NoEcho` flag itself — so a parameter appearing,
+* disappearing or changing shape still un-binds. Unmatched parameter content
+* hashes exactly as before: the map is rebuilt, but the canonicaliser sorts
+* keys and ignores prototypes, so a template with no `NoEcho` default gets the
+* digest it always had.
+*/
+function withNoEchoDefaultsMasked(parameters) {
+	if (parameters === null || typeof parameters !== "object" || Array.isArray(parameters)) return parameters;
+	const masked = Object.create(null);
+	for (const [name, decl] of Object.entries(parameters)) {
+		const body = decl;
+		masked[name] = typeof body === "object" && body !== null && body["NoEcho"] === true && "Default" in body ? {
+			...body,
+			Default: NO_ECHO_DEFAULT_MASK
+		} : decl;
+	}
+	return masked;
+}
+/**
+* The digest recorded in `StackState.skippedOutputs[outputKey]` by the deploy
+* and recomputed by the diff — see the module doc for what it covers. Both
+* sides call THIS function, so the coverage is spelled once.
+*
+* `template` must be the pre-resolution snapshot the module doc describes.
+*/
+function skippedOutputDigest(template, outputKey) {
+	const sections = Object.create(null);
+	for (const [section, body] of Object.entries(template)) {
+		if (section === "Resources" || section === "Outputs") continue;
+		sections[section] = section === "Parameters" ? withNoEchoDefaultsMasked(body) : body;
+	}
+	const entry = template.Outputs?.[outputKey];
+	return createHash("sha256").update(canonicalJson({
+		output: entry,
+		template: sections
+	})).digest("hex");
+}
+/**
+* The record a deploy writes for the bag `resolveOutputs` produced: every key
+* whose value is `undefined`, mapped to its digest. Two arms write that value:
+* the default arm of `handleOutputResolutionFailure` (the resolver THREW —
+* warned, and refused under `--strict-getatt`), and a resolver that returned
+* `undefined` outright without throwing (an attribute it could construct
+* nothing for, `constructAttribute`'s empty arm — no warn, no strict refusal).
+* Both leave the key out of a re-resolved bag (the no-change path may keep a
+* previous value under it, see the module doc), and that path's
+* `resolutionFailed` treats both the same, so this record does too: the
+* question it answers is "will the next deploy leave this key absent?", and
+* the answer is yes either way. `undefined` (the field OMITTED) when nothing
+* was skipped, so a record that carries the field says at least one output
+* was skipped.
+*
+* `template` must be the pre-resolution snapshot (see the module doc).
+*/
+function collectSkippedOutputs(template, resolvedOutputs) {
+	let record;
+	for (const [outputKey, value] of Object.entries(resolvedOutputs)) {
+		if (value !== void 0) continue;
+		record ??= Object.create(null);
+		record[outputKey] = skippedOutputDigest(template, outputKey);
+	}
+	return record;
+}
+/**
+* Every resource logical id an output entry could reference, from `Ref`,
+* either `Fn::GetAtt` spelling, and an `Fn::Sub` placeholder, walked to any
+* depth over the whole entry (`Value`, `Export.Name` and anything else it
+* declares).
+*
+* A deliberate SUPERSET: an `Fn::Sub` placeholder naming a template
+* PARAMETER, or a `Ref` to one, lands here too, since telling the two apart
+* needs the `Parameters` section and the answer only ever widens the set. The
+* one consumer intersects it with the ids that actually have a pending
+* RESOURCE change, so a name that is not a resource cannot match, and a
+* parameter deliberately named after a changed resource merely un-binds one
+* record — the direction that previews a row rather than hiding one. Pseudo
+* parameters (`AWS::…`) and the `${!Literal}` escape are dropped.
+*/
+function referencedLogicalIds(entry) {
+	const ids = /* @__PURE__ */ new Set();
+	const addName = (name) => {
+		const logicalId = name.split(".")[0];
+		if (logicalId !== void 0 && logicalId !== "" && !logicalId.startsWith("AWS::")) ids.add(logicalId);
+	};
+	const walk = (value) => {
+		if (Array.isArray(value)) {
+			for (const item of value) walk(item);
+			return;
+		}
+		if (value === null || typeof value !== "object") return;
+		const obj = value;
+		if (typeof obj["Ref"] === "string") addName(obj["Ref"]);
+		const getAtt = obj["Fn::GetAtt"];
+		if (typeof getAtt === "string") addName(getAtt);
+		else if (Array.isArray(getAtt) && typeof getAtt[0] === "string") addName(getAtt[0]);
+		for (const [key, nested] of Object.entries(obj)) {
+			if (key === "Fn::Sub") {
+				walkSub(nested);
+				continue;
+			}
+			walk(nested);
+		}
+	};
+	/**
+	* `Fn::Sub` in both spellings. Handled here rather than by the generic walk
+	* because the two-argument form's second element is a VARIABLE MAP, not a
+	* template fragment: its KEYS are variable names, so letting the generic
+	* walk see `{ Ref: 'Unrelated' }` there would read a variable literally
+	* named `Ref` as a `Ref` intrinsic. The map's VALUES are walked, since the
+	* resolver resolves them.
+	*/
+	const walkSub = (sub) => {
+		const isPair = Array.isArray(sub);
+		const subTemplate = typeof sub === "string" ? sub : isPair ? sub[0] : void 0;
+		const variableMap = isPair && sub[1] !== null && typeof sub[1] === "object" ? sub[1] : void 0;
+		if (typeof subTemplate === "string") {
+			const declaredVars = new Set(variableMap === void 0 ? [] : Object.keys(variableMap));
+			for (const [, placeholder] of subTemplate.matchAll(/\$\{([^}]*)\}/g)) {
+				if (placeholder === void 0 || placeholder.startsWith("!")) continue;
+				if (declaredVars.has(placeholder)) continue;
+				addName(placeholder);
+			}
+		}
+		if (isPair) for (const [index, element] of sub.entries()) {
+			if (index === 1) {
+				if (variableMap !== void 0) for (const declared of Object.values(variableMap)) walk(declared);
+				continue;
+			}
+			walk(element);
+		}
+		else walk(sub);
+	};
+	walk(entry);
+	return ids;
+}
+/**
+* The keys of a `StackState.skippedOutputs` record that still BIND against
+* today's template: recorded digest equal to the digest of the same key over
+* `pristineTemplate`, which must be the pre-resolution snapshot the module doc
+* describes. A key the template no longer declares is skipped outright — the
+* record is inert for it, and the next deploy clears it. The diff passes the
+* result to `resolveTemplateOutputs`, which adds the one check only state can
+* answer — that the key is still absent from the stored bag.
+*
+* `changedLogicalIds` is the second half of the binding rule, and the one the
+* digest structurally cannot carry (see the module doc's `Resources` bullet):
+* the logical ids this run's resource diff reports as changing. An output
+* whose entry references one of them does NOT bind, because the deploy that
+* follows takes the changed-resources path, re-resolves every output, and may
+* publish the very key the record would have hidden. Omitted by a caller with
+* no resource diff in hand — every such caller today is a test asserting the
+* digest half alone.
+*/
+function bindingSkippedOutputs(pristineTemplate, record, changedLogicalIds) {
+	const binding = /* @__PURE__ */ new Set();
+	if (record === null || record === void 0) return binding;
+	const declared = pristineTemplate.Outputs ?? {};
+	for (const [outputKey, digest] of Object.entries(record)) {
+		if (!Object.prototype.hasOwnProperty.call(declared, outputKey)) continue;
+		const entry = declared[outputKey];
+		if (digest !== skippedOutputDigest(pristineTemplate, outputKey)) continue;
+		if (changedLogicalIds !== void 0 && [...referencedLogicalIds(entry)].some((id) => changedLogicalIds.has(id))) continue;
+		binding.add(outputKey);
+	}
+	return binding;
+}
+/**
+* Whether two records — either possibly absent — describe the same skipped
+* set with the same digests. The no-change deploy path persists on a
+* difference here: it is the ONLY save trigger for this field on that path,
+* because a skipped output switches the outputs-changed trigger off.
+*/
+function skippedOutputsEqual(a, b) {
+	const aKeys = a === null || a === void 0 ? [] : Object.keys(a);
+	const bKeys = b === null || b === void 0 ? [] : Object.keys(b);
+	if (aKeys.length !== bKeys.length) return false;
+	return aKeys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && a?.[k] === b?.[k]);
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -35198,8 +36096,17 @@ var DeployEngine = class {
 	* secret collapse onto whichever expression was recorded last, exactly as two
 	* resource properties did before #1904. Captured in `resolveOutputs` at the
 	* same point `outputSecrets` is accumulated. Reset per `deploy()`.
+	*
+	* Null-prototype for the same reason as the outputs bag `resolveOutputs`
+	* builds two lines away: both are keyed by TEMPLATE-CONTROLLED output names,
+	* so an output called `__proto__` would replace this bag's prototype and a
+	* later lookup of a name it never stored would inherit from it. Only the
+	* RESET in `deploy()` is pinned — reverting this initialiser alone survives
+	* the suite, measured, because `deploy()` replaces the bag before anything
+	* writes to it, so the initialiser matches the reset rather than standing as
+	* a second guard.
 	*/
-	outputsTemplateSource = {};
+	outputsTemplateSource = Object.create(null);
 	/**
 	* The export aliases the last `resolveOutputs` pass WROTE into its bag
 	* (issue #2193) — exactly the keys `outputs[exportName] = value` landed on,
@@ -35212,6 +36119,18 @@ var DeployEngine = class {
 	*/
 	resolvedExportNames = [];
 	/**
+	* The outputs the last `resolveOutputs` pass could NOT resolve and SKIPPED
+	* (the resolver threw under the default arm of
+	* `handleOutputResolutionFailure`, or returned `undefined` outright — see
+	* `collectSkippedOutputs`), each mapped to the
+	* digest `cdkd diff` compares against (issue #2740, `StackState.
+	* skippedOutputs`). `undefined` when nothing was skipped, so the saves that
+	* persist the resolved bag spread it as-is and the field stays omitted. Same
+	* lifetime rule as `resolvedExportNames`: reset at the top of every
+	* `resolveOutputs`, meaningful only right after that call returns.
+	*/
+	skippedOutputs;
+	/**
 	* Whether {@link outputsTemplateSource} may be used to POSITION the outputs
 	* redaction. False once an outputs pass threw partway: the post-loop
 	* name pass never ran, so the bag holds only the alias keys written before
@@ -35298,8 +36217,9 @@ var DeployEngine = class {
 		this.perResourceTemplateProps = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
-		this.outputsTemplateSource = {};
+		this.outputsTemplateSource = Object.create(null);
 		this.outputsSourceUsable = true;
+		this.skippedOutputs = void 0;
 		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
@@ -35783,6 +36703,10 @@ var DeployEngine = class {
 			} catch {}
 			this.kickOffAutoRefreshObservedProperties(currentState.resources);
 			this.logger.debug(`Template has ${Object.keys(template.Resources || {}).length} resources`);
+			const outputsDigestSource = structuredClone({
+				...template,
+				Resources: {}
+			});
 			const parameterValues = await this.resolver.resolveParameters(template, this.options.parameters, { ...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets } });
 			this.logger.debug(`Resolved ${Object.keys(parameterValues).length} parameters: ${Object.keys(parameterValues).join(", ")}`);
 			const context = this.buildResolverContext({
@@ -35826,7 +36750,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, parameterValues, conditions));
+					const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
@@ -35835,7 +36759,8 @@ var DeployEngine = class {
 					if (resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs)) this.logger.warn("Outputs changed but one or more could not be resolved; keeping the previously persisted outputs. A downstream Fn::ImportValue may fail until the next deploy.");
 					const observedRefresh = this.observedCaptureTasks.size > 0;
 					if (observedRefresh) await this.drainObservedCaptures(currentState.resources);
-					if (observedRefresh || outputsChanged || exportSetChanged) try {
+					const skippedOutputsChanged = !skippedOutputsEqual(currentState.skippedOutputs, this.skippedOutputs);
+					if (observedRefresh || outputsChanged || exportSetChanged || skippedOutputsChanged) try {
 						const refreshedState = {
 							version: 9,
 							region: this.stackRegion,
@@ -35843,6 +36768,7 @@ var DeployEngine = class {
 							resources: currentState.resources,
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
 							...resolutionFailed ? exportNamesCarriedFrom(currentState) : { exportNames: [...this.resolvedExportNames] },
+							...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
 						};
@@ -35855,7 +36781,8 @@ var DeployEngine = class {
 							if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
 							else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
 							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(refreshedState));
-						} else this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
 						this.logger.warn(`Failed to persist no-change state update: ${saveError instanceof Error ? saveError.message : String(saveError)} — drift baseline / outputs will be re-resolved on next deploy.`);
 					}
@@ -35897,7 +36824,7 @@ var DeployEngine = class {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
 			};
-			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending);
+			const { state: newState, actualCounts } = await this.executeDeployment(effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending);
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
@@ -35939,7 +36866,7 @@ var DeployEngine = class {
 	* - DELETE follows reverse dependency order (a node starts as soon as all
 	*   resources that depend ON it have finished deleting)
 	*/
-	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
+	async executeDeployment(template, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending = false) {
 		const concurrency = this.options.concurrency;
 		const newResources = { ...currentState.resources };
 		const actualCounts = {
@@ -35965,6 +36892,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -36097,6 +37025,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -36133,6 +37062,7 @@ var DeployEngine = class {
 					resources: newResources,
 					outputs: currentState.outputs,
 					...exportNamesCarriedFrom(currentState),
+					...skippedOutputsCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
@@ -36150,6 +37080,7 @@ var DeployEngine = class {
 						resources: newResources,
 						outputs: currentState.outputs,
 						...exportNamesCarriedFrom(currentState),
+						...skippedOutputsCarriedFrom(currentState),
 						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
@@ -36164,7 +37095,7 @@ var DeployEngine = class {
 		}
 		let outputs;
 		try {
-			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+			outputs = await withSharedDrainBudget(() => this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
 			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
 			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -36181,6 +37112,7 @@ var DeployEngine = class {
 				resources: newResources,
 				outputs,
 				exportNames: [...this.resolvedExportNames],
+				...this.skippedOutputs && { skippedOutputs: { ...this.skippedOutputs } },
 				...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
 				...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
 				lastModified: Date.now()
@@ -36219,6 +37151,7 @@ var DeployEngine = class {
 			resources: newResources,
 			outputs: currentState.outputs,
 			...exportNamesCarriedFrom(currentState),
+			...skippedOutputsCarriedFrom(currentState),
 			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
@@ -37360,9 +38293,16 @@ var DeployEngine = class {
 	* opposite sides of the same question. `secrets` is the outputs pass's own
 	* map: everything recorded before this handler runs, an `Export.Name`
 	* resolution's entries included (its `finally` merges them back before the
-	* `catch` reaches here). What a still-pending concurrent part would have
-	* recorded is outside both — issue #2563's late write, the same bound every
-	* other masking site in this engine has.
+	* `catch` reaches here). Since issue #2563 a still-pending concurrent part
+	* is in the PASS bag before this handler runs: the resolver drains every
+	* part it started before a rejection reaches a caller. Not
+	* unconditionally, and the weaker claim is the true one -- the drain is
+	* bounded, and since the outputs pass wraps BOTH its loops in one budget
+	* the bound spans the whole pass rather than one resolution: an early
+	* failing output can leave a later `Export.Name` drain with no wait at all,
+	* so a late record needs only a leg that had not finished recording by
+	* then rather than one that outlived a full cap. (`inheritedSecrets` is the parent's, and no
+	* resolution writes to it.)
 	*
 	* The strict arm's `cause` is masked as an OBJECT, through
 	* `maskSecretsInError` — a clone of each `Error` link `errorCauseChain`
@@ -37399,10 +38339,10 @@ var DeployEngine = class {
 	* rather than whatever the declaration order happened to have recorded by
 	* then (issue #1919).
 	*/
-	async resolveOutputs(template, resources, stackName, parameterValues, conditions) {
+	async resolveOutputs(template, resources, stackName, digestSource, parameterValues, conditions) {
 		this.resolvedExportNames = [];
 		if (!template.Outputs) return {};
-		const outputs = {};
+		const outputs = Object.create(null);
 		const context = this.buildResolverContext({
 			template,
 			resources,
@@ -37447,8 +38387,8 @@ var DeployEngine = class {
 				}
 				if (typeof exportName !== "string") continue;
 				const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues);
-				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure));
-				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName));
+				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues));
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 				else {
 					outputs[exportName] = value;
 					if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
@@ -37467,6 +38407,7 @@ var DeployEngine = class {
 			if (!publishedOutputNames.has(outputKey)) continue;
 			this.outputsTemplateSource[outputKey] = output.Value;
 		}
+		this.skippedOutputs = collectSkippedOutputs(digestSource, outputs);
 		return markSameGenerationBag(outputs);
 	}
 	buildDisplayOutputs(template, resolvedOutputs) {
@@ -37481,5 +38422,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { createMaskedRetryLogger as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, replayWarn as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketWebsiteUrl as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, normalizeAwsTagsToCfn as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, configBooleanRefusal as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, coerceCfnBoolean as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, producerRegionsFromState as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, findSilentDropProperties as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, DiffCalculator as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, s3BucketArn as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, s3BucketDomainName as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, requireConfigObject as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigString as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, configStringRefusal as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, classifyReplaySecretRegion as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketDualStackDomainName as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, WAFv2WebACLProvider as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, assertRegionMatch as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, INTRINSIC_KEYS as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, applyRoleArnIfSet as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, findActionableSilentDrops as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, coerceParameterTypedValue as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, isInterruptedWaitError as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, parameterTypeMayLoseSecretIdentity as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, slowCcOperationTimeoutMs as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, deleteSkipReason as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, maskDeep as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, disableInstanceApiTermination as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, cfnRefValueFromPhysicalId as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, carriesDynamicReference as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, interruptWatchListenerCount as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, requireConfigArray as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, readConfigString as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, UNSPECIFIED_SKIP_REASON as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, IntrinsicFunctionResolver as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, beginCommandInterruptScope as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, startInterruptWatch as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, isTerminationProtectionPropagationError as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, endCommandInterruptScope as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, CloudControlProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, maskerOrIdentity as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, deleteIndeterminateGuards as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, getAccountInfo as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, resolveExplicitPhysicalId as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, refStateLookupFromResource as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, isUnboundTemplateParameter as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketRegionalDomainName as zt };
-//# sourceMappingURL=deploy-engine-Cxt3gn8N.js.map
+export { ProviderRegistry as $, partitionSensitiveEnv as $n, ResourceTimeoutError as $r, STATE_SOURCED_CROSS_GENERATION_RULES as $t, renderStatefulReason as A, buildAssetRedirectMap as An, derivePartitionAndUrlSuffix as Ar, configStringRefusal as At, red as B, parseBootstrapMarker as Bn, CdkdError as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, exportNamesCarriedFrom as Cn, findLargeInlineResources as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, AssetPublisher as Dn, expectedOwnerParam as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, shouldRetainResource as En, displaySafe as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, BOOTSTRAP_MARKER_PREFIX as Fn, AwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, describeAwsFailure as Gn, DynamicReferenceRegionAmbiguousError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, validateAssetBucketName as Hn, CrossAccountSecretRefusalError as Hr, s3BucketRegionalDomainName as Ht, bold as I, assertAssetBucketRegion as In, getAwsClients as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, describeDockerExecFailure as Jn, LocalStartServiceError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDockerImage as Kn, IntrinsicResolutionRefusalError as Kr, INTRINSIC_KEYS as Kt, cyan as L, ensureAssetStorage as Ln, resetAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, loadPublishableAssetManifest as Mn, processStackMessages as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, rewriteTemplateAssetReferences as Nn, clearBucketRegionCache as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, stringifyValue as On, PARTITION_TABLE as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, AssetModeResolver as Pn, resolveBucketRegion as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, getDockerCmd as Qn, ProvisioningError as Qr, TemplateParser as Qt, gray as R, getBootstrapMarkerKey as Rn, setAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, DEFAULT_STATE_PREFIX as Sn, MIGRATE_TMP_PREFIX as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, importableOutputs as Tn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, validateContainerRepoName as Un, DependencyError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, readBootstrapMarkerBody as Vn, ConfigError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, buildDenyExternalAccessPolicy as Wn, DeployCancelledError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, dockerSpawnEnvWithSensitive as Xn, NestedStackChildDirectDestroyError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerFailure as Yn, LockError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, formatDockerLoginError as Zn, PartialFailureError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildForceUnlockCommand as _n, resolveUseCdkBootstrapAssets as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, formatError as ai, errorCauseChain as an, AssetManifestLoader as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, shellQuote as bn, CFN_TEMPLATE_BODY_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, withErrorHandling as ci, maskSecretsInText as cn, synthesisStatusMessage as cr, startInterruptWatch as ct, updatePartialReason as d, isThrottlingError as di, redactSecretsForState as dn, resolveApp as dr, UNSPECIFIED_SKIP_REASON as dt, ResourceUpdateNotSupportedError as ei, STATE_SOURCED_READBACK_RULES as en, redactDockerArgvValues as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isTransientServerError as fi, scrubResourceRecord as fn, resolveAutoAssetStorage as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, __exportAll as gi, UNRENDERABLE as gn, resolveStateBucketWithDefaultAndSource as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, retryClassificationText as hi, rebuildClientForBucketRegion as hn, resolveStateBucketWithDefault as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, SynthesisError as ii, dynamicReferenceTokens as in, stripControlChars as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, createAssetRedirectResolver as jn, AssemblyReader as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, WorkGraph as kn, canonicalizeRegion as kr, configBooleanRefusal as kt, replayRollback as l, isMarkedNonRetryable as li, recordMaskOnlyValue as ln, getDefaultStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, markRedactedCause as mi, S3StateBackend as mn, resolveSkipPrefix as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as ni, carriesSecretMask as nn, runDockerStreaming as nr, maskDeep as nt, planFailedOps as o, isCdkdError as oi, isSingleDynamicReferenceToken as on, getDockerImageBySourceHash as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markNonRetryable as pi, LockManager as pn, resolveCaptureObservedState as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeDockerCapturedOutput as qn, LocalInvokeBuildError as qr, findActionableSilentDrops as qt, DeployEngine as r, StateError as ri, createSecretMasker as rn, escapeRegExp$1 as rr, maskerOrIdentity as rt, planRollback as s, normalizeAwsError as si, maskSecretsInError as sn, Synthesizer as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as ti, TEMPLATE_SOURCED_RULES as tn, runDockerForeground as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isRetryableTransientError as ui, recoverMaskedOutput as un, getLegacyStateBucketName as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, buildLockContentionMessage as vn, stateBucketExistenceConfirmed as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputKeys as wn, uploadCfnTemplate as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, CUSTOM_RESOURCE_RESPONSE_PREFIX as xn, CFN_TEMPLATE_URL_LIMIT as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, forceQuitRecoveryClause as yn, warnDeprecatedNoPrefixCliFlag as yr, coerceParameterTypedValue as yt, green as z, isCrossRegionRedirect as zn, AssetError as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-BiPxTgKT.js.map