@go-to-k/cdkd 0.288.3 → 0.288.5

package/dist/{deploy-engine-CfxcC3q3.js → deploy-engine-Dsf9bTqH.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
+import { t as getCdkdVersion } from "./version-BFmq8S23.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -102,6 +102,7 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
 	"permissions required to assume the role",
+	"does not have a trust relationship allowing",
 	"authorized to assume the provided role",
 	"not authorized to access the Log Destination",
 	"Cannot access stream",
@@ -4017,6 +4018,18 @@ async function expectedOwnerParam(client) {
 * A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
 * should pass `asciiOnly`, which is a positive allowlist and therefore has no
 * such residual at all.
+*
+* ONE CALLER DELIBERATELY GOES WIDER, and it is recorded here so an editor of
+* the residual note above knows a second module now disagrees with it.
+* `src/deployment/outputs-export-alias.ts` deletes a class derived from
+* `\p{Cc}` / `\p{Cf}` / `\p{Zl}` / `\p{Zp}` /
+* `\p{Default_Ignorable_Code_Point}`, because on THAT path the subject is a possibly
+* secret-bearing name in an operator's log: a plaintext split by a zero-width
+* character is READ as if it were contiguous, so it is disclosed without any
+* paste, and the command-forgery reasoning above does not transfer (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)). Nothing here changes
+* -- widening this helper would alter every caller that merely wants a
+* terminal-safe string.
 */
 function displaySafe(value, opts) {
 	if (value === void 0 || value === null) return "";
@@ -12245,13 +12258,45 @@ const TEMPLATE_SOURCED_RULES = {
 	trustAnyExpression: false,
 	sourceIsSameGeneration: false
 };
-/** An AWS readback projected from THIS record's own persisted STATE bag. */
+/**
+* An AWS readback projected from THIS record's own persisted STATE bag.
+*
+* Does NOT fail closed. This is the constant a caller reaches for when it knows
+* the SHAPE of its two bags and nothing about where the result lands —
+* `cdkd drift`'s two writers and `cdkd import`'s capture pass it, and so does
+* `DeployEngine.redactOperationsForJournal` for the journal's `previousState`
+* (issue [#2886](https://github.com/go-to-k/cdkd/issues/2886): a REPLAYED
+* baseline must not gain masks a rollback restore then persists). See
+* {@link STATE_SOURCED_BASELINE_RULES} for the one that does, and
+* `failClosedOnUncertifiedPositions` for why the difference is declared rather
+* than derived.
+*/
 const STATE_SOURCED_READBACK_RULES = {
 	descendArrays: false,
 	trustAnyExpression: true,
 	sourceIsSameGeneration: true
 };
 /**
+* {@link STATE_SOURCED_READBACK_RULES} for a caller that KNOWS its bag becomes
+* a drift BASELINE — `observedProperties` and nothing else (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Identical on the three shape flags, so every relaxation and refusal the
+* readback path already had applies unchanged; the only difference is that a
+* position this pass cannot certify is written as {@link SECRET_MASK} rather
+* than as the DECRYPTED readback. Passed by `cdkd state refresh-observed` and
+* derived by {@link scrubResourceRecord} for the observed bag — the deploy's
+* `drainObservedCaptures` baseline reaches it that way. `cdkd import`'s own
+* capture still passes the non-failing constant and keeps the residue; moving
+* it is a one-constant change in `src/cli/commands/import.ts`.
+*/
+const STATE_SOURCED_BASELINE_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true,
+	failClosedOnUncertifiedPositions: true
+};
+/**
 * A STATE source that is no longer this bag's own generation — `cdkd scrub`'s
 * `observedProperties` walk (issue #1917 review).
 *
@@ -12397,7 +12442,7 @@ function isSecretExpressionByVerdictOrSpelling(expression) {
 * so the position source is present with no map beside it.
 *
 * `cdkd state refresh-observed` and the deploy's `drainObservedCaptures` are
-* NOT affected: they take `STATE_SOURCED_READBACK_RULES`, which sets
+* NOT affected: they take a `STATE_SOURCED_*` readback constant, which sets
 * `sourceIsSameGeneration`, so {@link refuseUncertifiedReadbackPositions}
 * restores the source even under the old strict class.
 *
@@ -13312,7 +13357,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -13323,7 +13368,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 * Is this rules constant one whose BAG is an AWS readback and whose SOURCE is a
 * persisted STATE bag?
 *
-* Today that is {@link STATE_SOURCED_READBACK_RULES} alone: the path where the
+* Today that is {@link STATE_SOURCED_READBACK_RULES} and its fail-closed twin
+* {@link STATE_SOURCED_BASELINE_RULES}, which differ on nothing this predicate
+* reads (issue #2852 added a DESTINATION flag, not a shape one): the path where
+* the
 * secrets map can be EMPTY by construction (nothing was resolved), so the value
 * scan has no needles and POSITION is the only mechanism left. Derived from the
 * flags rather than compared against the constant so a future one with the same
@@ -13819,6 +13867,23 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 */
 const POSITION_DECIDED = Symbol("position decided by a position pass");
 /**
+* Marks a STRING leaf {@link refuseUncertifiedReadbackPositions} REFUSED — a
+* position whose source subtree proves a dynamic reference lives there while
+* the walk could not pair the two sides, so the readback value at it may be a
+* decrypted secret (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* A THIRD state, not a second spelling of {@link POSITION_DECIDED}, and the
+* difference is what keeps the fail-closed change from REGRESSING the derived
+* needles issue #2012 added. `POSITION_DECIDED` tells
+* {@link preferPositionDecisions} "this leaf is mine, the scan may not touch
+* it"; a refusal makes the opposite claim — the pass has NO answer here, only
+* the knowledge that the raw value is unsafe. So the scan still gets to win at
+* such a leaf (a derived needle NAMES the expression, which is strictly better
+* than a mask), and the mask stands only where nothing else spoke.
+*/
+const POSITION_UNCERTIFIED = Symbol("position refused by a position pass");
+/**
 * Record one (plaintext -> expression) pair, or strike the plaintext out.
 *
 * Below {@link MIN_NEEDLE_LENGTH} nothing is recorded, and this floor DECIDES
@@ -14080,11 +14145,13 @@ function asIndex(marks, index) {
 * newly extending #2427 to the EMPTY-map path, where the unchanged-resource
 * `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
 * the result to the live resource. With the guard a non-plain leaf falls
-* through to `refused`. That is the position passes' own answer — usually the
-* bag by identity, though NOT universally: their object arm has no prototype
-* guard of its own, so a non-plain leaf whose source subtree carries a
-* reference is already flattened one function earlier. Same defect as issue
-* #2427, one layer up, and out of this lane's scope.
+* through to `refused`. That is the position passes' own answer, which is the
+* bag by identity: their object arm carried no prototype guard of its own until
+* issue [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain
+* leaf whose source subtree carries a reference WAS already flattened one
+* function earlier and this guard could only keep a `{}` intact. Both halves
+* are guarded now; the remaining copy of the defect is the VALUE scan's own
+* walk, which is issue #2427 and a different pass.
 *
 * The net effect is byte-identical to the FIRST ordering on every input where
 * the un-certification did not fire — which is the whole point: it keeps that
@@ -14098,7 +14165,9 @@ function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
 	}
 	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
 	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
-	return scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	const scanDecision = scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	if (marks === POSITION_UNCERTIFIED && !(typeof scanDecision === "string" && isSingleDynamicReferenceToken(scanDecision))) return refused;
+	return scanDecision;
 }
 /**
 * DERIVED NEEDLES (issue [#2012](https://github.com/go-to-k/cdkd/issues/2012)):
@@ -14168,7 +14237,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 		poisoned: /* @__PURE__ */ new Set(),
 		inferred: /* @__PURE__ */ new Set()
 	};
-	refuseUncertifiedReadbackPositions(bag, source, secrets, collector);
+	refuseUncertifiedReadbackPositions(bag, source, secrets, false, collector);
 	if (collector.needles.size === 0) return void 0;
 	const certain = /* @__PURE__ */ new Map();
 	const inferred = /* @__PURE__ */ new Map();
@@ -14179,6 +14248,149 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 /**
+* FAIL CLOSED over one readback subtree the position walk could not certify
+* (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Every STRING leaf the source cannot account for becomes
+* {@link SECRET_MASK} — at EVERY position it occupies, including a node the bag
+* reaches twice; see the memo below. So does a BINARY leaf, whose bytes are a
+* secret in the clear once `JSON.stringify` writes them. Everything else is
+* kept. Called from
+* {@link refuseUncertifiedReadbackPositions} — through
+* {@link refuseAgainstSource}, and DIRECTLY from its keyed-array arm, which
+* hoists the literal set and re-spells the `failClosed` test — and only where
+* that walk has already established
+* BOTH halves of the evidence: the SOURCE subtree at this position spells a
+* dynamic reference (so the template says a secret lives here), and the two
+* sides cannot be paired (so no position can say WHICH leaf holds its resolved
+* form). Before this, every such branch returned the bag — the decrypted
+* readback — verbatim.
+*
+* "The source cannot account for" is the whole claim, and it is deliberately
+* WEAKER than "no plaintext survives": a leaf the source spells verbatim is
+* kept, so a readback that echoes a template literal back keeps it. What the
+* pass guarantees is that no leaf survives on the strength of the walk having
+* given up.
+*
+* WHY A MASK RATHER THAN THE SOURCE. Substituting the source is what the
+* certified rows do, and it is exactly what the array arm's own comment (and
+* the issue #1915 fences) refuse here: with no pairing, writing the source
+* fabricates baseline content AWS never reported, which `cdkd drift --revert`
+* then pushes to the live resource. A mask fabricates no content — it keeps
+* the bag's SHAPE, adds no key, no element and no scalar-over-container — and
+* `SECRET_MASK` is already a first-class persisted state with its own
+* downstream guards (`drift.ts`'s `collectSecretMaskPaths` /
+* `preserveLiveValuesAtMaskedLeaves`, `runAccept`'s refusal,
+* `rollback-executor.ts`'s `refuseMaskedReplayBaseline`), because the
+* mask-only channel (issue #2274) already puts one there.
+*
+* WHY STRINGS ONLY. A recorded secret is a `string` by the type of
+* {@link RecordedSecretValues}, so a number, a boolean or `null` cannot BE a
+* resolved secret and masking one would only cost drift a comparison. A
+* NON-PLAIN object (a `Date` an AWS SDK readback carries, a `Buffer`) is
+* returned BY IDENTITY for the same reason plus a second one: rebuilding it
+* from its own enumerable keys yields `{}` — the corruption of issue
+* [#2869](https://github.com/go-to-k/cdkd/issues/2869).
+*
+* A leaf that IS a whole `{{resolve:...}}` token is kept: it is an expression
+* AWS echoed back unresolved, not plaintext, and replacing it with a mask would
+* DESTROY a value `cdkd drift` can re-resolve. WHOLE, not "contains one" — that
+* wider test spared `postgres://admin:<plaintext>@{{resolve:ssm-secure:/h}}`,
+* where the embedded token vouched for a leaf that was mostly the decrypted
+* secret. The residual is the issue #1917 shape — a plaintext that merely LOOKS
+* like a token — which every arm of this module already trusts.
+*
+* SO IS A LEAF THE SOURCE SUBTREE ITSELF SPELLS, and this is what keeps the
+* fail-closed change from emptying an ordinary drift baseline. `sourceLiterals`
+* is {@link wholeStringLeavesOf} over the SOURCE at the refused position — the
+* literal frame of an `Fn::Join`, the anchor values of an array AWS reordered,
+* every ordinary property beside the reference. A value the template SPELLS is
+* not the resolved form of a reference, so masking it buys nothing; and where
+* it coincides with one, that plaintext is already sitting in the record's own
+* `properties`, so the copy in the readback is not the disclosure. Scoped to
+* the SOURCE AT THE REFUSED POSITION rather than the whole record on purpose: a
+* coincidence three properties away is not evidence about this one. Read that
+* literally — when an ARRAY refuses element by element the refused position is
+* the array, so a SIBLING element's literal does spare a leaf. That is the
+* intended granularity (the elements are peers of one list AWS returned
+* together, and the pairing that failed is between the two LISTS), and it is
+* stated because "subtree" reads narrower than the code is.
+*
+* OVER-MASKING IS THE REMAINING COST AND IT IS THE INTENDED DIRECTION: a value
+* AWS NORMALISED (`us-east-1` returned as `US-EAST-1`) no longer matches the
+* source and is masked with the secret, because nothing distinguishes them once
+* the pairing is gone. That is phantom drift rather than a disclosure — the
+* same way this module chooses to be wrong at
+* {@link mixedLeafMayCarryPublicReference}.
+*
+* `mark` is {@link refuseUncertifiedReadbackPositions}'s MARK MODE, threaded
+* so the parallel tree keeps the same shape: {@link POSITION_UNCERTIFIED}
+* lands wherever the substituting pass puts a mask, and the bag's own value
+* everywhere else — which is that mode's contract.
+*/
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+	if (typeof value === "string") {
+		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (value === "") return value;
+		return mark ? POSITION_UNCERTIFIED : "***";
+	}
+	if (value === null || typeof value !== "object") return value;
+	const memo = seen.get(value);
+	if (memo !== void 0) return memo;
+	if (Array.isArray(value)) {
+		const out = [];
+		seen.set(value, out);
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		return out;
+	}
+	if (isPlainObject$2(value) && hasPlainPrototype(value)) {
+		const out = Object.create(null);
+		seen.set(value, out);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		return out;
+	}
+	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
+	seen.set(value, value);
+	return value;
+}
+/**
+* {@link refuseUncertifiedSubtree} over a bag whose SOURCE is in hand, so the
+* literal set can never be built from anything but the source at the SAME
+* position.
+*
+* NOT the only spelling, and an earlier revision of this sentence said it was.
+* The keyed-array arm calls {@link refuseUncertifiedSubtree} DIRECTLY, because
+* it hoists the literal set out of its `bag.map` — so it also re-spells the
+* `failClosed` test this function owns. A future edit that drops that
+* re-spelling drops the DESTINATION check with it, which is why the two are
+* named here rather than left to be noticed.
+*/
+function refuseAgainstSource(bag, source, failClosed, mark) {
+	if (failClosed !== true) return bag;
+	return refuseUncertifiedSubtree(bag, wholeStringLeavesOf(source), mark);
+}
+/**
+* Does any element of `source` that the bag did NOT pair carry a dynamic
+* reference (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852))?
+*
+* The evidence that licenses refusing the bag's own unpaired elements in the
+* IDENTITY-KEYED array arm. An identity key that does not round-trip
+* byte-identically — AWS case-normalises a `Name`, or expands one to an ARN —
+* drops its element to `partner === undefined`, and the element the source
+* spells as a reference is then left over with nothing pointing at it, so its
+* resolved plaintext is somewhere in the unpaired remainder.
+*
+* The converse is why this is a QUESTION rather than a blanket refusal: when
+* every reference-bearing source element DID find its partner, an extra bag
+* element is a peer AWS added (another `Environment` entry) and carries no
+* secret this source can account for. Refusing those would mask ordinary
+* readback content for no evidence, which is the same trade the object arm's
+* extra-KEY branch declines to make.
+*/
+function unpairedSourceCarriesReference(source, key, bagIdentities) {
+	return source.some((item) => !bagIdentities.has(item[key]) && subtreeHasDynamicReference(item));
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -14200,15 +14412,42 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 *   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
 *   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          take source*
 *   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          take source*
-*   ...either of those, but REORDERED / normalised    LEAK          LEAK (#2012)
-*   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
-*   an observed KEY the source does not carry         LEAK          LEAK (#2012)
+*   ...either of those, but REORDERED / normalised    LEAK          MASK (#2852)
+*   an UNPAIRED element, source reference left over   LEAK          needle | MASK
+*   an UNPAIRED element, every source reference paired LEAK         needle (#2012)
+*   a RESHAPED container / added wrapper level        LEAK          MASK (#2852)
+*   a source leaf promoted to a container             LEAK          MASK (#2852)
+*   a RAW `Fn::Join` source vs a STRING readback      LEAK          MASK (#2846)
+*   an observed KEY the source does not carry         LEAK          needle | LEAK
+*   a `Date` under a reference-bearing source subtree `{}`          kept (#2869)
 *   whole `{{resolve:...}}` token                     ok            ok
 *   `Environment[]` keyed by `Name` (issue #1915)     ok            ok
 *   PUBLIC ssm MIXED leaf, POPULATED map               ok            ok
 *   PUBLIC ssm MIXED leaf, EMPTY map                   ok            over-redacts
 * ```
 *
+* MASK rows are the FAIL-CLOSED change of issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852). Every branch this walk
+* could not certify used to `return bag` — the decrypted readback, verbatim —
+* so "cannot pair" and "safe to persist" were the same answer. They are now
+* {@link refuseUncertifiedSubtree}, whose doc argues why a mask rather than the
+* source and why STRING leaves only. `needle | MASK` means the derived needles
+* of issue #2012 are consulted FIRST and the mask stands only where they had
+* nothing to say ({@link preferPositionDecisions}), so no row this table
+* previously closed by a needle is taken back.
+*
+* ONE row is deliberately still open: an observed KEY the source does not carry
+* keeps the plaintext when no needle names it. Refusing there needs evidence
+* that does not exist — the source has NO leaf at that position, so the walk
+* would be guessing — and the cost of guessing is not bounded: a write-only
+* credential AWS never echoes back (RDS `MasterUserPassword` and every
+* `getDriftUnknownPaths` sibling) leaves a reference-bearing source key
+* unpaired on EVERY readback, so keying the refusal on that would mask
+* `Runtime` / `FunctionArn` / `LastModified` for every secret-bearing resource
+* in the account. The extra-KEY asymmetry stated further down is the same
+* argument; issue [#2868](https://github.com/go-to-k/cdkd/issues/2868) owns the
+* shape where the plaintext has no counterpart in the source at all.
+*
 * The last row is the price of the row above it and is tracked as issue
 * [#2036](https://github.com/go-to-k/cdkd/issues/2036): with no map nothing was
 * resolved, so nothing distinguishes a public parameter from a `SecureString`
@@ -14242,7 +14481,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * {@link anchorsCorroboratePairing} answers only one of them and its own doc
 * says nothing in it is sufficient alone.
 *
-* The residual rows are one root cause, not several: no needle and no
+* The MASK rows are one root cause, not several: no needle and no
 * position, so nothing distinguishes a resolved secret from an ordinary
 * literal. They are NOT closed by taking the source subtree, which an earlier
 * revision did and the issue #1915 fences correctly rejected — measured, it
@@ -14257,13 +14496,24 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * The MIXED row is the shape this module itself calls DOMINANT for CDK — an
 * `Fn::Join` around `secret.secretValueFromJson(...)`.
 *
-* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it does close, for
+* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it CERTIFIES, for
 * the same reason the whole-token arm does: a mask is not a value `cdkd drift`
 * can re-resolve, so it would report a permanent phantom — and `cdkd drift
 * --revert` pushes the BASELINE to AWS, so a masked baseline would write the
 * literal `***` onto the live resource (the issue #1498 / #1501 class).
 *
-* The last two rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
+* That is an argument about a row where a SOURCE VALUE IS AVAILABLE, and it
+* decides nothing about a row where none is (issue #2852). There the choice is
+* not mask-versus-source but mask-versus-PLAINTEXT, and the two costs above are
+* both real: `runAccept` refuses a masked change and
+* `preserveLiveValuesAtMaskedLeaves` moves AWS's own value in before `--revert`
+* sends anything, so the mask degrades those two commands on that resource
+* rather than corrupting it — while the plaintext it replaces is the disclosure
+* of GHSA-p5qg-v9gv-hc7w sitting in `state.json`. Do not read the paragraph
+* above as a rule against the mask everywhere; it is a rule about the rows with
+* a certified source.
+*
+* The needle rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
 * #2012) — see {@link deriveReadbackNeedles}. Neither has a position to argue
 * from: an unpaired array element and an observed KEY the source does not carry
 * are both positions with no source leaf to take. What they never lacked was a
@@ -14289,7 +14539,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * drift, and a needle learned from a MIS-paired position is a false redaction
 * everywhere it then matches.
 */
-function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
+function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, learn, mark) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source)) {
 			if (learn) learnWholeTokenNeedle(learn, bag, source);
@@ -14300,25 +14550,26 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, learn, mark) : v;
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key === void 0) {
-			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, learn, mark));
+			if (!unkeyedArrayPairsByAnchors(bag, source)) return refuseAgainstSource(bag, source, failClosed, mark);
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, failClosed, learn, mark));
 		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
+		const orphanLiterals = unpairedSourceCarriesReference(source, key, new Set(bag.map((item) => item[key]))) && failClosed === true ? wholeStringLeavesOf(source) : void 0;
 		return bag.map((item) => {
 			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets, learn, mark);
+			return partner === void 0 ? orphanLiterals !== void 0 ? refuseUncertifiedSubtree(item, orphanLiterals, mark) : item : refuseUncertifiedReadbackPositions(item, partner, secrets, failClosed, learn, mark);
 		});
 	}
-	return bag;
+	return refuseAgainstSource(bag, source, failClosed, mark);
 }
 /**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
@@ -14334,10 +14585,11 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	if (source !== void 0) {
 		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
-		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
+		const failClosed = rules.failClosedOnUncertifiedPositions === true;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
-		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
 		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
@@ -14471,7 +14723,7 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_RULES));
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
 /**
@@ -19910,6 +20162,113 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
+//#endregion
+//#region src/deployment/drain-budget.ts
+/**
+* The drain BUDGET for one intrinsic resolution (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Its own module rather than a corner of `intrinsic-function-resolver.ts`,
+* and that is forced rather than tidy: 70+ unit files `vi.mock` the resolver
+* module, and the ones that REPLACE its exports rather than spreading
+* `...actual` see no new export -- so an opener declared there, whether as a
+* resolver method or as a module-level function, reddens most of
+* `tests/unit/deployment` the moment `deploy-engine.ts` imports it (measured,
+* both ways). A module the engine and the resolver both import, and nobody
+* mocks, is the shape that works.
+*/
+/**
+* Named `drainDeadlines` from when it held one, and kept because the name is
+* cited from several comments and a rename is churn this issue does not need.
+* It holds a {@link DrainBudget} -- remaining WAIT, not an instant.
+*/
+const drainDeadlines = new AsyncLocalStorage();
+/**
+* Run `fn` under ONE drain budget (issue #2563), inheriting the caller's if
+* there is one.
+*
+* A module-level function rather than a resolver METHOD, deliberately: the
+* engine's callers mock the resolver wholesale, and a new method on that
+* surface would make every such mock throw before it resolved anything
+* (measured -- most of `tests/unit/deployment` red).
+*
+* Why a caller needs this. `resolve` opens a budget per CALL, and a caller
+* that resolves in a LOOP therefore gets one cap per iteration: the outputs
+* pass walks `template.Outputs` sequentially, so the DRAIN WAIT it could
+* spend before `saveState`, with the S3 lock held, was `#outputs x` the cap
+* rather than the cap. CloudFormation allows 200 outputs. Wrapping the loop
+* here bounds the total drain WAIT under it at one budget.
+*
+* The budget is REMAINING milliseconds of wait, not a deadline, and that
+* distinction is the whole of it: an absolute deadline is spent by wall
+* clock, so ordinary resolution time between drains burns it although
+* nothing drained -- an output failing with a 5 ms sibling would leave a
+* later one with zero grace after 60 s of clean AWS work. Charged only while
+* a drain is actually waiting, and only once for nested drains whose waits
+* overlap, an iteration that spent nothing keeps its full grace.
+*
+* WHAT IT DOES NOT BOUND, since the cap is not a deadline on the pass: the
+* cap is armed by a REJECTION and bounds only the extra wait a drain takes
+* after one. Ordinary resolution time is outside it entirely -- a lookup
+* that hangs with no sibling rejection anywhere is unbounded here exactly
+* as it was before this issue, and `withResourceDeadline` does not reach
+* the outputs pass. So this wrap bounds aggregate drain grace, not the
+* hold.
+*
+* THE TRADE, stated because it is real: iterations that actually WAIT spend
+* the shared budget, so a later one can find it exhausted and its drain get
+* no grace. That is the same exposure issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814) records for nesting,
+* now reachable across a loop as well -- and on the `Export.Name` leg the
+* cost is a DROPPED write rather than a late one, since that block's
+* `nameSecrets` is a per-iteration local. What bounds it is that only real
+* waiting spends the budget: reaching zero takes a full cap of drain wait
+* inside one pass, not merely a slow pass. It is taken deliberately -- an
+* unbounded hold on a deploy's state save costs a first deploy every
+* resource it just created -- and the caller chooses, since a loop that
+* would rather buy grace per iteration simply does not wrap.
+*
+* `evaluateConditions` deliberately does NOT wrap its loop: a failed
+* condition is downgraded and evaluation continues, it runs before any
+* resource is provisioned, and one condition's slow parts should
+* not spend the next one's budget. Its aggregate is `#conditions x` the cap,
+* with the deploy lock already held -- less severe than the outputs pass,
+* where the state save is the thing waiting, but not lock-free.
+*
+* The other resolve LOOPS in the tree, assessed rather than assumed -- and
+* the first version of this note got two of them wrong, so each is stated
+* with what was checked:
+*
+* - `cdkd scrub` (`scrub.ts`): lock acquired above, `saveState` downstream,
+*   and its resolve loops -- the resources loop, two output loops, and
+*   `resolveCrossStackReads`, a per-leaf loop the other three each invoke.
+*   One budget is hoisted over all of them. That wrap is INLINE rather than
+*   around a callee, so the callee-keyed table in
+*   `intrinsic-resolver-concurrent-drain.test.ts` cannot see it; an
+*   owner-keyed case in that same file fences it instead.
+* - `cdkd import` (`import.ts`): `acquireLock` at the root and per child,
+*   `resolveImportedProperties` loops the resources, `saveState` follows.
+*   WRAPPED at both call sites.
+* - `cdkd export` (`export.ts`): child locks acquired before
+*   `buildResolvedParametersPerStack`, which loops `resolve` over the
+*   intrinsic parameters. WRAPPED.
+* - `diff-recursive.ts`: loops `resolve` over a parent's parameters with no
+*   lock and no state write -- a read-only diff. LEFT per-call, since a
+*   shared budget would buy no safety and would spend one resolution's
+*   grace on the next.
+*
+* The drain is what issue #2563 adds, so the wait in all four is new and
+* bounding it where it can hold something is part of adding it.
+*/
+async function withSharedDrainBudget(fn) {
+	if (drainDeadlines.getStore() !== void 0) return await fn();
+	return await drainDeadlines.run({
+		remaining: void 0,
+		waiting: 0,
+		since: void 0
+	}, fn);
+}
+
 //#endregion
 //#region src/deployment/secret-region-classification.ts
 /**
@@ -22133,6 +22492,170 @@ const MAX_LISTED_AVAILABLE_OUTPUTS = 10;
 */
 const dynamicReferenceRetryDelays = {};
 /**
+* How long {@link allSettledKeepingFirstRejection} waits for the remaining
+* parts AFTER a rejection is in hand. Double the largest FIXED wait in this
+* file (the `Fn::GetAtt` `Ipv6CidrBlocks` poll's sleep budget, 15 attempts
+* x 2 s), which makes it a hang guard rather than a schedule — not a
+* guarantee that healthy work fits inside it; see the function's own note.
+*
+* It is the budget for one CALL of {@link IntrinsicFunctionResolver.resolve}
+* and everything nested under it: nested drains share the REMAINING wait, so
+* a template's nesting depth cannot multiply it. It is NOT a bound on a caller
+* that resolves in a LOOP -- each iteration opens its own budget unless the
+* caller wraps the loop in {@link withSharedDrainBudget}, which the outputs
+* pass does and `evaluateConditions` deliberately does not (its aggregate is
+* `#conditions x` this, before any resource is provisioned but with the
+* deploy lock already held).
+*/
+const DRAIN_AFTER_REJECTION_MS = 6e4;
+/** Sentinel for "the cap expired", distinguishable from any resolved value. */
+const CAP_EXPIRED = Symbol("drain-cap-expired");
+/**
+* Test seam: overriding `ms` lets a unit test drive the cap without a real
+* minute of waiting (mirrors {@link dynamicReferenceRetryDelays}).
+*/
+const concurrentDrainCap = {};
+/**
+* `Promise.all`'s RESULT and its choice of error, with `Promise.allSettled`'s
+* TIMING: every promise started here has settled before this returns, and
+* before it throws unless the cap below expires first (issue
+* [#2563](https://github.com/go-to-k/cdkd/issues/2563)).
+*
+* Why the resolver needs that. Resolving a secret dynamic reference RECORDS
+* `plaintext -> expression` into `context.recordedSecretValues` just before
+* its promise settles, and that map is what every masking and redaction site
+* downstream uses as its needle set. Under a bare `Promise.all` a rejecting
+* part surfaces IMMEDIATELY, so a caller's `catch` / `finally` can run while a
+* sibling part is still in flight: `DeployEngine`'s `Export.Name` block copies
+* its private map into the pass map in exactly such a `finally`, and the
+* sibling's recording then lands in the private map after the copy and reaches
+* nothing. Draining here fixes it for every caller at once, which a
+* consumer-side drain cannot — `cdkd scrub`'s shared-map view (issue
+* [#2531](https://github.com/go-to-k/cdkd/issues/2531)) lets a late write land
+* whenever it happens but still cannot make it land before the next consumer
+* runs.
+*
+* THE ERROR IS SELECTED BY TIME, NOT BY INPUT ORDER, which is what `Promise.all`
+* does and what a naive `Promise.allSettled` + "first rejected entry" would
+* silently change: with two parts rejecting out of input order, the entry scan
+* reports the LATER one. Each promise gets its own `catch`, so the callbacks
+* fire in rejection order and the first assignment wins.
+*
+* Every input is `catch`-ed, so nothing here can raise an unhandled rejection
+* while the drain waits.
+*
+* THE WAIT IS CAPPED ONCE A REJECTION IS IN HAND. The drain exists to let a
+* sibling finish RECORDING, and that is worth a wait — but `resolveOutputs`
+* runs at `deploy-engine.ts`'s worst moment: after every resource has been
+* created in AWS, before the final `saveState`, with the S3 lock held and its
+* heartbeat pushing `expiresAt` forward. An unbounded wait there costs a deploy
+* its state and its lock, and on a FIRST deploy (`currentEtag` undefined, so
+* the incremental saves were no-ops) every created resource becomes invisible
+* to cdkd. Nothing else bounds it: `withRetry` caps ATTEMPTS not duration, no
+* `requestTimeout` is configured, and `withResourceDeadline` wraps
+* `provisionResourceBody` — which does bound the resource path, property
+* resolution included, but not the outputs pass. So once a rejection is
+* recorded the remaining settles race {@link DRAIN_AFTER_REJECTION_MS}, and the
+* recorded rejection is thrown when it expires.
+*
+* The cap is a HANG GUARD, and it does not claim to be more. It is sized
+* against the largest fixed wait in this file — the `Fn::GetAtt`
+* `Ipv6CidrBlocks` poll's sleep budget, 15 attempts x 2 s, about 30 s — but
+* that budget is a floor, not a ceiling: the poll also awaits 15 AWS calls,
+* and one part can drive several lookups in sequence through object
+* properties or `Fn::Sub` variables. Two healthy shapes measured on review
+* already exceed 60 s — three sequential `Ipv6CidrBlocks` polls in one part
+* is 3 x (15 x 2 s) = 90 s with no hang and no throttling, and five throttled
+* dynamic references is 5 x (1+2+4+8 s) = 75 s at
+* `MAX_DYNAMIC_REFERENCE_THROTTLE_RETRIES` = 4. Healthy work CAN therefore
+* outlast the cap, and when it does its recording lands after the rejection
+* was released, which is the window this whole function exists to close.
+* Nothing here cancels that sibling — it keeps running and can record
+* arbitrarily later — so what the cap bounds is the WAIT, not the lateness.
+* That is the trade taken deliberately: a bounded wait with a late record
+* still possible beyond it, against an unbounded hold on a deploy's state
+* save.
+*
+* AND A DRAIN CAN GET NO GRACE AT ALL. The budget is shared REMAINING wait,
+* so a drain that arms once it is spent gets
+* `Math.max(0, remaining - openWindow)` = 0 and releases its rejection on the
+* next macrotask. That applies to any drain NOT ALREADY ARMED when a rejection
+* reaches it: the ordinary case is an inner drain that spends the full budget
+* and throws, whose every not-yet-armed ancestor then arms against an
+* exhausted remaining-wait budget. What it does NOT mean is that a fast sibling is exposed: a
+* sibling still pending at that moment has itself been running at least the
+* budget. What it means is that the sibling's own RECORDING gets no wait --
+* a lookup begun late inside a long-running part is fast in itself and still
+* lands after the rejection was released. That reasoning covers the NESTED
+* ancestor case; a caller that wraps a LOOP widens it, because a later
+* iteration starts FRESH siblings against a budget an earlier one already
+* spent and those need not be long-running at all. So the exposure does not
+* require the "healthy work slower than 60 s" shape the sizing paragraph
+* describes; that shape is the cheapest way to reach it with no nesting and
+* no wrapped loop, not the floor.
+* Residual: issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814).
+*
+* ONE REMAINING CONSEQUENCE, deliberate and pinned by a case rather than only
+* described: the earliest-in-time rule holds PER INVOCATION, not across
+* NESTED resolutions. For a join whose parts are `[listWithAnEarlyFailure,
+* laterFailure]`, the inner list's drain holds its own rejection while its
+* slow sibling finishes, so the outer join captures the later failure first
+* and reports that instead. That is not only cosmetic: the retry classifiers
+* DO read the message (`retryClassificationText` feeds
+* `isRetryableTransientError`, whose `RETRYABLE_ERROR_MESSAGE_PATTERNS` is an
+* explicit substring table), so swapping which failure surfaces can swap a
+* transient verdict for a terminal one. What does not change is that the
+* resolution FAILS: both are genuine failures of the same resolve, and the
+* selection was already timing-dependent — `Promise.all` reports whichever
+* lost the race. The drain adds a systematic bias toward the SHALLOWER
+* failure where the old race was arbitrary. Residual: issue
+* [#2805](https://github.com/go-to-k/cdkd/issues/2805).
+*/
+async function allSettledKeepingFirstRejection(promises) {
+	let rejection;
+	const shared = drainDeadlines.getStore();
+	let armCap;
+	const guarded = promises.map((promise) => promise.catch((error) => {
+		if (rejection === void 0) {
+			rejection = { error };
+			armCap?.();
+		}
+	}));
+	let capTimer;
+	let charged = false;
+	const capped = new Promise((resolve) => {
+		armCap = () => {
+			const budget = concurrentDrainCap.ms ?? DRAIN_AFTER_REJECTION_MS;
+			let wait = budget;
+			if (shared !== void 0) {
+				shared.remaining ??= budget;
+				const openWindow = shared.since === void 0 ? 0 : Date.now() - shared.since;
+				wait = Math.max(0, shared.remaining - openWindow);
+				if (shared.waiting === 0) shared.since = Date.now();
+				shared.waiting += 1;
+				charged = true;
+			}
+			capTimer = setTimeout(() => resolve(CAP_EXPIRED), wait);
+		};
+	});
+	try {
+		const outcome = await Promise.race([Promise.all(guarded), capped]);
+		if (rejection !== void 0) throw rejection.error;
+		if (outcome === CAP_EXPIRED) throw markNonRetryable(/* @__PURE__ */ new Error("drain cap expired with no rejection recorded"));
+		return outcome;
+	} finally {
+		if (capTimer !== void 0) clearTimeout(capTimer);
+		if (charged && shared !== void 0) {
+			shared.waiting -= 1;
+			if (shared.waiting === 0 && shared.since !== void 0) {
+				shared.remaining = Math.max(0, (shared.remaining ?? 0) - (Date.now() - shared.since));
+				shared.since = void 0;
+			}
+		}
+	}
+}
+/**
 * Is `region` safe to build an AWS SDK client from?
 *
 * This is a SECURITY gate, not an AWS region registry, and the distinction
@@ -23035,7 +23558,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* Resolve all intrinsic functions in a value
 	*/
 	async resolve(value, context) {
-		return await this.resolveValue(value, context);
+		return await withSharedDrainBudget(() => this.resolveValue(value, context));
 	}
 	/**
 	* Evaluate all conditions in the template
@@ -23077,7 +23600,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 		};
 		for (const name of Object.keys(templateConditions)) try {
-			await evaluateByName(name);
+			await withSharedDrainBudget(() => evaluateByName(name));
 		} catch (error) {
 			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
@@ -23093,7 +23616,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await Promise.all(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
@@ -23397,7 +23920,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const [rawLogicalId, rawAttributeName] = getAtt;
 			logicalId = rawLogicalId;
 			const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(resolvedAttributeName)}`);
+			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
@@ -23410,13 +23933,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			if (flatValue !== void 0) {
-				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId);
+				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, nameServers)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, nameServers), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, flatValue), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -23429,17 +23952,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, cursor)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, cursor), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, value)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, value), context)}`);
 		return value;
 	}
 	/**
@@ -23490,7 +24013,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const read = `${logicalId}.${attributeName}`;
+			const read = `${logicalId}.${this.maskSecretsForLog(attributeName, context)}`;
 			if (!context.redactedAttributeReads.includes(read)) context.redactedAttributeReads.push(read);
 		}
 		return value;
@@ -23524,10 +24047,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* honest answer is to say so and name the remedy: the record heals on the
 	* resource's next in-place update (#1727).
 	*/
-	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -23572,7 +24095,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -23585,14 +24108,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* result. Keep this method's NAME — `scripts/gen-sdk-attr-coverage.ts` reads
 	* the resource types it references.
 	*/
-	async constructAttribute(resource, attributeName, _context, logicalId, accountInfo) {
+	async constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 		const { resourceType, physicalId } = resource;
 		const { accountId, partition } = accountInfo;
 		const region = canonicalizeRegion(accountInfo.region);
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return s3BucketArn(physicalId, region);
@@ -23600,12 +24123,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "RegionalDomainName": return s3BucketRegionalDomainName(physicalId, region);
 			case "DualStackDomainName": return s3BucketDualStackDomainName(physicalId, region);
 			case "WebsiteURL": return s3BucketWebsiteUrl(physicalId, region);
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -23617,7 +24140,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${JSON.stringify(blocks)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
@@ -23634,38 +24157,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
 			case "UserPoolId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -23675,41 +24198,41 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
 			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -23721,38 +24244,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -23764,26 +24287,26 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
 			case "TopicName": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -23807,16 +24330,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const serviceName = physicalId.substring(pipeIdx + 1);
 				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
 			case "InstanceId": return physicalId;
@@ -23850,13 +24373,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 						cachedEc2InstanceAttributes[cacheKey] = value;
 						return value;
 					}
-					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${attributeName}; returning physical ID`);
+					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${this.maskSecretsForLog(attributeName, context)}; returning physical ID`);
 				} catch (err) {
-					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return physicalId;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -23865,14 +24388,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
 			if (attributeName === "LaunchTemplateId") return physicalId;
-			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
-		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 	}
 	/**
 	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
@@ -23901,13 +24424,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* route through this helper — those are explicit `case`s in the
 	* per-type handlers.
 	*/
-	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
-		if (expectsArnShape || expectsUrlShape) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
+		if (expectsArnShape || expectsUrlShape) {
+			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+		}
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
-		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
+		this.logger.warn(`Unknown attribute ${this.maskSecretsForLog(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
 	/**
@@ -23920,7 +24446,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let values = rawValues;
 		if (!Array.isArray(values)) values = await this.resolveValue(values, context);
 		if (!Array.isArray(values)) throw new Error(`Fn::Join's second argument must be a list (an array literal or a list-returning intrinsic such as Fn::Cidr / Fn::GetAZs / Fn::Split / a Ref to a list-typed parameter — any List<...> type or CommaDelimitedList), but resolved to ${typeof values}`);
-		let result = (await Promise.all(values.map(async (v) => {
+		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
 		}))).join(delimiter);
@@ -24108,13 +24634,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, getAttError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, refError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -24148,7 +24674,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return `{{Fn::Select:${index}:OutOfBounds}}`;
 		}
 		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24292,7 +24818,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 		}
 		const result = resolvedValue.split(delimiter);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24323,7 +24849,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved1 = await this.resolveValue(value1, context);
 		const resolved2 = await this.resolveValue(value2, context);
 		const result = JSON.stringify(resolved1) === JSON.stringify(resolved2);
-		this.logger.debug(`Resolved Fn::Equals: ${this.maskSecretsForLog(JSON.stringify(resolved1), context)} === ${this.maskSecretsForLog(JSON.stringify(resolved2), context)} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Equals: ${JSON.stringify(this.maskValueLeaves(resolved1, context))} === ${JSON.stringify(this.maskValueLeaves(resolved2, context))} -> ${result}`);
 		return result;
 	}
 	/**
@@ -24471,7 +24997,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (context.recordedSecretValues) recordMaskOnlyValuesIn(recovered, context.recordedSecretValues);
 				return recovered;
 			}
-			if (context.redactedAttributeReads !== void 0 && !context.redactedAttributeReads.includes(origin)) context.redactedAttributeReads.push(origin);
+			if (context.redactedAttributeReads !== void 0) {
+				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				if (!context.redactedAttributeReads.includes(loggedOrigin)) context.redactedAttributeReads.push(loggedOrigin);
+			}
 		}
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
@@ -24587,12 +25116,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
 				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
@@ -24606,30 +25135,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
 			if (context.stackName && refStack === context.stackName) {
-				this.logger.debug(`Skipping current stack: ${refStack}`);
+				this.logger.debug(`Skipping current stack: ${this.maskSecretsForLog(refStack, context)}`);
 				continue;
 			}
 			try {
 				const lookupRegion = refRegion ?? this.resolverRegion ?? "";
 				if (!lookupRegion) {
-					this.logger.debug(`No region available for stack '${refStack}' — skipping (cdkd cannot read state without a region)`);
+					this.logger.debug(`No region available for stack '${this.maskSecretsForLog(refStack, context)}' — skipping (cdkd cannot read state without a region)`);
 					continue;
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${refStack} (${lookupRegion})`);
+					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${lookupRegion})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${refStack} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
 						producerRegion: lookupRegion
 					}).catch((err) => {
-						this.logger.debug(`Failed to patch exports index for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
+						this.logger.debug(`Failed to patch exports index for '${this.maskSecretsForLog(exportName, context)}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 					});
 					this.recordImport(context, exportName, refStack, lookupRegion);
 					found = {
@@ -24640,7 +25169,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 			} catch (error) {
-				this.logger.warn(`Failed to read state for stack ${refStack}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to read state for stack ${this.maskSecretsForLog(refStack, context)}: ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 				continue;
 			}
 		}
@@ -24656,7 +25185,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return cfnExport.value;
 			}
 		}
-		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
+		throw new Error(`Fn::ImportValue: export '${loggedExportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
 	}
 	/**
 	* CloudFormation `ListExports` fallback lookup for `Fn::ImportValue`
@@ -24687,7 +25216,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -24757,7 +25286,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(region, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -24866,7 +25395,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${stripControlChars(resolvedRegion).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
 		}
 		let roleArn;
@@ -24875,10 +25404,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(region, context)}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		const loggedRegion = this.maskSecretsForLog(region, context);
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
@@ -24886,24 +25416,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
+						throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in CloudFormation stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
-					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
-			throw new Error(`Fn::GetStackOutput: stack '${stackName}' not found in region '${region}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-			throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in stack '${stackName}' (${region}). Available outputs: ${available}`);
+			throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
 			stackName,
 			region,
@@ -25021,19 +25551,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (!map) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: mapping '${mapName}' not found in Mappings section`);
+			throw new Error(`Fn::FindInMap: mapping '${this.maskSecretsForLog(mapName, context)}' not found in Mappings section`);
 		}
 		const topLevel = Object.hasOwn(map, topLevelKey) ? map[topLevelKey] : void 0;
 		if (!topLevel || typeof topLevel !== "object") {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: top-level key '${topLevelKey}' not found in mapping '${mapName}'`);
+			throw new Error(`Fn::FindInMap: top-level key '${this.maskSecretsForLog(topLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}'`);
 		}
 		if (!Object.hasOwn(topLevel, secondLevelKey)) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: second-level key '${secondLevelKey}' not found in mapping '${mapName}' -> '${topLevelKey}'`);
+			throw new Error(`Fn::FindInMap: second-level key '${this.maskSecretsForLog(secondLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}' -> '${this.maskSecretsForLog(topLevelKey, context)}'`);
 		}
 		const result = topLevel[secondLevelKey];
-		this.logger.debug(`Resolved Fn::FindInMap: ${mapName}.${topLevelKey}.${secondLevelKey} -> ${JSON.stringify(result)}`);
+		this.logger.debug(`Resolved Fn::FindInMap: ${this.maskSecretsForLog(mapName, context)}.${this.maskSecretsForLog(topLevelKey, context)}.${this.maskSecretsForLog(secondLevelKey, context)} -> ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(result, context)), context)}`);
 		return result;
 	}
 	/**
@@ -25046,6 +25576,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
+		if (context.recordedSecretValues && this.maskSecretsForLog(resolvedValue, context) !== resolvedValue) recordMaskOnlyValue(context.recordedSecretValues, result);
 		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(resolvedValue, context)} -> ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
@@ -25077,7 +25608,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let clientRegion;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${stripControlChars(resolvedValue).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
 		} else {
@@ -25086,7 +25617,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${region} -> ${JSON.stringify(cached)}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
 		const ec2Client = this.clientsForRegion(clientRegion).ec2;
@@ -25100,11 +25631,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${region}': ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${region}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${region} -> ${JSON.stringify(azNames)}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -25150,6 +25681,95 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secrets && secrets.size > 0) masked = maskSecretsInText(masked, secrets);
 		return masked;
 	}
+	/**
+	* A copy of `value` with every string LEAF (and every object KEY) masked, for
+	* a caller about to ENCODE it into a message (issue
+	* [#2759](https://github.com/go-to-k/cdkd/issues/2759)).
+	*
+	* `stringifyValue` / `JSON.stringify` ESCAPE a leaf containing `"`, `\` or a
+	* control character, and {@link maskSecretsInText} matches a needle
+	* LITERALLY — so masking the ENCODED text misses exactly the plaintexts the
+	* encoder rewrote (`pa"ss\word12` encodes to `["pa\"ss\\word12"]`, which no
+	* needle matches). Masking each leaf first also buys the WHOLE-VALUE arm,
+	* which has no {@link MIN_NEEDLE_LENGTH} floor, for a leaf that IS the
+	* plaintext.
+	*
+	* Returns the STRUCTURE rather than a rendered string, deliberately: each
+	* call site keeps its own encoder, so this changes which characters are
+	* masked and nothing about how a value RENDERS. Encoding here instead
+	* dropped `JSON.stringify`'s quotes around a bare string and made a `cdkd
+	* scrub` log line unrecognisable to its own test.
+	*
+	* Object KEYS are masked too: a `Fn::Split` / `Fn::GetAtt` chain can put a
+	* resolved value in key position, and an unmasked key discloses exactly as
+	* much as an unmasked value.
+	*
+	* Cycle-safe by MEMOIZATION rather than a depth cap: a self-referential
+	* structure terminates (the replacement is registered before its children are
+	* walked, so the cycle closes on it) and a legal deep one is still walked to
+	* the bottom. A repeated but NON-cyclic sub-object gets its real rendering
+	* rather than a placeholder — see the note at the `Map`.
+	*/
+	maskValueLeaves(value, context) {
+		const done = /* @__PURE__ */ new Map();
+		const walk = (node) => {
+			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (node === null || typeof node !== "object") return node;
+			const memo = done.get(node);
+			if (memo !== void 0) return memo;
+			if (Array.isArray(node)) {
+				const out = [];
+				done.set(node, out);
+				for (const item of node) out.push(walk(item));
+				return out;
+			}
+			const out = Object.create(null);
+			done.set(node, out);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			return out;
+		};
+		return walk(value);
+	}
+	/**
+	* Mask `value`, STRIP its control characters, then mask again — the shape a
+	* message that truncates its input needs (issue
+	* [#2827](https://github.com/go-to-k/cdkd/issues/2827) review round 1).
+	*
+	* NEITHER SINGLE ORDER IS CORRECT, and both were measured. Masking AFTER
+	* `stripControlChars` is what this fix was written to avoid: the strip
+	* rewrites the text a literal needle has to match. But masking BEFORE it is
+	* not safe either, because `stripControlChars` DELETES rather than replaces —
+	* so a plaintext SPLIT by an invisible (`S3cret\u200ePassw0rd`) is missed by
+	* the first mask and then RECONSTITUTED contiguous by the strip. That is the
+	* go-to-k/cdkd#2874 class arriving through a different door.
+	*
+	* Masking in BOTH string spaces closes both: the first pass catches a needle
+	* that occurs literally, the second catches one that only becomes contiguous
+	* after stripping. `maskSecretsInText` is idempotent, so the overlap costs
+	* nothing, and the caller truncates AFTERWARDS — never between the two.
+	*
+	* WHICH HALF IS FENCED, stated because a mutation probe made the difference
+	* visible. The FIRST mask is demonstrated by a test: deleting it (masking
+	* only after the strip) reds the split-needle case, because the recorded
+	* needle is then the split form and the strip has destroyed it. The SECOND
+	* mask is NOT reached by any test here and is defence in depth: it earns its
+	* place only when the bag holds a needle that is the STRIPPED form of the
+	* value in hand, and every route through THIS resolver records the value it
+	* actually resolved — so the split copy is itself a needle and the first
+	* mask already catches it. The shape was measured against a hand-built bag
+	* during review, not produced by the resolver. Kept anyway: it is one
+	* idempotent call, and the alternative is re-deciding per future caller
+	* whether the bag and the value can disagree.
+	*
+	* THE BOUND, since this file's job is to state them: this covers a needle
+	* split by a character `stripControlChars` removes. A needle split by
+	* anything else, or one whose canonical form differs for another reason, is
+	* `outputs-export-alias.ts`'s `canonicalForSecretScan` problem and is not
+	* solved here.
+	*/
+	maskThenStripThenMask(value, context) {
+		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+	}
 	async resolveDynamicReferences(value, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
@@ -25164,7 +25784,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
 				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferences(fullMatch, withoutProducerRegions(context));
 				result = result.replace(fullMatch, () => foreign);
@@ -25209,7 +25829,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
 				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(fullMatch, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
@@ -25273,22 +25893,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`, context));
+		const loggedSecretId = this.maskSecretsForLog(secretId, context);
+		const loggedJsonKey = this.maskSecretsForLog(jsonKey, context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(versionStage, context)}:${this.maskSecretsForLog(versionId, context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`secretsmanager:${secretId}`, context))).SecretString;
-		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`)).SecretString;
+		if (!secretString) throw new Error(`Dynamic reference: secret '${loggedSecretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const parsed = JSON.parse(secretString);
 			const keyValue = Object.hasOwn(parsed, jsonKey) ? parsed[jsonKey] : void 0;
-			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${jsonKey}' not found in secret '${secretId}'`);
+			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${loggedJsonKey}' not found in secret '${loggedSecretId}'`);
 			return stringifyValue(keyValue);
 		} catch (error) {
-			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${secretId}' is not valid JSON but JSON_KEY '${jsonKey}' was specified`);
+			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${loggedSecretId}' is not valid JSON but JSON_KEY '${loggedJsonKey}' was specified`);
 			throw error;
 		}
 		return secretString;
@@ -25314,8 +25936,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const ipBlock = await this.resolveValue(rawIpBlock, context);
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
-		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(ipBlock)}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${ipBlock}, count=${count}, cidrBits=${cidrBits}`);
+		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -25347,7 +25969,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				results.push(`${a}.${b}.${c}.${d}/${subnetPrefix}`);
 			}
 		}
-		this.logger.debug(`Fn::Cidr result: ${JSON.stringify(results)}`);
+		this.logger.debug(`Fn::Cidr result: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(results, context)), context)}`);
 		return results;
 	}
 	/** Expand IPv6 address to full 8-group form */
@@ -25437,21 +26059,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: ${service}:${parameterName}`, context));
+		const loggedParameterName = this.maskSecretsForLog(parameterName, context);
+		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`${service}:${parameterName}`, context));
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`);
 		const paramValue = response.Parameter?.Value;
-		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
+		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(this.maskSecretsForLog(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`, context));
+			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
 			value: paramValue,
@@ -26660,7 +27283,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CQrHElrl.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C_AHAmgD.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -31137,6 +31760,134 @@ function isExportAliasCollision(exportName, outputKey, ownedOutputNames) {
 */
 const MIN_SECRET_NEEDLE = 4;
 /**
+* Characters deleted before any secret containment test on this path, and
+* deleted from the text that gets PRINTED — ONE class, because the verdict and
+* the printed text have to live in the same string space (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)).
+*
+* WHY A THIRD CLASS RATHER THAN EITHER SANITISER'S. `stripControlChars`
+* DELETES its class; `displaySafe` REPLACES its own with a space. Composing
+* them — which is what every site here used to do — leaves three different
+* strings in play: the raw key the verdict was taken from, the sanitised key
+* that was printed, and the masked one in between. A recorded secret split by
+* a DELETED character is absent from the raw key and contiguous in the printed
+* one, so the verdict said `safe` over text that held the plaintext; a secret
+* split by a REPLACED one is absent from both and prints one character short
+* of the plaintext, which a `not.toContain(SECRET)` assertion cannot see.
+* Measured across both classes: eight of ten characters reconstituted the
+* secret verbatim, and the remaining two printed it minus one character.
+*
+* So the fix is not another arm on the check — it is removing the second and
+* third string. Everything below happens in `canonicalForSecretScan` space.
+*
+* THE CLASS IS DERIVED FROM UNICODE CATEGORIES, NOT ENUMERATED. A hand list
+* was written first -- both sanitisers' classes plus the four residuals
+* `display-safe.ts` names -- and review measured it arbitrary: `U+2060`
+* (WORD JOINER) verdicted `safe` and printed visibly-contiguous plaintext
+* while `U+FEFF` was caught, and `U+2060` is the character Unicode itself
+* designates as the replacement for `U+FEFF` in that role. Eight more did the
+* same (`U+00AD`, `U+180E`, `U+FE0F`, `U+3164`, `U+2061`, `U+FFFB`, `U+115F`,
+* `U+17B4`). A list of the invisibles somebody happened to think of is not a
+* boundary; the general categories are.
+*
+* - `\p{Cc}` control and `\p{Cf}` format: the C0 / C1 and DEL ranges, the bidi
+*   marks / embeddings / overrides / isolates, the zero-width set, `U+FEFF`,
+*   `U+00AD`, `U+061C`, and the invisible-operator block.
+* - `\p{Zl}` / `\p{Zp}`: `U+2028` / `U+2029`, the two `displaySafe` REPLACES.
+* - `\p{Default_Ignorable_Code_Point}`: Unicode's own INTENT-TO-BE-IGNORED
+*   property, which carries the variation selectors, the Mongolian free
+*   variation selectors, the Hangul fillers and `U+034F` COMBINING GRAPHEME
+*   JOINER.
+*
+* - `\p{Me}` ENCLOSING marks. The same zero-advance-width shape as `\p{Mn}`
+*   below, and INCLUDED rather than deferred because the cost argument that
+*   defers `\p{Mn}` does not transfer: `\p{Me}` is about a dozen code points
+*   with no legitimate use in a resource name.
+*
+* NAMED RESIDUAL, because `\p{Default_Ignorable_Code_Point}` is Unicode's
+* INTENT-TO-BE-IGNORED property and NOT "everything that renders as nothing"
+* -- an earlier revision of this comment claimed the latter and review refuted
+* it. NONSPACING marks (`\p{Mn}`) carry zero advance width, so a secret split
+* by one renders contiguous while this class keeps it: measured with `U+09BC`,
+* which verdicts `safe` AND publishes the alias. Not widened here, because
+* `\p{Mn}` is the diacritics of Devanagari, Arabic, Hebrew and Vietnamese and
+* deleting it would mangle legitimate names for every user. Tracked as issue
+* [#2889](https://github.com/go-to-k/cdkd/issues/2889), which also carries the
+* homoglyph question. `origin/main` behaves identically, so this is a recorded
+* residual rather than something this change introduced.
+*
+* THE THIRD BULLET REPLACED A HAND TAIL, and the hand tail was measured
+* leaking. A first cut listed the ranges by hand -- `FE00-FE0F`,
+* `E0100-E01EF`, `180B-180D`, `115F`, `1160`, `3164`, `FFA0`, `17B4`, `17B5`
+* -- and review found `U+034F` outside it, printing `hunter2hunter2` in a
+* `warn` line under a `safe` verdict. It also spelled `180B-180D` while
+* calling itself "the Mongolian FVS", missing `U+180F`, which Unicode 14
+* added. Naming the PROPERTY is what makes the next such addition arrive
+* covered instead of arriving as another finding.
+*
+* WIDENED HERE AND NOT IN `display-safe.ts` because the two files answer
+* different questions. `displaySafe` is about a terminal rendering a value,
+* and its recorded reason for keeping these is command forgery -- where a
+* character that renders as nothing changes nothing. That reason does not
+* transfer to a secret: a plaintext split by an invisible character is READ by
+* a human exactly as if it were contiguous, so disclosure needs no paste.
+*
+* `tests/unit/deployment/secret-scan-class-superset.test.ts` fences this as a
+* SUPERSET of both sanitisers' classes by SCANNING CODE POINTS rather than by
+* comparing source text, so a future edit to either sanitiser that this class
+* does not cover reds -- the failure mode a hand list has and a derivation
+* does not.
+*/
+const SECRET_SCAN_INVISIBLES = /[\p{Cc}\p{Cf}\p{Me}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]/gu;
+/**
+* The one string space in which this module tests for, masks, and prints a
+* possibly-secret-bearing name.
+*
+* `.trim()` mirrors `displaySafe`, whose trim this replaces on these paths. It
+* is applied to the TEXT only -- see {@link canonicalNeedle}, where trimming
+* would silently shorten a recorded secret.
+*/
+function canonicalForSecretScan(text) {
+	return text.replace(SECRET_SCAN_INVISIBLES, "").trim();
+}
+/**
+* A recorded secret as a NEEDLE in canonical space.
+*
+* STRIPPED BUT NOT TRIMMED. That is not an oversight of the symmetry with
+* {@link canonicalForSecretScan} but the deliberate asymmetry between a
+* haystack and a needle: whitespace at the edge of a recorded secret is part
+* of the secret and sits in the MIDDLE of a longer key, so trimming the needle
+* stops it matching there. Measured -- a recorded `"ab  "` embedded in
+* `x-ab  -y` was masked before this change and came back `safe` after it.
+*
+* Canonicalising the needle at all is what let the raw-key fallback arm go
+* away: a secret whose own plaintext carries a stripped character used to
+* survive in the raw key and be destroyed in the sanitised one, so it could be
+* DETECTED only from the raw form and MASKED in neither -- a permanent
+* `withheld`. Here it is both found and masked.
+*/
+function canonicalNeedle(plaintext) {
+	return plaintext.replace(SECRET_SCAN_INVISIBLES, "");
+}
+/**
+* The recorded secrets as NEEDLES, keyed by their canonical form.
+*
+* A needle whose canonical form is EMPTY is dropped: canonicalisation can turn
+* a non-empty recorded value into `''`, and `maskEveryOccurrence` splitting on
+* `''` interleaves the mask between every character of the key. The resolver
+* never records an empty secret, so nothing upstream guards this. Measured
+* without the guard: `OrdinaryKey` came back as
+* `O***r***d***i***n***a***r***y***K***e***y`.
+*/
+function canonicalNeedles(secrets) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of secrets ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) out.set(needle, expression);
+	}
+	return out;
+}
+/**
 * Which recorded secrets are visible in `text`, or `undefined` when none is.
 *
 * ONE rule for both callers below, because they were inconsistent and the
@@ -31161,8 +31912,14 @@ const MIN_SECRET_NEEDLE = 4;
 */
 function secretsPresentIn(text, secrets) {
 	if (!secrets || secrets.size === 0) return void 0;
+	const haystack = canonicalForSecretScan(text);
 	const exposure = /* @__PURE__ */ new Map();
-	for (const [plaintext, expression] of secrets) if (text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext)) exposure.set(plaintext, expression);
+	for (const [plaintext, expression] of secrets) {
+		const needle = canonicalNeedle(plaintext);
+		const canonicalHit = haystack === needle || needle.length >= MIN_SECRET_NEEDLE && haystack.includes(needle);
+		const rawHit = text === plaintext || plaintext.length >= MIN_SECRET_NEEDLE && text.includes(plaintext);
+		if (canonicalHit || rawHit) exposure.set(plaintext, expression);
+	}
 	return exposure.size > 0 ? exposure : void 0;
 }
 /**
@@ -31252,10 +32009,13 @@ function maskEveryOccurrence(text, exposure) {
 * unchanged. stderr is a reader like any other, so the invariant is absolute: a
 * message must never claim a masking it did not perform.
 */
-function secretBearingExportNameWarning(outputKey, exportName, exposure) {
-	const masked = stripControlChars(maskEveryOccurrence(exportName, exposure));
-	const shown = masked === stripControlChars(exportName) ? "" : `(masked: "${masked}") `;
-	return `Output ${stripControlChars(outputKey)} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
+function secretBearingExportNameWarning(outputKey, exportName, exposure, secrets) {
+	const corpus = secrets ?? exposure;
+	const name = secretSafeKeyDisplay(exportName, corpus, exposure);
+	const shown = name.kind === "masked" ? `(masked: "${name.text}") ` : "";
+	const ownerForceMask = /* @__PURE__ */ new Map();
+	for (const [plaintext, expression] of exposure) if (plaintext === outputKey || canonicalNeedle(plaintext) === canonicalForSecretScan(outputKey) || plaintext.length >= MIN_SECRET_NEEDLE) ownerForceMask.set(plaintext, expression);
+	return `Output ${displayTextOrWithheld(secretSafeKeyDisplay(outputKey, corpus, ownerForceMask))} has an Export.Name that resolves to a value containing a secret ${shown}— skipping the export alias. An export name becomes a key in state.json and in the exports index, and redaction rewrites VALUES only, so publishing it would persist the secret in plaintext. Use a non-secret Export.Name.`;
 }
 /**
 * Test `key` for recorded secret plaintext and return how it may be shown.
@@ -31265,60 +32025,62 @@ function secretBearingExportNameWarning(outputKey, exportName, exposure) {
 * key safe to print" would disagree on the boundary cases those two encode
 * (the whole-key match for a sub-floor needle, longest-needle-first masking).
 *
-* SANITISED WITH BOTH helpers, because neither is a superset of the other —
-* measured, after a first cut swapped one for the other and silently traded
-* one class of character for another (issue #2667 review):
-*
-* | input    | `stripControlChars` | `displaySafe` |
-* | -------- | ------------------- | ------------- |
-* | `U+200E` | removed             | KEPT          |
-* | `U+200F` | removed             | KEPT          |
-* | `U+2028` | KEPT                | replaced      |
-* | `U+2029` | KEPT                | replaced      |
-*
-* `U+2028` / `U+2029` matter because this text is PERSISTED and re-rendered by
-* JSON and web log viewers that treat both as line terminators — the CI-log
-* surface this masking exists to protect, where an `Fn::Sub`-built export name
-* carrying one could forge a log line (`display-safe.ts` states that
-* rationale). `U+200E` / `U+200F` are the bidi MARKS, named as residuals in
-* that same file; they reorder rendered text without terminating a line. On a
-* path whose subject is a possibly-secret-bearing name in an operator's log,
-* neither loss is worth taking, and composing costs nothing.
-*
-* ORDER IS LOAD-BEARING, and for the OVERLAP set — not for the marks, which
-* an earlier revision of this comment named and measurement contradicted.
-* `displaySafe` never touches `U+200E` / `U+200F`, so those give identical
-* output either way. Where the two classes OVERLAP — `U+0000`-`U+001F`,
-* `U+007F`-`U+009F`, `U+202A`-`U+202E`, `U+2066`-`U+2069` — `stripControlChars`
-* DELETES while `displaySafe` replaces with a space, so strip-then-display
-* yields `"ab"` and display-then-strip yields `"a b"`. Stripping first keeps a
-* name carrying them from being padded out.
-*
-* `displaySafe` also `.trim()`s, which `stripControlChars` alone did not: a
-* display-shape change for a key with leading or trailing whitespace. Stated
-* because it is a real difference, not hidden.
-*
-* The sibling warnings in this file still use `stripControlChars` ALONE and
-* carry the `U+2028` half of the gap; widening that helper, or converting
-* them, changes call sites this issue does not touch, so it is filed as issue
-* [#2874](https://github.com/go-to-k/cdkd/issues/2874) rather than done here.
-*/
-function secretSafeKeyDisplay(key, secrets) {
-	const sanitise = (text) => displaySafe(stripControlChars(text));
-	const shown = sanitise(key);
-	const exposure = stateKeySecretExposure(shown, secrets) ?? stateKeySecretExposure(key, secrets);
-	if (!exposure) return {
+* CANONICAL SPACE, not a composition of the two sanitisers. An earlier
+* revision of this comment described running `stripControlChars` and then
+* `displaySafe`, with a table of what each one touches and a note that the
+* ORDER was load-bearing. That composition WAS the defect (issue
+* [#2874](https://github.com/go-to-k/cdkd/issues/2874)): it leaves three
+* strings in play -- the raw key the verdict came from, the sanitised key that
+* was printed, and the masked one between them -- and `stripControlChars`
+* DELETES, so a plaintext split by one of its characters is absent from the
+* first and contiguous in the second. See {@link SECRET_SCAN_INVISIBLES} for
+* the class that replaced it and why it is derived rather than enumerated.
+*/
+function secretSafeKeyDisplay(key, secrets, forceMask) {
+	const shown = canonicalForSecretScan(key);
+	const exposure = stateKeySecretExposure(key, secrets);
+	const mask = canonicalNeedles(forceMask);
+	for (const [plaintext, expression] of exposure ?? []) {
+		const needle = canonicalNeedle(plaintext);
+		if (needle.length > 0) mask.set(needle, expression);
+	}
+	if (mask.size === 0) return {
+		kind: "safe",
+		text: shown
+	};
+	const masked = maskEveryOccurrence(shown, mask);
+	if (masked === shown) return exposure ? { kind: "withheld" } : {
 		kind: "safe",
 		text: shown
 	};
-	const masked = sanitise(maskEveryOccurrence(shown, exposure));
-	if (masked === shown) return { kind: "withheld" };
+	if (stateKeySecretExposure(masked, secrets)) return { kind: "withheld" };
 	return {
 		kind: "masked",
 		text: masked
 	};
 }
 /**
+* The display for a name plus the verdict its CALLER needs, as one value.
+*
+* Exists so a caller cannot take the verdict from one call and the text from
+* another — the shape of the bug in {@link secretSafeKeyDisplay}'s own callers
+* (issue #2874), one level up.
+*/
+function secretBearing(display) {
+	return display.kind !== "safe";
+}
+/**
+* What a message prints in place of a name it may not show.
+*
+* Deliberately not name-shaped and never quoted as if it were a key: a reader
+* has to be able to tell this is the tool declining, not an odd export name.
+*/
+const WITHHELD_NAME_DISPLAY = "<name withheld: contains a secret>";
+/** The text of a display, or {@link WITHHELD_NAME_DISPLAY} when there is none. */
+function displayTextOrWithheld(display) {
+	return display.kind === "withheld" ? WITHHELD_NAME_DISPLAY : display.text;
+}
+/**
 * Warning for a state KEY that already holds secret plaintext — the residue an
 * EARLIER binary left when it published an export name that resolved to one.
 *
@@ -31329,8 +32091,9 @@ function secretSafeKeyDisplay(key, secrets) {
 * redeploy, which rewrites `state.outputs` wholesale and republishes the index.
 * Reported so the `--dry-run --fail` CI gate stops calling such a state clean.
 */
-function secretBearingStateKeyWarning(stackName, key, exposure) {
-	return `State for ${stripControlChars(stackName)} holds an output KEY containing a secret (masked: "${stripControlChars(maskEveryOccurrence(key, exposure))}") — cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
+function secretBearingStateKeyWarning(stackName, display) {
+	const clause = display.kind === "masked" ? `(masked: "${display.text}") ` : `(the name is withheld: masking it would leave the secret readable) `;
+	return `State for ${canonicalForSecretScan(stackName)} holds an output KEY that renders a secret ${clause}— cdkd scrub cannot rewrite a key, only a value, because the key IS the export name consumers resolve by. Give that output a non-secret Export.Name and redeploy: the next deploy replaces state.outputs and the exports index entirely. ROTATE the exposed secret.`;
 }
 /**
 * Warning for an `Export.Name` colliding with an output NAME it does not own.
@@ -31339,13 +32102,18 @@ function secretBearingStateKeyWarning(stackName, key, exposure) {
 * says which value survives — the export is skipped, so the key keeps the
 * output's own value.
 *
-* No masking here, and none is needed: the name printed is one that MATCHED a
-* declared output name, i.e. template text, and a name carrying a secret is
-* refused by {@link secretBearingExportNameWarning} before this is reached.
-*/
-function exportAliasCollisionWarning(outputKey, exportName) {
-	const shown = stripControlChars(exportName);
-	const from = stripControlChars(outputKey);
+* MASKED HERE, and the bound that used to excuse it is named rather than
+* relied on. This message prints a name that MATCHED a declared output name --
+* template text -- and a secret-bearing `Export.Name` is refused by
+* {@link secretBearingExportNameWarning} upstream. But that is SOMEBODY ELSE'S
+* VERDICT, and this site is reached from exactly the arm taken when it MISSED:
+* before issue [#2874](https://github.com/go-to-k/cdkd/issues/2874)
+* canonicalised the containment scan, it missed for eight of ten invisible
+* characters, and this message printed the plaintext verbatim.
+*/
+function exportAliasCollisionWarning(outputKey, exportName, secrets) {
+	const shown = displayTextOrWithheld(secretSafeKeyDisplay(exportName, secrets));
+	const from = displayTextOrWithheld(secretSafeKeyDisplay(outputKey, secrets));
 	return `Output ${from} exports as "${shown}", which is also the name of another output in this stack — skipping the export alias, so output ${shown} keeps its own value and the export is not published. A consumer's Fn::ImportValue on "${shown}" therefore resolves to output ${shown}, NOT to ${from} (CloudFormation would publish both). Rename the export, or the colliding output.`;
 }
 /**
@@ -31360,12 +32128,12 @@ function exportAliasCollisionWarning(outputKey, exportName) {
 * {@link collectDeclaredOutputNames}.
 */
 function exportAliasCollisionScrubWarning(outputKey, exportName, secrets) {
-	const mask = (name) => {
-		const exposure = secretsPresentIn(name, secrets);
-		return stripControlChars(exposure ? maskEveryOccurrence(name, exposure) : name);
-	};
-	const shown = mask(exportName);
-	return `Output ${mask(outputKey)} exports as "${shown}", which is also the name of another output in this stack — state cannot say which of the two the stored value under "${shown}" came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
+	const nameDisplay = (name) => secretSafeKeyDisplay(name, secrets);
+	const exportDisplay = nameDisplay(exportName);
+	const shown = displayTextOrWithheld(exportDisplay);
+	const storedUnder = exportDisplay.kind === "withheld" ? "the stored value under that name" : `the stored value under "${shown}"`;
+	const ownerDisplay = nameDisplay(outputKey);
+	return `Output ${ownerDisplay.kind === "withheld" && exportDisplay.kind === "withheld" ? "<the owning output, name withheld: contains a secret>" : displayTextOrWithheld(ownerDisplay)} exports as ${exportDisplay.kind === "withheld" ? shown : `"${shown}"`}, which is also the name of another output in this stack — state cannot say which of the two ${storedUnder} came from, so that key is redacted by value match instead of by template position, and two references resolving to the same value could still collapse there. Rename the export, or the colliding output, and redeploy.`;
 }
 
 //#endregion
@@ -36010,7 +36778,7 @@ var DeployEngine = class {
 			const next = { ...op };
 			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
 			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps);
-			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
+			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES);
 			return next;
 		});
 	}
@@ -36322,7 +37090,7 @@ var DeployEngine = class {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
 				if (!this.options.dryRun) {
-					const resolvedOutputs = this.redactOutputs(await this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions));
+					const resolvedOutputs = this.redactOutputs(await withSharedDrainBudget(() => this.resolveOutputs(effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
 					const resolutionFailed = Object.values(resolvedOutputs).some((v) => v === void 0);
 					const outputsChanged = !resolutionFailed && !outputMapsEqual(persistedOutputs, resolvedOutputs);
 					const currentEffectiveExports = new Set(importableOutputKeys(currentState));
@@ -36667,7 +37435,7 @@ var DeployEngine = class {
 		}
 		let outputs;
 		try {
-			outputs = await this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions);
+			outputs = await withSharedDrainBudget(() => this.resolveOutputs(template, newResources, stackName, outputsDigestSource, parameterValues, conditions));
 			const resolvedOutputsBeforeRedaction = outputs;
 			outputs = this.redactOutputs(outputs);
 			this.rememberRecoverableMaskedOutputs(stackName, resolvedOutputsBeforeRedaction, outputs);
@@ -36938,6 +37706,8 @@ var DeployEngine = class {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
 			this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
+			const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
+			if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 			this.recordEvent({
 				eventType: "RESOURCE_FAILED",
 				stackName,
@@ -37630,6 +38400,99 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* The plain-CREATE sibling of {@link replacementNameOrigin} (issue
+	* [#2902](https://github.com/go-to-k/cdkd/issues/2902)).
+	*
+	* A CREATE that collides on a name cdkd DERIVED is very likely a resource
+	* cdkd itself left behind: `DeletionPolicy: Retain` makes a rollback drop
+	* the state record while leaving the resource in AWS (CloudFormation
+	* semantics, and deliberate), and cdkd's generated names carry no random
+	* component (`generateResourceName`) — so the next deploy asks AWS for
+	* exactly the name the orphan still holds, fails, rolls back again, and
+	* repeats forever. Before this, the user saw only the bare AWS sentence:
+	* nothing named the collision's cause and nothing named a way out, so the
+	* reported recovery was hand-deleting resources through the AWS API.
+	*
+	* CloudFormation never shows this because its generated names carry a
+	* random suffix, so a retained orphan cannot collide with a later deploy.
+	* The breakage is that combination — CFn's retain semantics with cdkd's
+	* deterministic naming — rather than either half, which is why the fix here
+	* is a diagnosis and a remedy rather than a behaviour change. Whether cdkd
+	* should instead RE-ADOPT the retained resource is issue
+	* [#2914](https://github.com/go-to-k/cdkd/issues/2914).
+	*
+	* Returns `undefined` — leaving the pre-existing wording untouched — for
+	* every case it cannot vouch for:
+	*
+	* - not a CREATE. A replacement collision DOES arrive here — the
+	*   `NAMED_REPLACEMENT_COLLISION` throws happen inside `provisionResourceBody`,
+	*   which the caller invokes inside the same `try`, and this method's own
+	*   suite asserts their line was logged. What refuses them is the
+	*   `ProvisioningError` check below (they throw `CdkdError`), so deleting
+	*   EITHER guard alone leaves the suite green. That does not make this one
+	*   dead: a non-CREATE `ProvisioningError` whose message carries
+	*   `already exists` — an UPDATE-path sub-resource conflict — would reach
+	*   the advice without it, and the replacement message's remedy is to
+	*   RENAME, which does not recover an orphan. (An earlier revision of this
+	*   comment claimed the throws "never reach this catch at all". Three
+	*   reviewers disproved it independently.);
+	* - not a name collision;
+	* - no physical id on the error (a create that failed BEFORE the AWS call
+	*   never names one). At RUNTIME this is subsumed by the next guard --
+	*   `looksLikeCdkdGeneratedName` refuses a falsy id on its own first line,
+	*   measured: deleting this check ALONE leaves the suite green, deleting
+	*   both together reds it. It stays for the TYPE narrowing the message
+	*   interpolation needs, and so the refusal is readable here rather than
+	*   inferred from another module;
+	* - a name cdkd did not derive — a user-supplied name may collide with a
+	*   resource of someone else's entirely, and telling that user to
+	*   `cdkd import` it would be advice to adopt what this stack does not own;
+	* - a NESTED-STACK child. Its stack name is `<parent>~<logicalId>`, and CDK's
+	*   own stack-name rule bars `~`, so no Cloud Assembly stack can ever carry
+	*   it — `cdkd import` resolves its target from the assembly and walks
+	*   top-level stacks only, so the command would be unrunnable. That is the
+	*   same #2610 class this method's `canImport` check exists for, one level
+	*   down, so the child takes the delete-only arm.
+	*
+	* **A cdkd-DERIVED name is not proof the resource is THIS stack's**, which
+	* the first revision of this advice assumed. Two ways it is not, both
+	* reachable: a globally-namespaced type (`AWS::S3::Bucket` is the documented
+	* exception — see `.claude/rules/provider-resource-identity.md`) can collide
+	* with ANOTHER ACCOUNT's resource, and because the derivation is predictable
+	* that name can be pre-registered by someone else; and the same stack name
+	* deployed in two REGIONS derives the same name for a global type, so the
+	* collision is with a live resource another state file already owns —
+	* importing it would give two stacks one resource, and either `cdkd destroy`
+	* would then delete it out from under the other. So the message names the
+	* orphan as the LIKELY case rather than the certain one, and asks the reader
+	* to confirm ownership before adopting.
+	*/
+	orphanedNameCollisionAdvice(changeType, logicalId, error) {
+		if (changeType !== "CREATE") return void 0;
+		if (!(error instanceof ProvisioningError)) return void 0;
+		const physicalId = error.physicalId;
+		if (!physicalId) return void 0;
+		if (!isNameCollisionError(error.message)) return void 0;
+		const stackName = getCurrentStackName();
+		if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+		if (!stackName) return void 0;
+		const safeId = displaySafe(physicalId, { asciiOnly: true });
+		const safeStack = displaySafe(stackName, { asciiOnly: true });
+		const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+		const diagnosis = `${safeLogicalId}: the name AWS reports as taken (${safeId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+		const deleteArm = `If it is not a resource you want to keep, delete ${safeId} in AWS — after confirming it holds nothing you need, since Retain is what kept it — and re-deploy.`;
+		let canImport;
+		try {
+			canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
+		} catch {
+			canImport = false;
+		}
+		const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+		const importableTarget = !stackName.includes("~");
+		if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+		return `${diagnosis} To recover, adopt it back into state instead of re-creating it: cdkd import ${shellQuote(safeStack)} --resource ${shellQuote(`${safeLogicalId}=${safeId}`)} (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}`;
+	}
+	/**
 	* Read `DeletionPolicy` / `UpdateReplacePolicy` from the synth template
 	* so they can be persisted in `ResourceState` (schema v5+). Always returns
 	* both keys (`undefined` when the template does not carry the attribute)
@@ -37865,9 +38728,16 @@ var DeployEngine = class {
 	* opposite sides of the same question. `secrets` is the outputs pass's own
 	* map: everything recorded before this handler runs, an `Export.Name`
 	* resolution's entries included (its `finally` merges them back before the
-	* `catch` reaches here). What a still-pending concurrent part would have
-	* recorded is outside both — issue #2563's late write, the same bound every
-	* other masking site in this engine has.
+	* `catch` reaches here). Since issue #2563 a still-pending concurrent part
+	* is in the PASS bag before this handler runs: the resolver drains every
+	* part it started before a rejection reaches a caller. Not
+	* unconditionally, and the weaker claim is the true one -- the drain is
+	* bounded, and since the outputs pass wraps BOTH its loops in one budget
+	* the bound spans the whole pass rather than one resolution: an early
+	* failing output can leave a later `Export.Name` drain with no wait at all,
+	* so a late record needs only a leg that had not finished recording by
+	* then rather than one that outlived a full cap. (`inheritedSecrets` is the parent's, and no
+	* resolution writes to it.)
 	*
 	* The strict arm's `cause` is masked as an OBJECT, through
 	* `maskSecretsInError` — a clone of each `Error` link `errorCauseChain`
@@ -37952,8 +38822,8 @@ var DeployEngine = class {
 				}
 				if (typeof exportName !== "string") continue;
 				const exposure = exportNameSecretExposure(exportName, nameSecrets, context.recordedSecretValues);
-				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure));
-				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName));
+				if (exposure) this.logger.warn(secretBearingExportNameWarning(outputKey, exportName, exposure, context.recordedSecretValues));
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) this.logger.warn(exportAliasCollisionWarning(outputKey, exportName, outputsPassSecrets));
 				else {
 					outputs[exportName] = value;
 					if (!this.resolvedExportNames.includes(exportName)) this.resolvedExportNames.push(exportName);
@@ -37987,5 +38857,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { ProviderRegistry as $, redactDockerArgvValues as $n, ResourceUpdateNotSupportedError as $r, STATE_SOURCED_READBACK_RULES as $t, renderStatefulReason as A, createAssetRedirectResolver as An, AssemblyReader as Ar, configStringRefusal as At, red as B, readBootstrapMarkerBody as Bn, ConfigError as Br, s3BucketDualStackDomainName as Bt, refusesFinalSnapshot as C, importableOutputKeys as Cn, uploadCfnTemplate as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, stringifyValue as Dn, PARTITION_TABLE as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, AssetPublisher as En, expectedOwnerParam as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, assertAssetBucketRegion as Fn, getAwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, buildDockerImage as Gn, IntrinsicResolutionRefusalError as Gr, INTRINSIC_KEYS as Gt, collectDeclaredOutputNames as H, validateContainerRepoName as Hn, DependencyError as Hr, s3BucketWebsiteUrl as Ht, bold as I, ensureAssetStorage as In, resetAwsClients as Ir, classifyReplaySecretRegion as It, stateKeySecretExposure as J, describeDockerFailure as Jn, LockError as Jr, describeTypeWithThrottleRetry as Jt, secretBearingStateKeyWarning as K, describeDockerCapturedOutput as Kn, LocalInvokeBuildError as Kr, findActionableSilentDrops as Kt, cyan as L, getBootstrapMarkerKey as Ln, setAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, rewriteTemplateAssetReferences as Mn, clearBucketRegionCache as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, AssetModeResolver as Nn, resolveBucketRegion as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, WorkGraph as On, canonicalizeRegion as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, BOOTSTRAP_MARKER_PREFIX as Pn, AwsClients as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, partitionSensitiveEnv as Qn, ResourceTimeoutError as Qr, STATE_SOURCED_CROSS_GENERATION_RULES as Qt, gray as R, isCrossRegionRedirect as Rn, AssetError as Rr, s3BucketArn as Rt, isFinalSnapshotError as S, exportNamesCarriedFrom as Sn, findLargeInlineResources as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, shouldRetainResource as Tn, displaySafe as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, buildDenyExternalAccessPolicy as Un, DeployCancelledError as Ur, applyRoleArnIfSet as Ut, yellow as V, validateAssetBucketName as Vn, CrossAccountSecretRefusalError as Vr, s3BucketRegionalDomainName as Vt, exportAliasCollisionScrubWarning as W, describeAwsFailure as Wn, DynamicReferenceRegionAmbiguousError as Wr, DiffCalculator as Wt, IAMRoleProvider as X, formatDockerLoginError as Xn, PartialFailureError as Xr, DagBuilder as Xt, getCurrentResourceSecrets as Y, dockerSpawnEnvWithSensitive as Yn, NestedStackChildDirectDestroyError as Yr, withRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, getDockerCmd as Zn, ProvisioningError as Zr, TemplateParser as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildLockContentionMessage as _n, stateBucketExistenceConfirmed as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, isCdkdError as ai, isSingleDynamicReferenceToken as an, getDockerImageBySourceHash as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, CUSTOM_RESOURCE_RESPONSE_PREFIX as bn, CFN_TEMPLATE_URL_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, isMarkedNonRetryable as ci, recordMaskOnlyValue as cn, getDefaultStateBucketName as cr, startInterruptWatch as ct, updatePartialReason as d, isTransientServerError as di, scrubResourceRecord as dn, resolveAutoAssetStorage as dr, UNSPECIFIED_SKIP_REASON as dt, StackHasActiveImportsError as ei, TEMPLATE_SOURCED_RULES as en, runDockerForeground as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, markNonRetryable as fi, LockManager as fn, resolveCaptureObservedState as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, buildForceUnlockCommand as gn, resolveUseCdkBootstrapAssets as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, __exportAll as hi, UNRENDERABLE as hn, resolveStateBucketWithDefaultAndSource as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, formatError as ii, errorCauseChain as in, AssetManifestLoader as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, loadPublishableAssetManifest as jn, processStackMessages as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, buildAssetRedirectMap as kn, derivePartitionAndUrlSuffix as kr, configBooleanRefusal as kt, replayRollback as l, isRetryableTransientError as li, recoverMaskedOutput as ln, getLegacyStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, retryClassificationText as mi, rebuildClientForBucketRegion as mn, resolveStateBucketWithDefault as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StateError as ni, createSecretMasker as nn, escapeRegExp$1 as nr, maskDeep as nt, planFailedOps as o, normalizeAwsError as oi, maskSecretsInError as on, Synthesizer as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markRedactedCause as pi, S3StateBackend as pn, resolveSkipPrefix as pr, deleteSkipReason as pt, secretSafeKeyDisplay as q, describeDockerExecFailure as qn, LocalStartServiceError as qr, findSilentDropProperties as qt, DeployEngine as r, SynthesisError as ri, dynamicReferenceTokens as rn, stripControlChars as rr, maskerOrIdentity as rt, planRollback as s, withErrorHandling as si, maskSecretsInText as sn, synthesisStatusMessage as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackTerminationProtectionError as ti, carriesSecretMask as tn, runDockerStreaming as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isThrottlingError as ui, redactSecretsForState as un, resolveApp as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, forceQuitRecoveryClause as vn, warnDeprecatedNoPrefixCliFlag as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputs as wn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, DEFAULT_STATE_PREFIX as xn, MIGRATE_TMP_PREFIX as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, shellQuote as yn, CFN_TEMPLATE_BODY_LIMIT as yr, coerceParameterTypedValue as yt, green as z, parseBootstrapMarker as zn, CdkdError as zr, s3BucketDomainName as zt };
-//# sourceMappingURL=deploy-engine-CfxcC3q3.js.map
+export { ProviderRegistry as $, formatDockerLoginError as $n, PartialFailureError as $r, STATE_SOURCED_BASELINE_RULES as $t, renderStatefulReason as A, stringifyValue as An, PARTITION_TABLE as Ar, configStringRefusal as At, red as B, getBootstrapMarkerKey as Bn, setAwsClients as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, CUSTOM_RESOURCE_RESPONSE_PREFIX as Cn, CFN_TEMPLATE_URL_LIMIT as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, importableOutputs as Dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, importableOutputKeys as En, uploadCfnTemplate as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, rewriteTemplateAssetReferences as Fn, clearBucketRegionCache as Fr, requireConfigString as Ft, isExportAliasCollision as G, validateContainerRepoName as Gn, DependencyError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, parseBootstrapMarker as Hn, CdkdError as Hr, s3BucketRegionalDomainName as Ht, bold as I, AssetModeResolver as In, resolveBucketRegion as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, buildDockerImage as Jn, IntrinsicResolutionRefusalError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDenyExternalAccessPolicy as Kn, DeployCancelledError as Kr, INTRINSIC_KEYS as Kt, cyan as L, BOOTSTRAP_MARKER_PREFIX as Ln, AwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, buildAssetRedirectMap as Mn, derivePartitionAndUrlSuffix as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, createAssetRedirectResolver as Nn, AssemblyReader as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, shouldRetainResource as On, displaySafe as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, loadPublishableAssetManifest as Pn, processStackMessages as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, dockerSpawnEnvWithSensitive as Qn, NestedStackChildDirectDestroyError as Qr, TemplateParser as Qt, gray as R, assertAssetBucketRegion as Rn, getAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, shellQuote as Sn, CFN_TEMPLATE_BODY_LIMIT as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, exportNamesCarriedFrom as Tn, findLargeInlineResources as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, readBootstrapMarkerBody as Un, ConfigError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, isCrossRegionRedirect as Vn, AssetError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, validateAssetBucketName as Wn, CrossAccountSecretRefusalError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, describeDockerExecFailure as Xn, LocalStartServiceError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerCapturedOutput as Yn, LocalInvokeBuildError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, describeDockerFailure as Zn, LockError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, retryClassificationText as _i, rebuildClientForBucketRegion as _n, resolveStateBucketWithDefault as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, StateError as ai, dynamicReferenceTokens as an, escapeRegExp$1 as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, buildLockContentionMessage as bn, stateBucketExistenceConfirmed as br, getAccountInfo as bt, replayFailedOperations as c, isCdkdError as ci, isSingleDynamicReferenceToken as cn, getDockerImageBySourceHash as cr, startInterruptWatch as ct, updatePartialReason as d, isMarkedNonRetryable as di, recordMaskOnlyValue as dn, getDefaultStateBucketName as dr, UNSPECIFIED_SKIP_REASON as dt, ProvisioningError as ei, STATE_SOURCED_CROSS_GENERATION_RULES as en, getDockerCmd as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isRetryableTransientError as fi, recoverMaskedOutput as fn, getLegacyStateBucketName as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, markRedactedCause as gi, S3StateBackend as gn, resolveSkipPrefix as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, markNonRetryable as hi, LockManager as hn, resolveCaptureObservedState as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, StackTerminationProtectionError as ii, createSecretMasker as in, runDockerStreaming as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, WorkGraph as jn, canonicalizeRegion as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, AssetPublisher as kn, expectedOwnerParam as kr, configBooleanRefusal as kt, replayRollback as l, normalizeAwsError as li, maskSecretsInError as ln, Synthesizer as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isTransientServerError as mi, scrubResourceRecord as mn, resolveAutoAssetStorage as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as ni, TEMPLATE_SOURCED_RULES as nn, redactDockerArgvValues as nr, maskDeep as nt, planFailedOps as o, SynthesisError as oi, errorCauseChain as on, stripControlChars as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, isThrottlingError as pi, redactSecretsForState as pn, resolveApp as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeAwsFailure as qn, DynamicReferenceRegionAmbiguousError as qr, findActionableSilentDrops as qt, DeployEngine as r, StackHasActiveImportsError as ri, carriesSecretMask as rn, runDockerForeground as rr, maskerOrIdentity as rt, planRollback as s, formatError as si, identityKeyFor as sn, AssetManifestLoader as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as ti, STATE_SOURCED_READBACK_RULES as tn, partitionSensitiveEnv as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, withErrorHandling as ui, maskSecretsInText as un, synthesisStatusMessage as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, __exportAll as vi, UNRENDERABLE as vn, resolveStateBucketWithDefaultAndSource as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, DEFAULT_STATE_PREFIX as wn, MIGRATE_TMP_PREFIX as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, forceQuitRecoveryClause as xn, warnDeprecatedNoPrefixCliFlag as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, buildForceUnlockCommand as yn, resolveUseCdkBootstrapAssets as yr, coerceParameterTypedValue as yt, green as z, ensureAssetStorage as zn, resetAwsClients as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-Dsf9bTqH.js.map