@go-to-k/cdkd 0.288.4 → 0.288.5

package/dist/{deploy-engine-BiPxTgKT.js → deploy-engine-Dsf9bTqH.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BmM4QJ9t.js";
+import { t as getCdkdVersion } from "./version-BFmq8S23.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -102,6 +102,7 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
 	"permissions required to assume the role",
+	"does not have a trust relationship allowing",
 	"authorized to assume the provided role",
 	"not authorized to access the Log Destination",
 	"Cannot access stream",
@@ -12257,13 +12258,45 @@ const TEMPLATE_SOURCED_RULES = {
 	trustAnyExpression: false,
 	sourceIsSameGeneration: false
 };
-/** An AWS readback projected from THIS record's own persisted STATE bag. */
+/**
+* An AWS readback projected from THIS record's own persisted STATE bag.
+*
+* Does NOT fail closed. This is the constant a caller reaches for when it knows
+* the SHAPE of its two bags and nothing about where the result lands —
+* `cdkd drift`'s two writers and `cdkd import`'s capture pass it, and so does
+* `DeployEngine.redactOperationsForJournal` for the journal's `previousState`
+* (issue [#2886](https://github.com/go-to-k/cdkd/issues/2886): a REPLAYED
+* baseline must not gain masks a rollback restore then persists). See
+* {@link STATE_SOURCED_BASELINE_RULES} for the one that does, and
+* `failClosedOnUncertifiedPositions` for why the difference is declared rather
+* than derived.
+*/
 const STATE_SOURCED_READBACK_RULES = {
 	descendArrays: false,
 	trustAnyExpression: true,
 	sourceIsSameGeneration: true
 };
 /**
+* {@link STATE_SOURCED_READBACK_RULES} for a caller that KNOWS its bag becomes
+* a drift BASELINE — `observedProperties` and nothing else (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Identical on the three shape flags, so every relaxation and refusal the
+* readback path already had applies unchanged; the only difference is that a
+* position this pass cannot certify is written as {@link SECRET_MASK} rather
+* than as the DECRYPTED readback. Passed by `cdkd state refresh-observed` and
+* derived by {@link scrubResourceRecord} for the observed bag — the deploy's
+* `drainObservedCaptures` baseline reaches it that way. `cdkd import`'s own
+* capture still passes the non-failing constant and keeps the residue; moving
+* it is a one-constant change in `src/cli/commands/import.ts`.
+*/
+const STATE_SOURCED_BASELINE_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true,
+	failClosedOnUncertifiedPositions: true
+};
+/**
 * A STATE source that is no longer this bag's own generation — `cdkd scrub`'s
 * `observedProperties` walk (issue #1917 review).
 *
@@ -12409,7 +12442,7 @@ function isSecretExpressionByVerdictOrSpelling(expression) {
 * so the position source is present with no map beside it.
 *
 * `cdkd state refresh-observed` and the deploy's `drainObservedCaptures` are
-* NOT affected: they take `STATE_SOURCED_READBACK_RULES`, which sets
+* NOT affected: they take a `STATE_SOURCED_*` readback constant, which sets
 * `sourceIsSameGeneration`, so {@link refuseUncertifiedReadbackPositions}
 * restores the source even under the old strict class.
 *
@@ -13324,7 +13357,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -13335,7 +13368,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 * Is this rules constant one whose BAG is an AWS readback and whose SOURCE is a
 * persisted STATE bag?
 *
-* Today that is {@link STATE_SOURCED_READBACK_RULES} alone: the path where the
+* Today that is {@link STATE_SOURCED_READBACK_RULES} and its fail-closed twin
+* {@link STATE_SOURCED_BASELINE_RULES}, which differ on nothing this predicate
+* reads (issue #2852 added a DESTINATION flag, not a shape one): the path where
+* the
 * secrets map can be EMPTY by construction (nothing was resolved), so the value
 * scan has no needles and POSITION is the only mechanism left. Derived from the
 * flags rather than compared against the constant so a future one with the same
@@ -13831,6 +13867,23 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 */
 const POSITION_DECIDED = Symbol("position decided by a position pass");
 /**
+* Marks a STRING leaf {@link refuseUncertifiedReadbackPositions} REFUSED — a
+* position whose source subtree proves a dynamic reference lives there while
+* the walk could not pair the two sides, so the readback value at it may be a
+* decrypted secret (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* A THIRD state, not a second spelling of {@link POSITION_DECIDED}, and the
+* difference is what keeps the fail-closed change from REGRESSING the derived
+* needles issue #2012 added. `POSITION_DECIDED` tells
+* {@link preferPositionDecisions} "this leaf is mine, the scan may not touch
+* it"; a refusal makes the opposite claim — the pass has NO answer here, only
+* the knowledge that the raw value is unsafe. So the scan still gets to win at
+* such a leaf (a derived needle NAMES the expression, which is strictly better
+* than a mask), and the mask stands only where nothing else spoke.
+*/
+const POSITION_UNCERTIFIED = Symbol("position refused by a position pass");
+/**
 * Record one (plaintext -> expression) pair, or strike the plaintext out.
 *
 * Below {@link MIN_NEEDLE_LENGTH} nothing is recorded, and this floor DECIDES
@@ -14092,11 +14145,13 @@ function asIndex(marks, index) {
 * newly extending #2427 to the EMPTY-map path, where the unchanged-resource
 * `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
 * the result to the live resource. With the guard a non-plain leaf falls
-* through to `refused`. That is the position passes' own answer — usually the
-* bag by identity, though NOT universally: their object arm has no prototype
-* guard of its own, so a non-plain leaf whose source subtree carries a
-* reference is already flattened one function earlier. Same defect as issue
-* #2427, one layer up, and out of this lane's scope.
+* through to `refused`. That is the position passes' own answer, which is the
+* bag by identity: their object arm carried no prototype guard of its own until
+* issue [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain
+* leaf whose source subtree carries a reference WAS already flattened one
+* function earlier and this guard could only keep a `{}` intact. Both halves
+* are guarded now; the remaining copy of the defect is the VALUE scan's own
+* walk, which is issue #2427 and a different pass.
 *
 * The net effect is byte-identical to the FIRST ordering on every input where
 * the un-certification did not fire — which is the whole point: it keeps that
@@ -14110,7 +14165,9 @@ function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
 	}
 	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
 	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
-	return scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	const scanDecision = scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	if (marks === POSITION_UNCERTIFIED && !(typeof scanDecision === "string" && isSingleDynamicReferenceToken(scanDecision))) return refused;
+	return scanDecision;
 }
 /**
 * DERIVED NEEDLES (issue [#2012](https://github.com/go-to-k/cdkd/issues/2012)):
@@ -14180,7 +14237,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 		poisoned: /* @__PURE__ */ new Set(),
 		inferred: /* @__PURE__ */ new Set()
 	};
-	refuseUncertifiedReadbackPositions(bag, source, secrets, collector);
+	refuseUncertifiedReadbackPositions(bag, source, secrets, false, collector);
 	if (collector.needles.size === 0) return void 0;
 	const certain = /* @__PURE__ */ new Map();
 	const inferred = /* @__PURE__ */ new Map();
@@ -14191,6 +14248,149 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 /**
+* FAIL CLOSED over one readback subtree the position walk could not certify
+* (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Every STRING leaf the source cannot account for becomes
+* {@link SECRET_MASK} — at EVERY position it occupies, including a node the bag
+* reaches twice; see the memo below. So does a BINARY leaf, whose bytes are a
+* secret in the clear once `JSON.stringify` writes them. Everything else is
+* kept. Called from
+* {@link refuseUncertifiedReadbackPositions} — through
+* {@link refuseAgainstSource}, and DIRECTLY from its keyed-array arm, which
+* hoists the literal set and re-spells the `failClosed` test — and only where
+* that walk has already established
+* BOTH halves of the evidence: the SOURCE subtree at this position spells a
+* dynamic reference (so the template says a secret lives here), and the two
+* sides cannot be paired (so no position can say WHICH leaf holds its resolved
+* form). Before this, every such branch returned the bag — the decrypted
+* readback — verbatim.
+*
+* "The source cannot account for" is the whole claim, and it is deliberately
+* WEAKER than "no plaintext survives": a leaf the source spells verbatim is
+* kept, so a readback that echoes a template literal back keeps it. What the
+* pass guarantees is that no leaf survives on the strength of the walk having
+* given up.
+*
+* WHY A MASK RATHER THAN THE SOURCE. Substituting the source is what the
+* certified rows do, and it is exactly what the array arm's own comment (and
+* the issue #1915 fences) refuse here: with no pairing, writing the source
+* fabricates baseline content AWS never reported, which `cdkd drift --revert`
+* then pushes to the live resource. A mask fabricates no content — it keeps
+* the bag's SHAPE, adds no key, no element and no scalar-over-container — and
+* `SECRET_MASK` is already a first-class persisted state with its own
+* downstream guards (`drift.ts`'s `collectSecretMaskPaths` /
+* `preserveLiveValuesAtMaskedLeaves`, `runAccept`'s refusal,
+* `rollback-executor.ts`'s `refuseMaskedReplayBaseline`), because the
+* mask-only channel (issue #2274) already puts one there.
+*
+* WHY STRINGS ONLY. A recorded secret is a `string` by the type of
+* {@link RecordedSecretValues}, so a number, a boolean or `null` cannot BE a
+* resolved secret and masking one would only cost drift a comparison. A
+* NON-PLAIN object (a `Date` an AWS SDK readback carries, a `Buffer`) is
+* returned BY IDENTITY for the same reason plus a second one: rebuilding it
+* from its own enumerable keys yields `{}` — the corruption of issue
+* [#2869](https://github.com/go-to-k/cdkd/issues/2869).
+*
+* A leaf that IS a whole `{{resolve:...}}` token is kept: it is an expression
+* AWS echoed back unresolved, not plaintext, and replacing it with a mask would
+* DESTROY a value `cdkd drift` can re-resolve. WHOLE, not "contains one" — that
+* wider test spared `postgres://admin:<plaintext>@{{resolve:ssm-secure:/h}}`,
+* where the embedded token vouched for a leaf that was mostly the decrypted
+* secret. The residual is the issue #1917 shape — a plaintext that merely LOOKS
+* like a token — which every arm of this module already trusts.
+*
+* SO IS A LEAF THE SOURCE SUBTREE ITSELF SPELLS, and this is what keeps the
+* fail-closed change from emptying an ordinary drift baseline. `sourceLiterals`
+* is {@link wholeStringLeavesOf} over the SOURCE at the refused position — the
+* literal frame of an `Fn::Join`, the anchor values of an array AWS reordered,
+* every ordinary property beside the reference. A value the template SPELLS is
+* not the resolved form of a reference, so masking it buys nothing; and where
+* it coincides with one, that plaintext is already sitting in the record's own
+* `properties`, so the copy in the readback is not the disclosure. Scoped to
+* the SOURCE AT THE REFUSED POSITION rather than the whole record on purpose: a
+* coincidence three properties away is not evidence about this one. Read that
+* literally — when an ARRAY refuses element by element the refused position is
+* the array, so a SIBLING element's literal does spare a leaf. That is the
+* intended granularity (the elements are peers of one list AWS returned
+* together, and the pairing that failed is between the two LISTS), and it is
+* stated because "subtree" reads narrower than the code is.
+*
+* OVER-MASKING IS THE REMAINING COST AND IT IS THE INTENDED DIRECTION: a value
+* AWS NORMALISED (`us-east-1` returned as `US-EAST-1`) no longer matches the
+* source and is masked with the secret, because nothing distinguishes them once
+* the pairing is gone. That is phantom drift rather than a disclosure — the
+* same way this module chooses to be wrong at
+* {@link mixedLeafMayCarryPublicReference}.
+*
+* `mark` is {@link refuseUncertifiedReadbackPositions}'s MARK MODE, threaded
+* so the parallel tree keeps the same shape: {@link POSITION_UNCERTIFIED}
+* lands wherever the substituting pass puts a mask, and the bag's own value
+* everywhere else — which is that mode's contract.
+*/
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+	if (typeof value === "string") {
+		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (value === "") return value;
+		return mark ? POSITION_UNCERTIFIED : "***";
+	}
+	if (value === null || typeof value !== "object") return value;
+	const memo = seen.get(value);
+	if (memo !== void 0) return memo;
+	if (Array.isArray(value)) {
+		const out = [];
+		seen.set(value, out);
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		return out;
+	}
+	if (isPlainObject$2(value) && hasPlainPrototype(value)) {
+		const out = Object.create(null);
+		seen.set(value, out);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		return out;
+	}
+	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
+	seen.set(value, value);
+	return value;
+}
+/**
+* {@link refuseUncertifiedSubtree} over a bag whose SOURCE is in hand, so the
+* literal set can never be built from anything but the source at the SAME
+* position.
+*
+* NOT the only spelling, and an earlier revision of this sentence said it was.
+* The keyed-array arm calls {@link refuseUncertifiedSubtree} DIRECTLY, because
+* it hoists the literal set out of its `bag.map` — so it also re-spells the
+* `failClosed` test this function owns. A future edit that drops that
+* re-spelling drops the DESTINATION check with it, which is why the two are
+* named here rather than left to be noticed.
+*/
+function refuseAgainstSource(bag, source, failClosed, mark) {
+	if (failClosed !== true) return bag;
+	return refuseUncertifiedSubtree(bag, wholeStringLeavesOf(source), mark);
+}
+/**
+* Does any element of `source` that the bag did NOT pair carry a dynamic
+* reference (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852))?
+*
+* The evidence that licenses refusing the bag's own unpaired elements in the
+* IDENTITY-KEYED array arm. An identity key that does not round-trip
+* byte-identically — AWS case-normalises a `Name`, or expands one to an ARN —
+* drops its element to `partner === undefined`, and the element the source
+* spells as a reference is then left over with nothing pointing at it, so its
+* resolved plaintext is somewhere in the unpaired remainder.
+*
+* The converse is why this is a QUESTION rather than a blanket refusal: when
+* every reference-bearing source element DID find its partner, an extra bag
+* element is a peer AWS added (another `Environment` entry) and carries no
+* secret this source can account for. Refusing those would mask ordinary
+* readback content for no evidence, which is the same trade the object arm's
+* extra-KEY branch declines to make.
+*/
+function unpairedSourceCarriesReference(source, key, bagIdentities) {
+	return source.some((item) => !bagIdentities.has(item[key]) && subtreeHasDynamicReference(item));
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -14212,15 +14412,42 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 *   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
 *   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          take source*
 *   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          take source*
-*   ...either of those, but REORDERED / normalised    LEAK          LEAK (#2012)
-*   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
-*   an observed KEY the source does not carry         LEAK          LEAK (#2012)
+*   ...either of those, but REORDERED / normalised    LEAK          MASK (#2852)
+*   an UNPAIRED element, source reference left over   LEAK          needle | MASK
+*   an UNPAIRED element, every source reference paired LEAK         needle (#2012)
+*   a RESHAPED container / added wrapper level        LEAK          MASK (#2852)
+*   a source leaf promoted to a container             LEAK          MASK (#2852)
+*   a RAW `Fn::Join` source vs a STRING readback      LEAK          MASK (#2846)
+*   an observed KEY the source does not carry         LEAK          needle | LEAK
+*   a `Date` under a reference-bearing source subtree `{}`          kept (#2869)
 *   whole `{{resolve:...}}` token                     ok            ok
 *   `Environment[]` keyed by `Name` (issue #1915)     ok            ok
 *   PUBLIC ssm MIXED leaf, POPULATED map               ok            ok
 *   PUBLIC ssm MIXED leaf, EMPTY map                   ok            over-redacts
 * ```
 *
+* MASK rows are the FAIL-CLOSED change of issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852). Every branch this walk
+* could not certify used to `return bag` — the decrypted readback, verbatim —
+* so "cannot pair" and "safe to persist" were the same answer. They are now
+* {@link refuseUncertifiedSubtree}, whose doc argues why a mask rather than the
+* source and why STRING leaves only. `needle | MASK` means the derived needles
+* of issue #2012 are consulted FIRST and the mask stands only where they had
+* nothing to say ({@link preferPositionDecisions}), so no row this table
+* previously closed by a needle is taken back.
+*
+* ONE row is deliberately still open: an observed KEY the source does not carry
+* keeps the plaintext when no needle names it. Refusing there needs evidence
+* that does not exist — the source has NO leaf at that position, so the walk
+* would be guessing — and the cost of guessing is not bounded: a write-only
+* credential AWS never echoes back (RDS `MasterUserPassword` and every
+* `getDriftUnknownPaths` sibling) leaves a reference-bearing source key
+* unpaired on EVERY readback, so keying the refusal on that would mask
+* `Runtime` / `FunctionArn` / `LastModified` for every secret-bearing resource
+* in the account. The extra-KEY asymmetry stated further down is the same
+* argument; issue [#2868](https://github.com/go-to-k/cdkd/issues/2868) owns the
+* shape where the plaintext has no counterpart in the source at all.
+*
 * The last row is the price of the row above it and is tracked as issue
 * [#2036](https://github.com/go-to-k/cdkd/issues/2036): with no map nothing was
 * resolved, so nothing distinguishes a public parameter from a `SecureString`
@@ -14254,7 +14481,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * {@link anchorsCorroboratePairing} answers only one of them and its own doc
 * says nothing in it is sufficient alone.
 *
-* The residual rows are one root cause, not several: no needle and no
+* The MASK rows are one root cause, not several: no needle and no
 * position, so nothing distinguishes a resolved secret from an ordinary
 * literal. They are NOT closed by taking the source subtree, which an earlier
 * revision did and the issue #1915 fences correctly rejected — measured, it
@@ -14269,13 +14496,24 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * The MIXED row is the shape this module itself calls DOMINANT for CDK — an
 * `Fn::Join` around `secret.secretValueFromJson(...)`.
 *
-* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it does close, for
+* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it CERTIFIES, for
 * the same reason the whole-token arm does: a mask is not a value `cdkd drift`
 * can re-resolve, so it would report a permanent phantom — and `cdkd drift
 * --revert` pushes the BASELINE to AWS, so a masked baseline would write the
 * literal `***` onto the live resource (the issue #1498 / #1501 class).
 *
-* The last two rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
+* That is an argument about a row where a SOURCE VALUE IS AVAILABLE, and it
+* decides nothing about a row where none is (issue #2852). There the choice is
+* not mask-versus-source but mask-versus-PLAINTEXT, and the two costs above are
+* both real: `runAccept` refuses a masked change and
+* `preserveLiveValuesAtMaskedLeaves` moves AWS's own value in before `--revert`
+* sends anything, so the mask degrades those two commands on that resource
+* rather than corrupting it — while the plaintext it replaces is the disclosure
+* of GHSA-p5qg-v9gv-hc7w sitting in `state.json`. Do not read the paragraph
+* above as a rule against the mask everywhere; it is a rule about the rows with
+* a certified source.
+*
+* The needle rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
 * #2012) — see {@link deriveReadbackNeedles}. Neither has a position to argue
 * from: an unpaired array element and an observed KEY the source does not carry
 * are both positions with no source leaf to take. What they never lacked was a
@@ -14301,7 +14539,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * drift, and a needle learned from a MIS-paired position is a false redaction
 * everywhere it then matches.
 */
-function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
+function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, learn, mark) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source)) {
 			if (learn) learnWholeTokenNeedle(learn, bag, source);
@@ -14312,25 +14550,26 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, learn, mark) : v;
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key === void 0) {
-			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, learn, mark));
+			if (!unkeyedArrayPairsByAnchors(bag, source)) return refuseAgainstSource(bag, source, failClosed, mark);
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, failClosed, learn, mark));
 		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
+		const orphanLiterals = unpairedSourceCarriesReference(source, key, new Set(bag.map((item) => item[key]))) && failClosed === true ? wholeStringLeavesOf(source) : void 0;
 		return bag.map((item) => {
 			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets, learn, mark);
+			return partner === void 0 ? orphanLiterals !== void 0 ? refuseUncertifiedSubtree(item, orphanLiterals, mark) : item : refuseUncertifiedReadbackPositions(item, partner, secrets, failClosed, learn, mark);
 		});
 	}
-	return bag;
+	return refuseAgainstSource(bag, source, failClosed, mark);
 }
 /**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
@@ -14346,10 +14585,11 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	if (source !== void 0) {
 		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
-		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
+		const failClosed = rules.failClosedOnUncertifiedPositions === true;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
-		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
 		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
@@ -14483,7 +14723,7 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_RULES));
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
 /**
@@ -23680,7 +23920,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const [rawLogicalId, rawAttributeName] = getAtt;
 			logicalId = rawLogicalId;
 			const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(resolvedAttributeName)}`);
+			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
@@ -23693,13 +23933,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			if (flatValue !== void 0) {
-				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId);
+				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, nameServers)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, nameServers), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, flatValue), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -23712,17 +23952,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, cursor)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, cursor), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, value)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, value), context)}`);
 		return value;
 	}
 	/**
@@ -23773,7 +24013,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const read = `${logicalId}.${attributeName}`;
+			const read = `${logicalId}.${this.maskSecretsForLog(attributeName, context)}`;
 			if (!context.redactedAttributeReads.includes(read)) context.redactedAttributeReads.push(read);
 		}
 		return value;
@@ -23807,10 +24047,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* honest answer is to say so and name the remedy: the record heals on the
 	* resource's next in-place update (#1727).
 	*/
-	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -23855,7 +24095,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -23868,14 +24108,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* result. Keep this method's NAME — `scripts/gen-sdk-attr-coverage.ts` reads
 	* the resource types it references.
 	*/
-	async constructAttribute(resource, attributeName, _context, logicalId, accountInfo) {
+	async constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 		const { resourceType, physicalId } = resource;
 		const { accountId, partition } = accountInfo;
 		const region = canonicalizeRegion(accountInfo.region);
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return s3BucketArn(physicalId, region);
@@ -23883,12 +24123,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "RegionalDomainName": return s3BucketRegionalDomainName(physicalId, region);
 			case "DualStackDomainName": return s3BucketDualStackDomainName(physicalId, region);
 			case "WebsiteURL": return s3BucketWebsiteUrl(physicalId, region);
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -23900,7 +24140,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${JSON.stringify(blocks)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
@@ -23917,38 +24157,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
 			case "UserPoolId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -23958,41 +24198,41 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
 			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -24004,38 +24244,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -24047,26 +24287,26 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
 			case "TopicName": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -24090,16 +24330,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const serviceName = physicalId.substring(pipeIdx + 1);
 				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
 			case "InstanceId": return physicalId;
@@ -24133,13 +24373,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 						cachedEc2InstanceAttributes[cacheKey] = value;
 						return value;
 					}
-					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${attributeName}; returning physical ID`);
+					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${this.maskSecretsForLog(attributeName, context)}; returning physical ID`);
 				} catch (err) {
-					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return physicalId;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -24148,14 +24388,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
 			if (attributeName === "LaunchTemplateId") return physicalId;
-			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
-		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 	}
 	/**
 	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
@@ -24184,13 +24424,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* route through this helper — those are explicit `case`s in the
 	* per-type handlers.
 	*/
-	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
-		if (expectsArnShape || expectsUrlShape) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
+		if (expectsArnShape || expectsUrlShape) {
+			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+		}
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
-		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
+		this.logger.warn(`Unknown attribute ${this.maskSecretsForLog(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
 	/**
@@ -24391,13 +24634,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, getAttError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, refError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -24431,7 +24674,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return `{{Fn::Select:${index}:OutOfBounds}}`;
 		}
 		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24575,7 +24818,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 		}
 		const result = resolvedValue.split(delimiter);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24606,7 +24849,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved1 = await this.resolveValue(value1, context);
 		const resolved2 = await this.resolveValue(value2, context);
 		const result = JSON.stringify(resolved1) === JSON.stringify(resolved2);
-		this.logger.debug(`Resolved Fn::Equals: ${this.maskSecretsForLog(JSON.stringify(resolved1), context)} === ${this.maskSecretsForLog(JSON.stringify(resolved2), context)} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Equals: ${JSON.stringify(this.maskValueLeaves(resolved1, context))} === ${JSON.stringify(this.maskValueLeaves(resolved2, context))} -> ${result}`);
 		return result;
 	}
 	/**
@@ -24754,7 +24997,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (context.recordedSecretValues) recordMaskOnlyValuesIn(recovered, context.recordedSecretValues);
 				return recovered;
 			}
-			if (context.redactedAttributeReads !== void 0 && !context.redactedAttributeReads.includes(origin)) context.redactedAttributeReads.push(origin);
+			if (context.redactedAttributeReads !== void 0) {
+				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				if (!context.redactedAttributeReads.includes(loggedOrigin)) context.redactedAttributeReads.push(loggedOrigin);
+			}
 		}
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
@@ -24870,12 +25116,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
 				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
@@ -24889,30 +25135,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
 			if (context.stackName && refStack === context.stackName) {
-				this.logger.debug(`Skipping current stack: ${refStack}`);
+				this.logger.debug(`Skipping current stack: ${this.maskSecretsForLog(refStack, context)}`);
 				continue;
 			}
 			try {
 				const lookupRegion = refRegion ?? this.resolverRegion ?? "";
 				if (!lookupRegion) {
-					this.logger.debug(`No region available for stack '${refStack}' — skipping (cdkd cannot read state without a region)`);
+					this.logger.debug(`No region available for stack '${this.maskSecretsForLog(refStack, context)}' — skipping (cdkd cannot read state without a region)`);
 					continue;
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${refStack} (${lookupRegion})`);
+					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${lookupRegion})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${refStack} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
 						producerRegion: lookupRegion
 					}).catch((err) => {
-						this.logger.debug(`Failed to patch exports index for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
+						this.logger.debug(`Failed to patch exports index for '${this.maskSecretsForLog(exportName, context)}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 					});
 					this.recordImport(context, exportName, refStack, lookupRegion);
 					found = {
@@ -24923,7 +25169,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 			} catch (error) {
-				this.logger.warn(`Failed to read state for stack ${refStack}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to read state for stack ${this.maskSecretsForLog(refStack, context)}: ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 				continue;
 			}
 		}
@@ -24939,7 +25185,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return cfnExport.value;
 			}
 		}
-		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
+		throw new Error(`Fn::ImportValue: export '${loggedExportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
 	}
 	/**
 	* CloudFormation `ListExports` fallback lookup for `Fn::ImportValue`
@@ -24970,7 +25216,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -25040,7 +25286,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(region, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -25149,7 +25395,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${stripControlChars(resolvedRegion).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
 		}
 		let roleArn;
@@ -25158,10 +25404,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(region, context)}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		const loggedRegion = this.maskSecretsForLog(region, context);
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
@@ -25169,24 +25416,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
+						throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in CloudFormation stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
-					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
-			throw new Error(`Fn::GetStackOutput: stack '${stackName}' not found in region '${region}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-			throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in stack '${stackName}' (${region}). Available outputs: ${available}`);
+			throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
 			stackName,
 			region,
@@ -25304,19 +25551,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (!map) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: mapping '${mapName}' not found in Mappings section`);
+			throw new Error(`Fn::FindInMap: mapping '${this.maskSecretsForLog(mapName, context)}' not found in Mappings section`);
 		}
 		const topLevel = Object.hasOwn(map, topLevelKey) ? map[topLevelKey] : void 0;
 		if (!topLevel || typeof topLevel !== "object") {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: top-level key '${topLevelKey}' not found in mapping '${mapName}'`);
+			throw new Error(`Fn::FindInMap: top-level key '${this.maskSecretsForLog(topLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}'`);
 		}
 		if (!Object.hasOwn(topLevel, secondLevelKey)) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: second-level key '${secondLevelKey}' not found in mapping '${mapName}' -> '${topLevelKey}'`);
+			throw new Error(`Fn::FindInMap: second-level key '${this.maskSecretsForLog(secondLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}' -> '${this.maskSecretsForLog(topLevelKey, context)}'`);
 		}
 		const result = topLevel[secondLevelKey];
-		this.logger.debug(`Resolved Fn::FindInMap: ${mapName}.${topLevelKey}.${secondLevelKey} -> ${JSON.stringify(result)}`);
+		this.logger.debug(`Resolved Fn::FindInMap: ${this.maskSecretsForLog(mapName, context)}.${this.maskSecretsForLog(topLevelKey, context)}.${this.maskSecretsForLog(secondLevelKey, context)} -> ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(result, context)), context)}`);
 		return result;
 	}
 	/**
@@ -25329,6 +25576,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
+		if (context.recordedSecretValues && this.maskSecretsForLog(resolvedValue, context) !== resolvedValue) recordMaskOnlyValue(context.recordedSecretValues, result);
 		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(resolvedValue, context)} -> ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
@@ -25360,7 +25608,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let clientRegion;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${stripControlChars(resolvedValue).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
 		} else {
@@ -25369,7 +25617,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${region} -> ${JSON.stringify(cached)}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
 		const ec2Client = this.clientsForRegion(clientRegion).ec2;
@@ -25383,11 +25631,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${region}': ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${region}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${region} -> ${JSON.stringify(azNames)}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -25433,6 +25681,95 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secrets && secrets.size > 0) masked = maskSecretsInText(masked, secrets);
 		return masked;
 	}
+	/**
+	* A copy of `value` with every string LEAF (and every object KEY) masked, for
+	* a caller about to ENCODE it into a message (issue
+	* [#2759](https://github.com/go-to-k/cdkd/issues/2759)).
+	*
+	* `stringifyValue` / `JSON.stringify` ESCAPE a leaf containing `"`, `\` or a
+	* control character, and {@link maskSecretsInText} matches a needle
+	* LITERALLY — so masking the ENCODED text misses exactly the plaintexts the
+	* encoder rewrote (`pa"ss\word12` encodes to `["pa\"ss\\word12"]`, which no
+	* needle matches). Masking each leaf first also buys the WHOLE-VALUE arm,
+	* which has no {@link MIN_NEEDLE_LENGTH} floor, for a leaf that IS the
+	* plaintext.
+	*
+	* Returns the STRUCTURE rather than a rendered string, deliberately: each
+	* call site keeps its own encoder, so this changes which characters are
+	* masked and nothing about how a value RENDERS. Encoding here instead
+	* dropped `JSON.stringify`'s quotes around a bare string and made a `cdkd
+	* scrub` log line unrecognisable to its own test.
+	*
+	* Object KEYS are masked too: a `Fn::Split` / `Fn::GetAtt` chain can put a
+	* resolved value in key position, and an unmasked key discloses exactly as
+	* much as an unmasked value.
+	*
+	* Cycle-safe by MEMOIZATION rather than a depth cap: a self-referential
+	* structure terminates (the replacement is registered before its children are
+	* walked, so the cycle closes on it) and a legal deep one is still walked to
+	* the bottom. A repeated but NON-cyclic sub-object gets its real rendering
+	* rather than a placeholder — see the note at the `Map`.
+	*/
+	maskValueLeaves(value, context) {
+		const done = /* @__PURE__ */ new Map();
+		const walk = (node) => {
+			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (node === null || typeof node !== "object") return node;
+			const memo = done.get(node);
+			if (memo !== void 0) return memo;
+			if (Array.isArray(node)) {
+				const out = [];
+				done.set(node, out);
+				for (const item of node) out.push(walk(item));
+				return out;
+			}
+			const out = Object.create(null);
+			done.set(node, out);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			return out;
+		};
+		return walk(value);
+	}
+	/**
+	* Mask `value`, STRIP its control characters, then mask again — the shape a
+	* message that truncates its input needs (issue
+	* [#2827](https://github.com/go-to-k/cdkd/issues/2827) review round 1).
+	*
+	* NEITHER SINGLE ORDER IS CORRECT, and both were measured. Masking AFTER
+	* `stripControlChars` is what this fix was written to avoid: the strip
+	* rewrites the text a literal needle has to match. But masking BEFORE it is
+	* not safe either, because `stripControlChars` DELETES rather than replaces —
+	* so a plaintext SPLIT by an invisible (`S3cret\u200ePassw0rd`) is missed by
+	* the first mask and then RECONSTITUTED contiguous by the strip. That is the
+	* go-to-k/cdkd#2874 class arriving through a different door.
+	*
+	* Masking in BOTH string spaces closes both: the first pass catches a needle
+	* that occurs literally, the second catches one that only becomes contiguous
+	* after stripping. `maskSecretsInText` is idempotent, so the overlap costs
+	* nothing, and the caller truncates AFTERWARDS — never between the two.
+	*
+	* WHICH HALF IS FENCED, stated because a mutation probe made the difference
+	* visible. The FIRST mask is demonstrated by a test: deleting it (masking
+	* only after the strip) reds the split-needle case, because the recorded
+	* needle is then the split form and the strip has destroyed it. The SECOND
+	* mask is NOT reached by any test here and is defence in depth: it earns its
+	* place only when the bag holds a needle that is the STRIPPED form of the
+	* value in hand, and every route through THIS resolver records the value it
+	* actually resolved — so the split copy is itself a needle and the first
+	* mask already catches it. The shape was measured against a hand-built bag
+	* during review, not produced by the resolver. Kept anyway: it is one
+	* idempotent call, and the alternative is re-deciding per future caller
+	* whether the bag and the value can disagree.
+	*
+	* THE BOUND, since this file's job is to state them: this covers a needle
+	* split by a character `stripControlChars` removes. A needle split by
+	* anything else, or one whose canonical form differs for another reason, is
+	* `outputs-export-alias.ts`'s `canonicalForSecretScan` problem and is not
+	* solved here.
+	*/
+	maskThenStripThenMask(value, context) {
+		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+	}
 	async resolveDynamicReferences(value, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
@@ -25447,7 +25784,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
 				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferences(fullMatch, withoutProducerRegions(context));
 				result = result.replace(fullMatch, () => foreign);
@@ -25492,7 +25829,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
 				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(fullMatch, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
@@ -25556,22 +25893,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`, context));
+		const loggedSecretId = this.maskSecretsForLog(secretId, context);
+		const loggedJsonKey = this.maskSecretsForLog(jsonKey, context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(versionStage, context)}:${this.maskSecretsForLog(versionId, context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`secretsmanager:${secretId}`, context))).SecretString;
-		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`)).SecretString;
+		if (!secretString) throw new Error(`Dynamic reference: secret '${loggedSecretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const parsed = JSON.parse(secretString);
 			const keyValue = Object.hasOwn(parsed, jsonKey) ? parsed[jsonKey] : void 0;
-			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${jsonKey}' not found in secret '${secretId}'`);
+			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${loggedJsonKey}' not found in secret '${loggedSecretId}'`);
 			return stringifyValue(keyValue);
 		} catch (error) {
-			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${secretId}' is not valid JSON but JSON_KEY '${jsonKey}' was specified`);
+			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${loggedSecretId}' is not valid JSON but JSON_KEY '${loggedJsonKey}' was specified`);
 			throw error;
 		}
 		return secretString;
@@ -25597,8 +25936,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const ipBlock = await this.resolveValue(rawIpBlock, context);
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
-		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(ipBlock)}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${ipBlock}, count=${count}, cidrBits=${cidrBits}`);
+		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -25630,7 +25969,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				results.push(`${a}.${b}.${c}.${d}/${subnetPrefix}`);
 			}
 		}
-		this.logger.debug(`Fn::Cidr result: ${JSON.stringify(results)}`);
+		this.logger.debug(`Fn::Cidr result: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(results, context)), context)}`);
 		return results;
 	}
 	/** Expand IPv6 address to full 8-group form */
@@ -25720,21 +26059,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: ${service}:${parameterName}`, context));
+		const loggedParameterName = this.maskSecretsForLog(parameterName, context);
+		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`${service}:${parameterName}`, context));
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`);
 		const paramValue = response.Parameter?.Value;
-		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
+		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(this.maskSecretsForLog(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`, context));
+			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
 			value: paramValue,
@@ -26943,7 +27283,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-TexsJufw.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C_AHAmgD.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -36438,7 +36778,7 @@ var DeployEngine = class {
 			const next = { ...op };
 			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
 			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps);
-			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
+			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES);
 			return next;
 		});
 	}
@@ -37366,6 +37706,8 @@ var DeployEngine = class {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
 			this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
+			const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
+			if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 			this.recordEvent({
 				eventType: "RESOURCE_FAILED",
 				stackName,
@@ -38058,6 +38400,99 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* The plain-CREATE sibling of {@link replacementNameOrigin} (issue
+	* [#2902](https://github.com/go-to-k/cdkd/issues/2902)).
+	*
+	* A CREATE that collides on a name cdkd DERIVED is very likely a resource
+	* cdkd itself left behind: `DeletionPolicy: Retain` makes a rollback drop
+	* the state record while leaving the resource in AWS (CloudFormation
+	* semantics, and deliberate), and cdkd's generated names carry no random
+	* component (`generateResourceName`) — so the next deploy asks AWS for
+	* exactly the name the orphan still holds, fails, rolls back again, and
+	* repeats forever. Before this, the user saw only the bare AWS sentence:
+	* nothing named the collision's cause and nothing named a way out, so the
+	* reported recovery was hand-deleting resources through the AWS API.
+	*
+	* CloudFormation never shows this because its generated names carry a
+	* random suffix, so a retained orphan cannot collide with a later deploy.
+	* The breakage is that combination — CFn's retain semantics with cdkd's
+	* deterministic naming — rather than either half, which is why the fix here
+	* is a diagnosis and a remedy rather than a behaviour change. Whether cdkd
+	* should instead RE-ADOPT the retained resource is issue
+	* [#2914](https://github.com/go-to-k/cdkd/issues/2914).
+	*
+	* Returns `undefined` — leaving the pre-existing wording untouched — for
+	* every case it cannot vouch for:
+	*
+	* - not a CREATE. A replacement collision DOES arrive here — the
+	*   `NAMED_REPLACEMENT_COLLISION` throws happen inside `provisionResourceBody`,
+	*   which the caller invokes inside the same `try`, and this method's own
+	*   suite asserts their line was logged. What refuses them is the
+	*   `ProvisioningError` check below (they throw `CdkdError`), so deleting
+	*   EITHER guard alone leaves the suite green. That does not make this one
+	*   dead: a non-CREATE `ProvisioningError` whose message carries
+	*   `already exists` — an UPDATE-path sub-resource conflict — would reach
+	*   the advice without it, and the replacement message's remedy is to
+	*   RENAME, which does not recover an orphan. (An earlier revision of this
+	*   comment claimed the throws "never reach this catch at all". Three
+	*   reviewers disproved it independently.);
+	* - not a name collision;
+	* - no physical id on the error (a create that failed BEFORE the AWS call
+	*   never names one). At RUNTIME this is subsumed by the next guard --
+	*   `looksLikeCdkdGeneratedName` refuses a falsy id on its own first line,
+	*   measured: deleting this check ALONE leaves the suite green, deleting
+	*   both together reds it. It stays for the TYPE narrowing the message
+	*   interpolation needs, and so the refusal is readable here rather than
+	*   inferred from another module;
+	* - a name cdkd did not derive — a user-supplied name may collide with a
+	*   resource of someone else's entirely, and telling that user to
+	*   `cdkd import` it would be advice to adopt what this stack does not own;
+	* - a NESTED-STACK child. Its stack name is `<parent>~<logicalId>`, and CDK's
+	*   own stack-name rule bars `~`, so no Cloud Assembly stack can ever carry
+	*   it — `cdkd import` resolves its target from the assembly and walks
+	*   top-level stacks only, so the command would be unrunnable. That is the
+	*   same #2610 class this method's `canImport` check exists for, one level
+	*   down, so the child takes the delete-only arm.
+	*
+	* **A cdkd-DERIVED name is not proof the resource is THIS stack's**, which
+	* the first revision of this advice assumed. Two ways it is not, both
+	* reachable: a globally-namespaced type (`AWS::S3::Bucket` is the documented
+	* exception — see `.claude/rules/provider-resource-identity.md`) can collide
+	* with ANOTHER ACCOUNT's resource, and because the derivation is predictable
+	* that name can be pre-registered by someone else; and the same stack name
+	* deployed in two REGIONS derives the same name for a global type, so the
+	* collision is with a live resource another state file already owns —
+	* importing it would give two stacks one resource, and either `cdkd destroy`
+	* would then delete it out from under the other. So the message names the
+	* orphan as the LIKELY case rather than the certain one, and asks the reader
+	* to confirm ownership before adopting.
+	*/
+	orphanedNameCollisionAdvice(changeType, logicalId, error) {
+		if (changeType !== "CREATE") return void 0;
+		if (!(error instanceof ProvisioningError)) return void 0;
+		const physicalId = error.physicalId;
+		if (!physicalId) return void 0;
+		if (!isNameCollisionError(error.message)) return void 0;
+		const stackName = getCurrentStackName();
+		if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+		if (!stackName) return void 0;
+		const safeId = displaySafe(physicalId, { asciiOnly: true });
+		const safeStack = displaySafe(stackName, { asciiOnly: true });
+		const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+		const diagnosis = `${safeLogicalId}: the name AWS reports as taken (${safeId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+		const deleteArm = `If it is not a resource you want to keep, delete ${safeId} in AWS — after confirming it holds nothing you need, since Retain is what kept it — and re-deploy.`;
+		let canImport;
+		try {
+			canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
+		} catch {
+			canImport = false;
+		}
+		const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+		const importableTarget = !stackName.includes("~");
+		if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+		return `${diagnosis} To recover, adopt it back into state instead of re-creating it: cdkd import ${shellQuote(safeStack)} --resource ${shellQuote(`${safeLogicalId}=${safeId}`)} (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}`;
+	}
+	/**
 	* Read `DeletionPolicy` / `UpdateReplacePolicy` from the synth template
 	* so they can be persisted in `ResourceState` (schema v5+). Always returns
 	* both keys (`undefined` when the template does not carry the attribute)
@@ -38422,5 +38857,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { ProviderRegistry as $, partitionSensitiveEnv as $n, ResourceTimeoutError as $r, STATE_SOURCED_CROSS_GENERATION_RULES as $t, renderStatefulReason as A, buildAssetRedirectMap as An, derivePartitionAndUrlSuffix as Ar, configStringRefusal as At, red as B, parseBootstrapMarker as Bn, CdkdError as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, exportNamesCarriedFrom as Cn, findLargeInlineResources as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, AssetPublisher as Dn, expectedOwnerParam as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, shouldRetainResource as En, displaySafe as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, BOOTSTRAP_MARKER_PREFIX as Fn, AwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, describeAwsFailure as Gn, DynamicReferenceRegionAmbiguousError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, validateAssetBucketName as Hn, CrossAccountSecretRefusalError as Hr, s3BucketRegionalDomainName as Ht, bold as I, assertAssetBucketRegion as In, getAwsClients as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, describeDockerExecFailure as Jn, LocalStartServiceError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDockerImage as Kn, IntrinsicResolutionRefusalError as Kr, INTRINSIC_KEYS as Kt, cyan as L, ensureAssetStorage as Ln, resetAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, loadPublishableAssetManifest as Mn, processStackMessages as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, rewriteTemplateAssetReferences as Nn, clearBucketRegionCache as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, stringifyValue as On, PARTITION_TABLE as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, AssetModeResolver as Pn, resolveBucketRegion as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, getDockerCmd as Qn, ProvisioningError as Qr, TemplateParser as Qt, gray as R, getBootstrapMarkerKey as Rn, setAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, DEFAULT_STATE_PREFIX as Sn, MIGRATE_TMP_PREFIX as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, importableOutputs as Tn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, validateContainerRepoName as Un, DependencyError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, readBootstrapMarkerBody as Vn, ConfigError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, buildDenyExternalAccessPolicy as Wn, DeployCancelledError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, dockerSpawnEnvWithSensitive as Xn, NestedStackChildDirectDestroyError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerFailure as Yn, LockError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, formatDockerLoginError as Zn, PartialFailureError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildForceUnlockCommand as _n, resolveUseCdkBootstrapAssets as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, formatError as ai, errorCauseChain as an, AssetManifestLoader as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, shellQuote as bn, CFN_TEMPLATE_BODY_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, withErrorHandling as ci, maskSecretsInText as cn, synthesisStatusMessage as cr, startInterruptWatch as ct, updatePartialReason as d, isThrottlingError as di, redactSecretsForState as dn, resolveApp as dr, UNSPECIFIED_SKIP_REASON as dt, ResourceUpdateNotSupportedError as ei, STATE_SOURCED_READBACK_RULES as en, redactDockerArgvValues as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isTransientServerError as fi, scrubResourceRecord as fn, resolveAutoAssetStorage as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, __exportAll as gi, UNRENDERABLE as gn, resolveStateBucketWithDefaultAndSource as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, retryClassificationText as hi, rebuildClientForBucketRegion as hn, resolveStateBucketWithDefault as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, SynthesisError as ii, dynamicReferenceTokens as in, stripControlChars as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, createAssetRedirectResolver as jn, AssemblyReader as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, WorkGraph as kn, canonicalizeRegion as kr, configBooleanRefusal as kt, replayRollback as l, isMarkedNonRetryable as li, recordMaskOnlyValue as ln, getDefaultStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, markRedactedCause as mi, S3StateBackend as mn, resolveSkipPrefix as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as ni, carriesSecretMask as nn, runDockerStreaming as nr, maskDeep as nt, planFailedOps as o, isCdkdError as oi, isSingleDynamicReferenceToken as on, getDockerImageBySourceHash as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markNonRetryable as pi, LockManager as pn, resolveCaptureObservedState as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeDockerCapturedOutput as qn, LocalInvokeBuildError as qr, findActionableSilentDrops as qt, DeployEngine as r, StateError as ri, createSecretMasker as rn, escapeRegExp$1 as rr, maskerOrIdentity as rt, planRollback as s, normalizeAwsError as si, maskSecretsInError as sn, Synthesizer as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as ti, TEMPLATE_SOURCED_RULES as tn, runDockerForeground as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isRetryableTransientError as ui, recoverMaskedOutput as un, getLegacyStateBucketName as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, buildLockContentionMessage as vn, stateBucketExistenceConfirmed as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputKeys as wn, uploadCfnTemplate as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, CUSTOM_RESOURCE_RESPONSE_PREFIX as xn, CFN_TEMPLATE_URL_LIMIT as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, forceQuitRecoveryClause as yn, warnDeprecatedNoPrefixCliFlag as yr, coerceParameterTypedValue as yt, green as z, isCrossRegionRedirect as zn, AssetError as zr, s3BucketArn as zt };
-//# sourceMappingURL=deploy-engine-BiPxTgKT.js.map
+export { ProviderRegistry as $, formatDockerLoginError as $n, PartialFailureError as $r, STATE_SOURCED_BASELINE_RULES as $t, renderStatefulReason as A, stringifyValue as An, PARTITION_TABLE as Ar, configStringRefusal as At, red as B, getBootstrapMarkerKey as Bn, setAwsClients as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, CUSTOM_RESOURCE_RESPONSE_PREFIX as Cn, CFN_TEMPLATE_URL_LIMIT as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, importableOutputs as Dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, importableOutputKeys as En, uploadCfnTemplate as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, rewriteTemplateAssetReferences as Fn, clearBucketRegionCache as Fr, requireConfigString as Ft, isExportAliasCollision as G, validateContainerRepoName as Gn, DependencyError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, parseBootstrapMarker as Hn, CdkdError as Hr, s3BucketRegionalDomainName as Ht, bold as I, AssetModeResolver as In, resolveBucketRegion as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, buildDockerImage as Jn, IntrinsicResolutionRefusalError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDenyExternalAccessPolicy as Kn, DeployCancelledError as Kr, INTRINSIC_KEYS as Kt, cyan as L, BOOTSTRAP_MARKER_PREFIX as Ln, AwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, buildAssetRedirectMap as Mn, derivePartitionAndUrlSuffix as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, createAssetRedirectResolver as Nn, AssemblyReader as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, shouldRetainResource as On, displaySafe as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, loadPublishableAssetManifest as Pn, processStackMessages as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, dockerSpawnEnvWithSensitive as Qn, NestedStackChildDirectDestroyError as Qr, TemplateParser as Qt, gray as R, assertAssetBucketRegion as Rn, getAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, shellQuote as Sn, CFN_TEMPLATE_BODY_LIMIT as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, exportNamesCarriedFrom as Tn, findLargeInlineResources as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, readBootstrapMarkerBody as Un, ConfigError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, isCrossRegionRedirect as Vn, AssetError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, validateAssetBucketName as Wn, CrossAccountSecretRefusalError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, describeDockerExecFailure as Xn, LocalStartServiceError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerCapturedOutput as Yn, LocalInvokeBuildError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, describeDockerFailure as Zn, LockError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, retryClassificationText as _i, rebuildClientForBucketRegion as _n, resolveStateBucketWithDefault as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, StateError as ai, dynamicReferenceTokens as an, escapeRegExp$1 as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, buildLockContentionMessage as bn, stateBucketExistenceConfirmed as br, getAccountInfo as bt, replayFailedOperations as c, isCdkdError as ci, isSingleDynamicReferenceToken as cn, getDockerImageBySourceHash as cr, startInterruptWatch as ct, updatePartialReason as d, isMarkedNonRetryable as di, recordMaskOnlyValue as dn, getDefaultStateBucketName as dr, UNSPECIFIED_SKIP_REASON as dt, ProvisioningError as ei, STATE_SOURCED_CROSS_GENERATION_RULES as en, getDockerCmd as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isRetryableTransientError as fi, recoverMaskedOutput as fn, getLegacyStateBucketName as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, markRedactedCause as gi, S3StateBackend as gn, resolveSkipPrefix as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, markNonRetryable as hi, LockManager as hn, resolveCaptureObservedState as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, StackTerminationProtectionError as ii, createSecretMasker as in, runDockerStreaming as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, WorkGraph as jn, canonicalizeRegion as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, AssetPublisher as kn, expectedOwnerParam as kr, configBooleanRefusal as kt, replayRollback as l, normalizeAwsError as li, maskSecretsInError as ln, Synthesizer as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isTransientServerError as mi, scrubResourceRecord as mn, resolveAutoAssetStorage as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as ni, TEMPLATE_SOURCED_RULES as nn, redactDockerArgvValues as nr, maskDeep as nt, planFailedOps as o, SynthesisError as oi, errorCauseChain as on, stripControlChars as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, isThrottlingError as pi, redactSecretsForState as pn, resolveApp as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeAwsFailure as qn, DynamicReferenceRegionAmbiguousError as qr, findActionableSilentDrops as qt, DeployEngine as r, StackHasActiveImportsError as ri, carriesSecretMask as rn, runDockerForeground as rr, maskerOrIdentity as rt, planRollback as s, formatError as si, identityKeyFor as sn, AssetManifestLoader as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as ti, STATE_SOURCED_READBACK_RULES as tn, partitionSensitiveEnv as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, withErrorHandling as ui, maskSecretsInText as un, synthesisStatusMessage as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, __exportAll as vi, UNRENDERABLE as vn, resolveStateBucketWithDefaultAndSource as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, DEFAULT_STATE_PREFIX as wn, MIGRATE_TMP_PREFIX as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, forceQuitRecoveryClause as xn, warnDeprecatedNoPrefixCliFlag as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, buildForceUnlockCommand as yn, resolveUseCdkBootstrapAssets as yr, coerceParameterTypedValue as yt, green as z, ensureAssetStorage as zn, resetAwsClients as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-Dsf9bTqH.js.map