@go-to-k/cdkd 0.288.4 → 0.288.5

package/dist/{program-Ci4Y5UO9.js → program-CMhpftan.js}

@@ -1,8 +1,8 @@
-import { $ as ProviderRegistry, $n as partitionSensitiveEnv, $r as ResourceTimeoutError, $t as STATE_SOURCED_CROSS_GENERATION_RULES, A as renderStatefulReason, An as buildAssetRedirectMap, Ar as derivePartitionAndUrlSuffix, At as configStringRefusal, B as red, Bn as parseBootstrapMarker, Br as CdkdError, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as exportNamesCarriedFrom, Cr as findLargeInlineResources, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as AssetPublisher, Dr as expectedOwnerParam, Dt as assertRegionMatch, E as extractDeploymentEventError, En as shouldRetainResource, Er as displaySafe, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as BOOTSTRAP_MARKER_PREFIX, Fr as AwsClients, Ft as requireConfigString, G as isExportAliasCollision, Gn as describeAwsFailure, Gr as DynamicReferenceRegionAmbiguousError, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as validateAssetBucketName, Hr as CrossAccountSecretRefusalError, Ht as s3BucketRegionalDomainName, I as bold, In as assertAssetBucketRegion, Ir as getAwsClients, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as describeDockerExecFailure, Jr as LocalStartServiceError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDockerImage, Kr as IntrinsicResolutionRefusalError, Kt as INTRINSIC_KEYS, L as cyan, Ln as ensureAssetStorage, Lr as resetAwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as loadPublishableAssetManifest, Mr as processStackMessages, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as rewriteTemplateAssetReferences, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as stringifyValue, Or as PARTITION_TABLE, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as AssetModeResolver, Pr as resolveBucketRegion, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as getDockerCmd, Qr as ProvisioningError, Qt as TemplateParser, R as gray, Rn as getBootstrapMarkerKey, Rr as setAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as DEFAULT_STATE_PREFIX, Sr as MIGRATE_TMP_PREFIX, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as importableOutputs, Tr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as validateContainerRepoName, Ut as s3BucketWebsiteUrl, V as yellow, Vn as readBootstrapMarkerBody, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as buildDenyExternalAccessPolicy, Wr as DeployCancelledError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as dockerSpawnEnvWithSensitive, Xr as NestedStackChildDirectDestroyError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerFailure, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as formatDockerLoginError, Zr as PartialFailureError, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as buildForceUnlockCommand, _r as resolveUseCdkBootstrapAssets, _t as carriesDynamicReference, a as DeploymentEventsStore, an as errorCauseChain, ar as AssetManifestLoader, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as shellQuote, br as CFN_TEMPLATE_BODY_LIMIT, bt as getAccountInfo, c as replayFailedOperations, ci as withErrorHandling, cn as maskSecretsInText, cr as synthesisStatusMessage, ct as startInterruptWatch, d as updatePartialReason, di as isThrottlingError, dn as redactSecretsForState, dr as resolveApp, dt as UNSPECIFIED_SKIP_REASON, ei as ResourceUpdateNotSupportedError, en as STATE_SOURCED_READBACK_RULES, er as redactDockerArgvValues, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isTransientServerError, fn as scrubResourceRecord, fr as resolveAutoAssetStorage, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gn as UNRENDERABLE, gr as resolveStateBucketWithDefaultAndSource, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as retryClassificationText, hn as rebuildClientForBucketRegion, hr as resolveStateBucketWithDefault, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, in as dynamicReferenceTokens, ir as stripControlChars, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as createAssetRedirectResolver, jr as AssemblyReader, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as WorkGraph, kr as canonicalizeRegion, kt as configBooleanRefusal, l as replayRollback, li as isMarkedNonRetryable, ln as recordMaskOnlyValue, lr as getDefaultStateBucketName, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as markRedactedCause, mn as S3StateBackend, mr as resolveSkipPrefix, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as StackTerminationProtectionError, nn as carriesSecretMask, nr as runDockerStreaming, nt as maskDeep, o as planFailedOps, on as isSingleDynamicReferenceToken, or as getDockerImageBySourceHash, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as markNonRetryable, pn as LockManager, pr as resolveCaptureObservedState, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeDockerCapturedOutput, qr as LocalInvokeBuildError$1, qt as findActionableSilentDrops, r as DeployEngine, rn as createSecretMasker, rr as escapeRegExp, rt as maskerOrIdentity, s as planRollback, si as normalizeAwsError, sn as maskSecretsInError, sr as Synthesizer, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as StackHasActiveImportsError, tn as TEMPLATE_SOURCED_RULES, tr as runDockerForeground, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as isRetryableTransientError, un as recoverMaskedOutput, ur as getLegacyStateBucketName, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as buildLockContentionMessage, vr as stateBucketExistenceConfirmed, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as importableOutputKeys, wr as uploadCfnTemplate, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as CUSTOM_RESOURCE_RESPONSE_PREFIX, xr as CFN_TEMPLATE_URL_LIMIT, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as forceQuitRecoveryClause, yr as warnDeprecatedNoPrefixCliFlag, yt as coerceParameterTypedValue, z as green, zn as isCrossRegionRedirect, zt as s3BucketArn } from "./deploy-engine-BiPxTgKT.js";
+import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-Dsf9bTqH.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BmM4QJ9t.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-TexsJufw.js";
+import { t as getCdkdVersion } from "./version-BFmq8S23.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-C_AHAmgD.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -44136,7 +44136,11 @@ var CognitoUserPoolProvider = class {
 	* Retry a Cognito control-plane call on transient "settling" errors. A
 	* SetUserPoolMfaConfig issued immediately after CreateUserPool (or another
 	* control-plane write) can briefly hit `ConcurrentModificationException` /
-	* "please retry". Backoff 1s -> 2s -> 4s, default 3 attempts.
+	* "please retry". Backoff is capped at 4s, but the DEFAULT 3 attempts means
+	* only TWO sleeps -- 1s then 2s, 3s total -- so the 4s step is unreachable
+	* unless a caller raises `maxAttempts`. (`retryable-errors.ts`'s Cognito
+	* SMS-role entry depends on that arithmetic; an earlier revision of it
+	* copied a 7s figure out of this comment's previous wording.)
 	*/
 	async retryOnTransientControlPlane(fn, label, maxAttempts = 3) {
 		for (let attempt = 1;; attempt++) try {
@@ -70046,7 +70050,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					secrets.clear();
 				}
-				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager', 'ssm' and 'ssm-secure' references; anything else is left as written.`);
+				if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched where its position can be matched against AWS's report (a list element pairs by an identity field, or by the list's own unchanged literal values); where it cannot be matched, and where a token is EMBEDDED in a longer string, the revert writes the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager', 'ssm' and 'ssm-secure' references; anything else is left as written.`);
 				const observedIgnorePaths = useObserved ? undeclaredEmptyObservedKeys(resource.observedProperties, resource.properties ?? {}) : [];
 				const normalized = await canonicalizePrincipalUniqueIds(comparisonBaseline, aws, resolvePrincipalUniqueId);
 				const protocolNormalized = canonicalizeIpProtocols(normalized.baseline, normalized.aws, resource.resourceType);
@@ -70523,6 +70527,22 @@ function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Does this value carry an ORDINARY object prototype?
+*
+* {@link isPlainRecord} admits `Date` / `Map` / `Set` / class instances, whose
+* own enumerable keys are `[]` — so a key-walk over one reports "no
+* contradiction" between two values that actually differ. The redaction walk's
+* `deepEqualJsonValue` carries the same guard for the same reason
+* (`secret-redaction.ts`, issue #2869): a `Date` anchor corroborates NOTHING.
+* Kept file-local rather than imported because `secret-redaction.js` is
+* `vi.mock`ed by several drift suites, and a value import from it reds them
+* with a missing-export failure.
+*/
+function hasPlainPrototype(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/**
 * Merge the AWS-current value with the revert baseline, KEEPING every path the
 * baseline does not declare (issue
 * [#1626](https://github.com/go-to-k/cdkd/issues/1626) items 2 + 3).
@@ -70606,7 +70626,8 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 		return merged;
 	}
 	if (!isPlainRecord(awsValue) || !isPlainRecord(desiredValue)) return desiredValue;
-	const merged = {};
+	if (!hasPlainPrototype(awsValue) || !hasPlainPrototype(desiredValue)) return desiredValue;
+	const merged = Object.create(null);
 	for (const [key, value] of Object.entries(awsValue)) merged[key] = key in desiredValue ? mergeUntemplatedValue(value, desiredValue[key]) : value;
 	for (const [key, value] of Object.entries(desiredValue)) if (!(key in awsValue)) merged[key] = value;
 	return merged;
@@ -70640,9 +70661,26 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 *
 * Falls back to KEEPING the token wherever AWS has nothing at that position —
 * that is what `cdkd deploy` sends, so it is the safe residual rather than
-* dropping a property the resource may require. Array descent is positional
-* and bails to that same residual on any length mismatch, since a reordered
-* readback cannot be positioned against.
+* dropping a property the resource may require. Array descent pairs live
+* elements through {@link pairedLiveItems} — an identity field first, else the
+* array's own literal frame corroborated per LEAF — never by blind index
+* (issue [#2893](https://github.com/go-to-k/cdkd/issues/2893)): until that
+* issue the descent was positional behind a length test, so a readback AWS
+* REORDERED copied element *i*'s live value into element *i*'s token position
+* and `provider.update` shipped a value belonging to a DIFFERENT element. The
+* wildcard handed to the pairing is "whole token OR the redaction mask": a
+* token leaf cannot corroborate an order (its live counterpart is the resolved
+* value, so comparing would refuse every array this pass exists to serve), and
+* a mask leaf belongs to the SIBLING mask walk but must abstain here rather
+* than contradict. Where the pairing refuses, the token is KEPT — the same
+* residual as everywhere else in this pass, and deliberately NOT the mask
+* walk's drop-the-resource refusal: that one would abandon every other drifted
+* property over an alignment this pass never needed, while the kept token is
+* what `cdkd deploy` sends. The trade this accepts: an array whose OTHER
+* leaves genuinely drifted no longer takes a positional copy (the frame cannot
+* corroborate an order it no longer matches), so the token ships there —
+* a no-op for a record cdkd deployed, and for any other record a preserved
+* pre-existing breakage rather than another element's value written live.
 */
 function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 	const walk = (value, live) => {
@@ -70652,12 +70690,13 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 			return live;
 		}
 		if (Array.isArray(value)) {
-			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
+			const liveItems = pairedLiveItems(value, live, isTokenOrMaskLeaf, carriesTokenOrMask, true);
 			return value.map((item, i) => walk(item, liveItems?.[i]));
 		}
 		if (value !== null && typeof value === "object") {
+			if (!hasPlainPrototype(value)) return value;
 			const liveObject = isPlainRecord(live) ? live : void 0;
-			const out = {};
+			const out = Object.create(null);
 			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k]);
 			return out;
 		}
@@ -70666,6 +70705,335 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 	return walk(send, awsProperties);
 }
 /**
+* Paths in the bag `--revert` is about to send whose value is an unresolved
+* CloudFormation intrinsic OBJECT — `{ Ref: ... }` or a single-key
+* `{ 'Fn::*': ... }` (issue
+* [#2855](https://github.com/go-to-k/cdkd/issues/2855)).
+*
+* WHY THE SHAPE IS REACHABLE. `cdkd import`'s warn path persists raw intrinsic
+* objects into a record's `properties`, and issue #2842's baseline refusal is
+* what routes such a record here: it leaves `observedProperties` undefined, so
+* `runRevert`'s `revertBaseline` falls back to the raw bag.
+* `resolveStateSecretExpressions` re-resolves only `{{resolve:...}}` STRINGS,
+* so the OBJECT walks through it untouched, and the drift comparator's
+* `{{resolve:` skip is a string test too — the object simply differs from the
+* readback, drifts, and `buildRevertNewProperties` overlays it into the send
+* bag.
+*
+* WHY IT MUST BE REFUSED rather than shipped or live-preserved. Measured
+* (issue #2855's open question) with mocked SDK clients on both routes: NO
+* route fails loudly on cdkd's side. `SSMParameterProvider.update` puts the
+* raw object straight into `PutParameterCommand.input.Value`;
+* `CloudControlProvider.update` emits it verbatim as a JSON-patch value, and
+* for a `JSON_STRING_PROPERTIES` type (`AWS::Events::Rule.EventPattern`) it is
+* `JSON.stringify`ed into a schema-VALID string — a payload AWS cannot even
+* reject on type, i.e. guaranteed silent corruption. Live-preserving (the
+* token pass's answer) is no better: the intrinsic's real value depends on
+* template context a synth-free command does not have, and copying whatever
+* AWS holds would silently bless an out-of-band edit as the baseline.
+*
+* The predicate mirrors the resolver's own rule (a CloudFormation intrinsic is
+* ALWAYS a single-key object; `detectUnknownIntrinsicKey` in
+* `intrinsic-function-resolver.ts` states why single-key is what keeps a real
+* property literally named `Ref` from false-positiving). A non-plain object
+* (`Date`, `Uint8Array`) cannot be an intrinsic and is not descended. The scan
+* is scoped to `topLevelKeys` — the DRIFTED keys, the only ones
+* `buildRevertNewProperties` sources from the baseline — so a value that
+* merely looks intrinsic under a non-drifted key cannot refuse a revert it
+* never participates in. The caller hands it the BASELINE
+* (`desiredProperties`), never the post-overlay send bag: on the very
+* population this refusal exists for, `mergeUntemplatedValue`'s key-merge can
+* FUSE a single-key intrinsic with a plain-record live value into a multi-key
+* object the predicate no longer matches, while every overlay arm re-emits
+* every baseline path into the send bag in some shape — so the baseline scan
+* is complete where the merged-bag scan was dilutable, and an AWS-echoed
+* lookalike (which lives only in the overlay) stays exempt by construction.
+* The caller additionally gates the whole scan on
+* `observedProperties === undefined` — intrinsic objects reach a revert
+* baseline only through the raw-`properties` fallback, while an
+* `observedProperties` baseline is READBACK-derived, where a single-key map
+* named like an intrinsic is a real AWS value and a refusal would be
+* permanent (the call site's comment carries the full derivation).
+*
+* The whole flagged leaf is reported once; nothing beneath it is separately
+* scanned, since the caller refuses the resource on the first path anyway.
+*/
+function collectUnresolvedIntrinsicObjectPaths(bag, topLevelKeys) {
+	const found = [];
+	const visit = (value, path) => {
+		if (Array.isArray(value)) {
+			value.forEach((item, i) => visit(item, `${path}[${i}]`));
+			return;
+		}
+		if (value !== null && typeof value === "object") {
+			if (!hasPlainPrototype(value)) return;
+			const record = value;
+			const keys = Object.keys(record);
+			const key = keys[0];
+			if (keys.length === 1 && key !== void 0 && (key === "Ref" || key.startsWith("Fn::"))) {
+				found.push(path);
+				return;
+			}
+			for (const [k, v] of Object.entries(record)) visit(v, `${path}.${k}`);
+		}
+	};
+	for (const key of topLevelKeys) if (Object.hasOwn(bag, key)) visit(bag[key], key);
+	return found.sort();
+}
+/**
+* The live array to read a preserved leaf's replacement from, aligned to
+* `send`'s indices — or `undefined` when the two lists cannot be aligned at
+* all, which routes every mask beneath them to `unpreservablePaths` in the
+* mask walk and keeps the token in the token walk (see the wildcard
+* paragraph below for the split).
+*
+* WHY THIS IS NOT INDEX ALIGNMENT ANY MORE (issue
+* [#2884](https://github.com/go-to-k/cdkd/issues/2884)). Until issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852) the only mask in a
+* persisted bag came from a `NoEcho` custom resource's `Data` (issue #2274),
+* which sits at a scalar leaf of a property the template names. #2852 added a
+* second source, and it lands in exactly the population index alignment is
+* WRONG on: a leaf is masked BECAUSE `refuseUncertifiedReadbackPositions` could
+* not pair the two lists — an unkeyed array AWS reordered, or a keyed element
+* whose identity AWS normalised. A resource that produced a mask is by
+* construction one whose list does not come back in a stable order.
+*
+* Traced consequence, which is the issue #1498 / #1501 data-loss class this
+* module's own doc calls "strictly worse than the disclosure": for
+* `Environment: [{Name:'DB_PASS', Value:<ref>}, {Name:'REGION', Value:'...'}]`
+* echoed back case-normalised and reordered, the baseline becomes
+* `[{Name:'REGION',...}, {Name:'***', Value:'***'}]`, and an index-aligned
+* revert copies `live[1]` into the masked slot — shipping a duplicated `REGION`
+* and DELETING the password variable from the live task definition.
+*
+* So the alignment must be one AWS's own reordering cannot break:
+* {@link identityKeyFor} — the same rule the redaction walk pairs by, so the
+* two can never disagree about which elements correspond. It is asked FIRST and
+* with NO length test, which is a change from the first cut of this function: a
+* length test ahead of it refuses a list AWS legitimately ADDED an element to,
+* while the keyed lookup needs no such partner — a `send` element whose identity
+* AWS does not report simply yields no live value, which is already the
+* refusing arm.
+*
+* WITHOUT AN IDENTITY FIELD the array's own literal FRAME has to vouch for the
+* order — the same corroboration `unkeyedArrayPairsByAnchors` requires on the
+* redaction side — and the test is PER-LEAF. Three rules, and the first cut of
+* this function had none of them right:
+*
+* - **the lengths must match**, positional alignment being all that is left;
+* - **every leaf of `send` that is not a mask must equal `live`'s leaf at the
+*   same position** ({@link corroboratedLeafCount}), masked leaves wildcarded.
+*   A whole-ELEMENT exemption is what shipped first, and it corroborated
+*   NOTHING: {@link carriesSecretMask} is a DEEP, whole-subtree test, so an
+*   element carrying one mask anywhere skipped the comparison entirely.
+*   Measured on `[{Pw:'***',Role:'reader'},{Pw:'***',Role:'admin'}]` against a
+*   live list AWS returned in the other order — the admin password was written
+*   onto the reader entry and `provider.update` shipped it;
+* - **at most ONE element may carry a mask, and at least one non-mask leaf must
+*   actually have been COMPARED.** Two masked slots leave the surviving literal
+*   frame unable to say which mask goes where (two secret environment variables
+*   in one container definition is the ordinary shape), and zero compared
+*   leaves is the all-masked array {@link SECRET_MASK} produces when AWS
+*   normalised the identity field too — there the old `every` was vacuously
+*   true and the alignment rested on no evidence at all. With ONE masked slot
+*   and every other position literally equal, the single live element left over
+*   is the only value that can belong there.
+*
+* The `compared > 0` floor DELIBERATELY also refuses a single-element scalar
+* array — `[SECRET_MASK]` against one live value — even though one masked slot
+* against one live slot looks unambiguous. It is unambiguous only IF the live
+* list corresponds to this one, and with zero corroborated leaves the only
+* evidence for that is the length-1 match, which is no evidence: this is the
+* all-masked reading applied to its smallest shape, and the cost is a refusal
+* (the safe residual), not a wrong write. THAT COST SENTENCE IS THE MASK
+* WALK'S ALONE — for the token walk a refusal WRITES the token, so the same
+* floor inverts there and the singleton is accepted instead; see
+* `pairedLiveItems`' `acceptForcedSingleton` for the derivation.
+*
+* THE EVIDENCE MUST NOT BE MANUFACTURED BY A SIBLING PASS. `send` here must be
+* values the caller did not itself copy from `live` — see
+* {@link preserveLiveValuesAtMaskedLeaves}'s `corroborationSource` parameter
+* for the round-4 #2884 defect where the token pass's index-copied live values
+* corroborated their own indices.
+*
+* Refusing is the correct outcome for the MASK caller — it drops the whole
+* resource rather than send a guess. The TOKEN caller's refusal residual is
+* KEEPING the token (see below); both are the refusal `undefined` spells here,
+* and what it costs is the CALLER's contract, not this function's.
+*
+* PARAMETERISED WILDCARDS (issue #2893). This pairing now serves BOTH preserve
+* walks, because the two questions are identical — "which live element belongs
+* to this send element?" — and a second hand-rolled copy of the rule is
+* exactly how the `maskDeep` class of divergence starts. What differs per
+* caller is only WHICH leaf is the one being paired FOR (and so must be
+* wildcarded rather than compared) and what a refusal costs:
+*
+* - the MASK walk wildcards {@link SECRET_MASK} alone; a refusal drops the
+*   resource, so over-refusal is a safe posture there;
+* - the TOKEN walk wildcards a WHOLE `{{resolve:...}}` token (its live
+*   counterpart is the resolved value, so comparing would contradict on every
+*   array that pass exists to serve) AND the mask (owned by the LATER mask
+*   walk — comparing `***` against live would contradict spuriously, and
+*   treating it as evidence would be wrong in the other direction). Its
+*   refusal residual is keeping the token, which `provider.update` ships —
+*   a no-op for a record cdkd deployed, a preserved pre-existing breakage
+*   otherwise, and in both cases better than another element's live value
+*   copied into the wrong position.
+*
+* `carriesWildcard` must be the DEEP form of `wildcardLeaf` (an element
+* carrying a wildcard anywhere is a slot whose alignment part-rests on
+* abstention), and the one-slot bound applies to it: with two such elements
+* the surviving literal frame cannot say which wildcard goes where.
+*
+* `acceptForcedSingleton` (PR #2912 review, blocker 1) is where the two
+* callers' refusal COSTS meet the evidence rules, and it exists because a
+* rule that is sound for one arm BECAUSE of what its refusal costs cannot be
+* shared without re-deriving that cost. At `send.length === 1` against
+* `live.length === 1` no evidence question remains OPEN: the position is
+* FORCED (there is no other candidate to mis-pair with), and a positional
+* copy writes each live value back to its own position, so no
+* cross-POSITION donation — the credential-swap class every bound above
+* exists to stop — is constructible. Cross-IDENTITY donation is: the
+* bypass sits above the identity arm and its wildcard-identity guard, so
+* `[{Name:'DB', Value:<token>}]` against a live `[{Name:'OTHER', Value:'X'}]`
+* ships `{Name:'DB', Value:'X'}` — a value from a differently-identified
+* element. That is position-neutral (X lands at the exact position AWS
+* holds it), it is what the pre-#2893 positional descent did for every such
+* array, and the alternative writes the token over X; the trade is stated
+* here rather than claimed away. What the evidence rules still doubt at
+* 1-vs-1 is only "does this live list correspond to this send list at
+* all", and the two callers answer that doubt oppositely because their
+* refusal residuals invert:
+*
+* - the MASK walk refuses (`false`, the default): its residual is dropping
+*   the resource, so doubt costs a refusal — the safe direction, and the
+*   `[SECRET_MASK]`-vs-one-live-value reading its own doc defends;
+* - the TOKEN walk accepts (`true`): its residual WRITES the literal token
+*   over whatever AWS holds (`provider.update` ships it — the #1914
+*   corruption), so refusing on a forced position DESTROYS the live value a
+*   pairing would have preserved, while accepting is write-neutral even when
+*   the correspondence doubt is real (the copied value lands at the exact
+*   position AWS already holds it). Refusal buys nothing and costs a
+*   destructive write, so the token walk takes the pairing — which is also
+*   exactly the pre-#2893 behaviour for every 1-vs-1 array.
+*
+* The bypass sits ABOVE the identity arm deliberately: at 1-vs-1 an identity
+* mismatch (AWS normalised the one element's Name) changes which EVIDENCE
+* rule fails, not the forced position, and routing it through the identity
+* arm would re-open the same inverted cost through a different door. Every
+* bound below is untouched for `length >= 2`, where mis-pairing is real.
+*/
+function pairedLiveItems(send, live, wildcardLeaf = isMaskLeaf, carriesWildcard = carriesSecretMask, acceptForcedSingleton = false) {
+	if (!Array.isArray(live)) return void 0;
+	if (acceptForcedSingleton && send.length === 1 && live.length === 1) return live;
+	const key = identityKeyFor(send, live);
+	if (key !== void 0) {
+		const byIdentity = /* @__PURE__ */ new Map();
+		for (const item of live) byIdentity.set(item[key], item);
+		return send.map((item) => {
+			const identity = item[key];
+			return wildcardLeaf(identity) ? void 0 : byIdentity.get(identity);
+		});
+	}
+	if (live.length !== send.length) return void 0;
+	let wildcardSlots = 0;
+	let compared = 0;
+	for (let i = 0; i < send.length; i++) {
+		if (carriesWildcard(send[i])) wildcardSlots++;
+		const corroborated = corroboratedLeafCount(send[i], live[i], wildcardLeaf);
+		if (corroborated === void 0) return void 0;
+		compared += corroborated;
+	}
+	if (wildcardSlots > 1 || compared === 0) return void 0;
+	return live;
+}
+/** The MASK walk's wildcard: the redaction mask alone. */
+function isMaskLeaf(leaf) {
+	return leaf === "***";
+}
+/**
+* The TOKEN walk's wildcard: a leaf whose WHOLE value is a `{{resolve:...}}`
+* token, plus the mask (which that walk never touches but must abstain on —
+* see {@link pairedLiveItems}). A MIXED leaf (a token embedded in a longer
+* string) is deliberately NOT a wildcard: the token walk does not preserve it
+* either, and its live counterpart genuinely differs, so letting it abstain
+* would make every partially-resolved string an unbounded free pass.
+*/
+function isTokenOrMaskLeaf(leaf) {
+	if (leaf === "***") return true;
+	return typeof leaf === "string" && leaf.includes("{{resolve:") && isSingleDynamicReferenceToken(leaf);
+}
+/**
+* Deep form of {@link isTokenOrMaskLeaf}, for the one-slot bound.
+*
+* Cycle-guarded like its sibling `carriesSecretMask`, via the same inner
+* closure so the visited set is not a callable parameter (PR #2912 review):
+* the value walked here is an element of `buildRevertNewProperties`' output,
+* which carries RAW `readCurrentState` returns — provider-authored, not
+* JSON-round-tripped — so a self-referential object must answer `false`
+* rather than throw `RangeError` out of the pairing. The guard bounds the
+* PAIRING frame only: a cyclic PLAIN element still overflows the enclosing
+* preserve walk one frame later (pre-existing, caught by `runRevert`'s
+* per-resource payload-build catch); what this guard keeps alive is the
+* NON-PLAIN cyclic element, which that walk returns by identity and only
+* this slot count ever descends.
+*/
+function carriesTokenOrMask(value) {
+	const seen = /* @__PURE__ */ new Set();
+	const walkNode = (node) => {
+		if (isTokenOrMaskLeaf(node)) return true;
+		if (node === null || typeof node !== "object") return false;
+		if (seen.has(node)) return false;
+		seen.add(node);
+		if (Array.isArray(node)) return node.some(walkNode);
+		return Object.values(node).some(walkNode);
+	};
+	return walkNode(value);
+}
+/**
+* How many of `send`'s leaves the live side CORROBORATES, or `undefined` the
+* moment one of them CONTRADICTS it.
+*
+* A WILDCARD leaf (the caller's `wildcardLeaf` — the mask for the mask walk,
+* a whole token or the mask for the token walk) contributes 0 and is never
+* compared: it is the value being paired FOR, so requiring it to match would
+* refuse every array {@link pairedLiveItems} exists to align. Everything else
+* must agree — including the container SHAPE around it, since a subtree of a
+* different shape is a contradiction rather than an absent comparison.
+*
+* A COUNT rather than a boolean, because "nothing contradicted me" is exactly
+* the answer an all-wildcard array gives and it is not evidence. The caller
+* requires a non-zero count before it reads the order as corroborated.
+*/
+function corroboratedLeafCount(send, live, wildcardLeaf = isMaskLeaf) {
+	if (wildcardLeaf(send)) return 0;
+	if (Array.isArray(send)) {
+		if (!Array.isArray(live) || live.length !== send.length) return void 0;
+		let total = 0;
+		for (let i = 0; i < send.length; i++) {
+			const corroborated = corroboratedLeafCount(send[i], live[i], wildcardLeaf);
+			if (corroborated === void 0) return void 0;
+			total += corroborated;
+		}
+		return total;
+	}
+	if (isPlainRecord(send)) {
+		if (!hasPlainPrototype(send)) return void 0;
+		if (!isPlainRecord(live) || !hasPlainPrototype(live)) return void 0;
+		const keys = Object.keys(send);
+		if (keys.length !== Object.keys(live).length) return void 0;
+		let total = 0;
+		for (const k of keys) {
+			if (!Object.prototype.hasOwnProperty.call(live, k)) return void 0;
+			const corroborated = corroboratedLeafCount(send[k], live[k], wildcardLeaf);
+			if (corroborated === void 0) return void 0;
+			total += corroborated;
+		}
+		return total;
+	}
+	return deepEqualUnordered(send, live) ? 1 : void 0;
+}
+/**
 * Keep `cdkd drift --revert` from pushing a REDACTION MASK to AWS (issue
 * [#2274](https://github.com/go-to-k/cdkd/issues/2274)).
 *
@@ -70689,9 +71057,16 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 * revision's reason for not doing so was wrong: it said "the live value is one
 * cdkd never resolved and cannot recognise, so there is no needle to record".
 * The needle is `liveValue -> {@link SECRET_MASK}`, i.e. a MASK-ONLY entry, and
-* the evidence for it is the position — THE MASKED POSITION IS THE PROOF THE
-* VALUE IS SECRET, since nothing but this module's own redaction puts a mask at
-* a leaf. Without the registration this function copies live plaintext into the
+* the evidence for it is the position — the masked position proves the value
+* is ONE CDKD CHOSE TO MASK, since nothing but this module's own redaction
+* puts a mask at a leaf. That is deliberately weaker than "proof the value is
+* secret" (issue #2881): a #2852 fail-closed mask deliberately over-masks a
+* value the walk merely could not certify — a normalised `US-EAST-1` as
+* readily as a credential — so the live value registered here may be an
+* ordinary literal. The consequence is bounded to over-masking log output,
+* the safe direction, and registering it is still right: when the position
+* DOES hold a secret, the registration is what keeps the moved plaintext out
+* of every reader below. Without it this function copies live plaintext into the
 * send bag and then `collectNarrowedTopLevelKeys` persists that delta into
 * `observedProperties` against a `secrets` map holding no entry for it — the
 * same disclosure the mask exists to prevent, arriving through the mechanism
@@ -70718,17 +71093,58 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 *   would be the corruption; dropping the key would delete a property the
 *   resource may require.
 *
-* Array descent is POSITIONAL and bails to "no live value" on any length
-* mismatch, matching the sibling: a reordered readback cannot be positioned
-* against, and guessing would put one element's live value at another's index.
-*
-* Returns the input bag BY IDENTITY when it holds no mask, so the ordinary
-* revert is byte-identical and pays one walk.
-*/
-function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets) {
+* Array descent is NOT positional and does NOT bail on a length mismatch —
+* {@link pairedLiveItems} owns that question, for BOTH walks since issue
+* #2893 (the sibling's earlier answer, index alignment behind a length test,
+* was wrong by construction on the population that produces these masks, and
+* wrong under any reordered readback for the sibling's own tokens). An
+* earlier revision of this paragraph still claimed the sibling's rule after
+* the pairing had changed underneath it.
+*
+* `corroborationSource` is the bag the PAIRING EVIDENCE is read from, and it
+* exists because of a round-4 #2884 defect: `runRevert` runs
+* {@link preserveLiveValuesAtUnresolvedTokens} FIRST, and that pass copies
+* `live` values into whole-token leaves — BY INDEX when the defect was found;
+* by certified pairing since issue #2893, which does not retire this
+* parameter, because a copied leaf is trivially deep-equal to `live` at its
+* own position HOWEVER it was chosen, so corroborating `send` (the post-token
+* bag) against that same `live` still counts evidence a sibling pass
+* manufactured rather than evidence AWS's readback supplied. Under the
+* original index copies, an unkeyed array
+* whose only non-mask leaves were tokens satisfied both the
+* `compared > 0` floor and the one-mask bound on evidence the sibling pass
+* manufactured, and a reordered `live` wrote another element's secret into the
+* masked slot — the credential-swap class the guards were added for. The same
+* fabrication reached the IDENTITY arm: an identity field that was itself a
+* token took its live value by index, and {@link pairedLiveItems}' keyed
+* lookup then "paired" it right back to that index. So the caller passes the
+* PRE-token bag here; both the identity lookup and the per-leaf corroboration
+* run over values no sibling pass copied from `live`, a token leaf compares
+* against the resolved live value and CONTRADICTS (its live counterpart is
+* unknowable, and an abstention would make token leaves unbounded wildcards
+* beside the deliberately bounded one-mask rule), and the array refuses. The
+* masked VALUES the walk writes still come from `send` — only the evidence
+* source changes. Defaults to `send` (self-corroboration, the pre-round-4
+* behaviour) for a caller with no sibling pass; a structural mismatch between
+* the two bags — which the token pass CAN produce, by returning the live
+* CONTAINER AWS holds over a whole-token string leaf — refuses the masks
+* beneath it rather than falling back to the fabricable bag. That refusal is
+* a deliberate fail-closed cost, not a reachable loss: the mismatching
+* subtree is live-derived and carries no mask, so nothing preservable is
+* refused today.
+*
+* Returns the input bag BY IDENTITY when it holds no mask — checked FIRST via
+* {@link carriesSecretMask}, so a mask-free revert (the ordinary case) pays
+* one boolean walk instead of a full rebuild plus per-array pairing.
+*/
+function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets, corroborationSource = send) {
+	if (!carriesSecretMask(send)) return {
+		properties: send,
+		unpreservablePaths: []
+	};
 	const unpreservablePaths = [];
 	let changed = false;
-	const walk = (value, live, path) => {
+	const walk = (value, corr, live, path) => {
 		if (value === "***") {
 			if (live === void 0) {
 				unpreservablePaths.push(path);
@@ -70739,18 +71155,24 @@ function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets) {
 			return live;
 		}
 		if (Array.isArray(value)) {
-			const liveItems = Array.isArray(live) && live.length === value.length ? live : void 0;
-			return value.map((item, i) => walk(item, liveItems?.[i], `${path}[${i}]`));
+			const corrItems = Array.isArray(corr) && corr.length === value.length ? corr : void 0;
+			const liveItems = corrItems === void 0 ? void 0 : pairedLiveItems(corrItems, live);
+			return value.map((item, i) => walk(item, corrItems?.[i], liveItems?.[i], `${path}[${i}]`));
 		}
 		if (value !== null && typeof value === "object") {
+			if (!hasPlainPrototype(value)) {
+				if (carriesSecretMask(value)) unpreservablePaths.push(path);
+				return value;
+			}
 			const liveObject = isPlainRecord(live) ? live : void 0;
-			const out = {};
-			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k], path === "" ? k : `${path}.${k}`);
+			const corrObject = isPlainRecord(corr) ? corr : void 0;
+			const out = Object.create(null);
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, corrObject?.[k], liveObject?.[k], path === "" ? k : `${path}.${k}`);
 			return out;
 		}
 		return value;
 	};
-	const properties = walk(send, awsProperties, "");
+	const properties = walk(send, corroborationSource, awsProperties, "");
 	if (!changed && unpreservablePaths.length === 0) return {
 		properties: send,
 		unpreservablePaths
@@ -70997,15 +71419,28 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					return;
 				}
 				const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
-				if (unrevertablePaths.length > 0) logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cannot revert ${unrevertablePaths.join(", ")} — cdkd cannot name the property, so it is left as AWS has it. ROTATE the secret that leaked into the property name.`);
-				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert. Where a token is EMBEDDED in a longer string, that string is written with the token literal, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
+				if (stateResource.observedProperties === void 0) {
+					const driftedTopLevelKeys = /* @__PURE__ */ new Set();
+					for (const change of outcome.changes) {
+						const topLevelKey = change.path.split(".", 1)[0];
+						if (topLevelKey) driftedTopLevelKeys.add(topLevelKey);
+					}
+					const intrinsicObjectPaths = collectUnresolvedIntrinsicObjectPaths(desiredProperties, driftedTopLevelKeys);
+					if (intrinsicObjectPaths.length > 0) {
+						totalUnresolvable++;
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(intrinsicObjectPaths.join(", "), secrets)} — the recorded baseline holds an unresolved CloudFormation intrinsic there (e.g. Fn::Join, Ref), which cdkd cannot resolve outside a deploy; writing it would set the live property to the raw intrinsic object instead of its value. Run 'cdkd deploy' for this stack — the deploy resolves the template and records a resolvable baseline — then re-run the revert if drift remains.`);
+						return;
+					}
+				}
+				if (unrevertablePaths.length > 0) logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cannot revert ${maskSecretsInText(unrevertablePaths.join(", "), secrets)} — cdkd cannot name the property, so it is left as AWS has it. ROTATE the secret that leaked into the property name.`);
+				if (unresolvedTokens.size > 0) logger.warn(`  ! [revert] ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — a property whose WHOLE value is one of these tokens is left UNCHANGED by this revert when cdkd can pair its position against AWS's report (a list element by an identity field, or by its list's own unchanged literal values). Where it cannot pair, and where a token is EMBEDDED in a longer string, the token is written literally, exactly as 'cdkd deploy' does, so a resolved value AWS holds there is overwritten.`);
 				let newProperties;
 				try {
 					const overlaid = buildRevertNewProperties(outcome.changes, desiredProperties, outcome.awsProperties, { preserveUntemplated: stateResource.observedProperties === void 0 });
-					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties) : overlaid, outcome.awsProperties, secrets);
+					const maskPreserved = preserveLiveValuesAtMaskedLeaves(unresolvedTokens.size > 0 ? preserveLiveValuesAtUnresolvedTokens(overlaid, outcome.awsProperties) : overlaid, outcome.awsProperties, secrets, overlaid);
 					if (maskPreserved.unpreservablePaths.length > 0) {
 						totalUnresolvable++;
-						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskPreserved.unpreservablePaths.join(", ")} — the recorded baseline holds only the redaction mask there (a NoEcho custom-resource value), and AWS reports nothing to preserve, so cdkd has no value it may write. Force that custom resource to update (change one of its properties, e.g. a nonce) and re-deploy, so its handler runs again and supplies the value — an ordinary re-deploy leaves it unchanged and the mask stays.`);
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): refused to revert ${maskSecretsInText(maskPreserved.unpreservablePaths.join(", "), secrets)} — the recorded baseline holds only the redaction mask there, and AWS reports nothing to preserve, so cdkd has no value it may write. Two causes leave such a mask, and the record does not say which: a NoEcho custom-resource value (force that custom resource to update — change one of its properties, e.g. a nonce — and re-deploy, so its handler runs again and supplies the value), or a readback position cdkd could not certify when the baseline was captured (deploy a change to this resource, so the baseline is recaptured against the template). An ordinary no-change re-deploy clears neither.`);
 						return;
 					}
 					newProperties = maskPreserved.properties;
@@ -71102,7 +71537,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	if (totalFailed > 0) summaryParts.push(`${totalFailed} failed`);
 	logger.info(`\nRevert summary: ${summaryParts.join(", ")}.`);
 	if (totalUnsupported > 0) logger.warn(`${totalUnsupported} resource(s) cannot be reverted in place — re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`);
-	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} whose dynamic reference(s) could not be resolved — those never reached provider.update; grant the caller secretsmanager:GetSecretValue / ssm:GetParameter, or fix the reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
+	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} refused or unresolvable — those never reached provider.update; each per-resource message above names its cause and remedy, e.g. missing secretsmanager:GetSecretValue / ssm:GetParameter grants for an unresolvable reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
 }
 function humanTextSink(json) {
 	return json ? {
@@ -76980,7 +77415,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						unsupported++;
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS$1, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS$1, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -90417,4 +90852,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Ci4Y5UO9.js.map
+//# sourceMappingURL=program-CMhpftan.js.map