@go-to-k/cdkd 0.288.4 → 0.288.6

package/dist/{deploy-engine-BiPxTgKT.js → deploy-engine-umIP3xus.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BmM4QJ9t.js";
+import { t as getCdkdVersion } from "./version-4xTzOaA1.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -102,6 +102,7 @@ const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
 	"required permissions for: ENHANCED_MONITORING",
 	"Caught ServiceAccessDeniedException",
 	"permissions required to assume the role",
+	"does not have a trust relationship allowing",
 	"authorized to assume the provided role",
 	"not authorized to access the Log Destination",
 	"Cannot access stream",
@@ -12257,13 +12258,54 @@ const TEMPLATE_SOURCED_RULES = {
 	trustAnyExpression: false,
 	sourceIsSameGeneration: false
 };
-/** An AWS readback projected from THIS record's own persisted STATE bag. */
+/**
+* An AWS readback projected from THIS record's own persisted STATE bag.
+*
+* Does NOT fail closed. This is the constant a caller reaches for when it knows
+* the SHAPE of its two bags and nothing about where the result lands —
+* `cdkd drift`'s two writers pass it, and so does
+* `DeployEngine.redactOperationsForJournal` for the journal's `previousState`
+* (issue [#2886](https://github.com/go-to-k/cdkd/issues/2886): a REPLAYED
+* baseline must not gain masks a rollback restore then persists). See
+* {@link STATE_SOURCED_BASELINE_RULES} for the one that does, and
+* `failClosedOnUncertifiedPositions` for why the difference is declared rather
+* than derived.
+*/
 const STATE_SOURCED_READBACK_RULES = {
 	descendArrays: false,
 	trustAnyExpression: true,
 	sourceIsSameGeneration: true
 };
 /**
+* {@link STATE_SOURCED_READBACK_RULES} for a caller that KNOWS its bag becomes
+* a drift BASELINE — `observedProperties` and nothing else (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Identical on the three shape flags, so every relaxation and refusal the
+* readback path already had applies unchanged; the only difference is that a
+* position this pass cannot certify is written as {@link SECRET_MASK} rather
+* than as the DECRYPTED readback. Passed by `cdkd state refresh-observed` and
+* by `cdkd import`'s observed capture (issue
+* [#2885](https://github.com/go-to-k/cdkd/issues/2885), which moved it off the
+* non-failing constant), and derived by {@link scrubResourceRecord} for the
+* observed bag — the deploy's `drainObservedCaptures` baseline reaches it that
+* way.
+*
+* WHAT SELECTS IT IS THE DESTINATION, which is why it cannot be derived from
+* the two bags: `cdkd drift --accept` walks with the same shape flags and then
+* writes its result into `properties` for a record with no
+* `observedProperties`, where a mask is a REGRESSION rather than a refusal
+* (`cdkd export` blocks such a record and the rollback replay refuses the
+* operation). A caller declares this constant when it knows its bag becomes a
+* drift baseline and nothing else.
+*/
+const STATE_SOURCED_BASELINE_RULES = {
+	descendArrays: false,
+	trustAnyExpression: true,
+	sourceIsSameGeneration: true,
+	failClosedOnUncertifiedPositions: true
+};
+/**
 * A STATE source that is no longer this bag's own generation — `cdkd scrub`'s
 * `observedProperties` walk (issue #1917 review).
 *
@@ -12409,7 +12451,7 @@ function isSecretExpressionByVerdictOrSpelling(expression) {
 * so the position source is present with no map beside it.
 *
 * `cdkd state refresh-observed` and the deploy's `drainObservedCaptures` are
-* NOT affected: they take `STATE_SOURCED_READBACK_RULES`, which sets
+* NOT affected: they take a `STATE_SOURCED_*` readback constant, which sets
 * `sourceIsSameGeneration`, so {@link refuseUncertifiedReadbackPositions}
 * restores the source even under the old strict class.
 *
@@ -13324,7 +13366,7 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		}
 		if (rules.descendArrays && bag.length === source.length) return bag.map((item, i) => redactByPath(item, source[i], secrets, rules, secretExpressions, bagIsSameGeneration));
 	}
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
 		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? redactByPath(v, source[k], secrets, rules, secretExpressions, bagIsSameGeneration) : redactSecretsForState(v, secrets);
 		return out;
@@ -13335,7 +13377,10 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 * Is this rules constant one whose BAG is an AWS readback and whose SOURCE is a
 * persisted STATE bag?
 *
-* Today that is {@link STATE_SOURCED_READBACK_RULES} alone: the path where the
+* Today that is {@link STATE_SOURCED_READBACK_RULES} and its fail-closed twin
+* {@link STATE_SOURCED_BASELINE_RULES}, which differ on nothing this predicate
+* reads (issue #2852 added a DESTINATION flag, not a shape one): the path where
+* the
 * secrets map can be EMPTY by construction (nothing was resolved), so the value
 * scan has no needles and POSITION is the only mechanism left. Derived from the
 * flags rather than compared against the constant so a future one with the same
@@ -13831,6 +13876,23 @@ function unkeyedArrayPairsByAnchors(bag, source) {
 */
 const POSITION_DECIDED = Symbol("position decided by a position pass");
 /**
+* Marks a STRING leaf {@link refuseUncertifiedReadbackPositions} REFUSED — a
+* position whose source subtree proves a dynamic reference lives there while
+* the walk could not pair the two sides, so the readback value at it may be a
+* decrypted secret (issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* A THIRD state, not a second spelling of {@link POSITION_DECIDED}, and the
+* difference is what keeps the fail-closed change from REGRESSING the derived
+* needles issue #2012 added. `POSITION_DECIDED` tells
+* {@link preferPositionDecisions} "this leaf is mine, the scan may not touch
+* it"; a refusal makes the opposite claim — the pass has NO answer here, only
+* the knowledge that the raw value is unsafe. So the scan still gets to win at
+* such a leaf (a derived needle NAMES the expression, which is strictly better
+* than a mask), and the mask stands only where nothing else spoke.
+*/
+const POSITION_UNCERTIFIED = Symbol("position refused by a position pass");
+/**
 * Record one (plaintext -> expression) pair, or strike the plaintext out.
 *
 * Below {@link MIN_NEEDLE_LENGTH} nothing is recorded, and this floor DECIDES
@@ -14092,11 +14154,13 @@ function asIndex(marks, index) {
 * newly extending #2427 to the EMPTY-map path, where the unchanged-resource
 * `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
 * the result to the live resource. With the guard a non-plain leaf falls
-* through to `refused`. That is the position passes' own answer — usually the
-* bag by identity, though NOT universally: their object arm has no prototype
-* guard of its own, so a non-plain leaf whose source subtree carries a
-* reference is already flattened one function earlier. Same defect as issue
-* #2427, one layer up, and out of this lane's scope.
+* through to `refused`. That is the position passes' own answer, which is the
+* bag by identity: their object arm carried no prototype guard of its own until
+* issue [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain
+* leaf whose source subtree carries a reference WAS already flattened one
+* function earlier and this guard could only keep a `{}` intact. Both halves
+* are guarded now; the remaining copy of the defect is the VALUE scan's own
+* walk, which is issue #2427 and a different pass.
 *
 * The net effect is byte-identical to the FIRST ordering on every input where
 * the un-certification did not fire — which is the whole point: it keeps that
@@ -14110,7 +14174,9 @@ function preferPositionDecisions(scanned, refused, bag, marks, inferred) {
 	}
 	if (Array.isArray(bag) && Array.isArray(refused) && Array.isArray(scanned) && refused.length === bag.length && scanned.length === bag.length) return refused.map((item, i) => preferPositionDecisions(scanned[i], item, bag[i], asIndex(marks, i), inferred));
 	if (typeof bag !== "string" || marks === POSITION_DECIDED) return refused;
-	return scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	const scanDecision = scanned === bag ? inferred.get(bag) ?? scanned : scanned;
+	if (marks === POSITION_UNCERTIFIED && !(typeof scanDecision === "string" && isSingleDynamicReferenceToken(scanDecision))) return refused;
+	return scanDecision;
 }
 /**
 * DERIVED NEEDLES (issue [#2012](https://github.com/go-to-k/cdkd/issues/2012)):
@@ -14180,7 +14246,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 		poisoned: /* @__PURE__ */ new Set(),
 		inferred: /* @__PURE__ */ new Set()
 	};
-	refuseUncertifiedReadbackPositions(bag, source, secrets, collector);
+	refuseUncertifiedReadbackPositions(bag, source, secrets, false, collector);
 	if (collector.needles.size === 0) return void 0;
 	const certain = /* @__PURE__ */ new Map();
 	const inferred = /* @__PURE__ */ new Map();
@@ -14191,6 +14257,149 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 	};
 }
 /**
+* FAIL CLOSED over one readback subtree the position walk could not certify
+* (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852)).
+*
+* Every STRING leaf the source cannot account for becomes
+* {@link SECRET_MASK} — at EVERY position it occupies, including a node the bag
+* reaches twice; see the memo below. So does a BINARY leaf, whose bytes are a
+* secret in the clear once `JSON.stringify` writes them. Everything else is
+* kept. Called from
+* {@link refuseUncertifiedReadbackPositions} — through
+* {@link refuseAgainstSource}, and DIRECTLY from its keyed-array arm, which
+* hoists the literal set and re-spells the `failClosed` test — and only where
+* that walk has already established
+* BOTH halves of the evidence: the SOURCE subtree at this position spells a
+* dynamic reference (so the template says a secret lives here), and the two
+* sides cannot be paired (so no position can say WHICH leaf holds its resolved
+* form). Before this, every such branch returned the bag — the decrypted
+* readback — verbatim.
+*
+* "The source cannot account for" is the whole claim, and it is deliberately
+* WEAKER than "no plaintext survives": a leaf the source spells verbatim is
+* kept, so a readback that echoes a template literal back keeps it. What the
+* pass guarantees is that no leaf survives on the strength of the walk having
+* given up.
+*
+* WHY A MASK RATHER THAN THE SOURCE. Substituting the source is what the
+* certified rows do, and it is exactly what the array arm's own comment (and
+* the issue #1915 fences) refuse here: with no pairing, writing the source
+* fabricates baseline content AWS never reported, which `cdkd drift --revert`
+* then pushes to the live resource. A mask fabricates no content — it keeps
+* the bag's SHAPE, adds no key, no element and no scalar-over-container — and
+* `SECRET_MASK` is already a first-class persisted state with its own
+* downstream guards (`drift.ts`'s `collectSecretMaskPaths` /
+* `preserveLiveValuesAtMaskedLeaves`, `runAccept`'s refusal,
+* `rollback-executor.ts`'s `refuseMaskedReplayBaseline`), because the
+* mask-only channel (issue #2274) already puts one there.
+*
+* WHY STRINGS ONLY. A recorded secret is a `string` by the type of
+* {@link RecordedSecretValues}, so a number, a boolean or `null` cannot BE a
+* resolved secret and masking one would only cost drift a comparison. A
+* NON-PLAIN object (a `Date` an AWS SDK readback carries, a `Buffer`) is
+* returned BY IDENTITY for the same reason plus a second one: rebuilding it
+* from its own enumerable keys yields `{}` — the corruption of issue
+* [#2869](https://github.com/go-to-k/cdkd/issues/2869).
+*
+* A leaf that IS a whole `{{resolve:...}}` token is kept: it is an expression
+* AWS echoed back unresolved, not plaintext, and replacing it with a mask would
+* DESTROY a value `cdkd drift` can re-resolve. WHOLE, not "contains one" — that
+* wider test spared `postgres://admin:<plaintext>@{{resolve:ssm-secure:/h}}`,
+* where the embedded token vouched for a leaf that was mostly the decrypted
+* secret. The residual is the issue #1917 shape — a plaintext that merely LOOKS
+* like a token — which every arm of this module already trusts.
+*
+* SO IS A LEAF THE SOURCE SUBTREE ITSELF SPELLS, and this is what keeps the
+* fail-closed change from emptying an ordinary drift baseline. `sourceLiterals`
+* is {@link wholeStringLeavesOf} over the SOURCE at the refused position — the
+* literal frame of an `Fn::Join`, the anchor values of an array AWS reordered,
+* every ordinary property beside the reference. A value the template SPELLS is
+* not the resolved form of a reference, so masking it buys nothing; and where
+* it coincides with one, that plaintext is already sitting in the record's own
+* `properties`, so the copy in the readback is not the disclosure. Scoped to
+* the SOURCE AT THE REFUSED POSITION rather than the whole record on purpose: a
+* coincidence three properties away is not evidence about this one. Read that
+* literally — when an ARRAY refuses element by element the refused position is
+* the array, so a SIBLING element's literal does spare a leaf. That is the
+* intended granularity (the elements are peers of one list AWS returned
+* together, and the pairing that failed is between the two LISTS), and it is
+* stated because "subtree" reads narrower than the code is.
+*
+* OVER-MASKING IS THE REMAINING COST AND IT IS THE INTENDED DIRECTION: a value
+* AWS NORMALISED (`us-east-1` returned as `US-EAST-1`) no longer matches the
+* source and is masked with the secret, because nothing distinguishes them once
+* the pairing is gone. That is phantom drift rather than a disclosure — the
+* same way this module chooses to be wrong at
+* {@link mixedLeafMayCarryPublicReference}.
+*
+* `mark` is {@link refuseUncertifiedReadbackPositions}'s MARK MODE, threaded
+* so the parallel tree keeps the same shape: {@link POSITION_UNCERTIFIED}
+* lands wherever the substituting pass puts a mask, and the bag's own value
+* everywhere else — which is that mode's contract.
+*/
+function refuseUncertifiedSubtree(value, sourceLiterals, mark, seen = /* @__PURE__ */ new Map()) {
+	if (typeof value === "string") {
+		if (isSingleDynamicReferenceToken(value) || sourceLiterals.has(value)) return value;
+		if (value === "") return value;
+		return mark ? POSITION_UNCERTIFIED : "***";
+	}
+	if (value === null || typeof value !== "object") return value;
+	const memo = seen.get(value);
+	if (memo !== void 0) return memo;
+	if (Array.isArray(value)) {
+		const out = [];
+		seen.set(value, out);
+		for (const item of value) out.push(refuseUncertifiedSubtree(item, sourceLiterals, mark, seen));
+		return out;
+	}
+	if (isPlainObject$2(value) && hasPlainPrototype(value)) {
+		const out = Object.create(null);
+		seen.set(value, out);
+		for (const [k, v] of Object.entries(value)) out[k] = refuseUncertifiedSubtree(v, sourceLiterals, mark, seen);
+		return out;
+	}
+	if (ArrayBuffer.isView(value)) return mark ? POSITION_UNCERTIFIED : "***";
+	seen.set(value, value);
+	return value;
+}
+/**
+* {@link refuseUncertifiedSubtree} over a bag whose SOURCE is in hand, so the
+* literal set can never be built from anything but the source at the SAME
+* position.
+*
+* NOT the only spelling, and an earlier revision of this sentence said it was.
+* The keyed-array arm calls {@link refuseUncertifiedSubtree} DIRECTLY, because
+* it hoists the literal set out of its `bag.map` — so it also re-spells the
+* `failClosed` test this function owns. A future edit that drops that
+* re-spelling drops the DESTINATION check with it, which is why the two are
+* named here rather than left to be noticed.
+*/
+function refuseAgainstSource(bag, source, failClosed, mark) {
+	if (failClosed !== true) return bag;
+	return refuseUncertifiedSubtree(bag, wholeStringLeavesOf(source), mark);
+}
+/**
+* Does any element of `source` that the bag did NOT pair carry a dynamic
+* reference (issue [#2852](https://github.com/go-to-k/cdkd/issues/2852))?
+*
+* The evidence that licenses refusing the bag's own unpaired elements in the
+* IDENTITY-KEYED array arm. An identity key that does not round-trip
+* byte-identically — AWS case-normalises a `Name`, or expands one to an ARN —
+* drops its element to `partner === undefined`, and the element the source
+* spells as a reference is then left over with nothing pointing at it, so its
+* resolved plaintext is somewhere in the unpaired remainder.
+*
+* The converse is why this is a QUESTION rather than a blanket refusal: when
+* every reference-bearing source element DID find its partner, an extra bag
+* element is a peer AWS added (another `Environment` entry) and carries no
+* secret this source can account for. Refusing those would mask ordinary
+* readback content for no evidence, which is the same trade the object arm's
+* extra-KEY branch declines to make.
+*/
+function unpairedSourceCarriesReference(source, key, bagIdentities) {
+	return source.some((item) => !bagIdentities.has(item[key]) && subtreeHasDynamicReference(item));
+}
+/**
 * Refuse to persist a readback leaf the path pass could not CERTIFY, at any
 * position the STATE source proves is secret-bearing (issue #1926 review).
 *
@@ -14212,15 +14421,42 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 *   ...the same MIXED leaf inside a PAIRED element    LEAK          take source
 *   `['--pw', '{{resolve:...}}']` (no identity key)   LEAK          take source*
 *   `[{Field, Val: '{{resolve:...}}'}]` (no `Name`)   LEAK          take source*
-*   ...either of those, but REORDERED / normalised    LEAK          LEAK (#2012)
-*   an UNPAIRED element beside a paired one           LEAK          LEAK (#2012)
-*   an observed KEY the source does not carry         LEAK          LEAK (#2012)
+*   ...either of those, but REORDERED / normalised    LEAK          MASK (#2852)
+*   an UNPAIRED element, source reference left over   LEAK          needle | MASK
+*   an UNPAIRED element, every source reference paired LEAK         needle (#2012)
+*   a RESHAPED container / added wrapper level        LEAK          MASK (#2852)
+*   a source leaf promoted to a container             LEAK          MASK (#2852)
+*   a RAW `Fn::Join` source vs a STRING readback      LEAK          MASK (#2846)
+*   an observed KEY the source does not carry         LEAK          needle | LEAK
+*   a `Date` under a reference-bearing source subtree `{}`          kept (#2869)
 *   whole `{{resolve:...}}` token                     ok            ok
 *   `Environment[]` keyed by `Name` (issue #1915)     ok            ok
 *   PUBLIC ssm MIXED leaf, POPULATED map               ok            ok
 *   PUBLIC ssm MIXED leaf, EMPTY map                   ok            over-redacts
 * ```
 *
+* MASK rows are the FAIL-CLOSED change of issue
+* [#2852](https://github.com/go-to-k/cdkd/issues/2852). Every branch this walk
+* could not certify used to `return bag` — the decrypted readback, verbatim —
+* so "cannot pair" and "safe to persist" were the same answer. They are now
+* {@link refuseUncertifiedSubtree}, whose doc argues why a mask rather than the
+* source and why STRING leaves only. `needle | MASK` means the derived needles
+* of issue #2012 are consulted FIRST and the mask stands only where they had
+* nothing to say ({@link preferPositionDecisions}), so no row this table
+* previously closed by a needle is taken back.
+*
+* ONE row is deliberately still open: an observed KEY the source does not carry
+* keeps the plaintext when no needle names it. Refusing there needs evidence
+* that does not exist — the source has NO leaf at that position, so the walk
+* would be guessing — and the cost of guessing is not bounded: a write-only
+* credential AWS never echoes back (RDS `MasterUserPassword` and every
+* `getDriftUnknownPaths` sibling) leaves a reference-bearing source key
+* unpaired on EVERY readback, so keying the refusal on that would mask
+* `Runtime` / `FunctionArn` / `LastModified` for every secret-bearing resource
+* in the account. The extra-KEY asymmetry stated further down is the same
+* argument; issue [#2868](https://github.com/go-to-k/cdkd/issues/2868) owns the
+* shape where the plaintext has no counterpart in the source at all.
+*
 * The last row is the price of the row above it and is tracked as issue
 * [#2036](https://github.com/go-to-k/cdkd/issues/2036): with no map nothing was
 * resolved, so nothing distinguishes a public parameter from a `SecureString`
@@ -14254,7 +14490,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * {@link anchorsCorroboratePairing} answers only one of them and its own doc
 * says nothing in it is sufficient alone.
 *
-* The residual rows are one root cause, not several: no needle and no
+* The MASK rows are one root cause, not several: no needle and no
 * position, so nothing distinguishes a resolved secret from an ordinary
 * literal. They are NOT closed by taking the source subtree, which an earlier
 * revision did and the issue #1915 fences correctly rejected — measured, it
@@ -14269,13 +14505,24 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * The MIXED row is the shape this module itself calls DOMINANT for CDK — an
 * `Fn::Join` around `secret.secretValueFromJson(...)`.
 *
-* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it does close, for
+* TAKE SOURCE rather than a {@link SECRET_MASK} on the rows it CERTIFIES, for
 * the same reason the whole-token arm does: a mask is not a value `cdkd drift`
 * can re-resolve, so it would report a permanent phantom — and `cdkd drift
 * --revert` pushes the BASELINE to AWS, so a masked baseline would write the
 * literal `***` onto the live resource (the issue #1498 / #1501 class).
 *
-* The last two rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
+* That is an argument about a row where a SOURCE VALUE IS AVAILABLE, and it
+* decides nothing about a row where none is (issue #2852). There the choice is
+* not mask-versus-source but mask-versus-PLAINTEXT, and the two costs above are
+* both real: `runAccept` refuses a masked change and
+* `preserveLiveValuesAtMaskedLeaves` moves AWS's own value in before `--revert`
+* sends anything, so the mask degrades those two commands on that resource
+* rather than corrupting it — while the plaintext it replaces is the disclosure
+* of GHSA-p5qg-v9gv-hc7w sitting in `state.json`. Do not read the paragraph
+* above as a rule against the mask everywhere; it is a rule about the rows with
+* a certified source.
+*
+* The needle rows were the RESIDUAL and are closed by DERIVED NEEDLES (issue
 * #2012) — see {@link deriveReadbackNeedles}. Neither has a position to argue
 * from: an unpaired array element and an observed KEY the source does not carry
 * are both positions with no source leaf to take. What they never lacked was a
@@ -14301,7 +14548,7 @@ function deriveReadbackNeedles(bag, source, secrets, rules) {
 * drift, and a needle learned from a MIS-paired position is a false redaction
 * everywhere it then matches.
 */
-function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
+function refuseUncertifiedReadbackPositions(bag, source, secrets, failClosed, learn, mark) {
 	if (isDynamicReferenceString(source) && typeof bag === "string") {
 		if (isSingleDynamicReferenceToken(source)) {
 			if (learn) learnWholeTokenNeedle(learn, bag, source);
@@ -14312,25 +14559,26 @@ function refuseUncertifiedReadbackPositions(bag, source, secrets, learn, mark) {
 		return mark ? POSITION_DECIDED : source;
 	}
 	if (!subtreeHasDynamicReference(source)) return bag;
-	if (isPlainObject$2(bag) && isPlainObject$2(source)) {
+	if (isPlainObject$2(bag) && hasPlainPrototype(bag) && isPlainObject$2(source)) {
 		const out = Object.create(null);
-		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, learn, mark) : v;
+		for (const [k, v] of Object.entries(bag)) out[k] = Object.hasOwn(source, k) ? refuseUncertifiedReadbackPositions(v, source[k], secrets, failClosed, learn, mark) : v;
 		return out;
 	}
 	if (Array.isArray(bag) && Array.isArray(source)) {
 		const key = identityKeyFor(bag, source);
 		if (key === void 0) {
-			if (!unkeyedArrayPairsByAnchors(bag, source)) return bag;
-			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, learn, mark));
+			if (!unkeyedArrayPairsByAnchors(bag, source)) return refuseAgainstSource(bag, source, failClosed, mark);
+			return bag.map((item, i) => refuseUncertifiedReadbackPositions(item, source[i], secrets, failClosed, learn, mark));
 		}
 		const sourceByIdentity = /* @__PURE__ */ new Map();
 		for (const item of source) sourceByIdentity.set(item[key], item);
+		const orphanLiterals = unpairedSourceCarriesReference(source, key, new Set(bag.map((item) => item[key]))) && failClosed === true ? wholeStringLeavesOf(source) : void 0;
 		return bag.map((item) => {
 			const partner = sourceByIdentity.get(item[key]);
-			return partner === void 0 ? item : refuseUncertifiedReadbackPositions(item, partner, secrets, learn, mark);
+			return partner === void 0 ? orphanLiterals !== void 0 ? refuseUncertifiedSubtree(item, orphanLiterals, mark) : item : refuseUncertifiedReadbackPositions(item, partner, secrets, failClosed, learn, mark);
 		});
 	}
-	return bag;
+	return refuseAgainstSource(bag, source, failClosed, mark);
 }
 /**
 * Deep-clone `bag`, replacing every occurrence of a recorded secret value with
@@ -14346,10 +14594,11 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 	if (source !== void 0) {
 		const positioned = redactByPath(bag, source, secrets, rules, recordedExpressionsOf(secrets), isSameGenerationBag(bag));
 		if (!isReadbackProjectedFromState(rules)) return positioned;
-		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets);
+		const failClosed = rules.failClosedOnUncertifiedPositions === true;
+		const refused = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed);
 		const derived = deriveReadbackNeedles(bag, source, secrets, rules);
 		if (derived === void 0) return refused;
-		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, void 0, true);
+		const marks = refuseUncertifiedReadbackPositions(positioned, source, secrets, failClosed, void 0, true);
 		return preferPositionDecisions(redactSecretsForState(bag, derived.certain), refused, bag, marks, derived.inferred);
 	}
 	const regex = buildNeedleRegex(substringNeedlesOf(secrets));
@@ -14483,7 +14732,7 @@ function scrubResourceRecord(record, secrets, sourceProperties, observedRules) {
 	const next = { ...record };
 	next.properties = redactSecretsForState(record.properties, secrets, sourceProperties);
 	if (record.attributes) next.attributes = redactSecretsForState(record.attributes, secrets);
-	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties === void 0 ? STATE_SOURCED_READBACK_RULES : TEMPLATE_SOURCED_RULES));
+	if (record.observedProperties) next.observedProperties = redactSecretsForState(record.observedProperties, secrets, sourceProperties ?? next.properties, observedRules ?? (sourceProperties !== void 0 ? TEMPLATE_SOURCED_RULES : secrets.size === 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 	return next;
 }
 /**
@@ -16349,7 +16598,7 @@ async function fetchCreateOnlyPropertyPaths(resourceType) {
 		if (Array.isArray(createOnly)) for (const path of createOnly) {
 			if (typeof path !== "string") continue;
 			if (!path.startsWith("/properties/")) continue;
-			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$1).filter((segment) => segment.length > 0);
+			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$2).filter((segment) => segment.length > 0);
 			if (segments.length > 0) result.push(segments);
 		}
 	}
@@ -16359,7 +16608,7 @@ async function fetchCreateOnlyPropertyPaths(resourceType) {
 /**
 * Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
 */
-function unescapeJsonPointerSegment$1(segment) {
+function unescapeJsonPointerSegment$2(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
@@ -21827,16 +22076,106 @@ const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 * Only non-empty string values qualify — an intrinsic-shaped or empty value is
 * skipped so the caller falls back to the raw physical id rather than emitting
 * a broken `[object Object]` / `''`.
-*/
-function refStateLookupFromResource(resource) {
+*
+* A leaf carrying {@link SECRET_MASK} is handled specially, and that handling
+* is a SECURITY property rather than a shape one (issue
+* [#2847](https://github.com/go-to-k/cdkd/issues/2847)). Both bags this reads
+* can hold the mask: `attributes` because `CloudControlProvider.import` masks
+* every model key it cannot certify is a read-only attribute, and `properties`
+* because the mask-only channel (issue #2274) writes it there too.
+* `SECRET_MASK` is a non-empty string, so the lookup HITS and
+* `cfnRefValueFromPhysicalId` returns `'***'` as the resource's `Ref` value —
+* which `resolveRefValue` hands back verbatim and a green deploy substitutes
+* into the consumer's property and sends to AWS. That is the #1498 / #1501
+* corrupted-write class, reached through the ONE attribute reader that is not
+* an `Fn::GetAtt`.
+*
+* ## The skip is OPT-IN, and that is the load-bearing design decision
+*
+* `onMaskedValue` is not a notification bolted onto a global behaviour change;
+* it is the SWITCH. With no callback this function returns the mask exactly as
+* it did before issue #2847 — same value, same callers, nothing to audit. Only
+* a caller that passes one gets the skip, and by passing one it declares it
+* will ACT on the report.
+*
+* IT WAS UNCONDITIONAL FOR THREE REVIEW ROUNDS, and each round found a fresh
+* caller broken by it, because skipping a mask is only an improvement for a
+* caller that has somewhere to put the refusal. For everyone else it REMOVES a
+* guarded sentinel and substitutes an unguarded wrong value: the fall-through
+* emits the raw physical id — for `AWS::S3Tables::Table` an ARN ending in a
+* UUID rather than the table name CFn `Ref` returns — which
+* `refuseMaskedReplayBaseline`, `cdkd export`'s blocker, `cdkd drift`'s mask
+* handling and the deploy-time refusal all pass, where every one of them
+* REJECTS `'***'` loudly. The rounds found it in `cdkd orphan`, then in
+* `resolveOutputs`, then in `cdkd import`; the pattern was the design, not the
+* call sites, so the design changed rather than the sites.
+*
+* A caller therefore chooses between exactly two things, and doing NOTHING is
+* the safe default rather than a hole:
+*
+* 1. **Pass no callback** — pre-#2847 behaviour, the mask travels, downstream
+*    readers catch it. Every caller that has not opted in is in this bucket by
+*    construction, so there is no per-caller audit to keep current.
+* 2. **Pass one and act on it** — skip the mask and refuse. `resolveRefValue`
+*    → `noteRefStateMask` → `ResolverContext.redactedAttributeReads`, read by
+*    `DeployEngine.refuseRedactedAttributeReads` on the CREATE / UPDATE arms
+*    and by `resolveOutputs`' own per-output check;
+*    `src/analyzer/orphan-rewriter.ts` has no resolver context and reports the
+*    site as `unresolvable` instead (under `--force` it warns and substitutes
+*    `SECRET_MASK`, i.e. it opts back into bucket 1's VALUE deliberately).
+*
+* BUCKET 1 IS NOT "the harmless callers", and one of them was mis-described as
+* display-only before the opt-in existed: `cdkd export`'s
+* `resolveChildImportParameters` builds a bagless context whose result becomes
+* a `Parameter[]` on `CreateChangeSet --change-set-type IMPORT` — a re-apply to
+* a live system. It is safe for bucket 1's ORDINARY reason rather than a
+* special one: bagless, so it ships `'***'`, which CloudFormation rejects
+* loudly, exactly as it did before issue #2847. Whether it should REFUSE
+* instead is a separate choice nobody has made. That is the shape of the
+* argument every bucket-1 caller gets: not "this value goes nowhere" but "the
+* mask still reaches a reader that recognises it".
+*
+* The resolver passes a callback from ONE site — `resolveRefValue` — and it
+* passes one only when `context.redactedAttributeReads` EXISTS. Testing the
+* bag at the call site rather than inside `noteRefStateMask` is the whole
+* point: the note returning early still leaves the SKIP done, so a bagless
+* context took the fall-through with nowhere to record the refusal. That is
+* how `cdkd import` came to PERSIST a raw physical id into
+* `resource.properties` — from where `cdkd export` writes it into the imported
+* template and `cdkd drift --revert` sends it to AWS. `cdkd diff` and
+* `cdkd scrub` are bagless too and simply resolve as they did before.
+*
+* `onMaskedValue` fires only when the WHOLE lookup came up empty, not at the
+* masked leaf. The scan spans two bags and several alias keys, so a masked
+* `properties.TableName` beside a live `attributes.TableName` is an ordinary,
+* fully resolvable record — `cdkd import`'s own shape — and notifying there
+* would fail a deploy that has the value it needs. The distinction is "cdkd
+* could not answer, and the reason was a redaction", which is the only case
+* that must refuse. An ABSENT key keeps degrading to the physical id exactly as
+* before: the recovery branches document that graceful fall-through for a
+* pre-#1045 / pre-#1681 record, and nothing about that case changed.
+*/
+function refStateLookupFromResource(resource, onMaskedValue) {
 	return (keys) => {
+		let masked;
 		for (const source of [resource.properties, resource.attributes]) {
 			if (!source) continue;
 			for (const key of keys) {
 				const value = source[key];
-				if (typeof value === "string" && value.length > 0) return value;
+				if (typeof value === "string" && value.length > 0) {
+					if (carriesSecretMask(value)) {
+						if (onMaskedValue === void 0) return value;
+						masked ??= {
+							key,
+							notify: onMaskedValue
+						};
+						continue;
+					}
+					return value;
+				}
 			}
 		}
+		if (masked !== void 0) masked.notify(masked.key);
 	};
 }
 /**
@@ -23585,7 +23924,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveRef(logicalId, context) {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (resource) {
-			const refValue = this.resolveRefValue(resource);
+			const refValue = this.resolveRefValue(logicalId, resource, context);
 			this.logger.debug(`Resolved Ref to resource: ${logicalId} -> ${refValue}`);
 			return refValue;
 		}
@@ -23667,8 +24006,77 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* children, whose `Ref` is an ARN recovered from the provider-recorded ARN
 	* attribute through the same `stateLookup` seam.
 	*/
-	resolveRefValue(resource) {
-		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId, refStateLookupFromResource(resource));
+	resolveRefValue(logicalId, resource, context) {
+		const canRefuse = context.redactedAttributeReads !== void 0;
+		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId, canRefuse ? refStateLookupFromResource(resource, (key) => this.noteRefStateMask(logicalId, key, context)) : refStateLookupFromResource(resource));
+	}
+	/**
+	* The `Ref` twin of {@link noteAttributeSecrecy} (issue
+	* [#2847](https://github.com/go-to-k/cdkd/issues/2847) review).
+	*
+	* `noteAttributeSecrecy`'s own contract is "every branch serving a value out
+	* of a PERSISTED `attributes` bag must call this", and `Ref` was the branch
+	* that did not: {@link refStateLookupFromResource} reads `properties` then
+	* `attributes` to recover a `Ref` value the physical id cannot yield, and a
+	* masked leaf there travelled all the way to AWS with `redactedAttributeReads`
+	* left empty.
+	*
+	* It is a SEPARATE method rather than a call into `noteAttributeSecrecy` for
+	* two reasons, and both are about what the entry has to SAY. The refusal
+	* joins these entries into a user-facing sentence whose `Fn::GetAtt` arm ends
+	* "stop reading it" — advice that is wrong here, because this read is CDKD's
+	* own: CloudFormation defines these types' `Ref` as a state key rather than
+	* the physical id, so no template edit stops it. And `noteAttributeSecrecy`'s
+	* other half — recording a `NoEcho`-declared value as a mask-only needle — has
+	* nothing to do at this site: the value has ALREADY been masked in state, so
+	* there is no plaintext to register.
+	*
+	* The SPELLING (`Ref <LogicalId> (state key <Key>)`) is what
+	* `DeployEngine.maskedRecordRemedyFor` partitions on, so it is load-bearing
+	* rather than cosmetic — that helper reads the logical id out of it to emit
+	* the re-import command, and pins the shape in a test.
+	*
+	* `key` is never masked before interpolation because it is not template text:
+	* it comes from the fixed key lists `cfnRefValueFromPhysicalId` passes
+	* (`TableName` / `Name` / `SelectionId` / `RepositoryId` / the AppSync ARN
+	* attributes), all cdkd literals.
+	*/
+	noteRefStateMask(logicalId, key, context) {
+		this.pushRedactedAttributeRead(context, {
+			kind: "ref-state-key",
+			logicalId,
+			key,
+			display: `Ref ${logicalId} (state key ${key})`
+		});
+	}
+	/**
+	* The ONE writer of {@link ResolverContext.redactedAttributeReads}, so the
+	* bag's absent-context check and its de-duplication rule live in one place
+	* rather than being re-spelled at each of the three pushing branches.
+	*
+	* DE-DUPES ON THE WHOLE TUPLE, not on `display` alone, and that is the last
+	* decision this file moved out of string space (issue #2847 round-5 review).
+	* An earlier revision compared renderings, which is where two of this PR's
+	* blockers came from: a decision keyed on a joined human-readable string.
+	* Here it gated entry EXISTENCE while `DeployEngine`'s Outputs guard filters
+	* the surviving entries by `kind`, so an `attribute` entry whose `display`
+	* collided with a later `ref-state-key` one suppressed the refusal outright.
+	* Reachable only through an adversarial logical id (`Ref Foo (state key Table`
+	* with an attribute named `Name)`) — `main`'s string bag is equally
+	* contrived, which is why review called it a cleanup rather than a defect —
+	* but the class is the point, not this instance.
+	*
+	* `key` carries its weight here: for the `attribute` kind it is the
+	* ALREADY-MASKED attribute name, so two names differing only ABOVE the mask
+	* still render and compare identically and still collapse, exactly as they
+	* did when the bag held strings. Nothing else reads it, and comparing it is
+	* what keeps it from being a field written by two producers and read by none.
+	*/
+	pushRedactedAttributeRead(context, read) {
+		const bag = context.redactedAttributeReads;
+		if (bag === void 0) return;
+		if (bag.some((entry) => entry.kind === read.kind && entry.logicalId === read.logicalId && entry.key === read.key && entry.display === read.display)) return;
+		bag.push(read);
 	}
 	/**
 	* Resolve Fn::GetAtt intrinsic function
@@ -23680,7 +24088,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const [rawLogicalId, rawAttributeName] = getAtt;
 			logicalId = rawLogicalId;
 			const resolvedAttributeName = await this.resolveValue(rawAttributeName, context);
-			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(resolvedAttributeName)}`);
+			if (typeof resolvedAttributeName !== "string") throw new Error(`Fn::GetAtt attribute name for ${logicalId} must resolve to a string, got ${typeof resolvedAttributeName}: ${stringifyValue(this.maskValueLeaves(resolvedAttributeName, context))}`);
 			attributeName = resolvedAttributeName;
 		} else {
 			const split = splitGetAttStringForm(getAtt);
@@ -23693,13 +24101,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!(resource.resourceType === "AWS::EC2::VPC" && attributeName === "Ipv6CidrBlocks") && resource.attributes !== void 0) {
 			const flatValue = Object.hasOwn(resource.attributes, attributeName) ? resource.attributes[attributeName] : void 0;
 			if (flatValue !== void 0) {
-				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId);
+				this.rejectPlaceholderArnAttribute(resource, attributeName, flatValue, logicalId, context);
 				if (resource.resourceType === "AWS::Route53::HostedZone" && attributeName === "NameServers" && typeof flatValue === "string") {
 					const nameServers = flatValue === "" ? [] : flatValue.split(",");
-					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, nameServers)}`);
+					this.logger.debug(`Normalized legacy Fn::GetAtt attribute: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, nameServers), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
-				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
+				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, flatValue), context)}`);
 				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
@@ -23712,17 +24120,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 				if (cursor !== void 0) {
-					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, cursor)}`);
+					this.logger.debug(`Resolved Fn::GetAtt from nested attributes: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, cursor), context)}`);
 					return this.noteAttributeSecrecy(logicalId, attributeName, cursor, context);
 				}
 			}
 		}
 		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
-			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}]: the nested stack '${logicalId}' declares no output named '${this.maskSecretsForLog(attributeName.slice(8), context)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
 		const value = await this.constructGuardedAttribute(resource, attributeName, context, logicalId);
-		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, value)}`);
+		this.logger.debug(`Resolved Fn::GetAtt: ${logicalId}.${this.maskSecretsForLog(attributeName, context)} -> ${this.maskSecretsForLog(stringifyAttributeForLog(attributeName, value), context)}`);
 		return value;
 	}
 	/**
@@ -23773,8 +24181,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const read = `${logicalId}.${attributeName}`;
-			if (!context.redactedAttributeReads.includes(read)) context.redactedAttributeReads.push(read);
+			const maskedAttributeName = this.maskSecretsForLog(attributeName, context);
+			this.pushRedactedAttributeRead(context, {
+				kind: "attribute",
+				logicalId,
+				key: maskedAttributeName,
+				display: `${logicalId}.${maskedAttributeName}`
+			});
 		}
 		return value;
 	}
@@ -23807,10 +24220,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* honest answer is to say so and name the remedy: the record heals on the
 	* resource's next in-place update (#1727).
 	*/
-	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId) {
+	rejectPlaceholderArnAttribute(resource, attributeName, value, logicalId, context) {
 		if (!REF_RETURNS_ARN_FROM_STATE.get(resource.resourceType)?.includes(attributeName)) return;
 		if (typeof value !== "string" || !isPlaceholderArn(value)) return;
-		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: the recorded value "${value}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
+		throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: the recorded value "${stringifyValue(this.maskValueLeaves(value, context))}" is a placeholder written by a cdkd version older than issue #1681 — its region and account fields are literal wildcards, so it is not a usable ARN. Deploy the stack again so the resource's next update heals the record (cdkd now records the real ARN), or re-import the resource.`));
 	}
 	/**
 	* Construct resource attribute value based on resource type, refusing to
@@ -23855,7 +24268,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async constructGuardedAttribute(resource, attributeName, context, logicalId) {
 		const accountInfo = await getAccountInfo(this.resolverRegion);
 		const value = await this.constructAttribute(resource, attributeName, context, logicalId, accountInfo);
-		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
+		if (accountInfo.fabricated && embedsAccountId(value, accountInfo.accountId)) throw new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resource.resourceType}: STS did not report this deploy's account id, so cdkd would build the value from the placeholder account ${accountInfo.accountId} — structurally valid, naming a different account, and indistinguishable downstream from a real one. Fix the AWS credentials (or set AWS_ACCOUNT_ID to this deploy's account) and deploy again.`);
 		return value;
 	}
 	/**
@@ -23868,14 +24281,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* result. Keep this method's NAME — `scripts/gen-sdk-attr-coverage.ts` reads
 	* the resource types it references.
 	*/
-	async constructAttribute(resource, attributeName, _context, logicalId, accountInfo) {
+	async constructAttribute(resource, attributeName, context, logicalId, accountInfo) {
 		const { resourceType, physicalId } = resource;
 		const { accountId, partition } = accountInfo;
 		const region = canonicalizeRegion(accountInfo.region);
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return s3BucketArn(physicalId, region);
@@ -23883,12 +24296,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			case "RegionalDomainName": return s3BucketRegionalDomainName(physicalId, region);
 			case "DualStackDomainName": return s3BucketDualStackDomainName(physicalId, region);
 			case "WebsiteURL": return s3BucketWebsiteUrl(physicalId, region);
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -23900,7 +24313,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const associations = (await ec2.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0]?.Ipv6CidrBlockAssociationSet || [];
 					const blocks = associations.filter((a) => a.Ipv6CidrBlockState?.State === "associated").map((a) => a.Ipv6CidrBlock);
 					if (blocks.length > 0) {
-						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${JSON.stringify(blocks)}`);
+						this.logger.debug(`Resolved VPC Ipv6CidrBlocks for ${physicalId}: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(blocks, context)), context)}`);
 						return blocks;
 					}
 					if (associations.filter((a) => a.Ipv6CidrBlockState?.State === "associating").length === 0) {
@@ -23917,38 +24330,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
 			case "UserPoolId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -23958,41 +24371,41 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ApiGatewayV2::Api") switch (attributeName) {
 			case "ExecuteApiArn": return `arn:${partition}:execute-api:${region}:${accountId}:${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -24004,38 +24417,38 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -24047,26 +24460,26 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
 			case "TopicName": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.${derivePartitionAndUrlSuffix(region).urlSuffix}/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -24090,16 +24503,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				const serviceName = physicalId.substring(pipeIdx + 1);
 				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
 			case "InstanceId": return physicalId;
@@ -24133,13 +24546,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 						cachedEc2InstanceAttributes[cacheKey] = value;
 						return value;
 					}
-					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${attributeName}; returning physical ID`);
+					this.logger.warn(`DescribeInstances(${physicalId}) returned no ${this.maskSecretsForLog(attributeName, context)}; returning physical ID`);
 				} catch (err) {
-					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeInstances(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return physicalId;
 			}
-			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -24148,14 +24561,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					const value = attributeName === "LatestVersionNumber" ? lt?.LatestVersionNumber : lt?.DefaultVersionNumber;
 					if (value !== void 0 && value !== null) return String(value);
 				} catch (err) {
-					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${attributeName}: ${err instanceof Error ? err.message : String(err)}`);
+					this.logger.warn(`DescribeLaunchTemplates(${physicalId}) failed for ${this.maskSecretsForLog(attributeName, context)}: ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
 			if (attributeName === "LaunchTemplateId") return physicalId;
-			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 		}
-		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context);
 	}
 	/**
 	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
@@ -24184,13 +24597,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* route through this helper — those are explicit `case`s in the
 	* per-type handlers.
 	*/
-	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId, context) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
-		if (expectsArnShape || expectsUrlShape) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
-		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`));
+		if (expectsArnShape || expectsUrlShape) {
+			const expectedShape = expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)";
+			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" is not ${expectedShape}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
+		}
+		if (this.strictGetAtt) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${this.maskSecretsForLog(attributeName, context)}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${this.maskSecretsForLog(physicalId, context)}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${this.maskSecretsForLog(attributeName, context)}.`));
 		this.physicalIdFallbackCount++;
-		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
+		this.logger.warn(`Unknown attribute ${this.maskSecretsForLog(attributeName, context)} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
 	/**
@@ -24391,13 +24807,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					} catch (getAttError) {
 						if (getAttError instanceof IntrinsicResolutionRefusalError) throw getAttError;
 						this.rethrowStructuralSubFailure(varNameStr, getAttError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, getAttError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, getAttError), context));
 						replacement = match[0];
 					}
 					else {
 						if (refError instanceof IntrinsicResolutionRefusalError) throw refError;
 						this.rethrowStructuralSubFailure(varNameStr, refError, context);
-						this.logger.warn(this.subPlaceholderWarning(varNameStr, refError));
+						this.logger.warn(this.maskSecretsForLog(this.subPlaceholderWarning(varNameStr, refError), context));
 						replacement = match[0];
 					}
 				}
@@ -24431,7 +24847,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return `{{Fn::Select:${index}:OutOfBounds}}`;
 		}
 		const result = resolvedList[index];
-		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Select: index ${index} -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24575,7 +24991,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Fn::Split: the value to split${sourceClause} must be a string, got ${resolvedValue === null ? "null" : typeof resolvedValue}. Fn::Split accepts only a string; check the value or the intrinsic that produced it.`));
 		}
 		const result = resolvedValue.split(delimiter);
-		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${this.maskSecretsForLog(JSON.stringify(result), context)}`);
+		this.logger.debug(`Resolved Fn::Split: split by "${delimiter}" -> ${JSON.stringify(this.maskValueLeaves(result, context))}`);
 		return result;
 	}
 	/**
@@ -24606,7 +25022,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolved1 = await this.resolveValue(value1, context);
 		const resolved2 = await this.resolveValue(value2, context);
 		const result = JSON.stringify(resolved1) === JSON.stringify(resolved2);
-		this.logger.debug(`Resolved Fn::Equals: ${this.maskSecretsForLog(JSON.stringify(resolved1), context)} === ${this.maskSecretsForLog(JSON.stringify(resolved2), context)} -> ${result}`);
+		this.logger.debug(`Resolved Fn::Equals: ${JSON.stringify(this.maskValueLeaves(resolved1, context))} === ${JSON.stringify(this.maskValueLeaves(resolved2, context))} -> ${result}`);
 		return result;
 	}
 	/**
@@ -24754,7 +25170,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (context.recordedSecretValues) recordMaskOnlyValuesIn(recovered, context.recordedSecretValues);
 				return recovered;
 			}
-			if (context.redactedAttributeReads !== void 0 && !context.redactedAttributeReads.includes(origin)) context.redactedAttributeReads.push(origin);
+			if (context.redactedAttributeReads !== void 0) {
+				const loggedOrigin = this.maskSecretsForLog(origin, context);
+				this.pushRedactedAttributeRead(context, {
+					kind: "cross-stack",
+					display: loggedOrigin
+				});
+			}
 		}
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
@@ -24870,12 +25292,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			try {
 				entry = await context.exportIndex.lookup(exportName);
 			} catch (err) {
-				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${err instanceof Error ? err.message : String(err)}; falling back to state.json scan`);
+				this.logger.warn(`Exports index lookup failed for '${loggedExportName}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}; falling back to state.json scan`);
 				entry = void 0;
 			}
 			if (entry && (!context.stackName || entry.producerStack !== context.stackName)) {
 				this.recordImport(context, exportName, entry.producerStack, entry.producerRegion);
-				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${entry.producerStack} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
+				this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from index: ${this.maskSecretsForLog(entry.producerStack, context)} / ${entry.producerRegion}; ${carriesDynamicReference(entry.value) ? "redacted dynamic reference" : "literal value"})`);
 				return await this.reresolveCrossStackValue(entry.value, entry.producerRegion, context, `Fn::ImportValue '${exportName}' (producer ${entry.producerStack} / ${entry.producerRegion})`, sourceKey, {
 					stackName: entry.producerStack,
 					region: entry.producerRegion,
@@ -24889,30 +25311,30 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const ref of allStacks) {
 			const { stackName: refStack, region: refRegion } = ref;
 			if (context.stackName && refStack === context.stackName) {
-				this.logger.debug(`Skipping current stack: ${refStack}`);
+				this.logger.debug(`Skipping current stack: ${this.maskSecretsForLog(refStack, context)}`);
 				continue;
 			}
 			try {
 				const lookupRegion = refRegion ?? this.resolverRegion ?? "";
 				if (!lookupRegion) {
-					this.logger.debug(`No region available for stack '${refStack}' — skipping (cdkd cannot read state without a region)`);
+					this.logger.debug(`No region available for stack '${this.maskSecretsForLog(refStack, context)}' — skipping (cdkd cannot read state without a region)`);
 					continue;
 				}
 				const stateData = await context.stateBackend.getState(refStack, lookupRegion);
 				if (!stateData) {
-					this.logger.debug(`No state found for stack: ${refStack} (${lookupRegion})`);
+					this.logger.debug(`No state found for stack: ${this.maskSecretsForLog(refStack, context)} (${lookupRegion})`);
 					continue;
 				}
 				const { state } = stateData;
 				if (importableOutputKeys(state).includes(exportName)) {
 					const value = state.outputs[exportName];
-					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${refStack} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+					this.logger.info(`Resolved Fn::ImportValue: ${loggedExportName} (from stack: ${this.maskSecretsForLog(refStack, context)} / ${lookupRegion}; ${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 					if (context.exportIndex) context.exportIndex.patchEntry(exportName, {
 						value,
 						producerStack: refStack,
 						producerRegion: lookupRegion
 					}).catch((err) => {
-						this.logger.debug(`Failed to patch exports index for '${exportName}': ${err instanceof Error ? err.message : String(err)}`);
+						this.logger.debug(`Failed to patch exports index for '${this.maskSecretsForLog(exportName, context)}': ${this.maskSecretsForLog(err instanceof Error ? err.message : String(err), context)}`);
 					});
 					this.recordImport(context, exportName, refStack, lookupRegion);
 					found = {
@@ -24923,7 +25345,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					break;
 				}
 			} catch (error) {
-				this.logger.warn(`Failed to read state for stack ${refStack}: ${error instanceof Error ? error.message : String(error)}`);
+				this.logger.warn(`Failed to read state for stack ${this.maskSecretsForLog(refStack, context)}: ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 				continue;
 			}
 		}
@@ -24939,7 +25361,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				return cfnExport.value;
 			}
 		}
-		throw new Error(`Fn::ImportValue: export '${exportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
+		throw new Error(`Fn::ImportValue: export '${loggedExportName}' not found in any stack. Searched ${allStacks.length} cdkd state record(s)${this.cfnFallback ? " and CloudFormation exports" : ""}. Make sure the exporting stack has been deployed and the Output has an Export.Name property.`);
 	}
 	/**
 	* CloudFormation `ListExports` fallback lookup for `Fn::ImportValue`
@@ -24970,7 +25392,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			};
 			return;
 		} catch (error) {
-			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${error instanceof Error ? error.message : String(error)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::ImportValue: CloudFormation ListExports fallback failed for export '${this.maskSecretsForLog(exportName, context)}' (region ${this.resolverRegion}): ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}. Grant cloudformation:ListExports to resolve exports from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -25040,7 +25462,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			return await fetch;
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${region}): ${message}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
+			this.logger.warn(`Fn::GetStackOutput: CloudFormation DescribeStacks fallback failed for stack '${this.maskSecretsForLog(stackName, context)}' (${this.maskSecretsForLog(region, context)}): ${this.maskSecretsForLog(message, context)}. Grant cloudformation:DescribeStacks to resolve outputs from CloudFormation-managed stacks, or pass --no-cfn-fallback to disable the fallback.`);
 			return;
 		}
 	}
@@ -25149,7 +25571,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const resolvedRegion = await this.resolveValue(args["Region"], context);
 			if (typeof resolvedRegion !== "string" || resolvedRegion === "") throw new Error(`Fn::GetStackOutput: Region must resolve to a non-empty string, got ${typeof resolvedRegion}`);
 			const requestedRegion = canonicalizeRegion(resolvedRegion);
-			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${stripControlChars(resolvedRegion).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
+			if (!isClientSafeRegion(requestedRegion)) throw new Error(`Fn::GetStackOutput: '${this.maskThenStripThenMask(resolvedRegion, context).slice(0, 64)}' is not a valid AWS region name. The region selects both the AWS endpoint and the state-file key, so cdkd will not use it.`);
 			region = requestedRegion;
 		}
 		let roleArn;
@@ -25158,10 +25580,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof raw !== "string" || raw === "") throw new Error(`Fn::GetStackOutput: RoleArn must be a literal string in the template (no Ref / Fn::GetAtt / Fn::Sub allowed for cross-account references). Got ${raw === null ? "null" : Array.isArray(raw) ? "array" : typeof raw}${typeof raw === "object" ? ` (intrinsic shape: ${JSON.stringify(raw).slice(0, 80)})` : ""}.`);
 			roleArn = raw;
 		}
-		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${stackName}' in the same region '${region}'`);
+		if (!roleArn && context.stackName && context.stackName === stackName && canonicalizeRegion(region) === canonicalizeRegion(this.resolverRegion)) throw new Error(`Fn::GetStackOutput: cannot reference own stack '${this.maskSecretsForLog(stackName, context)}' in the same region '${this.maskSecretsForLog(region, context)}'`);
 		const loggedStackName = this.maskSecretsForLog(stackName, context);
 		const loggedOutputName = this.maskSecretsForLog(outputName, context);
-		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
+		const loggedRegion = this.maskSecretsForLog(region, context);
+		this.logger.debug(`Resolving Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""}`);
 		const stateData = roleArn ? await this.getCrossAccountStackState(roleArn, stackName, region, context) : await this.getSameAccountStackState(stackName, region, context);
 		if (!stateData) {
 			if (!roleArn && this.cfnFallback) {
@@ -25169,24 +25592,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				if (cfnOutputs) {
 					if (!Object.hasOwn(cfnOutputs, outputName)) {
 						const available = this.describeAvailableOutputs(Object.keys(cfnOutputs), context);
-						throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in CloudFormation stack '${stackName}' (${region}). Available outputs: ${available}`);
+						throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in CloudFormation stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 					}
 					const value = cfnOutputs[outputName];
-					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
+					this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName} (from CloudFormation stack outputs; weak reference — producer is not cdkd-managed)`);
 					return value;
 				}
 			}
-			throw new Error(`Fn::GetStackOutput: stack '${stackName}' not found in region '${region}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
+			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
-			throw new Error(`Fn::GetStackOutput: output '${outputName}' not found in stack '${stackName}' (${region}). Available outputs: ${available}`);
+			throw new Error(`Fn::GetStackOutput: output '${loggedOutputName}' not found in stack '${loggedStackName}' (${loggedRegion}). Available outputs: ${available}`);
 		}
 		const value = outputs[outputName];
-		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${region}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
+		this.logger.info(`Resolved Fn::GetStackOutput: StackName=${loggedStackName}, Region=${loggedRegion}, OutputName=${loggedOutputName}${roleArn ? `, RoleArn=${roleArn}` : ""} (${carriesDynamicReference(value) ? "redacted dynamic reference" : "literal value"})`);
 		if (!roleArn) this.recordOutputRead(context, stackName, region, outputName);
-		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${outputName}' of stack '${stackName}' (${region}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
+		if (roleArn && !context.skipDynamicReferences && carriesDynamicReference(value)) throw markNonRetryable(new CrossAccountSecretRefusalError(`Fn::GetStackOutput: output '${loggedOutputName}' of stack '${loggedStackName}' (${loggedRegion}) is a redacted dynamic reference, and this is a CROSS-ACCOUNT reference (RoleArn ${roleArn}). cdkd will not resolve a producer account's secret with the consumer's credentials — a same-named secret in the consumer account would answer instead. Export a non-secret value (e.g. the secret's ARN) and resolve it in the consumer stack, or reference the producer stack from within its own account.`));
 		return await this.reresolveCrossStackValue(value, region, context, `Fn::GetStackOutput '${outputName}' (producer ${stackName} / ${region})`, sourceKey, {
 			stackName,
 			region,
@@ -25304,19 +25727,19 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		if (!map) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: mapping '${mapName}' not found in Mappings section`);
+			throw new Error(`Fn::FindInMap: mapping '${this.maskSecretsForLog(mapName, context)}' not found in Mappings section`);
 		}
 		const topLevel = Object.hasOwn(map, topLevelKey) ? map[topLevelKey] : void 0;
 		if (!topLevel || typeof topLevel !== "object") {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: top-level key '${topLevelKey}' not found in mapping '${mapName}'`);
+			throw new Error(`Fn::FindInMap: top-level key '${this.maskSecretsForLog(topLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}'`);
 		}
 		if (!Object.hasOwn(topLevel, secondLevelKey)) {
 			if (hasDefaultValue) return await resolveDefault();
-			throw new Error(`Fn::FindInMap: second-level key '${secondLevelKey}' not found in mapping '${mapName}' -> '${topLevelKey}'`);
+			throw new Error(`Fn::FindInMap: second-level key '${this.maskSecretsForLog(secondLevelKey, context)}' not found in mapping '${this.maskSecretsForLog(mapName, context)}' -> '${this.maskSecretsForLog(topLevelKey, context)}'`);
 		}
 		const result = topLevel[secondLevelKey];
-		this.logger.debug(`Resolved Fn::FindInMap: ${mapName}.${topLevelKey}.${secondLevelKey} -> ${JSON.stringify(result)}`);
+		this.logger.debug(`Resolved Fn::FindInMap: ${this.maskSecretsForLog(mapName, context)}.${this.maskSecretsForLog(topLevelKey, context)}.${this.maskSecretsForLog(secondLevelKey, context)} -> ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(result, context)), context)}`);
 		return result;
 	}
 	/**
@@ -25329,6 +25752,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const resolvedValue = await this.resolveValue(value, context);
 		if (typeof resolvedValue !== "string") throw new Error(`Fn::Base64: value must resolve to a string, got ${typeof resolvedValue}`);
 		const result = Buffer.from(resolvedValue).toString("base64");
+		if (context.recordedSecretValues && this.maskSecretsForLog(resolvedValue, context) !== resolvedValue) recordMaskOnlyValue(context.recordedSecretValues, result);
 		this.logger.debug(`Resolved Fn::Base64: ${this.maskSecretsForLog(resolvedValue, context)} -> ${this.maskSecretsForLog(result, context)}`);
 		return result;
 	}
@@ -25360,7 +25784,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let clientRegion;
 		if (typeof resolvedValue === "string" && resolvedValue !== "") {
 			const requested = canonicalizeRegion(resolvedValue);
-			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${stripControlChars(resolvedValue).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
+			if (!isClientSafeRegion(requested)) throw new Error(`Fn::GetAZs: '${this.maskThenStripThenMask(resolvedValue, context).slice(0, 64)}' is not a valid AWS region name. A region is substituted into the AWS service hostname, so cdkd will not build a client from it.`);
 			region = requested;
 			clientRegion = requested;
 		} else {
@@ -25369,7 +25793,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		}
 		const cached = cachedAvailabilityZones[region];
 		if (cached) {
-			this.logger.debug(`Resolved Fn::GetAZs from cache: ${region} -> ${JSON.stringify(cached)}`);
+			this.logger.debug(`Resolved Fn::GetAZs from cache: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(cached, context))}`);
 			return cached;
 		}
 		const ec2Client = this.clientsForRegion(clientRegion).ec2;
@@ -25383,11 +25807,11 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				Values: ["available"]
 			}] }))).AvailabilityZones || []).map((az) => az.ZoneName).filter((name) => name !== void 0).sort();
 		} catch (error) {
-			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${region}': ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`Fn::GetAZs: failed to describe availability zones for region '${this.maskSecretsForLog(region, context)}': ${this.maskSecretsForLog(error instanceof Error ? error.message : String(error), context)}`);
 		}
-		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${region}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
+		if (azNames.length === 0) throw new Error(`Fn::GetAZs: no availability zones returned for region '${this.maskSecretsForLog(region, context)}'. Either the region is not enabled on this account (opt-in regions must be enabled before use), or the request was answered by a different region's endpoint.`);
 		cachedAvailabilityZones[region] = azNames;
-		this.logger.debug(`Resolved Fn::GetAZs: ${region} -> ${JSON.stringify(azNames)}`);
+		this.logger.debug(`Resolved Fn::GetAZs: ${this.maskSecretsForLog(region, context)} -> ${JSON.stringify(this.maskValueLeaves(azNames, context))}`);
 		return azNames;
 	}
 	/**
@@ -25433,6 +25857,95 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secrets && secrets.size > 0) masked = maskSecretsInText(masked, secrets);
 		return masked;
 	}
+	/**
+	* A copy of `value` with every string LEAF (and every object KEY) masked, for
+	* a caller about to ENCODE it into a message (issue
+	* [#2759](https://github.com/go-to-k/cdkd/issues/2759)).
+	*
+	* `stringifyValue` / `JSON.stringify` ESCAPE a leaf containing `"`, `\` or a
+	* control character, and {@link maskSecretsInText} matches a needle
+	* LITERALLY — so masking the ENCODED text misses exactly the plaintexts the
+	* encoder rewrote (`pa"ss\word12` encodes to `["pa\"ss\\word12"]`, which no
+	* needle matches). Masking each leaf first also buys the WHOLE-VALUE arm,
+	* which has no {@link MIN_NEEDLE_LENGTH} floor, for a leaf that IS the
+	* plaintext.
+	*
+	* Returns the STRUCTURE rather than a rendered string, deliberately: each
+	* call site keeps its own encoder, so this changes which characters are
+	* masked and nothing about how a value RENDERS. Encoding here instead
+	* dropped `JSON.stringify`'s quotes around a bare string and made a `cdkd
+	* scrub` log line unrecognisable to its own test.
+	*
+	* Object KEYS are masked too: a `Fn::Split` / `Fn::GetAtt` chain can put a
+	* resolved value in key position, and an unmasked key discloses exactly as
+	* much as an unmasked value.
+	*
+	* Cycle-safe by MEMOIZATION rather than a depth cap: a self-referential
+	* structure terminates (the replacement is registered before its children are
+	* walked, so the cycle closes on it) and a legal deep one is still walked to
+	* the bottom. A repeated but NON-cyclic sub-object gets its real rendering
+	* rather than a placeholder — see the note at the `Map`.
+	*/
+	maskValueLeaves(value, context) {
+		const done = /* @__PURE__ */ new Map();
+		const walk = (node) => {
+			if (typeof node === "string") return this.maskSecretsForLog(node, context);
+			if (node === null || typeof node !== "object") return node;
+			const memo = done.get(node);
+			if (memo !== void 0) return memo;
+			if (Array.isArray(node)) {
+				const out = [];
+				done.set(node, out);
+				for (const item of node) out.push(walk(item));
+				return out;
+			}
+			const out = Object.create(null);
+			done.set(node, out);
+			for (const [key, child] of Object.entries(node)) out[this.maskSecretsForLog(key, context)] = walk(child);
+			return out;
+		};
+		return walk(value);
+	}
+	/**
+	* Mask `value`, STRIP its control characters, then mask again — the shape a
+	* message that truncates its input needs (issue
+	* [#2827](https://github.com/go-to-k/cdkd/issues/2827) review round 1).
+	*
+	* NEITHER SINGLE ORDER IS CORRECT, and both were measured. Masking AFTER
+	* `stripControlChars` is what this fix was written to avoid: the strip
+	* rewrites the text a literal needle has to match. But masking BEFORE it is
+	* not safe either, because `stripControlChars` DELETES rather than replaces —
+	* so a plaintext SPLIT by an invisible (`S3cret\u200ePassw0rd`) is missed by
+	* the first mask and then RECONSTITUTED contiguous by the strip. That is the
+	* go-to-k/cdkd#2874 class arriving through a different door.
+	*
+	* Masking in BOTH string spaces closes both: the first pass catches a needle
+	* that occurs literally, the second catches one that only becomes contiguous
+	* after stripping. `maskSecretsInText` is idempotent, so the overlap costs
+	* nothing, and the caller truncates AFTERWARDS — never between the two.
+	*
+	* WHICH HALF IS FENCED, stated because a mutation probe made the difference
+	* visible. The FIRST mask is demonstrated by a test: deleting it (masking
+	* only after the strip) reds the split-needle case, because the recorded
+	* needle is then the split form and the strip has destroyed it. The SECOND
+	* mask is NOT reached by any test here and is defence in depth: it earns its
+	* place only when the bag holds a needle that is the STRIPPED form of the
+	* value in hand, and every route through THIS resolver records the value it
+	* actually resolved — so the split copy is itself a needle and the first
+	* mask already catches it. The shape was measured against a hand-built bag
+	* during review, not produced by the resolver. Kept anyway: it is one
+	* idempotent call, and the alternative is re-deciding per future caller
+	* whether the bag and the value can disagree.
+	*
+	* THE BOUND, since this file's job is to state them: this covers a needle
+	* split by a character `stripControlChars` removes. A needle split by
+	* anything else, or one whose canonical form differs for another reason, is
+	* `outputs-export-alias.ts`'s `canonicalForSecretScan` problem and is not
+	* solved here.
+	*/
+	maskThenStripThenMask(value, context) {
+		return this.maskSecretsForLog(stripControlChars(this.maskSecretsForLog(value, context)), context);
+	}
 	async resolveDynamicReferences(value, context) {
 		const pattern = /\{\{resolve:([^}]+)\}\}/g;
 		let result = value;
@@ -25447,7 +25960,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
 			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(fullMatch, context)}: it names '${this.maskSecretsForLog(regionVerdict.secretName, context)}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
 			if (regionVerdict.kind === "named-region") {
 				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferences(fullMatch, withoutProducerRegions(context));
 				result = result.replace(fullMatch, () => foreign);
@@ -25492,7 +26005,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
 				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(fullMatch, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
@@ -25556,22 +26069,24 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`, context));
+		const loggedSecretId = this.maskSecretsForLog(secretId, context);
+		const loggedJsonKey = this.maskSecretsForLog(jsonKey, context);
+		this.logger.debug(`Resolving dynamic reference: secretsmanager:${loggedSecretId}:SecretString:${loggedJsonKey}:${this.maskSecretsForLog(versionStage, context)}:${this.maskSecretsForLog(versionId, context)}`);
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`secretsmanager:${secretId}`, context))).SecretString;
-		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${loggedSecretId}`)).SecretString;
+		if (!secretString) throw new Error(`Dynamic reference: secret '${loggedSecretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const parsed = JSON.parse(secretString);
 			const keyValue = Object.hasOwn(parsed, jsonKey) ? parsed[jsonKey] : void 0;
-			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${jsonKey}' not found in secret '${secretId}'`);
+			if (keyValue === void 0) throw new Error(`Dynamic reference: key '${loggedJsonKey}' not found in secret '${loggedSecretId}'`);
 			return stringifyValue(keyValue);
 		} catch (error) {
-			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${secretId}' is not valid JSON but JSON_KEY '${jsonKey}' was specified`);
+			if (error instanceof SyntaxError) throw new Error(`Dynamic reference: secret '${loggedSecretId}' is not valid JSON but JSON_KEY '${loggedJsonKey}' was specified`);
 			throw error;
 		}
 		return secretString;
@@ -25597,8 +26112,8 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const ipBlock = await this.resolveValue(rawIpBlock, context);
 		const count = Number(await this.resolveValue(rawCount, context));
 		const cidrBits = Number(await this.resolveValue(rawCidrBits, context));
-		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(ipBlock)}`);
-		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${ipBlock}, count=${count}, cidrBits=${cidrBits}`);
+		if (!ipBlock || typeof ipBlock !== "string") throw new Error(`Fn::Cidr: ipBlock must be a string, got ${typeof ipBlock}: ${JSON.stringify(this.maskValueLeaves(ipBlock, context))}`);
+		this.logger.debug(`Resolving Fn::Cidr: ipBlock=${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(ipBlock, context)), context)}, count=${count}, cidrBits=${cidrBits}`);
 		const isIpv6 = ipBlock.includes(":");
 		const results = [];
 		if (isIpv6) {
@@ -25630,7 +26145,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				results.push(`${a}.${b}.${c}.${d}/${subnetPrefix}`);
 			}
 		}
-		this.logger.debug(`Fn::Cidr result: ${JSON.stringify(results)}`);
+		this.logger.debug(`Fn::Cidr result: ${this.maskSecretsForLog(JSON.stringify(this.maskValueLeaves(results, context)), context)}`);
 		return results;
 	}
 	/** Expand IPv6 address to full 8-group form */
@@ -25720,21 +26235,22 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: ${service}:${parameterName}`, context));
+		const loggedParameterName = this.maskSecretsForLog(parameterName, context);
+		this.logger.debug(`Resolving dynamic reference: ${service}:${loggedParameterName}`);
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`${service}:${parameterName}`, context));
+		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${loggedParameterName}`);
 		const paramValue = response.Parameter?.Value;
-		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
+		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${loggedParameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
 		const secure = paramType !== "String" && paramType !== "StringList";
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(this.maskSecretsForLog(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`, context));
+			this.logger.warn(`SSM parameter '${loggedParameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
 		}
 		return {
 			value: paramValue,
@@ -26094,7 +26610,7 @@ async function fetchTopLevelWriteOnlyProperties(resourceType) {
 		if (Array.isArray(writeOnly)) for (const path of writeOnly) {
 			if (typeof path !== "string") continue;
 			const match = /^\/properties\/([^/]+)/.exec(path);
-			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
 		}
 	}
 	logger.debug(`Resolved ${result.size} top-level write-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
@@ -26103,6 +26619,128 @@ async function fetchTopLevelWriteOnlyProperties(resourceType) {
 /**
 * Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
 */
+function unescapeJsonPointerSegment$1(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
+//#endregion
+//#region src/provisioning/read-only-properties.ts
+/**
+* Read-only property resolution for `CloudControlProvider.import()` (issue
+* [#2847](https://github.com/go-to-k/cdkd/issues/2847)) — the read-side sibling
+* of {@link file://./write-only-properties.ts}, sharing its `DescribeType` +
+* per-type cache + top-level reduction, and differing from it in exactly one
+* way that is the point of the module: it distinguishes "this type declares no
+* read-only properties" from "cdkd could not find out".
+*
+* WHY THE DISTINCTION IS LOAD-BEARING. The write-only caller degrades SAFELY to
+* the empty set (a smaller UPDATE patch). This caller does not: its empty set
+* would mean "surface no attributes", while its `undefined` means "cdkd cannot
+* tell an attribute from a property for this type". Collapsing the two into one
+* `Set` — which is what the write-only sibling's signature does — makes a
+* missing `cloudformation:DescribeType` permission indistinguishable from a
+* type with no attributes, and the CALLER's fail-closed arm then cannot be
+* written at all. So the return type is `ReadonlySet<string> | undefined` and
+* the failure is the `undefined`.
+*
+* WHAT `readOnlyProperties` MEANS HERE. In the CloudFormation registry schema a
+* type's `readOnlyProperties` are exactly the values `Fn::GetAtt` may read —
+* that is the definition CloudFormation itself applies, and it is why the
+* narrowing this module enables is a CORRECTNESS fix as much as a security one.
+* Cloud Control's `GetResource` returns the whole resource MODEL, whose keys are
+* every readable property, writable ones included; a `Fn::GetAtt` naming one of
+* those is rejected by CloudFormation at template validation, so nothing cdkd
+* drops here was ever a legitimate attribute.
+*
+* TOP-LEVEL REDUCTION, deliberately the same convention as the write-only
+* sibling: a nested pointer `/properties/Endpoint/Address` reduces to
+* `Endpoint`, so the whole containing property is kept. Keeping the container is
+* what makes the resolver's nested-path walk (`Endpoint.Address`, issue #381)
+* keep working; reducing to the leaf instead would drop the object the walk
+* descends into.
+*
+* WHAT THAT COSTS, stated because the caller is a redaction and the reduction
+* WIDENS what survives it: certifying `Endpoint` certifies the WHOLE container,
+* including sibling leaves the schema does not declare read-only. A type whose
+* schema marks `/properties/Endpoint/Address` read-only while `Endpoint` also
+* carries, say, a credential member would keep that member in the clear. The
+* alternative — reduce to the leaf and mask the rest of the container — was
+* rejected because it breaks `Fn::GetAtt Endpoint.Port` for every ordinary
+* type, which is a certain regression against a hypothetical exposure; a
+* PATH-precise certification is the real fix and is not what this module does.
+* The residual sits inside the wider one `import()`'s doc already states (a
+* read-only attribute that IS a credential is persisted in the clear), so it
+* adds a shape rather than a new class.
+*
+* CACHING matches the sibling exactly, including the part that is easy to get
+* wrong: the promise stored in the cache is the ALREADY-RECOVERED one, and what
+* keeps a failure from being cached is the handler DELETING its own entry, not
+* the cache holding a raw promise. An earlier revision of this module cached
+* the raw promise and recovered only the calling side — which meant a second
+* caller arriving inside the failure window received a REJECTION out of a
+* function whose contract says it never throws. Unreachable at the time (both
+* `importOne` loops are sequential `for…await`), but the contract is what the
+* caller's fail-closed arm is written against, so it is honoured here rather
+* than left to the call graph.
+*
+* Only SUCCESSFUL lookups therefore survive in the cache for the process
+* lifetime, so a transient throttle on the first imported resource of a type
+* cannot poison every later one. A schema-less response is a SUCCESSFUL lookup
+* of an empty set, not a failure — a type AWS publishes with no
+* `readOnlyProperties` genuinely has no attributes, and answering `undefined`
+* there would make the caller emit a missing-permission warning for a healthy
+* type.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only, holding the in-flight promise so
+* concurrent imports of the same type share one `DescribeType` call. A failed
+* lookup removes its own entry so a later call retries.
+*/
+const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the TOP-LEVEL read-only (i.e. `Fn::GetAtt`-able) property names for a
+* resource type.
+*
+* Returns `undefined` when the schema could not be resolved — a missing
+* `cloudformation:DescribeType` permission, an exhausted throttle retry, or a
+* type with no registry entry at all. Callers MUST treat `undefined` as "cannot
+* certify" rather than as "none": the two are different answers and this
+* function is the only place that can still tell them apart.
+*
+* Never throws.
+*/
+function getTopLevelReadOnlyProperties(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
+	const cached = readOnlyPropertiesCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
+		readOnlyPropertiesCache.delete(resourceType);
+		const message = error instanceof Error ? error.message : String(error);
+		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
+	});
+	readOnlyPropertiesCache.set(resourceType, entry);
+	return entry;
+}
+/**
+* Fetch + parse the type's read-only properties. THROWS on a DescribeType
+* failure — the caller catches, reports `undefined`, and declines to cache.
+*/
+async function fetchTopLevelReadOnlyProperties(resourceType) {
+	const logger = getLogger().child("ReadOnlyProperties");
+	const response = await describeTypeWithThrottleRetry(resourceType);
+	const result = /* @__PURE__ */ new Set();
+	if (response.Schema) {
+		const readOnly = JSON.parse(response.Schema).readOnlyProperties;
+		if (Array.isArray(readOnly)) for (const path of readOnly) {
+			if (typeof path !== "string") continue;
+			const match = /^\/properties\/([^/]+)/.exec(path);
+			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+		}
+	}
+	logger.debug(`Resolved ${result.size} top-level read-only properties for ${displaySafe(resourceType, { asciiOnly: true })}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	return result;
+}
+/** Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`). */
 function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
@@ -26784,6 +27422,12 @@ var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
 	patchGenerator = new JsonPatchGenerator();
+	/**
+	* Types whose unresolvable-schema import warning has already been printed —
+	* see `maskUncertifiedModelValues`. Per-instance so a test cannot inherit
+	* another test's suppression.
+	*/
+	warnedUnresolvableSchemaTypes = /* @__PURE__ */ new Set();
 	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
@@ -26943,7 +27587,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-TexsJufw.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CC6BMuNK.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -27304,10 +27948,18 @@ var CloudControlProvider = class {
 	/**
 	* Enrich resource attributes with computed values
 	*
-	* CC API GetResource returns property names that match CloudFormation
-	* Fn::GetAtt attribute names, so all properties are passed through as-is.
 	* This method adds fallback attributes for edge cases where CC API
 	* may not return certain values.
+	*
+	* It passes every other key through AS-IS, and on the CREATE / UPDATE path
+	* that bag is still the WHOLE resource model. This comment used to justify
+	* that by saying the model's property names match `Fn::GetAtt` attribute
+	* names; they do not — the model is every readable property, and
+	* CloudFormation rejects a `Fn::GetAtt` naming a writable one. Issue
+	* [#2847](https://github.com/go-to-k/cdkd/issues/2847) narrowed the IMPORT
+	* path for that reason; the deploy path is issue
+	* [#2925](https://github.com/go-to-k/cdkd/issues/2925), which also carries
+	* why the same narrowing cannot simply be copied here.
 	*/
 	async enrichResourceAttributes(resourceType, physicalId, attributes) {
 		const enriched = { ...attributes };
@@ -27760,7 +28412,9 @@ var CloudControlProvider = class {
 	*   - With `knownPhysicalId` (from `--resource <id>=<physicalId>` or
 	*     `--resource-mapping`): call `GetResource(TypeName, Identifier)`,
 	*     parse `ResourceModel` (returned as a JSON string by CC API), and
-	*     return its keys as `attributes`.
+	*     return the ATTRIBUTE keys as `attributes` — see
+	*     {@link maskUncertifiedModelValues} for what "attribute" means here and
+	*     why every other key comes back MASKED rather than dropped.
 	*   - Without `knownPhysicalId`: return `null`. CC API has no efficient
 	*     `aws:cdk:path`-tag lookup — `ListResources` returns identifiers
 	*     only, so tag lookup would require one `GetResource` per resource
@@ -27772,6 +28426,107 @@ var CloudControlProvider = class {
 	* SDK providers (S3, Lambda, IAM Role, etc.) implement their own
 	* `import` with tag-based auto-lookup; this fallback only kicks in for
 	* resource types that don't have a dedicated SDK provider.
+	*
+	* ---
+	*
+	* The rest of this block is the design of the attribute narrowing
+	* {@link maskUncertifiedModelValues} performs — every LEAF of a model key
+	* cdkd cannot certify is an ATTRIBUTE is replaced with {@link SECRET_MASK},
+	* container shape preserved, and the certified attributes are left untouched
+	* (issue [#2847](https://github.com/go-to-k/cdkd/issues/2847)).
+	*
+	* It lives HERE, on `import()`, rather than in a second block above the
+	* method, and that is deliberate: two consecutive block comments attach only
+	* the LAST one, so splitting this back out silently orphans whichever doc
+	* ends up first. Keep it as ONE block.
+	*
+	* ## What is being fixed
+	*
+	* `GetResource` returns the resource MODEL — every readable property, not
+	* just the attributes. `cdkd import` persisted that model verbatim into
+	* `ResourceState.attributes`, through no redactor, for every
+	* Cloud-Control-routed type. Where the model carries a credential, the
+	* credential landed in `state.json` in the clear.
+	*
+	* ## Why "attribute" means `readOnlyProperties`
+	*
+	* That is CloudFormation's own definition: a type's `readOnlyProperties` are
+	* exactly what `Fn::GetAtt` may read, and CloudFormation REJECTS a
+	* `Fn::GetAtt` naming a writable property at template validation. So a key
+	* outside that set was never a legitimate attribute, and cdkd persisting it
+	* bought nothing a valid template could use.
+	*
+	* ## Why MASK and not DROP — the load-bearing decision
+	*
+	* Dropping looks cleaner and is WRONG here, because there is no live
+	* fallback on the read side. `IntrinsicFunctionResolver.resolveGetAtt` looks
+	* the key up in this bag and, on a miss, falls through to
+	* `constructAttribute` — which synthesizes from `physicalId` alone and, for
+	* an attribute name that is neither `*Arn` nor `*Url`, WARNS and returns the
+	* physical id. That is a silently wrong value shipped to AWS. There is no
+	* `provider.getAttribute` rescue on the deploy path (the only caller of it
+	* outside the providers is `cdkd orphan`), and this class has no
+	* `getAttribute` at all.
+	*
+	* Masking keeps the KEY present, so the lookup HITS and the value flows
+	* through `noteAttributeSecrecy` into `ResolverContext.redactedAttributeReads`,
+	* where `DeployEngine.refuseRedactedAttributeReads` FAILS the resource rather
+	* than sending the mask. So the outcome is a loud, named refusal instead of a
+	* wrong value — which is the trade this repo already made for the mask-only
+	* channel (issue #2274), reusing its machinery rather than inventing a second
+	* sentinel nothing downstream recognises.
+	*
+	* ONE SHAPE ESCAPES THAT, and it is stated rather than left to be discovered:
+	* an uncertified EMPTY container (`{}` / `[]`) has no leaf to mask, so no
+	* `SECRET_MASK` lands under that key and no refusal can fire for it. A DOTTED
+	* read through it breaks at `Object.hasOwn` and falls to `constructAttribute`;
+	* a FLAT read returns the empty container itself. It is not a DISCLOSURE — the
+	* container was empty at AWS, so there was nothing to disclose — but the
+	* refusal genuinely does not fire there.
+	*
+	* ## The unresolvable-schema arm is FAIL-CLOSED
+	*
+	* `getTopLevelReadOnlyProperties` answers `undefined` when it could not find
+	* out — a missing `cloudformation:DescribeType` grant, an exhausted throttle
+	* retry, or a type with no registry entry. cdkd then cannot tell an attribute
+	* from a property for this type, so it certifies NOTHING and masks the whole
+	* model, warning at default verbosity with the grant to add. Failing OPEN
+	* here would make a missing IAM permission silently restore the exact
+	* disclosure this method exists to close.
+	*
+	* ## An UNREADABLE MODEL warns at the same volume as an unreadable schema
+	*
+	* The two arms below the `GetResource` — a `JSON.parse` failure, and a model
+	* that parsed to something other than an object — cannot mask anything (there
+	* is no bag to walk), so they yield `attributes: {}`. That is the DROP
+	* outcome this design rejects one section up: the key is absent,
+	* `resolveGetAtt` falls through to `constructAttribute`, and the physical id
+	* ships. "cdkd could not read the model" is the same epistemic state as "cdkd
+	* could not read the schema", so both report at DEFAULT verbosity. They used
+	* to differ — the schema arm warned while these logged at `debug` — which
+	* meant the one outcome that ships a wrong value silently was the one nobody
+	* was told about. Neither line prints any part of the model: the parse arm
+	* prints the error's NAME only (V8 embeds an input snippet in a
+	* `SyntaxError`'s message) and the non-object arm prints the SHAPE only.
+	*
+	* ## What this does NOT close, stated as the danger direction
+	*
+	* A CREDENTIAL THAT IS ITSELF A READ-ONLY ATTRIBUTE IS STILL PERSISTED IN THE
+	* CLEAR. `readOnlyProperties` is a structural test, not a sensitivity one, and
+	* the registry schema offers nothing better to key on: it has no general
+	* sensitivity marking. The nearest things it does have were both checked and
+	* neither serves — `"format": "password"` is declared by a single property in
+	* AWS's whole published bundle, and `writeOnlyProperties` (a real "cannot be
+	* returned by a read" marker, declared by a minority of types) describes
+	* values `GetResource` never returns, so masking them would be inert here. So
+	* the "mask by the schema's own marking" shape the issue floated is NARROWED
+	* to nothing usable rather than refuted outright. Known members of the
+	* surviving class include `AWS::IAM::AccessKey`'s `SecretAccessKey`,
+	* `AWS::Cognito::UserPoolClient`'s `ClientSecret` and
+	* `AWS::EC2::IpamExternalResourceVerificationToken`'s `TokenValue`. The list
+	* is not claimed to be exhaustive and no count is quoted here, because
+	* nothing in the tree fences one; the derivation and its residual are
+	* recorded on the issue.
 	*/
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
@@ -27780,14 +28535,21 @@ var CloudControlProvider = class {
 				TypeName: input.resourceType,
 				Identifier: input.knownPhysicalId
 			}));
-			let attributes = {};
+			const safeType = displaySafe(input.resourceType, { asciiOnly: true });
+			const safeId = displaySafe(input.knownPhysicalId, { asciiOnly: true });
+			let parsedModel;
 			const raw = resp.ResourceDescription?.Properties;
 			if (typeof raw === "string" && raw.length > 0) try {
 				const parsed = JSON.parse(raw);
-				if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) attributes = parsed;
+				if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) parsedModel = parsed;
+				else {
+					const shape = parsed === null ? "null" : Array.isArray(parsed) ? "an array" : typeof parsed;
+					this.logger.warn(`CC API ResourceModel for ${safeType}/${safeId} parsed to ${shape}, not an object — recording no attributes for it. An Fn::GetAtt against this resource will fall back to a value constructed from its physical id.`);
+				}
 			} catch (parseErr) {
-				this.logger.debug(`Failed to parse CC API ResourceModel for ${input.resourceType}/${input.knownPhysicalId}: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`);
+				this.logger.warn(`Failed to parse CC API ResourceModel for ${safeType}/${safeId}: ${parseErr instanceof Error ? parseErr.name : typeof parseErr}. Recording no attributes for it; an Fn::GetAtt against this resource will fall back to a value constructed from its physical id.`);
 			}
+			const attributes = parsedModel === void 0 ? {} : await this.maskUncertifiedModelValues(parsedModel, input.resourceType, input.knownPhysicalId);
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes
@@ -27797,7 +28559,81 @@ var CloudControlProvider = class {
 			throw error;
 		}
 	}
+	/**
+	* Replace every LEAF cdkd cannot certify belongs to an ATTRIBUTE with
+	* {@link SECRET_MASK}, preserving container SHAPE, and leave the certified
+	* attributes untouched. The argument for masking rather than dropping, and
+	* for the fail-closed `undefined` arm, is on {@link import} above.
+	*
+	* ## Why the walk is RECURSIVE — this was a measured defect, not caution
+	*
+	* The first cut replaced the whole VALUE, so an uncertified `Endpoint`
+	* object became the string `'***'`. `IntrinsicFunctionResolver.resolveGetAtt`
+	* resolves `Endpoint.Address` by WALKING the dotted path: it tests
+	* `typeof cursor === 'object'`, which a string fails, so the walk breaks with
+	* `cursor === undefined`, `noteAttributeSecrecy` is NEVER called, and control
+	* reaches `constructAttribute` — the physical-id fallback. That is precisely
+	* the silently-wrong-value outcome the mask exists to prevent, so
+	* whole-value masking DEFEATED its own justification for every nested
+	* attribute. Masking leaves keeps the containers walkable, so the walk lands
+	* on a `'***'` LEAF and notes it, and the refusal fires — for any container
+	* that HAS a leaf. An EMPTY one has none, and `import()`'s doc carries that
+	* gap; do not read this sentence as covering it.
+	*
+	* Arrays keep their length and element positions for the same reason.
+	*
+	* ## The bag is null-prototype
+	*
+	* `JSON.parse` can yield a legal own key `__proto__`; assigning that on an
+	* ordinary object literal writes the PROTOTYPE instead of an own property and
+	* the key vanishes from the bag — a DROP, the one outcome this method must
+	* never produce. `Object.create(null)` makes the assignment ordinary.
+	*/
+	async maskUncertifiedModelValues(model, resourceType, physicalId) {
+		const safeType = displaySafe(resourceType, { asciiOnly: true });
+		const safeId = displaySafe(physicalId, { asciiOnly: true });
+		const attributeNames = await getTopLevelReadOnlyProperties(resourceType);
+		if (attributeNames === void 0) {
+			if (!this.warnedUnresolvableSchemaTypes.has(resourceType)) {
+				this.warnedUnresolvableSchemaTypes.add(resourceType);
+				this.logger.warn(`Could not resolve the CloudFormation schema for ${safeType}, so cdkd cannot tell which of its Cloud Control model keys are Fn::GetAtt attributes. Every imported attribute for this type is recorded as "${"***"}" rather than risking a credential in state.json; an Fn::GetAtt against such a resource fails with a named refusal until that resource is next created or updated by a deploy. Grant cloudformation:DescribeType and re-import to record its attributes.`);
+			}
+		}
+		const masked = Object.create(null);
+		let maskedCount = 0;
+		for (const [key, value] of Object.entries(model)) if (attributeNames?.has(key)) masked[key] = value;
+		else {
+			masked[key] = maskLeavesDeep(value);
+			maskedCount++;
+		}
+		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not in the type's readOnlyProperties, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
+		return masked;
+	}
 };
+/**
+* Every LEAF of `value` replaced by {@link SECRET_MASK}, with object and array
+* CONTAINERS rebuilt at the same shape. See
+* `CloudControlProvider.maskUncertifiedModelValues` for why the shape must
+* survive.
+*
+* A `JSON.parse` result is acyclic by construction, so no visited-set is
+* needed — that answers CYCLES and nothing else. It is NOT a depth guarantee:
+* measured on this repo's node, `JSON.parse` survives ~100,000 nesting levels
+* while this recursion throws `RangeError` between 1,000 and 5,000. No Cloud
+* Control resource model comes close, and the `try` in `import()` is narrowed
+* to the parse, so such a `RangeError` would fail the import loudly rather than
+* degrade it silently — which is the direction this design wants. Recorded so
+* the acyclic sentence is not read as covering depth.
+*/
+function maskLeavesDeep(value) {
+	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
+	if (value !== null && typeof value === "object") {
+		const out = Object.create(null);
+		for (const [key, nested] of Object.entries(value)) out[key] = maskLeavesDeep(nested);
+		return out;
+	}
+	return "***";
+}
 
 //#endregion
 //#region src/provisioning/interrupt-watch.ts
@@ -34432,7 +35268,7 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 */
 function refuseMaskedReplayBaseline(props, logicalId) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
-	throw new CdkdError(`Cannot roll ${logicalId} back: its recorded baseline holds the redaction mask ('${"***"}') where a NoEcho custom-resource value was resolved, so cdkd would write that literal to the live resource. Restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
+	throw new CdkdError(`Cannot roll ${logicalId} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are two ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 /**
 * The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
@@ -35977,7 +36813,7 @@ function unionCrossStackReads(previous, recorded, identity) {
 	}
 	return out;
 }
-var DeployEngine = class {
+var DeployEngine = class DeployEngine {
 	logger = getLogger().child("DeployEngine");
 	resolver;
 	interrupted = false;
@@ -36246,7 +37082,7 @@ var DeployEngine = class {
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
 			recordedSecretValues,
 			noEchoAttributeResources: this.noEchoAttributeResources,
-			redactedAttributeReads: []
+			...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 		};
 	}
 	/**
@@ -36400,6 +37236,147 @@ var DeployEngine = class {
 		for (const name of names) recordMaskOnlyValuesIn(attributes[name], secrets, excluded);
 	}
 	/**
+	* The remedy clause of {@link refuseRedactedAttributeReads}'s import arm,
+	* derived from the `reads` entries rather than described in prose.
+	*
+	* `ResolverContext.redactedAttributeReads` is HETEROGENEOUS, and the split
+	* that matters is NOT which function pushed the entry — it is whether the
+	* masked record lives in THIS stack's state, because only then can a
+	* `--resource` re-import here reach it. FOUR populations reach the bag, and
+	* each entry now says which it is IN ITS OWN FIELDS
+	* ({@link RedactedAttributeRead}) rather than in a rendered string this
+	* function re-parses:
+	*
+	*  - `kind: 'attribute'` with a `logicalId` — `noteAttributeSecrecy`, a
+	*    resource in this stack. LOCAL.
+	*  - `kind: 'attribute'` whose `logicalId` names an
+	*    `AWS::CloudFormation::Stack` — ALSO `noteAttributeSecrecy`, and the
+	*    reason `kind` alone cannot partition. A nested stack's output attribute
+	*    reaches the cross-stack re-resolution arm only when it
+	*    `carriesDynamicReference`, and a value that is already `SECRET_MASK`
+	*    does NOT (that predicate tests for `{{resolve:`), so a masked child
+	*    output falls through to `noteAttributeSecrecy` and is pushed as an
+	*    ordinary local attribute read. Its record is the CHILD's
+	*    `state.outputs`, from which the parent's attributes are rebuilt every
+	*    deploy, so no `--resource` in THIS stack clears it:
+	*    `NestedStackProvider` implements no `import()` at all, so the command
+	*    would report `skipped-no-impl` and change nothing. FOREIGN, despite
+	*    being local by kind.
+	*  - `kind: 'cross-stack'` — `reresolveCrossStackValue`'s `Fn::ImportValue` /
+	*    `Fn::GetStackOutput` / `nested stack <Child> Outputs.<Key>` forms. It
+	*    carries NO `logicalId`, because there is no id in THIS stack to name.
+	*    FOREIGN.
+	*  - `kind: 'ref-state-key'` — `noteRefStateMask`, a resource in this stack
+	*    whose CFn `Ref` value is recovered from a state key rather than from the
+	*    physical id. LOCAL, and it earns a sentence of its own: the read is
+	*    cdkd's, not the template's, so the `Fn::GetAtt` remedy "stop reading it"
+	*    does not apply.
+	*
+	* Successive review rounds tried to express this as an instruction the reader
+	* applies ("the name to the left of the dot"), and each phrasing was wrong
+	* for a shape it had not considered — twice naming a REAL-but-wrong logical
+	* id that the import typo guard ACCEPTS, so following it would
+	* `--force`-overwrite an innocent row. Partitioning here makes each arm say
+	* only what is true of its own shape, and makes a new shape a change to THIS
+	* function rather than a silent widening of a sentence.
+	*
+	* **AND THE PARTITION READS FIELDS, NEVER A REGEX OVER `display`** (round-4
+	* review). Two revisions parsed the rendering back into structure and each
+	* shipped a defect: a hand-spelled pattern that a producer rename disarms,
+	* then an `[A-Za-z0-9]+` id class that a HYPHENATED logical id falls out of —
+	* and cdkd accepts one, because it validates no logical-id charset and never
+	* hands the template to CloudFormation. Here falling out cost a re-import
+	* command withheld; at `resolveOutputs`' guard the same miss cost the REFUSAL
+	* itself. One rendering serving two consumers whose safe directions are
+	* OPPOSITE is not a pattern to tune, so the structure moved into the data.
+	*
+	* The nested-stack case is excluded BY RESOURCE TYPE, not by an `Outputs.`
+	* spelling. Keying on the segment over-reaches: a local
+	* `AWS::ServiceCatalog::CloudFormationProvisionedProduct` documents
+	* `Outputs.<Key>` as a real `Fn::GetAtt` attribute, so a masked one would be
+	* misrouted to the foreign arm and the reachable remedy withheld. `resources`
+	* is on the context already, so the type is available and exact.
+	*
+	* A LOCAL target whose type cannot be repaired by `cdkd import` at all gets
+	* a THIRD arm since the issue #2847 round-2 review — a `Custom::*` /
+	* `AWS::CloudFormation::CustomResource`, whose provider records no
+	* attributes, so the import's same-physical-id carry-over restores the
+	* masked bag and the refusal repeats forever. It is NOT simply excluded from
+	* `isLocal`: that would route it to the FOREIGN arm, which asserts the record
+	* lives in another stack, and for a custom resource in this very template
+	* that is false. Its arm names the resource and withholds the command.
+	*
+	* An entry carrying NO `logicalId` is treated as foreign, which is both
+	* correct (`cross-stack` is the only kind that omits it) and the safe
+	* direction for a kind nobody has added yet: the foreign arm names no
+	* command, so an unrecognised shape costs a vaguer message rather than a
+	* destructive one.
+	*
+	* A logical id spelled `Ref Foo (state key X)`, or `My-Table`, or anything
+	* else cdkd accepts, now routes on the FIELD and cannot be misread as another
+	* row — the misparse the pre-round-4 regexes had to be anchored against.
+	*/
+	static maskedRecordRemedyFor(reads, resources) {
+		const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+		/**
+		* Types whose `import()` can NEVER clear a mask, so advising a re-import
+		* for them is a guaranteed no-op (issue #2847 round-2 review).
+		*
+		* TRACED, not assumed. `CustomResourceProvider.import` returns
+		* `{ physicalId, attributes: {} }` unconditionally; `import.ts`'s
+		* `rowAttributes` normalises an empty bag to `undefined` and the coalesce
+		* behind it CARRIES FORWARD the prior record's attributes whenever the
+		* physical id matches — which it does, since the command is run with that
+		* very id. So the masked bag is copied back verbatim and the refusal
+		* repeats, forever.
+		*
+		* This is the NoEcho population — arm (1) of the refusal's own message —
+		* which already has the right remedy there (force the custom resource to
+		* update so its handler runs again). It gets its OWN arm rather than being
+		* excluded from `isLocal`: excluding it would route the read to the FOREIGN
+		* arm, which says the record lives in ANOTHER stack, and for a custom
+		* resource sitting in this very template that is simply false. Narrower
+		* than issue #2927, which is about a re-import whose `GetResource` merely
+		* came back empty; here the provider cannot produce attributes at all.
+		*/
+		const importCannotClearMask = (type) => type === "AWS::CloudFormation::CustomResource" || (type?.startsWith("Custom::") ?? false);
+		const typeOf = (read) => read.logicalId !== void 0 && Object.hasOwn(resources, read.logicalId) ? resources[read.logicalId]?.resourceType : void 0;
+		const isLocal = (read) => {
+			if (read.logicalId === void 0) return false;
+			return typeOf(read) !== NESTED_STACK_RESOURCE_TYPE;
+		};
+		/** LOCAL, but no `cdkd import` can rewrite it — see above. */
+		const isUnclearableLocal = (read) => isLocal(read) && importCannotClearMask(typeOf(read));
+		const targetOf = (read) => read.logicalId;
+		const localTargets = [...new Set(reads.filter((read) => isLocal(read) && !isUnclearableLocal(read)).map(targetOf).filter((id) => id !== void 0))];
+		const unclearableTargets = [...new Set(reads.filter(isUnclearableLocal).map(targetOf).filter((id) => id !== void 0))];
+		const foreignReads = reads.filter((read) => !isLocal(read));
+		const hasRefStateRead = reads.some((read) => read.kind === "ref-state-key" && isLocal(read));
+		/**
+		* A logical id rendered inside the single-quoted command below.
+		*
+		* cdkd validates no logical-id charset, so the id can contain a `'` — and
+		* the line it lands in is meant to be COPY-PASTED into a shell, where an
+		* unescaped one closes the quoting early and the rest of the command
+		* reparses as something else. POSIX single-quote escaping (`'` becomes
+		* `'\\''`) is the fix: close, emit an escaped quote, reopen.
+		*
+		* cdkd never EXECUTES this string — it is advice in an error message — so
+		* this is about the pasted command being correct, not about injection into
+		* cdkd itself (issue #2847 round-5 review).
+		*/
+		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
+		const parts = [];
+		if (localTargets.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + localTargets.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
+		if (foreignReads.length > 0) {
+			const subject = reads.length === 1 ? "The read above resolves" : foreignReads.length === 1 ? "One of the reads above resolves" : "Some of the reads above resolve";
+			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
+		}
+		if (hasRefStateRead) parts.push("A 'Ref <LogicalId> (state key <Key>)' entry above is CDKD's own read, not one the template can stop making: CloudFormation defines that resource type's Ref value as that state key rather than the physical id, so the record must be repaired (re-import it, or let a deploy create or update the resource) — the \"stop reading it\" remedy does not apply to such an entry.");
+		return parts.join(" ");
+	}
+	/**
 	* Refuse to provision a resource whose resolution served a REDACTED attribute
 	* out of a previous deploy's state (issue #2274).
 	*
@@ -36417,17 +37394,30 @@ var DeployEngine = class {
 	* class. A loud failure naming the remedy is strictly better than a silent
 	* wrong write.
 	*
-	* NARROW BY CONSTRUCTION. The bag is only non-empty when a `Fn::GetAtt`
-	* actually served a masked attribute during THIS resource's resolution, so a
+	* NARROW BY CONSTRUCTION. The bag is only non-empty when a resolution
+	* actually served a masked value during THIS resource's resolution, so a
 	* resource whose properties merely happen to contain the string `***` is
 	* untouched — which is why the check is not "does `resolvedProps` hold the
 	* mask". And the diff pass does not consult the bag at all, so an untouched
 	* stack still reports NO_CHANGE and deploys.
+	*
+	* "A resolution", not "an `Fn::GetAtt`": the pushers are
+	* `noteAttributeSecrecy`, `reresolveCrossStackValue` and — since the issue
+	* #2847 review — `noteRefStateMask`, the `Ref` branch that reads a recovery
+	* key out of the same persisted bags. {@link maskedRecordRemedyFor} is the
+	* authority on the full shape list.
+	*
+	* This block sits DIRECTLY above its subject, and the previous revision's did
+	* not: `maskedRecordRemedyFor` was inserted between the two, so JavaScript's
+	* "only the LAST of two consecutive block comments attaches" rule (the same
+	* one `cloud-control-provider.ts`'s `import()` doc warns about) silently
+	* re-pointed 25 lines of doc at the wrong function and left this one with
+	* none. Keep a new helper OUT of the gap.
 	*/
 	refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const reads = context.redactedAttributeReads;
 		if (reads === void 0 || reads.length === 0) return;
-		throw new ProvisioningError(`Cannot resolve ${reads.join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. That happens when a custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Two remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
+		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)} If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
 	}
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
@@ -36438,7 +37428,7 @@ var DeployEngine = class {
 			const next = { ...op };
 			if (next.properties) next.properties = redactSecretsForState(next.properties, ownSecrets, templateProps);
 			if (next.attemptedProperties) next.attemptedProperties = redactSecretsForState(markSameGenerationBag({ ...next.attemptedProperties }), ownSecrets, templateProps);
-			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets);
+			if (next.previousState) next.previousState = scrubResourceRecord(next.previousState, ownSecrets, void 0, STATE_SOURCED_READBACK_RULES);
 			return next;
 		});
 	}
@@ -37366,6 +38356,8 @@ var DeployEngine = class {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
 			this.logger.error(this.maskForResource(logicalId, `Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`));
+			const orphanAdvice = this.orphanedNameCollisionAdvice(change.changeType, logicalId, error);
+			if (orphanAdvice) this.logger.error(this.maskForResource(logicalId, orphanAdvice));
 			this.recordEvent({
 				eventType: "RESOURCE_FAILED",
 				stackName,
@@ -37557,7 +38549,8 @@ var DeployEngine = class {
 					template,
 					resources: stateResources,
 					...parameterValues && { parameters: parameterValues },
-					...conditions && { conditions }
+					...conditions && { conditions },
+					redactedAttributeReads: []
 				}, stackName);
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -37605,7 +38598,8 @@ var DeployEngine = class {
 					template,
 					resources: stateResources,
 					...parameterValues && { parameters: parameterValues },
-					...conditions && { conditions }
+					...conditions && { conditions },
+					redactedAttributeReads: []
 				}, stackName);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
@@ -38058,6 +39052,99 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* The plain-CREATE sibling of {@link replacementNameOrigin} (issue
+	* [#2902](https://github.com/go-to-k/cdkd/issues/2902)).
+	*
+	* A CREATE that collides on a name cdkd DERIVED is very likely a resource
+	* cdkd itself left behind: `DeletionPolicy: Retain` makes a rollback drop
+	* the state record while leaving the resource in AWS (CloudFormation
+	* semantics, and deliberate), and cdkd's generated names carry no random
+	* component (`generateResourceName`) — so the next deploy asks AWS for
+	* exactly the name the orphan still holds, fails, rolls back again, and
+	* repeats forever. Before this, the user saw only the bare AWS sentence:
+	* nothing named the collision's cause and nothing named a way out, so the
+	* reported recovery was hand-deleting resources through the AWS API.
+	*
+	* CloudFormation never shows this because its generated names carry a
+	* random suffix, so a retained orphan cannot collide with a later deploy.
+	* The breakage is that combination — CFn's retain semantics with cdkd's
+	* deterministic naming — rather than either half, which is why the fix here
+	* is a diagnosis and a remedy rather than a behaviour change. Whether cdkd
+	* should instead RE-ADOPT the retained resource is issue
+	* [#2914](https://github.com/go-to-k/cdkd/issues/2914).
+	*
+	* Returns `undefined` — leaving the pre-existing wording untouched — for
+	* every case it cannot vouch for:
+	*
+	* - not a CREATE. A replacement collision DOES arrive here — the
+	*   `NAMED_REPLACEMENT_COLLISION` throws happen inside `provisionResourceBody`,
+	*   which the caller invokes inside the same `try`, and this method's own
+	*   suite asserts their line was logged. What refuses them is the
+	*   `ProvisioningError` check below (they throw `CdkdError`), so deleting
+	*   EITHER guard alone leaves the suite green. That does not make this one
+	*   dead: a non-CREATE `ProvisioningError` whose message carries
+	*   `already exists` — an UPDATE-path sub-resource conflict — would reach
+	*   the advice without it, and the replacement message's remedy is to
+	*   RENAME, which does not recover an orphan. (An earlier revision of this
+	*   comment claimed the throws "never reach this catch at all". Three
+	*   reviewers disproved it independently.);
+	* - not a name collision;
+	* - no physical id on the error (a create that failed BEFORE the AWS call
+	*   never names one). At RUNTIME this is subsumed by the next guard --
+	*   `looksLikeCdkdGeneratedName` refuses a falsy id on its own first line,
+	*   measured: deleting this check ALONE leaves the suite green, deleting
+	*   both together reds it. It stays for the TYPE narrowing the message
+	*   interpolation needs, and so the refusal is readable here rather than
+	*   inferred from another module;
+	* - a name cdkd did not derive — a user-supplied name may collide with a
+	*   resource of someone else's entirely, and telling that user to
+	*   `cdkd import` it would be advice to adopt what this stack does not own;
+	* - a NESTED-STACK child. Its stack name is `<parent>~<logicalId>`, and CDK's
+	*   own stack-name rule bars `~`, so no Cloud Assembly stack can ever carry
+	*   it — `cdkd import` resolves its target from the assembly and walks
+	*   top-level stacks only, so the command would be unrunnable. That is the
+	*   same #2610 class this method's `canImport` check exists for, one level
+	*   down, so the child takes the delete-only arm.
+	*
+	* **A cdkd-DERIVED name is not proof the resource is THIS stack's**, which
+	* the first revision of this advice assumed. Two ways it is not, both
+	* reachable: a globally-namespaced type (`AWS::S3::Bucket` is the documented
+	* exception — see `.claude/rules/provider-resource-identity.md`) can collide
+	* with ANOTHER ACCOUNT's resource, and because the derivation is predictable
+	* that name can be pre-registered by someone else; and the same stack name
+	* deployed in two REGIONS derives the same name for a global type, so the
+	* collision is with a live resource another state file already owns —
+	* importing it would give two stacks one resource, and either `cdkd destroy`
+	* would then delete it out from under the other. So the message names the
+	* orphan as the LIKELY case rather than the certain one, and asks the reader
+	* to confirm ownership before adopting.
+	*/
+	orphanedNameCollisionAdvice(changeType, logicalId, error) {
+		if (changeType !== "CREATE") return void 0;
+		if (!(error instanceof ProvisioningError)) return void 0;
+		const physicalId = error.physicalId;
+		if (!physicalId) return void 0;
+		if (!isNameCollisionError(error.message)) return void 0;
+		const stackName = getCurrentStackName();
+		if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
+		if (!stackName) return void 0;
+		const safeId = displaySafe(physicalId, { asciiOnly: true });
+		const safeStack = displaySafe(stackName, { asciiOnly: true });
+		const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+		const diagnosis = `${safeLogicalId}: the name AWS reports as taken (${safeId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+		const deleteArm = `If it is not a resource you want to keep, delete ${safeId} in AWS — after confirming it holds nothing you need, since Retain is what kept it — and re-deploy.`;
+		let canImport;
+		try {
+			canImport = typeof this.providerRegistry.getProvider(error.resourceType).import === "function";
+		} catch {
+			canImport = false;
+		}
+		const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+		const importableTarget = !stackName.includes("~");
+		if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+		return `${diagnosis} To recover, adopt it back into state instead of re-creating it: cdkd import ${shellQuote(safeStack)} --resource ${shellQuote(`${safeLogicalId}=${safeId}`)} (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}`;
+	}
+	/**
 	* Read `DeletionPolicy` / `UpdateReplacePolicy` from the synth template
 	* so they can be persisted in `ResourceState` (schema v5+). Always returns
 	* both keys (`undefined` when the template does not carry the attribute)
@@ -38349,6 +39436,83 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
+		/**
+		* Fail an output whose resolution served a value out of a MASKED state
+		* record, instead of publishing what the fall-through produced (issue
+		* [#2847](https://github.com/go-to-k/cdkd/issues/2847), independent
+		* round-2 review — the BLOCKER).
+		*
+		* `refuseRedactedAttributeReads` is called at exactly TWO sites, both
+		* per-resource CREATE / UPDATE. `resolveOutputs` builds its own context
+		* and consulted nothing, so the note this pass records was written and
+		* never read — and once `refStateLookupFromResource` learned to refuse a
+		* masked leaf, "never read" stopped being harmless. A `{"Ref": <record
+		* whose TableName / SelectionId / RepositoryId / AppSync ARN is masked>}`
+		* in `Outputs` publishes the RAW PHYSICAL ID: for a Cloud-Control-routed
+		* `AWS::S3Tables::Table`, a UUID-tailed ARN where the table NAME belongs.
+		*
+		* THE ASYMMETRY IS WHY THIS IS A REFUSAL RATHER THAN A WARNING. Before the
+		* refusal existed this published `'***'`, which the CONSUMER stack rejects
+		* — `reresolveCrossStackValue` tests `carriesSecretMask` and refuses. An
+		* ARN passes that test, so the consumer resolves its `Fn::ImportValue` to
+		* a wrong value and sends it to AWS, with both deploys green. Publishing
+		* nothing is the only outcome that keeps the consumer's guard meaningful.
+		*
+		* PER-OUTPUT BY ITS OWN BAG, and a length DELTA over the shared one is
+		* what this replaced (issue #2847 round-3 review, and the reason it is a
+		* bag rather than a `slice`). All three pushers are IDEMPOTENT — each
+		* guards with `if (!reads.includes(read))` — and `resolveOutputs` shares
+		* ONE context across every output, unlike the CREATE / UPDATE arms which
+		* build a fresh context per resource. So a second output reading the SAME
+		* masked record produced an EMPTY delta and was PUBLISHED:
+		*
+		*     Outputs:
+		*       TableRef:  { Value: { Ref: Tbl } }   # refused
+		*       TableRef2: { Value: { Ref: Tbl } }   # published the raw ARN
+		*
+		* `resolveRef` memoizes nothing, so the second resolution really does
+		* re-enter `noteRefStateMask` and really is refused a push. Giving each
+		* output its own array and MERGING the entries back afterwards keeps both
+		* properties: the guard sees exactly this output's reads, and the shared
+		* bag still accumulates for anything reading it later.
+		*
+		* SCOPED TO THE `ref-state-key` KIND, and that is a narrowing rather than
+		* an oversight. The refusal exists because of the FALL-THROUGH: when the
+		* lookup skips a masked leaf, `cfnRefValueFromPhysicalId` emits the raw
+		* physical id, which no downstream reader recognises. Every OTHER pusher —
+		* `noteAttributeSecrecy`'s `Fn::GetAtt`, `reresolveCrossStackValue`'s
+		* `Fn::ImportValue` / `Fn::GetStackOutput` / nested-stack forms — serves
+		* the MASK itself as the value, which `reresolveCrossStackValue` and the
+		* export blocker DO recognise. Firing there would silently change the
+		* pre-existing issue #2274 behaviour (an output that published `'***'`
+		* would vanish) for no safety gain, and would render this message's
+		* "would publish the resource's raw physical id" over a read for which
+		* there is no physical-id fall-through — the wrong-advice class this PR
+		* has spent three rounds removing.
+		*
+		* **SELECTED BY THE `kind` FIELD, NEVER BY A PATTERN OVER `display`**
+		* (round-4 review, BLOCKER). The previous revision filtered with the same
+		* regex `maskedRecordRemedyFor` used, whose id class was `[A-Za-z0-9]+` —
+		* so for `{"Ref": "My-Table"}` (an `overrideLogicalId`, or a migrated
+		* template; cdkd validates no logical-id charset and never hands the
+		* template to CloudFormation) the filter matched NOTHING, this function
+		* returned, and the output published the raw physical id. That is an
+		* earlier round's blocker reopened through a CHARSET. Falling out of the
+		* pattern is the SAFE direction at the remedy — a vaguer message — and the
+		* INVERTED one here, where it is the refusal itself; one rendering cannot
+		* serve two consumers whose safe directions are opposite, so the structure
+		* moved into the entry and both consumers now ask a field.
+		*
+		* It routes through {@link handleOutputResolutionFailure} rather than
+		* throwing its own way out, so it inherits that method's whole contract:
+		* warn-and-skip by default, promoted to a deploy error under
+		* `--strict-getatt`, and masked against both secret bags on the way.
+		*/
+		const refuseMaskedOutputReads = (outputKey, ownReads) => {
+			const added = ownReads.filter((read) => read.kind === "ref-state-key");
+			if (added.length === 0) return;
+			throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish the resource's raw physical id instead of the value CloudFormation's Ref returns — a wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
+		};
 		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
@@ -38359,8 +39523,14 @@ var DeployEngine = class {
 					this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 					continue;
 				}
+				const ownReads = [];
 				try {
-					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
+					const resolved = await this.resolver.resolve(output.Value, {
+						...context,
+						redactedAttributeReads: ownReads
+					});
+					refuseMaskedOutputReads(outputKey, ownReads);
+					outputs[outputKey] = resolved;
 				} catch (error) {
 					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				}
@@ -38371,13 +39541,16 @@ var DeployEngine = class {
 				const value = outputs[outputKey];
 				if (value === void 0) continue;
 				const nameSecrets = /* @__PURE__ */ new Map();
+				const nameReads = [];
 				let exportName;
 				try {
 					try {
 						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
 							...context,
-							recordedSecretValues: nameSecrets
+							recordedSecretValues: nameSecrets,
+							redactedAttributeReads: nameReads
 						});
+						refuseMaskedOutputReads(outputKey, nameReads);
 					} finally {
 						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
@@ -38422,5 +39595,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { ProviderRegistry as $, partitionSensitiveEnv as $n, ResourceTimeoutError as $r, STATE_SOURCED_CROSS_GENERATION_RULES as $t, renderStatefulReason as A, buildAssetRedirectMap as An, derivePartitionAndUrlSuffix as Ar, configStringRefusal as At, red as B, parseBootstrapMarker as Bn, CdkdError as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, exportNamesCarriedFrom as Cn, findLargeInlineResources as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, AssetPublisher as Dn, expectedOwnerParam as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, shouldRetainResource as En, displaySafe as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, BOOTSTRAP_MARKER_PREFIX as Fn, AwsClients as Fr, requireConfigString as Ft, isExportAliasCollision as G, describeAwsFailure as Gn, DynamicReferenceRegionAmbiguousError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, validateAssetBucketName as Hn, CrossAccountSecretRefusalError as Hr, s3BucketRegionalDomainName as Ht, bold as I, assertAssetBucketRegion as In, getAwsClients as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, describeDockerExecFailure as Jn, LocalStartServiceError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDockerImage as Kn, IntrinsicResolutionRefusalError as Kr, INTRINSIC_KEYS as Kt, cyan as L, ensureAssetStorage as Ln, resetAwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, loadPublishableAssetManifest as Mn, processStackMessages as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, rewriteTemplateAssetReferences as Nn, clearBucketRegionCache as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, stringifyValue as On, PARTITION_TABLE as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, AssetModeResolver as Pn, resolveBucketRegion as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, getDockerCmd as Qn, ProvisioningError as Qr, TemplateParser as Qt, gray as R, getBootstrapMarkerKey as Rn, setAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, DEFAULT_STATE_PREFIX as Sn, MIGRATE_TMP_PREFIX as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, importableOutputs as Tn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, validateContainerRepoName as Un, DependencyError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, readBootstrapMarkerBody as Vn, ConfigError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, buildDenyExternalAccessPolicy as Wn, DeployCancelledError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, dockerSpawnEnvWithSensitive as Xn, NestedStackChildDirectDestroyError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerFailure as Yn, LockError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, formatDockerLoginError as Zn, PartialFailureError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, buildForceUnlockCommand as _n, resolveUseCdkBootstrapAssets as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, formatError as ai, errorCauseChain as an, AssetManifestLoader as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, shellQuote as bn, CFN_TEMPLATE_BODY_LIMIT as br, getAccountInfo as bt, replayFailedOperations as c, withErrorHandling as ci, maskSecretsInText as cn, synthesisStatusMessage as cr, startInterruptWatch as ct, updatePartialReason as d, isThrottlingError as di, redactSecretsForState as dn, resolveApp as dr, UNSPECIFIED_SKIP_REASON as dt, ResourceUpdateNotSupportedError as ei, STATE_SOURCED_READBACK_RULES as en, redactDockerArgvValues as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isTransientServerError as fi, scrubResourceRecord as fn, resolveAutoAssetStorage as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, __exportAll as gi, UNRENDERABLE as gn, resolveStateBucketWithDefaultAndSource as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, retryClassificationText as hi, rebuildClientForBucketRegion as hn, resolveStateBucketWithDefault as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, SynthesisError as ii, dynamicReferenceTokens as in, stripControlChars as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, createAssetRedirectResolver as jn, AssemblyReader as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, WorkGraph as kn, canonicalizeRegion as kr, configBooleanRefusal as kt, replayRollback as l, isMarkedNonRetryable as li, recordMaskOnlyValue as ln, getDefaultStateBucketName as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, markRedactedCause as mi, S3StateBackend as mn, resolveSkipPrefix as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, StackTerminationProtectionError as ni, carriesSecretMask as nn, runDockerStreaming as nr, maskDeep as nt, planFailedOps as o, isCdkdError as oi, isSingleDynamicReferenceToken as on, getDockerImageBySourceHash as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, markNonRetryable as pi, LockManager as pn, resolveCaptureObservedState as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeDockerCapturedOutput as qn, LocalInvokeBuildError as qr, findActionableSilentDrops as qt, DeployEngine as r, StateError as ri, createSecretMasker as rn, escapeRegExp$1 as rr, maskerOrIdentity as rt, planRollback as s, normalizeAwsError as si, maskSecretsInError as sn, Synthesizer as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, StackHasActiveImportsError as ti, TEMPLATE_SOURCED_RULES as tn, runDockerForeground as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, isRetryableTransientError as ui, recoverMaskedOutput as un, getLegacyStateBucketName as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, buildLockContentionMessage as vn, stateBucketExistenceConfirmed as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, importableOutputKeys as wn, uploadCfnTemplate as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, CUSTOM_RESOURCE_RESPONSE_PREFIX as xn, CFN_TEMPLATE_URL_LIMIT as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, forceQuitRecoveryClause as yn, warnDeprecatedNoPrefixCliFlag as yr, coerceParameterTypedValue as yt, green as z, isCrossRegionRedirect as zn, AssetError as zr, s3BucketArn as zt };
-//# sourceMappingURL=deploy-engine-BiPxTgKT.js.map
+export { ProviderRegistry as $, formatDockerLoginError as $n, PartialFailureError as $r, STATE_SOURCED_BASELINE_RULES as $t, renderStatefulReason as A, stringifyValue as An, PARTITION_TABLE as Ar, configStringRefusal as At, red as B, getBootstrapMarkerKey as Bn, setAwsClients as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, CUSTOM_RESOURCE_RESPONSE_PREFIX as Cn, CFN_TEMPLATE_URL_LIMIT as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, importableOutputs as Dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, importableOutputKeys as En, uploadCfnTemplate as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, rewriteTemplateAssetReferences as Fn, clearBucketRegionCache as Fr, requireConfigString as Ft, isExportAliasCollision as G, validateContainerRepoName as Gn, DependencyError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, parseBootstrapMarker as Hn, CdkdError as Hr, s3BucketRegionalDomainName as Ht, bold as I, AssetModeResolver as In, resolveBucketRegion as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, buildDockerImage as Jn, IntrinsicResolutionRefusalError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDenyExternalAccessPolicy as Kn, DeployCancelledError as Kr, INTRINSIC_KEYS as Kt, cyan as L, BOOTSTRAP_MARKER_PREFIX as Ln, AwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, buildAssetRedirectMap as Mn, derivePartitionAndUrlSuffix as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, createAssetRedirectResolver as Nn, AssemblyReader as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, shouldRetainResource as On, displaySafe as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, loadPublishableAssetManifest as Pn, processStackMessages as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, dockerSpawnEnvWithSensitive as Qn, NestedStackChildDirectDestroyError as Qr, TemplateParser as Qt, gray as R, assertAssetBucketRegion as Rn, getAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, shellQuote as Sn, CFN_TEMPLATE_BODY_LIMIT as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, exportNamesCarriedFrom as Tn, findLargeInlineResources as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, readBootstrapMarkerBody as Un, ConfigError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, isCrossRegionRedirect as Vn, AssetError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, validateAssetBucketName as Wn, CrossAccountSecretRefusalError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, describeDockerExecFailure as Xn, LocalStartServiceError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerCapturedOutput as Yn, LocalInvokeBuildError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, describeDockerFailure as Zn, LockError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, retryClassificationText as _i, rebuildClientForBucketRegion as _n, resolveStateBucketWithDefault as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, StateError as ai, dynamicReferenceTokens as an, escapeRegExp$1 as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, buildLockContentionMessage as bn, stateBucketExistenceConfirmed as br, getAccountInfo as bt, replayFailedOperations as c, isCdkdError as ci, isSingleDynamicReferenceToken as cn, getDockerImageBySourceHash as cr, startInterruptWatch as ct, updatePartialReason as d, isMarkedNonRetryable as di, recordMaskOnlyValue as dn, getDefaultStateBucketName as dr, UNSPECIFIED_SKIP_REASON as dt, ProvisioningError as ei, STATE_SOURCED_CROSS_GENERATION_RULES as en, getDockerCmd as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isRetryableTransientError as fi, recoverMaskedOutput as fn, getLegacyStateBucketName as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, markRedactedCause as gi, S3StateBackend as gn, resolveSkipPrefix as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, markNonRetryable as hi, LockManager as hn, resolveCaptureObservedState as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, StackTerminationProtectionError as ii, createSecretMasker as in, runDockerStreaming as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, WorkGraph as jn, canonicalizeRegion as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, AssetPublisher as kn, expectedOwnerParam as kr, configBooleanRefusal as kt, replayRollback as l, normalizeAwsError as li, maskSecretsInError as ln, Synthesizer as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isTransientServerError as mi, scrubResourceRecord as mn, resolveAutoAssetStorage as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as ni, TEMPLATE_SOURCED_RULES as nn, redactDockerArgvValues as nr, maskDeep as nt, planFailedOps as o, SynthesisError as oi, errorCauseChain as on, stripControlChars as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, isThrottlingError as pi, redactSecretsForState as pn, resolveApp as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeAwsFailure as qn, DynamicReferenceRegionAmbiguousError as qr, findActionableSilentDrops as qt, DeployEngine as r, StackHasActiveImportsError as ri, carriesSecretMask as rn, runDockerForeground as rr, maskerOrIdentity as rt, planRollback as s, formatError as si, identityKeyFor as sn, AssetManifestLoader as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as ti, STATE_SOURCED_READBACK_RULES as tn, partitionSensitiveEnv as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, withErrorHandling as ui, maskSecretsInText as un, synthesisStatusMessage as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, __exportAll as vi, UNRENDERABLE as vn, resolveStateBucketWithDefaultAndSource as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, DEFAULT_STATE_PREFIX as wn, MIGRATE_TMP_PREFIX as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, forceQuitRecoveryClause as xn, warnDeprecatedNoPrefixCliFlag as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, buildForceUnlockCommand as yn, resolveUseCdkBootstrapAssets as yr, coerceParameterTypedValue as yt, green as z, ensureAssetStorage as zn, resetAwsClients as zr, s3BucketArn as zt };
+//# sourceMappingURL=deploy-engine-umIP3xus.js.map