@go-to-k/cdkd 0.289.2 → 0.289.4

package/dist/{deploy-engine-ClLLdy68.js → deploy-engine-BEpYvI14.js}

@@ -1,6 +1,6 @@
-import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName } from "./logger-D2Md1kTq.js";
+import { d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, y as displaySafe } from "./logger-CecsQ1UT.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DUhfbsEF.js";
+import { t as getCdkdVersion } from "./version-C3wRsCF2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1554,7 +1554,10 @@ function isCdkdError(error) {
 function formatError(error) {
 	if (isCdkdError(error)) {
 		let message = `${error.name}: ${error.message}`;
-		if (error.cause) message += `\nCaused by: ${error.cause.message}`;
+		if (error.cause) {
+			const cause = displaySafe(error.cause.message);
+			if (cause) message += `\nCaused by: ${cause}`;
+		}
 		return message;
 	}
 	if (error instanceof Error) return `${error.name}: ${error.message}`;
@@ -3987,56 +3990,6 @@ async function expectedOwnerParam(client) {
 	return owner ? { ExpectedBucketOwner: owner } : {};
 }
 
-//#endregion
-//#region src/utils/display-safe.ts
-/**
-* Make an untrusted value safe to render in a terminal or persist into a log.
-*
-* A LEAF module with no imports, and deliberately in `src/utils/` rather than
-* beside its first caller: issue [#2170](https://github.com/go-to-k/cdkd/issues/2170)'s
-* review found the same rule being widened BY HAND one module at a time and
-* missing an instance every round — the change sanitized 1 of 5 readers of
-* `LockInfo.owner`. One shared definition, imported by everything that renders
-* such a value, is what stops the next reader from inheriting nothing.
-*
-* The stripped class is wider than C0 + DEL, which a first cut used and which
-* misses every mechanism that actually forges a line:
-*
-* - `U+0085` (NEL) and the C1 range — xterm reads `U+009B` as CSI in UTF-8;
-* - `U+2028` / `U+2029` — this text is PERSISTED and re-rendered by JSON and
-*   web log viewers, where both are line terminators;
-* - `U+202A`-`U+202E` / `U+2066`-`U+2069` — the Trojan-Source bidi overrides
-*   and isolates, which visually REORDER the command being pasted.
-*
-* Known residual, recorded rather than implied away: the invisible formatters
-* (`U+200B`-`U+200D`, `U+FEFF`) and the bidi MARKS (`U+200E` / `U+200F` /
-* `U+061C`) survive, as do bare RTL letters, which no denylist can reach. All
-* of them can only make a rendered name differ visually from its bytes — the
-* command a user pastes still acts on exactly what is shown, and the blast
-* radius stays the attacker's own stack name.
-*
-* A caller whose value has a KNOWN ASCII charset (a stack name, an AWS region)
-* should pass `asciiOnly`, which is a positive allowlist and therefore has no
-* such residual at all.
-*
-* ONE CALLER DELIBERATELY GOES WIDER, and it is recorded here so an editor of
-* the residual note above knows a second module now disagrees with it.
-* `src/deployment/outputs-export-alias.ts` deletes a class derived from
-* `\p{Cc}` / `\p{Cf}` / `\p{Zl}` / `\p{Zp}` /
-* `\p{Default_Ignorable_Code_Point}`, because on THAT path the subject is a possibly
-* secret-bearing name in an operator's log: a plaintext split by a zero-width
-* character is READ as if it were contiguous, so it is disclosed without any
-* paste, and the command-forgery reasoning above does not transfer (issue
-* [#2874](https://github.com/go-to-k/cdkd/issues/2874)). Nothing here changes
-* -- widening this helper would alter every caller that merely wants a
-* terminal-safe string.
-*/
-function displaySafe(value, opts) {
-	if (value === void 0 || value === null) return "";
-	const text = String(value);
-	return (opts?.asciiOnly ? text.replace(/[^ -~]/g, " ") : text.replace(/[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g, " ")).trim();
-}
-
 //#endregion
 //#region src/state/s3-replication-purge-gap.ts
 /**
@@ -6075,16 +6028,16 @@ var FileAssetPublisher = class {
 	* Create ZIP archive and upload to S3
 	*/
 	async uploadZip(client, dirPath, bucket, key) {
-		const archiver = await import("archiver");
+		const { ZipArchive } = await import("archiver");
 		const body = await new Promise((resolve, reject) => {
 			const chunks = [];
-			const archive = archiver.default("zip", { zlib: { level: 9 } });
+			const archive = new ZipArchive({ zlib: { level: 9 } });
 			archive.on("data", (chunk) => chunks.push(chunk));
 			archive.on("end", () => resolve(Buffer.concat(chunks)));
 			archive.on("error", reject);
 			if (statSync(dirPath).isDirectory()) archive.directory(dirPath, false);
 			else archive.file(dirPath, { name: basename(dirPath) });
-			archive.finalize();
+			archive.finalize().catch(reject);
 		});
 		await client.send(new PutObjectCommand({
 			Bucket: bucket,
@@ -9656,18 +9609,20 @@ var S3StateBackend = class {
 	async getState(stackName, region) {
 		await this.ensureClientForBucket();
 		const newKey = this.getStateKey(stackName, region);
+		const shownStackName = this.displayName(stackName);
+		const shownRegionName = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
 		try {
-			this.logger.debug(`Getting state for stack: ${stackName} (${region})`);
+			this.logger.debug(`Getting state for stack: ${shownStackName} (${shownRegionName})`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: newKey
 			}));
-			if (!response.Body) throw new StateError(`State file for stack '${stackName}' (${region}) has no body`);
-			if (!response.ETag) throw new StateError(`State file for stack '${stackName}' (${region}) has no ETag`);
+			if (!response.Body) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no body`);
+			if (!response.ETag) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no ETag`);
 			const bodyString = await response.Body.transformToString();
 			const state = this.parseStateBody(bodyString, stackName);
-			this.logger.debug(`Retrieved state: ${stackName} (${region}), ETag: ${response.ETag}`);
+			this.logger.debug(`Retrieved state: ${shownStackName} (${shownRegionName}), ETag: ${response.ETag}`);
 			return {
 				state,
 				etag: response.ETag
@@ -9675,13 +9630,15 @@ var S3StateBackend = class {
 		} catch (error) {
 			if (!isNoSuchKey(error)) {
 				if (error instanceof StateError) throw error;
-				throw new StateError(`Failed to get state for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+				const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+				throw new StateError(`Failed to get state for stack '${shownStackName}' (${shownRegionName}): ${detail}`, error instanceof Error ? error : void 0);
 			}
-			this.logger.debug(`No state at new key for stack: ${stackName} (${region})`);
+			this.logger.debug(`No state at new key for stack: ${shownStackName} (${shownRegionName})`);
 		}
 		const legacy = await this.tryGetLegacy(stackName, region);
 		if (legacy) {
-			this.logger.warn(`Loaded legacy state for stack '${stackName}' from '${this.getLegacyStateKey(stackName)}'. It will be migrated to the region-scoped layout on next save.`);
+			const shownKey = displaySafe(this.getLegacyStateKey(stackName), { asciiOnly: true }) || "<unrenderable>";
+			this.logger.warn(`Loaded legacy state for stack '${shownStackName}' from '${shownKey}'. It will be migrated to the region-scoped layout on next save.`);
 			return {
 				...legacy,
 				migrationPending: true
@@ -10309,7 +10266,7 @@ var S3StateBackend = class {
 			const bodyString = await response.Body.transformToString();
 			const state = this.parseStateBody(bodyString, stackName);
 			if (state.region && state.region !== region) {
-				this.logger.debug(`Legacy state for stack '${stackName}' has region '${state.region}', not '${region}' — skipping legacy fallback.`);
+				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' has region '${displaySafe(state.region, { asciiOnly: true }) || "<unrenderable>"}', not '${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}' — skipping legacy fallback.`);
 				return null;
 			}
 			return {
@@ -10318,7 +10275,8 @@ var S3StateBackend = class {
 			};
 		} catch (error) {
 			if (isNoSuchKey(error)) return null;
-			throw new StateError(`Failed to get legacy state for stack '${stackName}': ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`Failed to get legacy state for stack '${this.displayName(stackName)}': ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10332,10 +10290,15 @@ var S3StateBackend = class {
 		try {
 			parsed = JSON.parse(bodyString);
 		} catch (error) {
-			throw new StateError(`State file for stack '${stackName}' is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const raw = error instanceof Error ? error.message : String(error);
+			const detail = displaySafe(raw, { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`State file for stack '${this.displayName(stackName)}' is not valid JSON: ${detail}`, error instanceof Error ? error : void 0);
 		}
 		const v = parsed.version;
-		if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) throw new StateError(`Unsupported state schema version ${String(v)} for stack '${stackName}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${String(v)}.`);
+		if (v !== void 0 && !STATE_SCHEMA_VERSIONS_READABLE.includes(v)) {
+			const shown = displaySafe(String(v), { asciiOnly: true }) || "<unrenderable>";
+			throw new StateError(`Unsupported state schema version ${shown} for stack '${this.displayName(stackName)}'. This cdkd binary supports versions ${STATE_SCHEMA_VERSIONS_READABLE.join(", ")}. Upgrade cdkd to a version that supports schema ${shown}.`);
+		}
 		return parsed;
 	}
 };
@@ -10381,6 +10344,20 @@ const MIN_RENEWAL_INTERVAL_MS = 1e3;
 */
 const LOCK_OBJECT_DESCRIPTION = "a stack lock heartbeat, which records the lock owner, its acquisition timestamp, its deadline and the operation name — no secret, but one row per renewal";
 /**
+* One spelling of "this value came from an S3 key or a lock record, and is
+* about to be interpolated into a message a terminal will render". A stack
+* name and an AWS region both have a known charset, so the ASCII allowlist is
+* a no-op on every legitimate input while an S3 key admits any UTF-8.
+*
+* Call it for a stack name or a region. Not every value in this file goes
+* through it, and this comment does not say which do: three revisions of that
+* sentence carried a count or a scope claim and each was wrong.
+* `grep safeSegment` answers it exactly.
+*/
+function safeSegment(value) {
+	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+}
+/**
 * S3-based lock manager using conditional writes (If-None-Match)
 *
 * Implements distributed locking using S3's If-None-Match: "*" condition
@@ -10585,7 +10562,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}): ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack '${safeSegment(stackName)}' (${safeSegment(region)}): ${displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>"}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10628,18 +10605,19 @@ var LockManager = class {
 	async getLockRecord(stackName, region) {
 		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
+		const shownStack = safeSegment(stackName);
 		try {
-			this.logger.debug(`Getting lock info for stack: ${stackName}`);
+			this.logger.debug(`Getting lock info for stack: ${shownStack}`);
 			const response = await this.s3Client.send(new GetObjectCommand({
 				Bucket: this.config.bucket,
 				...await this.ownerParam(),
 				Key: key
 			}));
-			if (!response.Body) throw new LockError(`Lock file for stack '${stackName}' has no body`);
+			if (!response.Body) throw new LockError(`Lock file for stack '${shownStack}' has no body`);
 			const bodyString = await response.Body.transformToString();
 			const raw = JSON.parse(bodyString);
 			if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-				this.logger.debug(`Lock file for stack ${stackName} is not an object; treating as absent`);
+				this.logger.debug(`Lock file for stack ${shownStack} is not an object; treating as absent`);
 				return null;
 			}
 			const parsed = raw;
@@ -10648,18 +10626,19 @@ var LockManager = class {
 				owner: displaySafe(parsed.owner),
 				...parsed.operation !== void 0 && { operation: displaySafe(parsed.operation) }
 			};
-			this.logger.debug(`Lock info for stack: ${stackName}:`, lockInfo);
+			this.logger.debug(`Lock info for stack: ${shownStack}:`, lockInfo);
 			return {
 				info: lockInfo,
 				etag: response.ETag
 			};
 		} catch (error) {
 			if (error instanceof NoSuchKey) {
-				this.logger.debug(`No lock exists for stack: ${stackName}`);
+				this.logger.debug(`No lock exists for stack: ${shownStack}`);
 				return null;
 			}
 			if (error instanceof LockError) throw error;
-			throw new LockError(`Failed to get lock info for stack '${stackName}': ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			const detail = displaySafe(error instanceof Error ? error.message : String(error), { asciiOnly: true }) || "<unrenderable>";
+			throw new LockError(`Failed to get lock info for stack '${shownStack}': ${detail}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -11156,7 +11135,7 @@ var LockManager = class {
 			if (lockInfo) {
 				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${safeSegment(stackName)}' (${safeSegment(region)}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -11166,8 +11145,8 @@ var LockManager = class {
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
 		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
 		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
-		const safeStack = displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
-		const safeRegion = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+		const safeStack = safeSegment(stackName);
+		const safeRegion = safeSegment(region);
 		throw new LockError(`Failed to acquire lock for stack '${safeStack}' (${safeRegion}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
@@ -11272,6 +11251,15 @@ function resolvedPlaintextOf(secrets, expression) {
 	return typeof recorded === "string" ? recorded : void 0;
 }
 /**
+* Every expression the pass that owns `secrets` resolved — the pair table's
+* keys, a CONFLICTING one included (it is still an expression this pass saw,
+* and a second sighting is what a uniqueness rule must count). The map's own
+* values name only the SURVIVOR per plaintext; this names the losers too.
+*/
+function resolvedExpressionsOf(secrets) {
+	return [...resolvedPairsOf.get(secrets)?.keys() ?? []];
+}
+/**
 * The bag OBJECTS a deploy pass produced ITSELF and installed on a success
 * path — the fact the resolved-pair evidence above cannot state (issue
 * [#2516](https://github.com/go-to-k/cdkd/issues/2516)).
@@ -11289,8 +11277,9 @@ function resolvedPlaintextOf(secrets, expression) {
 * is carried on the object: {@link markSameGenerationBag} at the moment the
 * successful result is installed, consulted by {@link redactSecretsForState}
 * for the object it is handed. A copy of the bag, a derived needle map, a
-* previous generation's record, a scrub / import / drift walk and a bag the
-* engine did not mark all answer `false` and keep the fall-through.
+* previous generation's record, a scrub / drift walk and a bag nobody marked
+* all answer `false` and keep the fall-through. `cdkd import` marks the one
+* bag its own resolver produced (the sixth site below, issue #2745).
 *
 * A `WeakSet` for the reason {@link resolvedPairsOf} is a `WeakMap`: the mark
 * dies with the object it is on, and nothing has to clear it.
@@ -11313,9 +11302,11 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 * be written as the token this pass recorded. What never qualifies is a bag of
 * MIXED provenance: a provider's `effectiveProperties` replacement may carry
 * previous-state values IN, so an object-level mark on it would prove nothing
-* for those leaves — it stays unmarked and keeps the residual. Nor does the
-* object the resolver produced, marked at resolution time: it is not
-* necessarily the object state ends up holding.
+* for those leaves — it stays unmarked and keeps the residual. Nor does an
+* object marked INSIDE the resolver, at resolution time: whether that object,
+* a narrowed copy of it or a provider's replacement is what gets redacted and
+* stored is the CALLER's decision, so the mark is taken by the caller at the
+* redaction call — the engine's five sites, and `cdkd import`'s one.
 *
 * The CONDITIONS are per SITE, not global, and stating them globally is what
 * this paragraph kept getting wrong (PR 2753, rounds 3 and 4). "After the
@@ -11323,9 +11314,9 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 * and may skip it entirely. "Every leaf this pass produced" is false for the
 * auto-refresh readback of an UNCHANGED resource, where nothing was resolved
 * at all — there the safety comes from the empty secrets map, not from the
-* mark. Read the per-site list below rather than a rule over all five.
+* mark. Read the per-site list below rather than a rule over all six.
 *
-* The five call sites, and which of them the record HOLDS, because the earlier
+* The six call sites, and which of them the record HOLDS, because the earlier
 * "two never-installed copies" reading of this paragraph was false once the
 * third copy arrived:
 * - `propertiesToRecord` — the record's `properties`, installed. The resolved
@@ -11359,11 +11350,28 @@ const sameGenerationBags = /* @__PURE__ */ new WeakSet();
 * - the rollback journal's FAILED-op `attemptedProperties` — a marked copy, so
 *   that persisted artifact does not carry the plaintext on exactly the
 *   failure path. NOT installed on the record.
+* - `cdkd import`'s `resolveImportedProperties` (issue #2745) — the bag
+*   import's OWN resolver produced from the imported template, marked as the
+*   redaction input; the record holds the redacted COPY, unmarked. Not a
+*   deploy pass, and the mark does not say it is: what it claims is PAIR
+*   PROVENANCE — this bag was produced from this source, in this pass, by the
+*   resolver that recorded these pairs — which import's resolve satisfies
+*   exactly as the create arm's does, since `unresolvedProperties` is the
+*   template bag it resolved and its per-resource map holds the pairs. What
+*   it does NOT claim is that AWS holds the value: `observedProperties` is
+*   captured separately, against the redacted record, and is never marked
+*   here.
 */
 function markSameGenerationBag(bag) {
 	sameGenerationBags.add(bag);
 	return bag;
 }
+/**
+* Exported for `cdkd import`'s unit test, which asserts that the STORED record
+* is not the marked object (maintainer review of PR 3052). Read-only over the
+* `WeakSet`: no behavior in this module changes with the export, and the only
+* writer, {@link markSameGenerationBag}, was exported already.
+*/
 function isSameGenerationBag(bag) {
 	return sameGenerationBags.has(bag);
 }
@@ -12683,6 +12691,55 @@ function joinSkeletonSegments(segments) {
 * choice, not the only option.
 */
 function intrinsicSkeletonPattern(source) {
+	const segments = intrinsicSkeletonSegments(source);
+	if (segments === void 0) return void 0;
+	return anchoredSkeletonPattern(segments);
+}
+/**
+* {@link joinSkeletonSegments} anchored at both ends, or `undefined` where the
+* wildcard cap refused it. The one place the skeleton's regex is built, for
+* both readers of the segment form — and the one place a literal segment is
+* ESCAPED: it takes the segment form itself (literal text, or
+* {@link UNKNOWN_PART}), never pre-built regex text, so a third caller cannot
+* hand it raw template text and get a pattern with live metacharacters and no
+* type error (maintainer review of PR 3052).
+*/
+function anchoredSkeletonPattern(segments) {
+	const body = joinSkeletonSegments(segments.map((segment) => segment === UNKNOWN_PART ? SKELETON_WILDCARD : escapeRegExp(segment)));
+	return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+}
+/**
+* A source part the skeleton cannot know — an `Fn::Join` element that is
+* itself an intrinsic, or an `Fn::Sub` `${...}` variable. The segment form of
+* {@link SKELETON_WILDCARD}: what a part IS, before {@link anchoredSkeletonPattern}
+* — the one speller — turns it into the wildcard.
+*/
+const UNKNOWN_PART = Symbol("unknown intrinsic part");
+/**
+* Stands in, while a source is RENDERED to text, for a part the skeleton cannot
+* know. A single character so the rendered string keeps the literal parts at
+* their true offsets, and NOT `}` so {@link dynamicReferenceSpans} reads it as
+* a token's INNER text (the resolver's `[^}]+`) rather than as its terminator —
+* which is exactly how a `{Ref}` sitting inside a `{{resolve:...}}` opening
+* must read. A NUL, RESERVED here as the placeholder: a template string can
+* carry one (CDK preserves it), so a source whose literal text does is refused
+* outright rather than rendered with one unknowable part too many.
+*/
+const UNKNOWN_PART_PLACEHOLDER = "\0";
+/**
+* The text of an `Fn::Join` / `Fn::Sub` source in order: a literal part as its
+* RAW text, an unknowable part as {@link UNKNOWN_PART}. ONE parser for the two
+* readers of that shape — {@link intrinsicSkeletonPattern}, which hands every
+* segment to {@link anchoredSkeletonPattern} to spell as a regex, and
+* {@link positionByIntrinsicFrame}, which needs the
+* literal text VERBATIM to know where a token's frame begins and ends — so
+* the two cannot disagree about what a source says (issue #2745).
+*
+* `undefined` for any source this cannot describe, per the pattern reader's
+* doc: a delimiter that is itself an intrinsic, a non-array `Fn::Join`, a
+* non-string `Fn::Sub` template, an object that is not a single-key intrinsic.
+*/
+function intrinsicSkeletonSegments(source) {
 	const keys = Object.keys(source);
 	if (keys.length !== 1) return void 0;
 	const key = keys[0];
@@ -12691,14 +12748,12 @@ function intrinsicSkeletonPattern(source) {
 		if (!Array.isArray(args) || args.length !== 2) return void 0;
 		const [delimiter, parts] = args;
 		if (typeof delimiter !== "string" || !Array.isArray(parts)) return void 0;
-		const separator = escapeRegExp(delimiter);
 		const segments = [];
 		parts.forEach((part, index) => {
-			if (index > 0) segments.push(separator);
-			segments.push(typeof part === "string" ? escapeRegExp(part) : SKELETON_WILDCARD);
+			if (index > 0) segments.push(delimiter);
+			segments.push(typeof part === "string" ? part : UNKNOWN_PART);
 		});
-		const body = joinSkeletonSegments(segments);
-		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+		return segments;
 	}
 	if (key === "Fn::Sub") {
 		const args = source[key];
@@ -12709,14 +12764,13 @@ function intrinsicSkeletonPattern(source) {
 		const variable = /\$\{([^}]*)\}/g;
 		let hit;
 		while ((hit = variable.exec(template)) !== null) {
-			segments.push(escapeRegExp(template.slice(cursor, hit.index)));
+			segments.push(template.slice(cursor, hit.index));
 			const inner = hit[1];
-			segments.push(inner.startsWith("!") ? escapeRegExp(`\${${inner.slice(1)}}`) : SKELETON_WILDCARD);
+			segments.push(inner.startsWith("!") ? `\${${inner.slice(1)}}` : UNKNOWN_PART);
 			cursor = hit.index + hit[0].length;
 		}
-		segments.push(escapeRegExp(template.slice(cursor)));
-		const body = joinSkeletonSegments(segments);
-		return body === void 0 ? void 0 : new RegExp(`^${body}$`);
+		segments.push(template.slice(cursor));
+		return segments;
 	}
 }
 /** Poison for an expression this pass recorded against two different plaintexts. */
@@ -12754,10 +12808,11 @@ const CONFLICTING_PLAINTEXT = Symbol("conflicting plaintext");
 * iterating it never yields one plaintext twice and a second sighting of an
 * expression is always a DIFFERENT plaintext.
 *
-* SHARED by {@link positionByIntrinsicSkeleton} and
-* {@link positionByCrossStackSource} (issue #2059) rather than copied into the
-* second: the poisoning rule is the subtle half of condition 3, and two copies
-* are two places for it to be relaxed independently.
+* SHARED by {@link positionByIntrinsicSkeleton},
+* {@link positionByCrossStackSource} (issue #2059) and
+* {@link positionByIntrinsicFrame} (issue #2745) rather than copied: the
+* poisoning rule is the subtle half of condition 3, and every copy is another
+* place for it to be relaxed independently.
 */
 function plaintextIndexOf(secrets) {
 	const plaintextOf = /* @__PURE__ */ new Map();
@@ -12903,8 +12958,9 @@ function associationForSource(source, secrets) {
 * leaf identity; the arm fires only for the spellings
 * {@link crossStackSourceKey} can key; and
 * condition 1 still demands that the bag leaf be a plaintext this pass
-* resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton} and
-* then to the value scan, i.e. to today's behavior.
+* resolved. Every rejection degrades to {@link positionByIntrinsicSkeleton},
+* {@link positionByIntrinsicFrame} and then to the value scan, i.e. to today's
+* behavior.
 */
 function positionByCrossStackSource(bag, source, secrets) {
 	const association = associationForSource(source, secrets);
@@ -12930,7 +12986,8 @@ function positionByCrossStackSource(bag, source, secrets) {
 * 1. The bag leaf's WHOLE value is a recorded secret plaintext. The skeleton
 *    describes ONE complete `{{resolve:...}}` token, so a leaf that merely
 *    EMBEDS a secret (a join with surrounding text) is not this shape at all
-*    and must keep going to the value scan, which rewrites just the substring.
+*    and goes on to {@link positionByIntrinsicFrame} (issue #2745), and only
+*    where that refuses to the value scan, which rewrites just the substring.
 * 2. EXACTLY ONE candidate matches. Two matching candidates mean the skeleton
 *    genuinely cannot separate them (`{Ref}` in the position that differs), and
 *    guessing would be the collapse this fix exists to remove, one step over.
@@ -12942,8 +12999,9 @@ function positionByCrossStackSource(bag, source, secrets) {
 *    candidate absent from that map is a collapsed LOSER, which is the case
 *    this whole function exists to serve, so it is accepted.
 *
-* Every rejection degrades to the value scan, i.e. to today's behavior, so no
-* case gets worse than it is without this pass.
+* Every rejection falls to {@link positionByIntrinsicFrame} (issue #2745) and,
+* where that arm refuses too, to the value scan, i.e. to today's behavior, so
+* no case gets worse than it is without this pass.
 *
 * One residual is worth naming rather than leaving to be rediscovered: a single
 * WRONG candidate can win only when this leaf's own expression is in NEITHER
@@ -12990,13 +13048,14 @@ function positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions) {
 	return matched;
 }
 /**
-* The ONE-span frame shared by {@link positionByEmbeddedSpan} and
+* The ONE-span frame shared by {@link positionByEmbeddedSpan},
+* {@link positionByIntrinsicFrame} (over the source's rendered text) and
 * {@link learnMixedLeafNeedle}: a source holding exactly one `{{resolve:...}}`
 * token, and a bag that starts with the source's prefix and ends with its
 * suffix with something non-empty between them that is NOT itself a complete
 * token (an already-redacted record is a persisted answer, not a plaintext).
-* `undefined` for any other shape. One helper rather than two copies so the
-* two refusals cannot drift apart.
+* `undefined` for any other shape. One helper rather than three copies so the
+* three refusals cannot drift apart.
 */
 function singleSpanFrame(bag, source) {
 	const spans = dynamicReferenceSpans(source);
@@ -13105,32 +13164,28 @@ function singleSpanFrame(bag, source) {
 * for a 4+ character coincidence in a readback. Every refusal of this arm
 * returns the scan's answer, so a leaf refused for interference (a frame
 * that is itself a recorded plaintext, say) has its frame rewritten and its
-* sub-floor middle left in plaintext. And this arm positions a LITERAL
-* source leaf only: an `Fn::Join` / `Fn::Sub` source rendering the same
-* `port:` + token goes to {@link positionByIntrinsicSkeleton}, which refuses
-* unless the WHOLE bag is a recorded plaintext, so a sub-floor secret
-* embedded through an intrinsic — the dominant CDK shape — still falls to
-* the value scan and persists in plaintext. `cdkd scrub`, the documented
-* repair tool for a pre-GHSA record, cannot repair a sub-floor embedded leaf
-* either: it walks a STORED bag, which no deploy marked, so the arm is
-* unreachable from it by construction and the leaf keeps the scan's answer.
-* The MASKING channel keeps the residual whole: `maskSecretsInText`'s
-* substring arm carries the same four-character floor, so once this arm has
-* put `port:{{resolve:...}}` in state, a warn line quoting an AWS message can
-* still print `port:q7`. Pre-existing and not a regression -- the #2453 class,
-* and the reason the list would otherwise read as complete when it is not
-* (maintainer review of PR 2753, round 2).
-*
-* The next DEPLOY of that resource repairs the leaves this arm is eligible
-* for — a LITERAL source leaf on a bag the engine marks — because the
-* re-check compares unequal against a record holding the plaintext and the
-* resource is written again from a bag this pass produced. The residuals
-* named above (an `effectiveProperties` substitution, an intrinsic source
-* shape) are not repaired by that deploy either; they stay tracked by
-* #2745. Tracked, with the sub-floor
-* residuals of a nested-stack child's inherited parameter and of `cdkd
-* import`'s own resolution, by issue
-* [#2745](https://github.com/go-to-k/cdkd/issues/2745).
+* sub-floor middle left in plaintext. This arm positions a LITERAL source
+* leaf; an `Fn::Join` / `Fn::Sub` source rendering the same `port:` + token
+* — the dominant CDK shape — is {@link positionByIntrinsicFrame}'s (issue
+* #2745), which shares this arm's bound and mark and refuses a frame that is
+* not wholly literal (a region `Ref` OUTSIDE the token), where a sub-floor
+* secret still falls to the value scan and persists in plaintext. `cdkd
+* scrub`, the documented repair tool for a pre-GHSA record, cannot repair a
+* sub-floor embedded leaf: it walks a STORED bag, which no deploy marked, so
+* both arms are unreachable from it by construction and the leaf keeps the
+* scan's answer. The MASKING channel keeps the residual whole:
+* `maskSecretsInText`'s substring arm carries the same four-character floor,
+* so once this arm has put `port:{{resolve:...}}` in state, a warn line
+* quoting an AWS message can still print `port:q7`. Pre-existing and not a
+* regression -- the #2453 class, and the reason the list would otherwise
+* read as complete when it is not (maintainer review of PR 2753, round 2).
+*
+* The next DEPLOY of that resource repairs the leaves the two arms are
+* eligible for — a literal-frame source leaf on a bag the engine marks —
+* because the re-check compares unequal against a record holding the
+* plaintext and the resource is written again from a bag this pass produced.
+* The residuals named above (an `effectiveProperties` substitution, a
+* nonliteral frame) are not repaired by that deploy either.
 *
 * One shape reaches this arm that a reader may not expect: a WHOLE-token
 * source that FAILED the whole-token arm's `isKnownSecretExpression` gate (an
@@ -13140,31 +13195,58 @@ function singleSpanFrame(bag, source) {
 * where the scan wrote the survivor. Stated so it is not mistaken for a leak.
 *
 * Everything else keeps the pre-#2485 fall-through: two or more spans (which
-* span produced which value is genuinely ambiguous when they share one), an
-* `Fn::Sub` / `Fn::Join` source (an object, not this arm at all — issue #2320's
-* placeholder primitive), a frame mismatch, a middle that is itself a complete
-* token (an already-redacted record, per the same refusal
-* {@link learnMixedLeafNeedle} makes), and a middle this pass cannot vouch for.
+* span produced which value is genuinely ambiguous when they share one), a
+* frame mismatch, a middle that is itself a complete token (an
+* already-redacted record, per the same refusal {@link learnMixedLeafNeedle}
+* makes), and a middle this pass cannot vouch for. An `Fn::Sub` / `Fn::Join`
+* source (an object, not this arm at all — issue #2320's placeholder
+* primitive) is {@link positionByIntrinsicFrame}'s since #2745, and reaches
+* the value scan only where that arm refuses.
 *
 * The frame is copied from the SOURCE, not scanned. A needle occurring in the
 * literal frame would be a reference the template never had at that offset —
 * the fabricated-baseline direction {@link preferPositionDecisions} refuses —
 * and the whole-token arm returns its source unscanned for the same reason.
 *
-* RETURNS THE VALUE SCAN'S ANSWER ON EVERY REFUSAL, not `undefined`: the scan
-* is computed once, here, for `(bag, secrets)` — the arm's bound below compares
-* against it, and every fall-through IS it — so the compared value provably
+* RETURNS THE VALUE SCAN'S ANSWER ON EVERY REFUSAL, not `undefined`: the two
+* early returns below compute it for `(bag, secrets)`, and the bound in
+* {@link writeFramedTokenWithinScanBound} computes its own from the same two
+* arguments — every fall-through IS that scan — so the compared value provably
 * comes from the same bag and map the arm positions. An earlier revision took
 * the scan as a parameter, which left the bound one wrong caller away from
-* comparing against a scan of some other bag with no type error.
+* comparing against a scan of some other bag with no type error; the shared
+* helper keeps that property by taking `(bag, secrets)` rather than a scan.
 */
 function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
-	const scanned = redactSecretsForState(bag, secrets);
 	const frame = singleSpanFrame(bag, source);
-	if (frame === void 0) return scanned;
+	if (frame === void 0) return redactSecretsForState(bag, secrets);
+	const recorded = resolvedPlaintextOf(secrets, frame.token);
+	if (recorded === void 0 || recorded !== frame.middle) return redactSecretsForState(bag, secrets);
+	return writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration);
+}
+/**
+* Write `prefix + token + suffix` for a framed leaf whose pass-local pair the
+* CALLER has already verified (`token` resolved to `middle` in the pass that
+* owns `secrets`), and ONLY where that stays within the value scan's own class
+* of answer — or, below the scan's floor, on a bag the engine marked. Returns
+* the scan's answer on every refusal.
+*
+* ONE helper for {@link positionByEmbeddedSpan} (a literal source, issue
+* #2485) and {@link positionByIntrinsicFrame} (an `Fn::Join` / `Fn::Sub`
+* source, issue #2745), for the reason {@link singleSpanFrame} is one: the
+* bound and the mark are the two claims this module makes about a FRAMED
+* leaf, and two copies are two places for one of them to be relaxed alone.
+*
+* THE SCAN IS COMPUTED HERE, for `(bag, secrets)` — the bound below compares
+* against it, and every fall-through IS it — so the compared value provably
+* comes from the same bag and map the token is written into. An earlier
+* revision of the literal arm took the scan as a parameter, which left the
+* bound one wrong caller away from comparing against a scan of some other
+* bag with no type error.
+*/
+function writeFramedTokenWithinScanBound(bag, secrets, frame, bagIsSameGeneration) {
+	const scanned = redactSecretsForState(bag, secrets);
 	const { token, prefix, suffix, middle } = frame;
-	const recorded = resolvedPlaintextOf(secrets, token);
-	if (recorded === void 0 || recorded !== middle) return scanned;
 	const survivor = secrets.get(middle);
 	if (survivor === void 0) return scanned;
 	if (scanned === prefix + survivor + suffix) return prefix + token + suffix;
@@ -13172,6 +13254,152 @@ function positionByEmbeddedSpan(bag, source, secrets, bagIsSameGeneration) {
 	return scanned;
 }
 /**
+* Position a bag leaf whose `Fn::Join` / `Fn::Sub` source EMBEDS exactly one
+* `{{resolve:...}}` token inside LITERAL surrounding text — `port:` + token —
+* by writing that token into the frame the source states (issue
+* [#2745](https://github.com/go-to-k/cdkd/issues/2745)).
+*
+* This is the intrinsic twin of {@link positionByEmbeddedSpan}, and the shape
+* is the DOMINANT one rather than a corner: `'port:' + secret.secretValueFromJson('pin')`
+* renders the secret ARN as a `Ref`, so CDK emits
+* `{"Fn::Join": ["", ["port:{{resolve:secretsmanager:", {"Ref": ...}, ":SecretString:pin::}}"]]}`
+* — the prefix FUSED into the token's opening part, the `Ref` INSIDE the
+* token. Before this arm such a leaf had no positioning route at all:
+* {@link positionByIntrinsicSkeleton} refuses unless the WHOLE bag is a
+* recorded plaintext (its condition 1), and {@link positionByEmbeddedSpan}
+* needs a source STRING to copy its frame from. So it fell to the value scan,
+* which for a 4+ character middle writes the map's SURVIVOR (a same-plaintext
+* sibling's spelling, the #1904 / #2485 class) and for a 1-3 character middle
+* writes NOTHING — {@link buildNeedleRegex} drops it from the alternation —
+* and `port:q7` was persisted in plaintext.
+*
+* HOW THE FRAME IS FOUND. The source is rendered to text by
+* {@link intrinsicSkeletonSegments} — the same parser the skeleton arm reads —
+* with each unknowable part as one {@link UNKNOWN_PART_PLACEHOLDER}, and
+* {@link singleSpanFrame} then finds the ONE token in that text exactly as it
+* does for a literal source. The prefix and suffix must be wholly literal: a
+* placeholder OUTSIDE the token (a region `Ref` after it, the `DB_URL` shape
+* of the `secrets-dynamic-ref` fixture) means the source cannot establish
+* where the middle ends, and the leaf is REFUSED — the nonliteral-frame shape
+* #2745 deliberately defers. Inside the token a placeholder becomes a
+* {@link SKELETON_WILDCARD}, capped by {@link MAX_SKELETON_WILDCARDS} through
+* the same {@link joinSkeletonSegments}, so the token pattern is the skeleton
+* arm's pattern restricted to the token's own extent.
+*
+* THE EVIDENCE, three checks and each removes a different way of being wrong:
+*
+* 1. EXACTLY ONE candidate expression matches the token pattern, and is not
+*    DEMONSTRABLY another value's — the skeleton arm's conditions 2 and 3,
+*    over its two candidate stores PLUS the pass-local pair table
+*    ({@link resolvedExpressionsOf}; the code says why), and the same
+*    {@link plaintextIndexOf} poisoning rule, with `middle` in the role the
+*    whole bag plays there.
+* 2. THIS PASS resolved that candidate to the middle ({@link recordResolvedPair},
+*    per map instance) — the literal arm's evidence, and what a
+*    shape-plausible expression this pass never resolved to the middle
+*    (another resource's, typically) cannot satisfy. What it does NOT prove
+*    is that the candidate is THIS leaf's token. A leaf
+*    whose own reference resolved PUBLIC (an `ssm` `String`, which nothing
+*    records) and carries an unknowable part INSIDE its token (a `Ref` in the
+*    parameter name — a wholly literal public token matches no candidate and
+*    refuses), beside a same-service SECRET sibling whose value coincides
+*    with the middle, passes all three checks and takes the sibling's
+*    expression — a wrong REFERENCE, not a disclosure, the class the
+*    floorless whole-value scan already accepts for a whole-leaf coincidence.
+*    Against the value scan: the scan writes the map's SURVIVOR for a 4+
+*    character middle and nothing below the floor, while this arm writes the
+*    same-service candidate — the two coincide only when that candidate is
+*    the survivor, so at 4+ the arm can change WHICH wrong reference is
+*    taken, and below the floor on a marked bag it adds one where the scan
+*    wrote nothing. "Not a disclosure" is a claim about the STORED artifact
+*    only: `resolveReplayProps` (`rollback-executor.ts`) re-resolves every
+*    `{{resolve:` token in a replayed bag without regard to which reference
+*    the leaf named, so a later failed deploy plus `cdkd rollback` resolves
+*    the sibling's expression and writes its CURRENT plaintext into the live
+*    property — the transformed-value-meets-inverse-transform shape of
+*    GHSA-p5qg-v9gv-hc7w's consumer, reached here through a wrong reference
+*    rather than a wrong value (maintainer review of PR 3052). THREE live
+*    consumers re-resolve a stored expression this way, each with a weaker
+*    precondition than the last. `cdkd drift --revert`
+*    (`resolveStateSecretExpressions`, `drift.ts`) needs no failed deploy:
+*    once the sibling rotates, the re-resolved baseline diverges from AWS,
+*    drift fires, and `--revert` pushes the sibling's plaintext to the live
+*    property — and `--accept` is no way out there, since the AWS-side value
+*    of a secret-classified path is masked and `runAccept` refuses to persist
+*    the mask, leaving `--revert` (the harmful button) or a redeploy. A
+*    consumer stack's cross-stack read (`reresolveCrossStackValue`,
+*    `intrinsic-function-resolver.ts`: `Fn::ImportValue`, `Fn::GetStackOutput`,
+*    a parent's `Fn::GetAtt Nested.Outputs.X`) needs nothing at all: the
+*    outputs bag is marked, so a sub-floor write reaches `state.outputs`, and
+*    an ORDINARY deploy of the consumer after the sibling rotates hands the
+*    sibling's current plaintext to the consumer's `provider.create` /
+*    `update`. Stated rather than closed, and pinned by the unit file:
+*    nothing records a public resolution, so this arm cannot tell "absent
+*    because public" from "absent because collapsed"; the PR that closes
+*    #2745's nested-stack site weighs these consumers rather than re-deriving
+*    them.
+* 3. The write stays within the value scan's class of answer, or — below the
+*    scan's floor — the bag carries the engine's same-generation mark:
+*    {@link writeFramedTokenWithinScanBound}, shared with the literal arm.
+*
+* One shape reaches this arm that a reader may not expect, the literal arm's
+* own: a WHOLE-token source, i.e. an EMPTY frame, where the leaf IS the
+* middle. {@link positionByIntrinsicSkeleton} runs first and answers for
+* every such leaf it can; what falls through is its REFUSAL, and this arm
+* re-asks over a wider candidate set — the pair table names a token this pass
+* resolved but never pinned (an `ssm` reference whose type came back
+* unclassifiable, #1901) and which lost the map slot to a sibling, a token
+* neither of the skeleton's stores can see. With the pair and the bound that
+* leaf is written back as ITSELF, where the scan wrote the survivor: the
+* leaf's own expression, never another's. Where the skeleton refused for two
+* matches, so does this arm (same pattern, a superset of candidates, same
+* rule); where it refused for want of one — nothing matched, or its only
+* match was skipped as another plaintext's — this arm may find the leaf's
+* own token in the pair table. Either way the whole-token answer changes ONLY
+* where the skeleton had none.
+*
+* Every refusal before the bound returns `undefined` and the walk falls to the
+* value scan; the bound's own refusals return that scan directly — the same
+* answer either way, today's behavior, so no REFUSAL makes a case worse. The
+* one ACCEPTANCE that can is check 2's residual above, where a public leaf
+* gains a wrong reference in place of its plaintext. What stays: the
+* nonliteral frame above; a source with more than one token; an `Fn::Join`
+* whose delimiter is itself an intrinsic (the parser refuses it); and
+* everything the shared bound refuses, listed on the literal arm.
+*/
+function positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration) {
+	const segments = intrinsicSkeletonSegments(source);
+	if (segments === void 0) return void 0;
+	if (segments.some((s) => s !== UNKNOWN_PART && s.includes(UNKNOWN_PART_PLACEHOLDER))) return;
+	const frame = singleSpanFrame(bag, segments.map((s) => s === UNKNOWN_PART ? UNKNOWN_PART_PLACEHOLDER : s).join(""));
+	if (frame === void 0) return void 0;
+	const { token, prefix, suffix, middle } = frame;
+	if (prefix.includes(UNKNOWN_PART_PLACEHOLDER) || suffix.includes(UNKNOWN_PART_PLACEHOLDER)) return;
+	const pattern = anchoredSkeletonPattern(token.split(UNKNOWN_PART_PLACEHOLDER).flatMap((literal, i) => i === 0 ? [literal] : [UNKNOWN_PART, literal]));
+	if (pattern === void 0) return void 0;
+	const plaintextOf = plaintextIndexOf(secrets);
+	let matched;
+	for (const candidate of /* @__PURE__ */ new Set([
+		...secretExpressions,
+		...recordedSecretExpressions$1,
+		...resolvedExpressionsOf(secrets)
+	])) {
+		if (candidate.length > MAX_SKELETON_CANDIDATE_LENGTH) return void 0;
+		if (!pattern.test(candidate)) continue;
+		const recordedPlaintext = plaintextOf.get(candidate);
+		if (recordedPlaintext !== void 0 && recordedPlaintext !== middle) continue;
+		if (matched !== void 0) return void 0;
+		matched = candidate;
+	}
+	if (matched === void 0 || resolvedPlaintextOf(secrets, matched) !== middle) return;
+	return writeFramedTokenWithinScanBound(bag, secrets, {
+		token: matched,
+		prefix,
+		suffix,
+		middle
+	}, bagIsSameGeneration);
+}
+/**
 * Keys tried, in order, when pairing two arrays whose ORDER cannot be trusted
 * (issue #1915).
 *
@@ -13337,7 +13565,7 @@ function positionListByCrossStackSource(bag, source, secrets) {
 * fetch and no value matching.
 *
 * A source leaf that is an intrinsic OBJECT has no string to copy, so it goes
-* through two positioning passes before the value scan, in this order:
+* through three positioning passes before the value scan, in this order:
 *
 * - {@link positionByCrossStackSource} (issue #2059), for the two CROSS-STACK
 *   spellings `Fn::ImportValue` / `Fn::GetStackOutput`. Those carry no text
@@ -13348,6 +13576,11 @@ function positionListByCrossStackSource(bag, source, secrets) {
 *   `Fn::Sub`: when the intrinsic's literal parts describe exactly one of the
 *   recorded secret expressions, THAT is persisted. This is the dominant CDK
 *   shape — an L2 secret token renders the ARN as a `Ref`, hence a join.
+* - {@link positionByIntrinsicFrame} (issue #2745), for the same two spellings
+*   when their literal parts FRAME one token (`port:` +
+*   `secretValueFromJson(...)`): the one candidate this pass resolved to the
+*   framed middle is written into the frame, under the literal span arm's
+*   bound and mark.
 *
 * An ARRAY leaf beside such an intrinsic OBJECT — the shape a
 * `CommaDelimitedList` nested-stack parameter produces once the child has
@@ -13357,9 +13590,10 @@ function positionListByCrossStackSource(bag, source, secrets) {
 * is aligned against a source array that does not exist; see that function for
 * the two shapes it refuses.
 *
-* The value scan is still applied wherever none can answer: a leaf that merely
-* EMBEDS a secret inside surrounding text, an intrinsic whose skeleton matches
-* zero or several candidates, a cross-stack leaf whose identity is not
+* The value scan is still applied wherever none can answer: an embedding leaf
+* the span arms refuse (a nonliteral frame, a middle no pair of this pass
+* vouches for), an intrinsic whose skeleton matches several candidates (or
+* none, the pair table included), a cross-stack leaf whose identity is not
 * literally computable, a diverged shape, a key the source lacks. So the passes
 * are complementary rather than alternatives — path where position is knowable,
 * association where the position is a cross-stack read, skeleton where it is a
@@ -13378,6 +13612,8 @@ function redactByPath(bag, source, secrets, rules, secretExpressions, bagIsSameG
 		if (certified !== void 0) return certified;
 		const positioned = positionByIntrinsicSkeleton(bag, source, secrets, secretExpressions);
 		if (positioned !== void 0) return positioned;
+		const framed = positionByIntrinsicFrame(bag, source, secrets, secretExpressions, bagIsSameGeneration);
+		if (framed !== void 0) return framed;
 	}
 	if (Array.isArray(bag) && isPlainObject$2(source)) {
 		const positionedList = positionListByCrossStackSource(bag, source, secrets);
@@ -20276,11 +20512,15 @@ const drainDeadlines = new AsyncLocalStorage();
 *
 * THE TRADE, stated because it is real: iterations that actually WAIT spend
 * the shared budget, so a later one can find it exhausted and its drain get
-* no grace. That is the same exposure issue
+* no grace. That is the exposure issue
 * [#2814](https://github.com/go-to-k/cdkd/issues/2814) records for nesting,
-* now reachable across a loop as well -- and on the `Export.Name` leg the
-* cost is a DROPPED write rather than a late one, since that block's
-* `nameSecrets` is a per-iteration local. What bounds it is that only real
+* reachable across a loop as well: a part such a drain stops waiting for
+* records LATE. Late, not lost -- the engine's `Export.Name` block writes each
+* recording through to the pass map (it used to copy a per-iteration local,
+* which DROPPED a late one), and the outputs readers after the pass redact
+* against the pass map at the moment they read -- but a reader that already
+* took its copy does not see it, and the resolver warns when a drain stops
+* waiting. What bounds it is that only real
 * waiting spends the budget: reaching zero takes a full cap of drain wait
 * inside one pass, not merely a slow pass. It is taken deliberately -- an
 * unbounded hold on a deploy's state save costs a first deploy every
@@ -21116,9 +21356,12 @@ const NAMEABLE_INTRINSIC_KEYS = /* @__PURE__ */ new Set([
 * now throw on an intrinsic — `route53-provider.ts` (`HostedZoneConfig`),
 * `cloudfront-oai-provider.ts` (`CloudFrontOriginAccessIdentityConfig`),
 * `kinesis-provider.ts` (`StreamModeDetails`), `ecs-provider.ts`
-* (`DeploymentController`), `secretsmanager-secret-provider.ts`
-* (`GenerateSecretString`, via `generateSecretString`) and `codebuild-provider.ts`
-* (reached from `update()` through `mapProperties`). Not a count, for the same
+* (`DeploymentController`) and `codebuild-provider.ts` (reached from `update()`
+* through `mapProperties`). `secretsmanager-secret-provider.ts` was on this
+* list until issue #3048 moved its update path to a SKIP (the container is
+* refused by `requireConfigObject` before `generateSecretString` reads it;
+* `create()` still throws, and so does the MEMBER-level `ExcludeCharacters`
+* read inside a well-formed container -- issue #3056). Not a count, for the same
 * reason as the near-copy list below: two successive reviews each found
 * another. Re-derive with
 * `grep -rn 'readConfigString(' src/provisioning/providers/`.
@@ -22776,6 +23019,13 @@ const CAP_EXPIRED = Symbol("drain-cap-expired");
 */
 const concurrentDrainCap = {};
 /**
+* The budgets whose drain has already reported abandoned inputs (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)). A `WeakSet` so a
+* budget's entry dies with the budget, as the budget itself does with the
+* async context that opened it.
+*/
+const abandonReported = /* @__PURE__ */ new WeakSet();
+/**
 * `Promise.all`'s RESULT and its choice of error, with `Promise.allSettled`'s
 * TIMING: every promise started here has settled before this returns, and
 * before it throws unless the cap below expires first (issue
@@ -22853,8 +23103,25 @@ const concurrentDrainCap = {};
 * require the "healthy work slower than 60 s" shape the sizing paragraph
 * describes; that shape is the cheapest way to reach it with no nesting and
 * no wrapped loop, not the floor.
-* Residual: issue
-* [#2814](https://github.com/go-to-k/cdkd/issues/2814).
+*
+* WHAT HAPPENS TO A PART THE CAP STOPS WAITING FOR (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)). It keeps running, and
+* its recording still lands in the context's map whenever it arrives -- the
+* cap costs it ORDER, not the write. So the answer sits with the READERS: one
+* that runs after the recording arrives must see it, which `DeployEngine`'s
+* outputs pass arranges for its `Export.Name` block (a map that writes each
+* recording through to the pass map at once, where a local copied in a
+* `finally` used to drop it) and for the persisted outputs, the exports index
+* and the deploy summary (each redacting against the pass map as it stands
+* at the moment it is written). A reader that took its
+* copy BEFORE the recording arrived -- a failure message already printed, a
+* state save already sent -- cannot be helped without waiting, and the wait
+* is what the cap bounds. Cancelling the
+* part would not close that either: a cancelled part never records, so its
+* plaintext would be missing for EVERY reader rather than for the early ones.
+* What this helper adds is the report: releasing a rejection with inputs
+* still running calls `onAbandoned` with how many, at most once per budget,
+* and the resolver turns that into a warning.
 *
 * ONE REMAINING CONSEQUENCE, deliberate and pinned by a case rather than only
 * described: the earliest-in-time rule holds PER INVOCATION, not across
@@ -22872,11 +23139,16 @@ const concurrentDrainCap = {};
 * failure where the old race was arbitrary. Residual: issue
 * [#2805](https://github.com/go-to-k/cdkd/issues/2805).
 */
-async function allSettledKeepingFirstRejection(promises) {
+async function allSettledKeepingFirstRejection(promises, onAbandoned) {
 	let rejection;
 	const shared = drainDeadlines.getStore();
 	let armCap;
-	const guarded = promises.map((promise) => promise.catch((error) => {
+	let settled = 0;
+	const guarded = promises.map((promise) => promise.then((value) => {
+		settled += 1;
+		return value;
+	}, (error) => {
+		settled += 1;
 		if (rejection === void 0) {
 			rejection = { error };
 			armCap?.();
@@ -22901,7 +23173,17 @@ async function allSettledKeepingFirstRejection(promises) {
 	});
 	try {
 		const outcome = await Promise.race([Promise.all(guarded), capped]);
-		if (rejection !== void 0) throw rejection.error;
+		if (rejection !== void 0) {
+			const pending = promises.length - settled;
+			if (pending > 0) {
+				if (shared === void 0) onAbandoned(pending);
+				else if (!abandonReported.has(shared)) {
+					abandonReported.add(shared);
+					onAbandoned(pending);
+				}
+			}
+			throw rejection.error;
+		}
 		if (outcome === CAP_EXPIRED) throw markNonRetryable(/* @__PURE__ */ new Error("drain cap expired with no rejection recorded"));
 		return outcome;
 	} finally {
@@ -23869,6 +24151,17 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return conditions;
 	}
 	/**
+	* Warn that a drain stopped waiting for `pending` inputs of a failed
+	* resolution (issue [#2814](https://github.com/go-to-k/cdkd/issues/2814)).
+	* The helper calls this at most once per budget. The text carries a count
+	* and the cap, nothing the template or AWS supplied, so it needs no masking.
+	*/
+	warnAbandonedParts(pending) {
+		const capSeconds = (concurrentDrainCap.ms ?? DRAIN_AFTER_REJECTION_MS) / 1e3;
+		const parts = pending === 1 ? "1 concurrent part was" : `${pending} concurrent parts were`;
+		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
+	}
+	/**
 	* Recursively resolve a value
 	*/
 	async resolveValue(value, context) {
@@ -23876,7 +24169,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
 			return value;
 		}
-		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)))).filter((v) => v !== AWS_NO_VALUE);
+		if (Array.isArray(value)) return (await allSettledKeepingFirstRejection(value.map((v) => this.resolveValue(v, context)), (pending) => this.warnAbandonedParts(pending))).filter((v) => v !== AWS_NO_VALUE);
 		const obj = value;
 		if ("Ref" in obj) return await this.resolveRef(obj["Ref"], context);
 		if ("Fn::GetAtt" in obj) return await this.resolveGetAtt(obj["Fn::GetAtt"], context);
@@ -24783,7 +25076,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		let result = (await allSettledKeepingFirstRejection(values.map(async (v) => {
 			const resolved = await this.resolveValue(v, context);
 			return String(resolved);
-		}))).join(delimiter);
+		}), (pending) => this.warnAbandonedParts(pending))).join(delimiter);
 		if (result.includes("{{resolve:")) result = await this.resolveDynamicReferences(result, context);
 		this.logger.debug(`Resolved Fn::Join: ${this.maskSecretsForLog(result, context)}`);
 		return result;
@@ -27748,7 +28041,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C5FQJwUN.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CpxZ9sVH.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -37059,6 +37352,47 @@ var DeploymentEventsReader = class {
 */
 const EMPTY_SECRETS = /* @__PURE__ */ new Map();
 /**
+* A secrets map that keeps its OWN entries and also writes each one through
+* to `target` the moment it is recorded (issue
+* [#2814](https://github.com/go-to-k/cdkd/issues/2814)).
+*
+* The outputs pass resolves each intrinsic `Export.Name` through one of these.
+* Its own entries are what `exportNameSecretExposure` reads as "substituted
+* into THIS name", which must stay exact -- a view of the whole pass map
+* (`cdkd scrub`'s `SharedEntriesSecrets`) would report every secret the pass
+* has recorded as one the name holds, and refuse every alias. The write-through
+* is what a copy could not give: a part the drain cap stopped waiting for
+* records AFTER the name's block has ended, and when this was a local copied
+* into the pass map in a `finally`, such a record reached nothing.
+*
+* Only `set` writes through: it is the one operation the resolver performs on
+* a recording map (grepped -- no resolver path calls `delete` or `clear` on
+* one). `cdkd scrub`'s `SharedEntriesSecrets` overrides those too, and the
+* asymmetry is deliberate: that one is a VIEW holding no entries of its own,
+* while a `delete` here would leave the pass map carrying an entry this map
+* dropped -- one needle too many, which over-redacts rather than leaks.
+* The ENTRIES only, never the resolved pairs beside them
+* (issue #2485): those are keyed by map INSTANCE (`recordResolvedPair`), so
+* they stay on this one. A name never positions a leaf, and a value re-using
+* the same token records its own pair at the seam, so carrying them could add
+* nothing -- what it COULD do is mark a pair conflicting (an `ssm` reference
+* whose `Type` came back unclassifiable is never cached, so a name resolving
+* it re-asks AWS and can see a value that moved since the value pass) and
+* destroy the positioning the value pass had earned.
+*/
+var ForwardingSecrets = class extends Map {
+	target;
+	constructor(target) {
+		super();
+		this.target = target;
+	}
+	set(plaintext, expression) {
+		super.set(plaintext, expression);
+		this.target?.set(plaintext, expression);
+		return this;
+	}
+};
+/**
 * Default per-resource warn threshold: warn the user when a single
 * resource has been in flight for 5 minutes. Most CC API resources
 * complete in under a minute; 5m is the agreed elbow.
@@ -37333,6 +37667,16 @@ var DeployEngine = class DeployEngine {
 	*/
 	outputSecrets = /* @__PURE__ */ new Map();
 	/**
+	* The outputs pass's own recording map(s), one per `resolveOutputs` call
+	* this deploy, so every redaction of the outputs bag re-reads them rather
+	* than trusting the copy taken when the pass ended (issue
+	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)): a part the drain
+	* cap stopped waiting for records into its pass map LATE, and the final
+	* save, the exports index and the deploy summary all run after that copy.
+	* Reset per `deploy()`.
+	*/
+	outputsPassSecretMaps = [];
+	/**
 	* UNRESOLVED template `Outputs` values, keyed by output name (issue #1910) —
 	* the outputs' POSITION source, the sibling of `perResourceTemplateProps` for
 	* the bag `resolveOutputs` produces. Without it two outputs resolving one
@@ -37461,6 +37805,7 @@ var DeployEngine = class DeployEngine {
 		this.perResourceResolvedType = /* @__PURE__ */ new Map();
 		this.attemptedResolvedProps = /* @__PURE__ */ new Map();
 		this.outputSecrets = /* @__PURE__ */ new Map();
+		this.outputsPassSecretMaps = [];
 		this.outputsTemplateSource = Object.create(null);
 		this.outputsSourceUsable = true;
 		this.skippedOutputs = void 0;
@@ -37532,12 +37877,16 @@ var DeployEngine = class DeployEngine {
 	* Redact the resolved stack OUTPUTS bag, positioned by the unresolved
 	* template `Outputs` values (issue #1910).
 	*
-	* A single entry point because THREE call sites redact this same bag — the
-	* state-persist choke point, the no-change re-check, and the post-deploy
-	* publish that feeds the exports index / deploy summary — and before this
-	* they each spelled the value-only redaction separately. Two outputs
-	* resolving one secret collapsed onto whichever expression was recorded last
-	* at all three.
+	* A single entry point because SEVEN call sites redact this same bag — the
+	* state-persist choke point, the no-change re-check, that path's exports
+	* index and deploy summary, the changes path's index and summary, and the
+	* outputs pass itself. THREE of those are the ones issue #1910 unified —
+	* the persist choke point, the re-check, and the outputs pass, which the
+	* list above ends on rather than opens with: before it they each spelled
+	* the value-only redaction separately, and two outputs resolving one secret
+	* collapsed onto whichever expression was recorded last at all three. The
+	* other FOUR are issue #2814's, both paths' index and summary: each read
+	* the bag unredacted until then, and now redacts at the moment it reads.
 	*/
 	/**
 	* Record the plaintext behind every output {@link redactOutputs} just masked,
@@ -37550,9 +37899,18 @@ var DeployEngine = class DeployEngine {
 	* value read back out of a previous run's state — is skipped, because there
 	* is no plaintext behind it to remember.
 	*
-	* Called only from the REAL-DEPLOY outputs pass. The other two `redactOutputs`
-	* callers hand it a bag from a previous generation, where a mask is already
-	* unrecoverable and pretending otherwise would serve a stale value.
+	* Called only from the REAL-DEPLOY outputs pass. Of the six other
+	* `redactOutputs` callers, three CAN hand it a bag from a previous
+	* generation — the persist walk always may, and the no-change path's
+	* exports index and summary do on the arms where that path keeps the
+	* previous bag — and there a mask is already unrecoverable, so pretending
+	* otherwise would
+	* serve a stale value. The other three are not this pass either: the
+	* no-change path performs the FIRST redaction of its own resolution there,
+	* and the changes path's index and summary re-redact the bag this pass
+	* already produced. (The "other two" this replaces counted the base's three
+	* callers correctly; what was wrong was calling both of the others
+	* previous-generation, when only the persist walk was one.)
 	*/
 	rememberRecoverableMaskedOutputs(stackName, resolved, redacted) {
 		if (resolved === redacted) return;
@@ -37563,7 +37921,51 @@ var DeployEngine = class DeployEngine {
 			recordRecoverableMaskedOutput(stackName, this.stackRegion, key, plaintext);
 		}
 	}
+	/**
+	* Fold every outputs-pass recording map into `outputSecrets` — the entries,
+	* and the uncollapsed evidence beside them (issue #2485: without it a
+	* literal Output embedding one of two same-plaintext references would lose
+	* its span positioning and persist the sibling's expression). Only what the
+	* outputs pass itself resolved, so the outputs redaction (GHSA fix) uses
+	* only outputs-substituted references: a literal output equal to a secret
+	* nothing resolved is not recorded, and is not touched.
+	*
+	* Run by every {@link redactOutputs} (issue
+	* [#2814](https://github.com/go-to-k/cdkd/issues/2814)), because a part the
+	* drain cap stopped waiting for records into its pass map LATE: a secret
+	* that arrives between the pass and the final save is then still a needle
+	* for the save, the exports index and the deploy summary. Repeating it is
+	* safe for the ENTRIES — re-setting one the bag holds changes nothing, and
+	* `Map.set` on an existing key keeps its insertion order, so last-wins
+	* cannot be reordered by a refold.
+	*
+	* The PAIRS are where repeating is not merely a no-op, stated because the
+	* end-of-pass copy could not see it: a part the cap stopped waiting for can
+	* record a pair LATE, and a second value for one expression marks it
+	* `CONFLICTING_PLAINTEXT` (a non-cacheable `{{resolve:ssm:X}}` re-resolved
+	* to a moved value). A later refold then carries that conflict into
+	* `outputSecrets`, the leaf loses its positioning and falls to the value
+	* scan, which can persist a sibling's expression (the issue #2485 class).
+	* The plaintext stays MASKED either way, so the cost is which expression
+	* is stored, not a disclosure — and the alternative, dropping the late
+	* pair, would keep a positioning the pass itself no longer vouches for.
+	*/
+	absorbOutputsPassSecrets() {
+		for (const passSecrets of this.outputsPassSecretMaps) {
+			for (const [value, expr] of passSecrets) this.outputSecrets.set(value, expr);
+			mergeResolvedPairs(passSecrets, this.outputSecrets);
+		}
+	}
+	/**
+	* Redact the outputs bag. NOT a pure transform: it folds the outputs pass
+	* map into `outputSecrets` first (issue #2814), so every call can grow that
+	* bag. Its KEY set only grows, and the bag has no other reader, which is
+	* what makes calling this on every save, index write and summary safe. The
+	* resolved PAIRS beside those keys are not equally free to refold — see
+	* {@link absorbOutputsPassSecrets}, which states what a late one costs.
+	*/
 	redactOutputs(outputs) {
+		this.absorbOutputsPassSecrets();
 		if (this.outputSecrets.size === 0) return outputs;
 		return redactSecretsForState(outputs, this.outputSecrets, this.outputsSourceUsable ? this.outputsTemplateSource : void 0, TEMPLATE_SOURCED_RULES);
 	}
@@ -38196,7 +38598,10 @@ var DeployEngine = class DeployEngine {
 							persistedOutputs = refreshedState.outputs;
 							if (outputsChanged) this.logger.info("Persisted Outputs-only change (no resource diff).");
 							else this.logger.debug("Persisted export-set change (no outputs-value diff, no-change path, #2193)");
-							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(refreshedState));
+							if (this.exportIndexStore) await this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+								...refreshedState,
+								outputs: this.redactOutputs(refreshedState.outputs)
+							}));
 						} else if (observedRefresh) this.logger.debug("Persisted refreshed observedProperties (no-change path)");
 						else this.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path, #2740)");
 					} catch (saveError) {
@@ -38213,7 +38618,7 @@ var DeployEngine = class DeployEngine {
 					updatePartial: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
-					outputs: this.buildDisplayOutputs(template, persistedOutputs),
+					outputs: this.buildDisplayOutputs(template, this.redactOutputs(persistedOutputs)),
 					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
@@ -38244,7 +38649,10 @@ var DeployEngine = class DeployEngine {
 			await this.drainObservedCaptures(newState.resources);
 			const newEtag = await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(newState));
 			this.logger.debug(`State saved (ETag: ${newEtag})`);
-			await Promise.all([this.deleteRollbackJournalBestEffort(stackName), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs(newState)) : Promise.resolve()]);
+			await Promise.all([this.deleteRollbackJournalBestEffort(stackName), this.exportIndexStore ? this.exportIndexStore.updateForStack(stackName, this.stackRegion, importableOutputs({
+				...newState,
+				outputs: this.redactOutputs(newState.outputs)
+			})) : Promise.resolve()]);
 			const durationMs = Date.now() - startTime;
 			const unchangedCount = this.diffCalculator.filterByType(changes, "NO_CHANGE").length + actualCounts.skipped;
 			return {
@@ -38256,7 +38664,7 @@ var DeployEngine = class DeployEngine {
 				updatePartial: actualCounts.updatePartial,
 				unchanged: unchangedCount,
 				durationMs,
-				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
+				outputs: this.buildDisplayOutputs(template, this.redactOutputs(newState.outputs ?? {})),
 				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		} finally {
@@ -39868,8 +40276,10 @@ var DeployEngine = class DeployEngine {
 	* defense in depth here — but two masking sites in one flow must not argue
 	* opposite sides of the same question. `secrets` is the outputs pass's own
 	* map: everything recorded before this handler runs, an `Export.Name`
-	* resolution's entries included (its `finally` merges them back before the
-	* `catch` reaches here). Since issue #2563 a still-pending concurrent part
+	* resolution's entries included (its map writes each one through to the
+	* pass map as the resolver records it, so they are here before the `catch`
+	* is; issue #2814 replaced the `finally` that copied them at the end of
+	* the block). Since issue #2563 a still-pending concurrent part
 	* is in the PASS bag before this handler runs: the resolver drains every
 	* part it started before a rejection reaches a caller. Not
 	* unconditionally, and the weaker claim is the true one -- the drain is
@@ -40004,6 +40414,7 @@ var DeployEngine = class DeployEngine {
 		};
 		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
+		if (context.recordedSecretValues) this.outputsPassSecretMaps.push(context.recordedSecretValues);
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 		let outputsPassCompleted = false;
 		try {
@@ -40029,20 +40440,16 @@ var DeployEngine = class DeployEngine {
 				if (!output.Export?.Name) continue;
 				const value = outputs[outputKey];
 				if (value === void 0) continue;
-				const nameSecrets = /* @__PURE__ */ new Map();
+				const nameSecrets = new ForwardingSecrets(context.recordedSecretValues);
 				const nameReads = [];
 				let exportName;
 				try {
-					try {
-						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
-							...context,
-							recordedSecretValues: nameSecrets,
-							redactedAttributeReads: nameReads
-						});
-						refuseMaskedOutputReads(outputKey, nameReads);
-					} finally {
-						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
-					}
+					exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
+						...context,
+						recordedSecretValues: nameSecrets,
+						redactedAttributeReads: nameReads
+					});
+					refuseMaskedOutputReads(outputKey, nameReads);
 				} catch (error) {
 					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 					continue;
@@ -40059,10 +40466,6 @@ var DeployEngine = class DeployEngine {
 			}
 			outputsPassCompleted = true;
 		} finally {
-			if (context.recordedSecretValues) {
-				for (const [value, expr] of context.recordedSecretValues) this.outputSecrets.set(value, expr);
-				mergeResolvedPairs(context.recordedSecretValues, this.outputSecrets);
-			}
 			if (!outputsPassCompleted) this.outputsSourceUsable = false;
 		}
 		for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -40084,5 +40487,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { collectInlinePolicyNamesManagedBySiblings as $, describeDockerCapturedOutput as $n, LocalInvokeBuildError as $r, DagBuilder as $t, isStatefulRecreateTargetForReplace as A, orphansAfterRollback as An, uploadCfnTemplate as Ar, coerceCfnBoolean as At, gray as B, AssetModeResolver as Bn, resolveBucketRegion as Br, withSharedDrainBudget as Bt, refusesFinalSnapshot as C, forceQuitRecoveryClause as Cn, resolveUseCdkBootstrapAssets as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, exportNamesCarriedFrom as Dn, CFN_TEMPLATE_URL_LIMIT as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, DEFAULT_STATE_PREFIX as En, CFN_TEMPLATE_BODY_LIMIT as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, WorkGraph as Fn, canonicalizeRegion as Fr, requireConfigArray as Ft, collectPublishedOutputNames as G, isCrossRegionRedirect as Gn, AssetError as Gr, s3BucketWebsiteUrl as Gt, red as H, assertAssetBucketRegion as Hn, getAwsClients as Hr, s3BucketDomainName as Ht, toFiniteNumber as I, buildAssetRedirectMap as In, derivePartitionAndUrlSuffix as Ir, requireConfigObject as It, secretBearing as J, validateAssetBucketName as Jn, CrossAccountSecretRefusalError as Jr, INTRINSIC_KEYS as Jt, exportAliasCollisionScrubWarning as K, parseBootstrapMarker as Kn, CdkdError as Kr, applyRoleArnIfSet as Kt, formatResourceLine as L, createAssetRedirectResolver as Ln, AssemblyReader as Lr, requireConfigString as Lt, renderStatefulReason as M, shouldRetainResource as Mn, displaySafe as Mr, configStringRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, AssetPublisher as Nn, expectedOwnerParam as Nr, readConfigString as Nt, planOrphanAdoption as O, importableOutputKeys as On, MIGRATE_TMP_PREFIX as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, stringifyValue as Pn, PARTITION_TABLE as Pr, replayWarn as Pt, IAMRoleProvider as Q, buildDockerImage as Qn, IntrinsicResolutionRefusalError as Qr, withRetry as Qt, bold as R, loadPublishableAssetManifest as Rn, processStackMessages as Rr, classifyReplaySecretRegion as Rt, isFinalSnapshotError as S, __exportAll as Si, buildLockContentionMessage as Sn, resolveStateBucketWithDefaultAndSource as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, CUSTOM_RESOURCE_RESPONSE_PREFIX as Tn, warnDeprecatedNoPrefixCliFlag as Tr, refStateLookupFromResource as Tt, yellow as U, ensureAssetStorage as Un, resetAwsClients as Ur, s3BucketDualStackDomainName as Ut, green as V, BOOTSTRAP_MARKER_PREFIX as Vn, AwsClients as Vr, s3BucketArn as Vt, collectDeclaredOutputNames as W, getBootstrapMarkerKey as Wn, setAwsClients as Wr, s3BucketRegionalDomainName as Wt, secretSafeKeyDisplay as X, buildDenyExternalAccessPolicy as Xn, DeployCancelledError as Xr, findSilentDropProperties as Xt, secretBearingStateKeyWarning as Y, validateContainerRepoName as Yn, DependencyError as Yr, findActionableSilentDrops as Yt, getCurrentResourceSecrets as Z, describeAwsFailure as Zn, DynamicReferenceRegionAmbiguousError as Zr, describeTypeWithThrottleRetry as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isThrottlingError as _i, LockManager as _n, resolveApp as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, ResourceTimeoutError as ai, carriesSecretMask as an, partitionSensitiveEnv as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, markRedactedCause as bi, UNRENDERABLE as bn, resolveSkipPrefix as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, StackTerminationProtectionError as ci, errorCauseChain as cn, runDockerStreaming as cr, interruptWatchListenerCount as ct, updatePartialReason as d, formatError as di, maskSecretsInError as dn, AssetManifestLoader as dr, CloudControlProvider as dt, LocalStartServiceError as ei, TemplateParser as en, describeDockerExecFailure as er, clearOnUpdateRemoval as et, withResourceDeadline as f, isCdkdError as fi, maskSecretsInText as fn, getDockerImageBySourceHash as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, isRetryableTransientError as gi, scrubResourceRecord as gn, getLegacyStateBucketName as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, isMarkedNonRetryable as hi, redactSecretsForState as hn, getDefaultStateBucketName as hr, deleteSkipReason as ht, DeploymentEventsReader as i, ProvisioningError as ii, TEMPLATE_SOURCED_RULES as in, getDockerCmd as ir, maskDeep as it, isStatefulRecreateTargetSync as j, orphansCarriedFrom as jn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as jr, configBooleanRefusal as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, importableOutputs as kn, findLargeInlineResources as kr, assertRegionMatch as kt, replayRollback as l, StateError as li, identityKeyFor as ln, escapeRegExp$1 as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, withErrorHandling as mi, recoverMaskedOutput as mn, synthesisStatusMessage as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, NestedStackChildDirectDestroyError as ni, STATE_SOURCED_CROSS_GENERATION_RULES as nn, dockerSpawnEnvWithSensitive as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ResourceUpdateNotSupportedError as oi, createSecretMasker as on, redactDockerArgvValues as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, normalizeAwsError as pi, recordMaskOnlyValue as pn, Synthesizer as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, readBootstrapMarkerBody as qn, ConfigError as qr, DiffCalculator as qt, DeployEngine as r, PartialFailureError as ri, STATE_SOURCED_READBACK_RULES as rn, formatDockerLoginError as rr, createMaskedRetryLogger as rt, planRollback as s, StackHasActiveImportsError as si, dynamicReferenceTokens as sn, runDockerForeground as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockError as ti, STATE_SOURCED_BASELINE_RULES as tn, describeDockerFailure as tr, ProviderRegistry as tt, updatePartialMessage as u, SynthesisError as ui, isSingleDynamicReferenceToken as un, stripControlChars as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isTransientServerError as vi, S3StateBackend as vn, resolveAutoAssetStorage as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, shellQuote as wn, stateBucketExistenceConfirmed as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, retryClassificationText as xi, buildForceUnlockCommand as xn, resolveStateBucketWithDefault as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, markNonRetryable as yi, rebuildClientForBucketRegion as yn, resolveCaptureObservedState as yr, carriesDynamicReference as yt, cyan as z, rewriteTemplateAssetReferences as zn, clearBucketRegionCache as zr, producerRegionsFromState as zt };
-//# sourceMappingURL=deploy-engine-ClLLdy68.js.map
+export { collectInlinePolicyNamesManagedBySiblings as $, buildDockerImage as $n, LocalInvokeBuildError as $r, DagBuilder as $t, isStatefulRecreateTargetForReplace as A, importableOutputs as An, findLargeInlineResources as Ar, coerceCfnBoolean as At, gray as B, rewriteTemplateAssetReferences as Bn, resolveBucketRegion as Br, withSharedDrainBudget as Bt, refusesFinalSnapshot as C, buildLockContentionMessage as Cn, resolveStateBucketWithDefaultAndSource as Cr, isUnboundTemplateParameter as Ct, makeSiblingClaimReader as D, DEFAULT_STATE_PREFIX as Dn, CFN_TEMPLATE_BODY_LIMIT as Dr, normalizeAwsTagsToCfn as Dt, extractDeploymentEventError as E, CUSTOM_RESOURCE_RESPONSE_PREFIX as En, warnDeprecatedNoPrefixCliFlag as Er, WAFv2WebACLProvider as Et, isWarmThroughputDecrease as F, stringifyValue as Fn, canonicalizeRegion as Fr, requireConfigArray as Ft, collectPublishedOutputNames as G, getBootstrapMarkerKey as Gn, AssetError as Gr, s3BucketWebsiteUrl as Gt, red as H, BOOTSTRAP_MARKER_PREFIX as Hn, getAwsClients as Hr, s3BucketDomainName as Ht, toFiniteNumber as I, WorkGraph as In, derivePartitionAndUrlSuffix as Ir, requireConfigObject as It, secretBearing as J, readBootstrapMarkerBody as Jn, CrossAccountSecretRefusalError as Jr, INTRINSIC_KEYS as Jt, exportAliasCollisionScrubWarning as K, isCrossRegionRedirect as Kn, CdkdError as Kr, applyRoleArnIfSet as Kt, formatResourceLine as L, buildAssetRedirectMap as Ln, AssemblyReader as Lr, requireConfigString as Lt, renderStatefulReason as M, orphansCarriedFrom as Mn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Mr, configStringRefusal as Mt, WARM_THROUGHPUT_MEMBERS as N, shouldRetainResource as Nn, expectedOwnerParam as Nr, readConfigString as Nt, planOrphanAdoption as O, exportNamesCarriedFrom as On, CFN_TEMPLATE_URL_LIMIT as Or, resolveExplicitPhysicalId as Ot, coerceWarmThroughput as P, AssetPublisher as Pn, PARTITION_TABLE as Pr, replayWarn as Pt, IAMRoleProvider as Q, describeAwsFailure as Qn, IntrinsicResolutionRefusalError as Qr, withRetry as Qt, bold as R, createAssetRedirectResolver as Rn, processStackMessages as Rr, classifyReplaySecretRegion as Rt, isFinalSnapshotError as S, __exportAll as Si, buildForceUnlockCommand as Sn, resolveStateBucketWithDefault as Sr, getAccountInfo as St, makeCanonicalizePropertiesFn as T, shellQuote as Tn, stateBucketExistenceConfirmed as Tr, refStateLookupFromResource as Tt, yellow as U, assertAssetBucketRegion as Un, resetAwsClients as Ur, s3BucketDualStackDomainName as Ut, green as V, AssetModeResolver as Vn, AwsClients as Vr, s3BucketArn as Vt, collectDeclaredOutputNames as W, ensureAssetStorage as Wn, setAwsClients as Wr, s3BucketRegionalDomainName as Wt, secretSafeKeyDisplay as X, validateContainerRepoName as Xn, DeployCancelledError as Xr, findSilentDropProperties as Xt, secretBearingStateKeyWarning as Y, validateAssetBucketName as Yn, DependencyError as Yr, findActionableSilentDrops as Yt, getCurrentResourceSecrets as Z, buildDenyExternalAccessPolicy as Zn, DynamicReferenceRegionAmbiguousError as Zr, describeTypeWithThrottleRetry as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, isThrottlingError as _i, scrubResourceRecord as _n, getLegacyStateBucketName as _r, isTerminationProtectionPropagationError as _t, DeploymentEventsStore as a, ResourceTimeoutError as ai, carriesSecretMask as an, getDockerCmd as ar, maskerOrIdentity as at, ccRoutedFinalSnapshotError as b, markRedactedCause as bi, rebuildClientForBucketRegion as bn, resolveCaptureObservedState as br, cfnRefValueFromPhysicalId as bt, replayFailedOperations as c, StackTerminationProtectionError as ci, errorCauseChain as cn, runDockerForeground as cr, interruptWatchListenerCount as ct, updatePartialReason as d, formatError as di, markSameGenerationBag as dn, stripControlChars as dr, CloudControlProvider as dt, LocalStartServiceError as ei, TemplateParser as en, describeDockerCapturedOutput as er, clearOnUpdateRemoval as et, withResourceDeadline as f, isCdkdError as fi, maskSecretsInError as fn, AssetManifestLoader as fr, slowCcOperationTimeoutMs as ft, bindingSkippedOutputs as g, isRetryableTransientError as gi, redactSecretsForState as gn, getDefaultStateBucketName as gr, disableInstanceApiTermination as gt, computeImplicitDeleteEdges as h, isMarkedNonRetryable as hi, recoverMaskedOutput as hn, synthesisStatusMessage as hr, deleteSkipReason as ht, DeploymentEventsReader as i, ProvisioningError as ii, TEMPLATE_SOURCED_RULES as in, formatDockerLoginError as ir, maskDeep as it, isStatefulRecreateTargetSync as j, orphansAfterRollback as jn, uploadCfnTemplate as jr, configBooleanRefusal as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, importableOutputKeys as kn, MIGRATE_TMP_PREFIX as kr, assertRegionMatch as kt, replayRollback as l, StateError as li, identityKeyFor as ln, runDockerStreaming as lr, isInterruptedWaitError as lt, IMPLICIT_DELETE_DEPENDENCIES as m, withErrorHandling as mi, recordMaskOnlyValue as mn, Synthesizer as mr, deleteIndeterminateGuards as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, NestedStackChildDirectDestroyError as ni, STATE_SOURCED_CROSS_GENERATION_RULES as nn, describeDockerFailure as nr, wouldReturnToSdkProvider as nt, planFailedOps as o, ResourceUpdateNotSupportedError as oi, createSecretMasker as on, partitionSensitiveEnv as or, beginCommandInterruptScope as ot, maskingRetryLogger as p, normalizeAwsError as pi, maskSecretsInText as pn, getDockerImageBySourceHash as pr, UNSPECIFIED_SKIP_REASON as pt, isExportAliasCollision as q, parseBootstrapMarker as qn, ConfigError as qr, DiffCalculator as qt, DeployEngine as r, PartialFailureError as ri, STATE_SOURCED_READBACK_RULES as rn, dockerSpawnEnvWithSensitive as rr, createMaskedRetryLogger as rt, planRollback as s, StackHasActiveImportsError as si, dynamicReferenceTokens as sn, redactDockerArgvValues as sr, endCommandInterruptScope as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, LockError as ti, STATE_SOURCED_BASELINE_RULES as tn, describeDockerExecFailure as tr, ProviderRegistry as tt, updatePartialMessage as u, SynthesisError as ui, isSingleDynamicReferenceToken as un, escapeRegExp$1 as ur, startInterruptWatch as ut, PRE_DELETE_SNAPSHOT_TYPES as v, isTransientServerError as vi, LockManager as vn, resolveApp as vr, IntrinsicFunctionResolver as vt, unsupportedFinalSnapshotError as w, forceQuitRecoveryClause as wn, resolveUseCdkBootstrapAssets as wr, parameterTypeMayLoseSecretIdentity as wt, createPreDeleteFinalSnapshot as x, retryClassificationText as xi, UNRENDERABLE as xn, resolveSkipPrefix as xr, coerceParameterTypedValue as xt, buildFinalSnapshotIdentifier as y, markNonRetryable as yi, S3StateBackend as yn, resolveAutoAssetStorage as yr, carriesDynamicReference as yt, cyan as z, loadPublishableAssetManifest as zn, clearBucketRegionCache as zr, producerRegionsFromState as zt };
+//# sourceMappingURL=deploy-engine-BEpYvI14.js.map