@go-to-k/cdkd 0.296.24 → 0.296.26

package/dist/{program--_T76pFz.js → program-CXVhqA7j.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as green, $a as describeTypeWithThrottleRetry, $i as refuseMalformedResourceAttributesForOrphan, $o as isLockInfoExpired, $r as carriesDynamicReference, $s as AssetManifestLoader, $t as updatePartialReason, A as readProtection, Aa as findReplacedReadersOfRecreateTargets, Ac as defineOwnKey, Ai as malformedOrphanRecordsRefusalMessage, An as collectPublishedOutputNames, Ao as scrubResourceRecord, Ar as producerRegionsFromState, As as readBootstrapMarkerBody, At as destroyStackRecordsView, Bi as malformedResourcesWarning, Bo as provenPublicValue, Br as callerEnvCredentials, Bs as finchSecretArgvRefusal, Bt as recheckFailedPlan, C as noEchoComparisonForTemplate, Ca as withheldAccountClause, Cc as expectedOwnerParam, Ci as isReadableResourceEntry, Cn as secretSafeKeyDisplay, Co as shareLogOnlyValues, Cs as AssetModeResolver, Ct as journaledOrphanLines, D as PROTECTION_PROPERTY_BY_TYPE, Dc as AssemblyReader, Di as malformedLocalOutputsWarning, Dn as isWholeDynamicReferenceValue, Do as maskSecretsInText, Dr as IntrinsicFunctionResolver, Ds as getBootstrapMarkerKey, Dt as replayFailedOperations, E as recordedProtectionNote, Ea as unwrittenCreateOnlyReplacement, Ec as derivePartitionAndUrlSuffix, Ei as malformedExportSourceWarning, En as exportNameSecretExposure, Eo as maskSecretsInError, Er as INTRINSIC_KEYS, Es as ensureAssetStorage, Et as sameJournaledOrphans, Fa as renderStatefulReason, Fc as absoluteAssemblyPathEscape, Fi as malformedOutputsRefusalMessage, Fn as maskingRetryLogger, Fo as identityKeyFor, Fr as explicitRoleArnOrThrow, Fs as resolveDockerContextDirectory, Ft as demoteSupersededOrphans, Go as wholeStringLeavesOf, Gs as partitionSensitiveEnv, Gt as findNestedStackTypeChanges, Hi as malformedStateRefusalMessage, Ho as recordMaskOnlyValuesIn, Hs as getDockerCmd, Ht as replacementNeverSwapped, Ic as describeFileReadFailure, Ii as malformedOutputsWarning, In as constructPathOf, Io as inheritNestedStackParameterAssociations, Ir as isIamRoleArn, Is as describeDockerCapturedOutput, It as isJournaledOrphan, J as formatResourceLine, Ji as refuseMalformedOrphans, Jo as STATE_SOURCED_READBACK_RULES, Jr as coerceParameterTypedValue, Js as runDockerForeground, Ki as refuseMalformedOrphanRecords, Ko as STATE_SOURCED_BASELINE_RULES, Ks as redactDockerArgvValues, Lc as displayAssemblyPath, Li as malformedRenderedContainersWarning, Ln as findDestructiveChanges, Lo as recordNestedStackParameterExpressions, Lr as sendableAssumeRoleCommand, Ls as describeDockerExecFailure, Lt as isReplacementOrphan, Ma as MULTI_REGION_RECREATE_BLOCKED_TYPES, Mc as hasPlainPrototype, Mi as malformedOrphanRowsKeptWarning, Mn as bindingSkippedOutputs, Mo as dynamicReferenceTokens, Mr as applyRoleArnIfSet, Ms as validateContainerRepoName, Mt as withStackRecords, Na as isStatefulRecreateTargetForReplace, Nc as nullPrototypeRecord, Ni as malformedOrphansRefusalMessage, Nn as DEFAULT_RESOURCE_TIMEOUT_MS, No as isUncertifiedBaselineMaskPosition, Nr as assertFlagRoleArn, Ns as buildDenyExternalAccessPolicy, Nt as removeProtectionTypeList, O as isProtectionValueActive, Oa as NO_CC_HANDLERS_REASON, Oc as StageLoadError, Oi as malformedLocalResourceEntriesWarning, On as noEchoParameterValueSeed, Oo as markSameGenerationBag, Or as poisonRenderedSpellingsCollidingIn, Os as isCrossRegionRedirect, Ot as replayRollback, Pa as isStatefulRecreateTargetSync, Pc as ownValue, Pi as malformedOrphansWarning, Pn as DEFAULT_RESOURCE_WARN_AFTER_MS, Po as pathCrossesDottedKey, Pr as assertSendableRoleArn, Ps as buildDockerImage, Pt as recordAfterRollbackUpdate, Q as gray, Qa as templateResourceTypes, Qi as refuseMalformedOutputsForDestroy, Qo as LockManager, Qr as isImpossibleEmptyStoredAttribute, Qs as stripControlChars, Qt as updatePartialMessage, Rc as renderAssemblyPathEscape, Ri as malformedResourceEntriesWarning, Rn as formatDestructiveChange, Rr as AWS_CREDENTIAL_ENV_KEYS, Rs as describeDockerFailure, Rt as planFailedOps, S as noEchoAttributeNamesOf, Sa as unreadableResourceEntries, Sc as decodeListingKey, Si as isReadableOrphanRecord, Sn as secretBearingStateKeyWarning, So as recordLogOnlyValue, Ss as rewriteTemplateAssetReferences, St as isHandledOrphan, T as recordedProtectionEvidence, Tc as canonicalizeRegion, Ti as malformedExportNamesWarning, Tn as exportNameNoEchoParameters, To as errorCauseChain, Tr as DiffCalculator, Ts as assertAssetBucketRegion, Tt as makeForeignHolderScan, Ui as previewableOrphanRecords, Un as withCreateTokenLedger, Uo as recordNoEchoAttributeValues, Us as isDockerClientEnvKey, Ut as resolveReplacementOldType, Vc as resolveBucketRegion, Vi as malformedScrubResourceEntriesRefusalMessage, Vn as ledgerForStack, Vo as recordMaskOnlyValue, Vr as envCredentialsAreAssumedRole, Vs as formatDockerLoginError, Vt as recordUnderIdIsNotOwn, Wi as refuseDivergentRecordRegionForDestroy, Wo as recordProvenPublicExpression, Ws as isMalformedEnvKey, Wt as orphanDeleteNeedsIdentity, X as bold, Xi as refuseMalformedOrphansForOrphan, Xo as WHOLE_DYNAMIC_REFERENCE_PATTERN, Xr as parameterTypeMayLoseSecretIdentity, Xs as warnFinchArgvExposure, Y as createReadOnlyAttributeHealerFactory, Yi as refuseMalformedOrphansForDestroy, Yo as TEMPLATE_SOURCED_RULES, Yr as isUnboundTemplateParameter, Ys as runDockerStreaming, Z as cyan, Za as prefetchCreateOnlyPropertyPaths, Zi as refuseMalformedOutputs, Zo as isSingleDynamicReferenceToken, Zr as getAccountInfo, Zs as escapeRegExp, _ as makeCanonicalizePropertiesFn, _a as repairMalformedResourceEntriesForReadOnly, _c as CFN_TEMPLATE_URL_LIMIT, _i as deployRefusesOrphanRowsReason, _n as extractDeploymentEventError, _o as hasMaskableValues, _r as isWaitAbandonedError, _s as stringifyValue, _t as withNestedRevertRun, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForOrphan, ac as loadCdkJson, ai as isStalePlaceholderArnAttribute, an as stateSecretNameNeedles, ao as TemplateParser, ar as TemplateNoEchoReresolver, as as exportNamesCarriedFrom, at as resourcesNamingDeclaredParameter, b as serviceTokenBlockingReason, ba as unpreviewableOrphanRecords, bc as uploadCfnTemplate, bi as hasReadableOutputs, bn as exportAliasCollisionScrubWarning, bo as printingCorpusOf, bs as createAssetRedirectResolver, bt as deleteJournaledOrphans, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForExport, cc as resolveCaptureObservedState, ci as withSharedDrainBudget, cn as buildFinalSnapshotIdentifier, co as maskWholeValue, cs as hasUnverifiableParameterRefusal, ct as NESTED_PENDING_PARENT_REASON, d as conditionInputsFrom, da as refuseMalformedResourcesForDestroy, dc as resolveStateBucketWithDefaultAndSource, di as JSON_LISTING_HOLE_VALUE, dn as effectiveDeletionPolicy, do as noEchoOutputsComparison, dr as slowCcOperationTimeoutMs, ds as isReadableBag, dt as dropSettledNestedJournals, ea as refuseMalformedResourceEntries, ec as getDockerImageBySourceHash, ei as carriesFetchableDynamicReference, en as completedReplayEntries, eo as withRetry, er as CC_BROKEN_REASON, es as S3StateBackend, et as red, f as parentSuppliedValues, fa as refuseMalformedResourcesForExport, fc as resolveUseCdkBootstrapAssets, fi as STATE_REGION_DIVERGED, fn as isFinalSnapshotError, fs as orphansAfterRollback, g as mergeNoChangeOutputs, ga as repairMalformedOutputsForReadOnly, gc as CFN_TEMPLATE_BODY_LIMIT, gi as accountArgs, gn as DeploymentEventsStore, go as createUnionSecretMasker, gs as isSensitiveAttributeName, gt as revertedNestedRowIds, h as keptWholeReasonText, ha as repairMalformedOrphansForReadOnly, hc as ssmResolvedValueType, hi as UNREADABLE_RESOURCES_MAP_ROW, hn as DeploymentEventsReader, ho as carryLogOnlyValues, hr as deleteSkipReason, hs as AssetPublisher, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForImportSave, ic as getLegacyStateBucketName, ii as cfnRefValueFromPhysicalId, in as secretNamePrintingBag, io as DagBuilder, ir as wouldReturnToSdkProvider, is as describeRegionValueKind, it as reachableDivergentParameters, ja as shownType, jc as hasOwnKey, ji as malformedOrphanRecordsWarning, jn as isExportAliasCollision, jo as DYNAMIC_REFERENCE_TOKEN_SCAN, jr as regionLessSecretName, js as validateAssetBucketName, k as perType, ka as hasNoCloudControlHandlers, kc as processStackMessages, ki as malformedLocalResourcesWarning, kn as collectDeclaredOutputNames, ko as redactSecretsForState, kr as classifyReplaySecretRegion, ks as parseBootstrapMarker, l as templateIdentity, la as refuseMalformedResourcePropertiesForOrphan, lc as resolveSkipPrefix, li as parameterInputsFor, ln as ccRoutedFinalSnapshotError, lo as maskedLeafCoordinatesOf, lr as withPrintingSecrets, ls as importableOutputKeys, lt as displacedOpClause, m as isSecretBearingReferenceString, ma as repairMalformedOrphanRecordsForReadOnly, mc as warnDeprecatedNoPrefixCliFlag, mi as UNREADABLE_ORPHANS_CONTAINER_ROW, mn as unsupportedFinalSnapshotError, mo as liveMatchesUnresolvedTokenFrame, mr as deleteIndeterminateGuards, ms as shouldRetainResource, mt as recordDisplacedSkips, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntriesForDestroy, nc as synthesisStatusMessage, ni as keepsSecretReferenceToken, nn as maskEventTextWithBoundBags, nr as ccBrokenReason, ns as splitImportedOps, nt as computeParameterTaint, o as isAbsoluteAssetPath, oa as refuseMalformedResourcePropertiesForDestroy, oc as resolveApp, oi as refStateLookupFromResource, on as ATOMIC_FINAL_SNAPSHOT_TYPES, oo as isMarkedCoordinate, or as readsNoEchoDeleteValues, os as hasReadableExportSet, ot as makeSiblingClaimReader, p as readRecordedConditionVerdicts, pa as refuseMalformedState, pc as stateBucketExistenceConfirmed, pi as STATE_RESOURCES_MALFORMED, pn as refusesFinalSnapshot, po as readsNoEchoSource, pr as UNSPECIFIED_SKIP_REASON, ps as orphansCarriedFrom, pt as nestedChildStackName$1, qi as refuseMalformedOrphanRecordsForDestroy, qo as STATE_SOURCED_CROSS_GENERATION_RULES, qs as redactedDockerCause, qt as inheritProducerRegions, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForImport, rc as getDefaultStateBucketName, ri as AWS_NO_VALUE, rn as orphanRecordsPrintingBag, rr as isCustomResource, rs as acceptedCreateOnlyDropsOf, rt as namesAnyDeclaredParameter, s as listNestedTemplateRows, sa as refuseMalformedResourcePropertiesForDrift, sc as resolveAutoAssetStorage, sn as PRE_DELETE_SNAPSHOT_TYPES, so as maskReadbackAtCoordinates, sr as isCustomResourceType$1, ss as hasReasonlessBaselineRefusal, st as planOrphanAdoption, t as DeployEngine, ta as refuseMalformedResourceEntriesForDeploy, tc as Synthesizer, ti as isNamelessDynamicReferenceError, tn as journaledOrphanPrintingBag, tr as ProviderRegistry, ts as rebuildClientForBucketRegion, tt as yellow, u as conditionFingerprint, ua as refuseMalformedResourcesForDeploy, uc as resolveStateBucketWithDefault, un as createPreDeleteFinalSnapshot, uo as noEchoLeavesOf, ur as CloudControlProvider, us as importableOutputs, ut as displacedPhysicalIdShown, v as deferredServiceTokenWarning, va as repairMalformedResourcePropertiesForReadOnly, vc as MIGRATE_TMP_PREFIX, vi as displayLogicalId, vn as WITHHELD_NAME_DISPLAY, vo as literalSplitDelimitersOf, vs as WorkGraph, w as noEchoParameterNamesOf, wa as findActionableSilentDrops, wc as PARTITION_TABLE, wi as malformedDriftResourcePropertiesWarning, wn as carriedExportAliasExposure, wo as createSecretMasker, ws as BOOTSTRAP_MARKER_PREFIX, wt as loadJournaledOrphans, x as withResourceDeadline, xa as unreadableOrphanRecords, xc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xi as hasReadableResources, xn as secretBearing, xo as recordLogOnlyParameterValue, xs as loadPublishableAssetManifest, xt as dropFailedHint, y as findServiceTokenRefusals, ya as repairMalformedResourcesForReadOnly, yc as findLargeInlineResources, yi as hasReadableOrphans, yn as displayTextOrWithheld, yo as logOnlyValueCount, ys as buildAssetRedirectMap, yt as withNestedStackContext, zc as resolveAssemblyPath, zi as malformedResourcePropertiesWarning, zn as RollbackInlinePolicyWriters, zo as carriesSecretMask, zr as applyCallerIdentityCredentials, zs as dockerSpawnEnvWithSensitive, zt as planRollback } from "./deploy-engine-4vPufRQF.js";
-import { t as getCdkdVersion } from "./version-3oP5vNZF.js";
+import { $ as gray, $a as templateResourceTypes, $i as refuseMalformedOutputsForDestroy, $o as STATE_SOURCED_BASELINE_RULES, $r as isImpossibleEmptyStoredAttribute, $s as redactDockerArgvValues, $t as updatePartialMessage, A as perType, Aa as hasNoCloudControlHandlers, Ac as expectedOwnerParam, Ai as malformedLocalResourcesWarning, An as collectDeclaredOutputNames, Ao as createSecretMasker, Ar as classifyReplaySecretRegion, As as AssetModeResolver, Bc as nullPrototypeRecord, Bi as malformedResourcePropertiesWarning, Bn as RollbackInlinePolicyWriters, Bo as pathCrossesDottedKey, Br as applyCallerIdentityCredentials, Bs as buildDenyExternalAccessPolicy, Bt as planRollback, C as noEchoComparisonForTemplate, Ca as unreadableResourceEntries, Cc as CFN_TEMPLATE_BODY_LIMIT, Ci as isReadableOrphanRecord, Cn as secretBearingStateKeyWarning, Co as hasMaskableValues, Cs as isSensitiveAttributeName, Ct as isHandledOrphan, D as recordedProtectionNote, Da as unwrittenCreateOnlyReplacement, Dc as uploadCfnTemplate, Di as malformedExportSourceWarning, Dn as exportNameSecretExposure, Do as recordLogOnlyParameterValue, Dr as INTRINSIC_KEYS, Ds as createAssetRedirectResolver, Dt as sameJournaledOrphans, E as recordedProtectionEvidence, Ec as findLargeInlineResources, Ei as malformedExportNamesWarning, En as exportNameNoEchoParameters, Eo as printingCorpusOf, Er as DiffCalculator, Es as buildAssetRedirectMap, Et as makeForeignHolderScan, Fa as isStatefulRecreateTargetSync, Fc as StageLoadError, Fi as malformedOrphansWarning, Fn as DEFAULT_RESOURCE_WARN_AFTER_MS, Fo as redactSecretsForState, Fr as assertSendableRoleArn, Fs as isCrossRegionRedirect, Ft as recordAfterRollbackUpdate, Gc as renderAssemblyPathEscape, Gi as refuseDivergentRecordRegionForDestroy, Go as carriesSecretMask, Gs as describeDockerFailure, Gt as orphanDeleteNeedsIdentity, Hc as absoluteAssemblyPathEscape, Hi as malformedScrubResourceEntriesRefusalMessage, Hn as ledgerForStack, Ho as inheritNestedStackParameterAssociations, Hr as envCredentialsAreAssumedRole, Hs as resolveDockerContextDirectory, Ht as recordUnderIdIsNotOwn, Ia as renderStatefulReason, Ic as processStackMessages, Ii as malformedOutputsRefusalMessage, In as maskingRetryLogger, Io as scrubResourceRecord, Ir as explicitRoleArnOrThrow, Is as parseBootstrapMarker, It as demoteSupersededOrphans, Jc as resolveBucketRegion, Ji as refuseMalformedOrphanRecordsForDestroy, Jo as recordMaskOnlyValuesIn, Js as formatDockerLoginError, Jt as inheritProducerRegions, Kc as resolveAssemblyPath, Ko as provenPublicValue, Ks as dockerSpawnEnvWithSensitive, Kt as findNestedStackTypeChanges, Lc as defineOwnKey, Li as malformedOutputsWarning, Ln as constructPathOf, Lo as DYNAMIC_REFERENCE_TOKEN_SCAN, Lr as isIamRoleArn, Ls as readBootstrapMarkerBody, Lt as isJournaledOrphan, Ma as shownType, Mc as canonicalizeRegion, Mi as malformedOrphanRecordsWarning, Mn as isExportAliasCollision, Mo as maskSecretsInError, Mr as regionLessSecretName, Ms as assertAssetBucketRegion, Na as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nc as derivePartitionAndUrlSuffix, Ni as malformedOrphanRowsKeptWarning, Nn as bindingSkippedOutputs, No as maskSecretsInText, Nr as applyRoleArnIfSet, Ns as ensureAssetStorage, Nt as withStackRecords, O as PROTECTION_PROPERTY_BY_TYPE, Oc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Oi as malformedLocalOutputsWarning, On as isWholeDynamicReferenceValue, Oo as recordLogOnlyValue, Or as IntrinsicFunctionResolver, Os as loadPublishableAssetManifest, Ot as replayFailedOperations, Pa as isStatefulRecreateTargetForReplace, Pc as AssemblyReader, Pi as malformedOrphansRefusalMessage, Pn as DEFAULT_RESOURCE_TIMEOUT_MS, Po as markSameGenerationBag, Pr as assertFlagRoleArn, Ps as getBootstrapMarkerKey, Pt as removeProtectionTypeList, Q as cyan, Qa as prefetchCreateOnlyPropertyPaths, Qi as refuseMalformedOutputs, Qo as wholeStringLeavesOf, Qr as getAccountInfo, Qs as partitionSensitiveEnv, Rc as hasOwnKey, Ri as malformedRenderedContainersWarning, Rn as findDestructiveChanges, Ro as dynamicReferenceTokens, Rr as sendableAssumeRoleCommand, Rs as validateAssetBucketName, Rt as isReplacementOrphan, S as noEchoAttributeNamesOf, Sa as unreadableOrphanRecords, Sc as ssmResolvedValueType, Si as hasReadableResources, Sn as secretBearing, So as createUnionSecretMasker, Ss as AssetPublisher, St as dropFailedHint, T as noEchoParameterNamesOf, Ta as findActionableSilentDrops, Tc as MIGRATE_TMP_PREFIX, Ti as malformedDriftResourcePropertiesWarning, Tn as carriedExportAliasExposure, To as logOnlyValueCount, Ts as WorkGraph, Tt as loadJournaledOrphans, Uc as describeFileReadFailure, Ui as malformedStateRefusalMessage, Uo as recordNestedStackParameterExpressions, Us as describeDockerCapturedOutput, Ut as replacementNeverSwapped, Vc as ownValue, Vi as malformedResourcesWarning, Vo as identityKeyFor, Vr as callerEnvCredentials, Vs as buildDockerImage, Vt as recheckFailedPlan, Wc as displayAssemblyPath, Wi as previewableOrphanRecords, Wn as withCreateTokenLedger, Ws as describeDockerExecFailure, Wt as resolveReplacementOldType, X as createReadOnlyAttributeHealerFactory, Xi as refuseMalformedOrphansForDestroy, Xo as recordNoEchoParameterFreshValue, Xr as isUnboundTemplateParameter, Xs as isDockerClientEnvKey, Y as formatResourceLine, Yi as refuseMalformedOrphans, Yo as recordNoEchoAttributeValues, Yr as coerceParameterTypedValue, Ys as getDockerCmd, Z as bold, Zi as refuseMalformedOrphansForOrphan, Zo as recordProvenPublicExpression, Zr as parameterTypeMayLoseSecretIdentity, Zs as isMalformedEnvKey, _ as makeCanonicalizePropertiesFn, _a as repairMalformedOutputsForReadOnly, _c as resolveStateBucketWithDefault, _i as accountArgs, _n as DeploymentEventsStore, _o as readbackPathFor, _s as importableOutputs, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForImportSave, ac as stripControlChars, ai as cfnRefValueFromPhysicalId, an as secretNamePrintingBag, ao as DagBuilder, ar as wouldReturnToSdkProvider, as as LockManager, at as reachableDivergentParameters, b as serviceTokenBlockingReason, ba as repairMalformedResourcesForReadOnly, bc as stateBucketExistenceConfirmed, bi as hasReadableOrphans, bn as displayTextOrWithheld, bo as liveMatchesUnresolvedTokenFrame, bs as orphansCarriedFrom, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForDrift, cc as Synthesizer, cn as PRE_DELETE_SNAPSHOT_TYPES, co as isMarkedCoordinate, cr as isCustomResourceType$1, cs as rebuildClientForBucketRegion, ct as planOrphanAdoption, d as conditionInputsFrom, da as refuseMalformedResourcesForDeploy, dc as getLegacyStateBucketName, dn as createPreDeleteFinalSnapshot, do as maskWholeValue, dr as CloudControlProvider, ds as describeRegionValueKind, dt as displacedPhysicalIdShown, ea as refuseMalformedResourceAttributesForOrphan, ec as redactedDockerCause, ei as carriesDynamicReference, en as updatePartialReason, eo as describeTypeWithThrottleRetry, es as STATE_SOURCED_CROSS_GENERATION_RULES, et as green, f as parentSuppliedValues, fa as refuseMalformedResourcesForDestroy, fc as loadCdkJson, fi as JSON_LISTING_HOLE_VALUE, fn as effectiveDeletionPolicy, fo as maskedLeafCoordinatesOf, fr as slowCcOperationTimeoutMs, fs as exportNamesCarriedFrom, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, ga as repairMalformedOrphansForReadOnly, gc as resolveSkipPrefix, gi as UNREADABLE_RESOURCES_MAP_ROW, gn as DeploymentEventsReader, gr as deleteSkipReason, gs as importableOutputKeys, h as keptWholeReasonText, ha as repairMalformedOrphanRecordsForReadOnly, hc as resolveCaptureObservedState, hi as UNREADABLE_ORPHANS_CONTAINER_ROW, hn as unsupportedFinalSnapshotError, ho as noEchoOutputsComparison, hr as deleteIndeterminateGuards, hs as hasUnverifiableParameterRefusal, ht as recordDisplacedSkips, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForImport, ic as escapeRegExp, ii as AWS_NO_VALUE, in as orphanRecordsPrintingBag, ir as isCustomResource, is as isSingleDynamicReferenceToken, it as namesAnyDeclaredParameter, j as readProtection, ja as findReplacedReadersOfRecreateTargets, jc as PARTITION_TABLE, ji as malformedOrphanRecordsRefusalMessage, jn as collectPublishedOutputNames, jo as errorCauseChain, jr as producerRegionsFromState, js as BOOTSTRAP_MARKER_PREFIX, jt as destroyStackRecordsView, k as isProtectionValueActive, ka as NO_CC_HANDLERS_REASON, kc as decodeListingKey, ki as malformedLocalResourceEntriesWarning, kn as noEchoParameterValueSeed, ko as shareLogOnlyValues, kr as poisonRenderedSpellingsCollidingIn, ks as rewriteTemplateAssetReferences, kt as replayRollback, l as templateIdentity, la as refuseMalformedResourcePropertiesForExport, lc as synthesisStatusMessage, li as withSharedDrainBudget, ln as buildFinalSnapshotIdentifier, lo as maskAtCoordinates, ls as splitImportedOps, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, ma as refuseMalformedState, mc as resolveAutoAssetStorage, mi as STATE_RESOURCES_MALFORMED, mn as refusesFinalSnapshot, mo as noEchoLeavesOf, mr as UNSPECIFIED_SKIP_REASON, ms as hasReasonlessBaselineRefusal, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntriesForDeploy, nc as runDockerStreaming, ni as isNamelessDynamicReferenceError, nn as journaledOrphanPrintingBag, nr as ProviderRegistry, ns as TEMPLATE_SOURCED_RULES, nt as yellow, o as isAbsoluteAssetPath, oa as refuseMalformedResourceEntriesForOrphan, oc as AssetManifestLoader, oi as isStalePlaceholderArnAttribute, on as stateSecretNameNeedles, oo as TemplateParser, or as TemplateNoEchoReresolver, os as isLockInfoExpired, ot as resourcesNamingDeclaredParameter, p as readRecordedConditionVerdicts, pa as refuseMalformedResourcesForExport, pc as resolveApp, pi as STATE_REGION_DIVERGED, pn as isFinalSnapshotError, po as noEchoCoordinatesOf, ps as hasReadableExportSet, qi as refuseMalformedOrphanRecords, qo as recordMaskOnlyValue, qs as finchSecretArgvRefusal, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForDestroy, rc as warnFinchArgvExposure, ri as keepsSecretReferenceToken, rn as maskEventTextWithBoundBags, rr as ccBrokenReason, rs as WHOLE_DYNAMIC_REFERENCE_PATTERN, rt as computeParameterTaint, s as listNestedTemplateRows, sa as refuseMalformedResourcePropertiesForDestroy, sc as getDockerImageBySourceHash, si as refStateLookupFromResource, sn as ATOMIC_FINAL_SNAPSHOT_TYPES, so as canonicalCoordinates, sr as readsNoEchoDeleteValues, ss as S3StateBackend, st as makeSiblingClaimReader, t as DeployEngine, ta as refuseMalformedResourceEntries, tc as runDockerForeground, ti as carriesFetchableDynamicReference, tn as completedReplayEntries, to as withRetry, tr as CC_BROKEN_REASON, ts as STATE_SOURCED_READBACK_RULES, tt as red, u as conditionFingerprint, ua as refuseMalformedResourcePropertiesForOrphan, uc as getDefaultStateBucketName, ui as parameterInputsFor, un as ccRoutedFinalSnapshotError, uo as maskReadbackAtCoordinates, ur as withPrintingSecrets, us as acceptedCreateOnlyDropsOf, ut as displacedOpClause, v as deferredServiceTokenWarning, va as repairMalformedResourceEntriesForReadOnly, vc as resolveStateBucketWithDefaultAndSource, vi as deployRefusesOrphanRowsReason, vn as extractDeploymentEventError, vo as readsNoEchoSource, vr as isWaitAbandonedError, vs as isReadableBag, vt as withNestedRevertRun, w as noEchoExactEchoLeavesOf, wa as withheldAccountClause, wc as CFN_TEMPLATE_URL_LIMIT, wi as isReadableResourceEntry, wn as secretSafeKeyDisplay, wo as literalSplitDelimitersOf, ws as stringifyValue, wt as journaledOrphanLines, x as withResourceDeadline, xa as unpreviewableOrphanRecords, xc as warnDeprecatedNoPrefixCliFlag, xi as hasReadableOutputs, xn as exportAliasCollisionScrubWarning, xo as carryLogOnlyValues, xs as shouldRetainResource, xt as deleteJournaledOrphans, y as findServiceTokenRefusals, ya as repairMalformedResourcePropertiesForReadOnly, yc as resolveUseCdkBootstrapAssets, yi as displayLogicalId, yn as WITHHELD_NAME_DISPLAY, yo as valueAtCoordinate, ys as orphansAfterRollback, zc as hasPlainPrototype, zi as malformedResourceEntriesWarning, zn as formatDestructiveChange, zo as isUncertifiedBaselineMaskPosition, zr as AWS_CREDENTIAL_ENV_KEYS, zs as validateContainerRepoName, zt as planFailedOps } from "./deploy-engine-DsF6NsaQ.js";
+import { t as getCdkdVersion } from "./version-BJxzX87A.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2396,7 +2396,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BcUBpRO1.js");
+	providerClasses ??= import("./provider-classes-C2uFHLt7.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -5621,12 +5621,13 @@ function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
 			continue;
 		}
 		const stateValue = outputs[exportName];
-		if (!carriesDynamicReference(stateValue)) continue;
+		if (!carriesDynamicReference(stateValue) && !carriesSecretMask(stateValue)) continue;
 		if (JSON.stringify(entry.value) === JSON.stringify(stateValue)) continue;
 		findings.push({
 			kind: "converge",
 			exportName,
-			stateValue
+			stateValue,
+			entryValue: entry.value
 		});
 	}
 	return {
@@ -6084,16 +6085,17 @@ async function scrubCommand(stacks, options) {
 			const absentNamed = (exportName, entryValue) => /[^A-Za-z0-9]/.test(exportName) ? "(name withheld: an export name, which may carry a secret)" : named(exportName, entryValue);
 			const named = (exportName, alsoMask) => renderStateKeyForLine(scrubbed.exportNameDisplay(exportName, alsoMask), "it may carry a secret");
 			const unwrittenNames = new Set(repair.unwritten);
+			const entryValueOf = new Map(repair.findings.map((finding) => [finding.exportName, finding.entryValue]));
 			for (const exportName of repair.unwritten) indexUnwritten.push({
 				region: stackRegion,
-				shown: named(exportName)
+				shown: named(exportName, entryValueOf.get(exportName))
 			});
 			for (const finding of repair.findings) if (finding.kind === "converge") {
 				indexConverged++;
-				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName, finding.entryValue)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
 				else {
 					totalIndexEntriesConverged++;
-					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName, finding.entryValue)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
 				}
 			} else {
 				totalIndexEntriesAbsent++;
@@ -7339,6 +7341,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const collisions = [];
 		let outputsSourceUntrusted = false;
 		let everyExportAliasReproduced = true;
+		const conditionalNameParameters = new Set(nestedInput?.noEchoConditionalParameters ?? []);
+		const noEchoNameParameters = /* @__PURE__ */ new Set([...noEchoParameterNamesOf(stack.template), ...(nestedInput?.noEchoParameters ?? []).filter((name) => !conditionalNameParameters.has(name))]);
+		const declaredAliasOf = /* @__PURE__ */ new Map();
+		const noEchoNameSeed = noEchoParameterValueSeed(stack.template.Parameters, parameters, inheritedSecrets);
 		const nestedRowParameters = /* @__PURE__ */ new Map();
 		await withSharedDrainBudget(async () => {
 			for (const logicalId of Object.keys(state.resources ?? {})) {
@@ -7470,7 +7476,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				const exportNameUnresolved = declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName));
 				if (typeof exportName === "string" && !exportNameUnresolved) accountedOutputKeys.add(exportName);
 				const literalCollision = typeof declaredExportName === "string" && isExportAliasCollision(declaredExportName, name, declaredOutputNames);
-				if (declaredExportName !== void 0 && !literalCollision && !(typeof exportName === "string" && !exportNameUnresolved && isReadableBag(state.outputs) && Object.hasOwn(state.outputs, exportName) && (knownExportNamesOf(state.exportNames)?.has(exportName) ?? (typeof declaredExportName === "string" || !declaredOutputNames.has(exportName))))) everyExportAliasReproduced = false;
+				const refusedForNoEcho = declaredExportName !== void 0 && !JSON.stringify(declaredExportName).includes("\"Fn::If\"") && (typeof exportName === "string" && !exportNameUnresolved && carriedExportAliasExposure(exportName, outputSecrets, noEchoNameSeed) !== void 0 || readsNoEchoSource(declaredExportName, { parameters: noEchoNameParameters }));
+				if (typeof exportName === "string" && !exportNameUnresolved) declaredAliasOf.set(name, exportName);
+				if (declaredExportName !== void 0 && !literalCollision && !refusedForNoEcho && !(typeof exportName === "string" && !exportNameUnresolved && isReadableBag(state.outputs) && Object.hasOwn(state.outputs, exportName) && (knownExportNamesOf(state.exportNames)?.has(exportName) ?? (typeof declaredExportName === "string" || !declaredOutputNames.has(exportName))))) everyExportAliasReproduced = false;
 				if (exportNameUnresolved) {
 					outputsSourceUntrusted = true;
 					logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
@@ -7521,6 +7529,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretBearingKeys.push(key);
 			logger.warn(secretBearingStateKeyWarning(stack.stackName, display));
 		}
+		const noEchoPlans = planScrubNoEcho(state, stack.template, perResourceTemplateProps, conditions, nestedInput?.noEchoParameters ?? [], nestedInput?.noEchoConditionalParameters ?? []);
 		const nestedChildren = [];
 		const nestedRowIds = /* @__PURE__ */ new Set();
 		for (const [logicalId, resource] of Object.entries(templateResources)) if (resource?.Type === NESTED_STACK_TYPE$1) nestedRowIds.add(logicalId);
@@ -7553,7 +7562,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				stackName: childStackName,
 				input: {
 					parameters,
-					inheritedSecrets: perResourceSecrets.get(logicalId) ?? /* @__PURE__ */ new Map()
+					inheritedSecrets: perResourceSecrets.get(logicalId) ?? /* @__PURE__ */ new Map(),
+					...(() => {
+						const filled = noEchoFilledRowParameters(templateResources[logicalId]?.Properties, noEchoPlans.sources, noEchoPlans.needleSources);
+						return {
+							noEchoParameters: filled.names,
+							...filled.conditional.length > 0 && { noEchoConditionalParameters: filled.conditional }
+						};
+					})()
 				}
 			});
 		}
@@ -7586,8 +7602,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const needles = new Map([...allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets), ...outputSecrets]);
 			return JSON.stringify(redactSecretsForState(value, needles)) !== JSON.stringify(value);
 		};
+		const noEchoPublicTokens = /* @__PURE__ */ new Set([region, stack.stackName]);
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
-		if (totalSecrets === 0) {
+		if (totalSecrets === 0 && !noEchoPlans.changesAny) {
 			emitAbandonedScanNotes();
 			return {
 				...await purgeExaminedHistory(loaded.migrationPending),
@@ -7621,8 +7638,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				properties: redactSecretsForState(record.properties, ownSecrets, templateProps, TEMPLATE_SOURCED_RULES)
 			} : record;
 			const scrubbed = secrets || templateProps ? scrubResourceRecord(positioned, ownSecrets, void 0, STATE_SOURCED_CROSS_GENERATION_RULES) : record;
-			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
-			newResources[logicalId] = scrubbed;
+			const plan = noEchoPlans.byLogicalId.get(logicalId);
+			const migrationNeedles = scrubMigrationNeedles(plan, noEchoPublicTokens);
+			const written = applyScrubNoEcho(migrationNeedles === void 0 ? scrubbed : scrubResourceRecord(scrubbed, migrationNeedles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES), record, plan);
+			if (JSON.stringify(written) !== JSON.stringify(record)) recordsChanged++;
+			newResources[logicalId] = written;
 		}
 		const newOrphans = (state.orphans ?? []).map((record, orphanIndex) => {
 			const own = orphanSecrets.get(String(orphanIndex));
@@ -7667,9 +7687,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const producer = list === "imports" ? `producer ${displayStackName(maskSecretsInText(entry.sourceStack, crossStackNeedles))}, ` : "";
 			logger.warn(safeMsg`Scrub of ${shownStack}: state.${list}[${index}] (${producer}${displayIdent(String(entry.sourceRegion))}) ` + "holds a cross-stack read name in plaintext that has the shape of a secret-bearing read in today's template but not the secret's current value — most likely a value from before the secret was ROTATED. Scrub cannot repair it (it matches only the current value) and does not print it; treat that earlier value as exposed. A deploy " + safeMsg`that updates ${shownStack} rewrites this list from the reads it performs.`);
 		}
-		const redactedOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+		const noEchoMaskedOutputs = maskScrubNoEchoOutputs(redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets)), noEchoPlans.outputKeys, new Set(Object.keys(stack.template.Outputs ?? {})), declaredAliasOf);
 		emitAbandonedScanNotes();
-		let newOutputs = redactedOutputs;
+		let newOutputs = noEchoMaskedOutputs;
 		let newExportNames = state.exportNames;
 		let droppedOutputKeys = 0;
 		let keptReadOutputKeys = 0;
@@ -7677,11 +7697,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		let droppedOutputReadersUnverified = false;
 		const droppedDisplayCorpus = /* @__PURE__ */ new Map();
 		const withheldOutputKeys = /* @__PURE__ */ new Set();
-		if (isReadableBag(state.outputs) && isReadableBag(redactedOutputs)) {
+		if (isReadableBag(state.outputs) && isReadableBag(noEchoMaskedOutputs)) {
 			const stored = state.outputs;
 			const plan = planUnnamedOutputDrop({
 				stored,
-				rewritten: redactedOutputs,
+				rewritten: noEchoMaskedOutputs,
 				accountedKeys: accountedOutputKeys,
 				reportedKeys: new Set(secretBearingKeys),
 				exportNames: state.exportNames,
@@ -7715,7 +7735,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				}
 				if (dropping.size > 0) {
 					droppedOutputKeys = dropping.size;
-					newOutputs = Object.fromEntries(Object.entries(redactedOutputs).filter(([key]) => !dropping.has(key)));
+					newOutputs = Object.fromEntries(Object.entries(noEchoMaskedOutputs).filter(([key]) => !dropping.has(key)));
 					if (Array.isArray(state.exportNames)) newExportNames = state.exportNames.filter((name) => !(typeof name === "string" && dropping.has(name)));
 					logger.info(safeMsg`${opts.dryRun ? "Would drop" : "Dropped"} ${dropping.size} output key(s) from ` + safeMsg`${shownStack} that its template no longer declares: ${shownKeys(dropping)}. ` + "Their values are not printed: scrub could not identify them as a secret's plaintext, and left beside the references it writes, cdkd diff would print them. A deploy of today's template does not write them either.");
 				}
@@ -7798,6 +7818,179 @@ function createScrubCommand() {
 	cmd.action(withErrorHandling(scrubCommand));
 	return cmd;
 }
+function planScrubNoEcho(state, template, templateProps, conditions, passedParameters = [], conditionalParameters = []) {
+	const byLogicalId = /* @__PURE__ */ new Map();
+	const parameters = /* @__PURE__ */ new Set([...noEchoParameterNamesOf(template), ...passedParameters]);
+	const resources = state.resources ?? {};
+	const declared = /* @__PURE__ */ new Map();
+	for (const [id, record] of Object.entries(resources)) declared.set(id, new Set(noEchoAttributeNamesOf(record) ?? []));
+	const sources = {
+		parameters,
+		attributeIsNoEcho: (id, attribute) => declared.get(id)?.has(attribute) === true,
+		...Object.keys(conditions).length > 0 && { conditions }
+	};
+	const persisted = (value) => carriesSecretMask(value) || typeof value === "string" && isSingleDynamicReferenceToken(value);
+	const templateResources = template.Resources ?? {};
+	const eligible = Object.entries(resources).filter(([logicalId, record]) => templateProps.has(logicalId) && Object.hasOwn(templateResources, logicalId) && templateResources[logicalId]?.Type === record.resourceType);
+	const positionFrom = (params, names) => {
+		const from = {
+			...sources,
+			parameters: params,
+			attributeIsNoEcho: (id, attribute) => names.get(id)?.has(attribute) === true
+		};
+		const leavesOf = /* @__PURE__ */ new Map();
+		for (let round = 0; round <= eligible.length; round++) {
+			let grew = false;
+			for (const [logicalId, record] of eligible) {
+				const own = noEchoLeavesOf(record);
+				const leaves = canonicalCoordinates(own ?? noEchoCoordinatesOf(templateProps.get(logicalId), record.properties, from));
+				leavesOf.set(logicalId, leaves);
+				for (const [name, attribute] of Object.entries(record.attributes ?? {})) {
+					if (attribute === record.physicalId || persisted(attribute)) continue;
+					const echoes = leaves.some((coordinate) => coordinate[0] === name && JSON.stringify(valueAtCoordinate(record.properties, coordinate)) === JSON.stringify(attribute));
+					const recordNames = names.get(logicalId);
+					if (echoes && !recordNames.has(name)) {
+						recordNames.add(name);
+						grew = true;
+					}
+				}
+			}
+			if (!grew) break;
+		}
+		return leavesOf;
+	};
+	const leavesOf = positionFrom(parameters, declared);
+	const conditional = new Set(conditionalParameters);
+	const needleParameters = new Set([...parameters].filter((name) => !conditional.has(name)));
+	const needleDeclared = conditional.size === 0 ? declared : new Map(Object.entries(resources).map(([id, record]) => [id, new Set(noEchoAttributeNamesOf(record) ?? [])]));
+	const needleLeavesOf = conditional.size === 0 ? leavesOf : positionFrom(needleParameters, needleDeclared);
+	let changesAny = false;
+	for (const [logicalId, record] of eligible) {
+		const leaves = leavesOf.get(logicalId) ?? [];
+		const attributeNames = [...declared.get(logicalId) ?? []].sort();
+		if (leaves.length === 0 && attributeNames.length === 0) continue;
+		const stored = [];
+		const needleCoordinates = new Set((needleLeavesOf.get(logicalId) ?? []).map((coordinate) => JSON.stringify(coordinate)));
+		for (const coordinate of leaves) {
+			const value = valueAtCoordinate(record.properties, coordinate);
+			if (value === void 0 || value === null || persisted(value)) continue;
+			stored.push({
+				coordinate,
+				value,
+				needle: needleCoordinates.has(JSON.stringify(coordinate))
+			});
+		}
+		byLogicalId.set(logicalId, {
+			leaves,
+			stored,
+			attributeNames
+		});
+		const unmaskedAttribute = attributeNames.some((name) => Object.hasOwn(record.attributes ?? {}, name) && !persisted(record.attributes[name]));
+		if (stored.length > 0 || unmaskedAttribute || leaves.length > 0 && JSON.stringify(record.noEchoLeaves) !== JSON.stringify(leaves)) changesAny = true;
+	}
+	const outputSources = {
+		parameters,
+		attributeIsNoEcho: sources.attributeIsNoEcho
+	};
+	const outputKeys = [];
+	const stored = state.outputs;
+	if (stored !== null && typeof stored === "object" && !Array.isArray(stored)) for (const [key, output] of Object.entries(template.Outputs ?? {})) {
+		if (!Object.hasOwn(stored, key)) continue;
+		const value = stored[key];
+		if (value === void 0 || value === null || persisted(value)) continue;
+		if (!readsNoEchoSource(output?.Value, outputSources)) continue;
+		outputKeys.push(key);
+	}
+	if (outputKeys.length > 0) changesAny = true;
+	return {
+		byLogicalId,
+		outputKeys,
+		changesAny,
+		parameters,
+		sources: outputSources,
+		needleSources: {
+			parameters: needleParameters,
+			attributeIsNoEcho: (id, attribute) => needleDeclared.get(id)?.has(attribute) === true
+		}
+	};
+}
+function scrubMigrationNeedles(plan, publicTokens) {
+	if (plan === void 0 || plan.stored.length === 0) return void 0;
+	const needles = /* @__PURE__ */ new Map();
+	for (const { value, needle } of plan.stored) if (needle) recordNoEchoParameterFreshValue(value, needles, publicTokens);
+	return needles.size > 0 ? needles : void 0;
+}
+function maskScrubNoEchoOutputs(outputs, keys, declared, aliasOf) {
+	if (outputs === void 0 || keys.length === 0) return outputs;
+	const ownAliases = new Set(keys.flatMap((key) => aliasOf.has(key) ? [aliasOf.get(key)] : []));
+	const otherAliases = new Set([...aliasOf].filter(([key]) => !keys.includes(key)).map(([, alias]) => alias));
+	const spelled = new Set(keys.filter((key) => Object.hasOwn(outputs, key)).map((key) => JSON.stringify(outputs[key])));
+	const masked = nullPrototypeRecord();
+	for (const [key, value] of Object.entries(outputs)) {
+		const byValue = !declared.has(key) && !otherAliases.has(key) && spelled.has(JSON.stringify(value));
+		masked[key] = keys.includes(key) || ownAliases.has(key) || byValue ? maskWholeValue(value) : value;
+	}
+	return masked;
+}
+function applyScrubNoEcho(scrubbed, record, plan) {
+	if (plan === void 0) return scrubbed;
+	const { leaves, attributeNames } = plan;
+	const next = {
+		...scrubbed,
+		properties: maskAtCoordinates(scrubbed.properties, leaves),
+		...leaves.length > 0 && { noEchoLeaves: leaves.map((coordinate) => [...coordinate]) },
+		...scrubbed.observedProperties !== void 0 && { observedProperties: maskReadbackAtCoordinates(scrubbed.observedProperties, record.properties, leaves) }
+	};
+	const marked = new Set(leaves.map((coordinate) => JSON.stringify(coordinate)));
+	const exact = noEchoExactEchoLeavesOf(scrubbed);
+	if (exact !== void 0) {
+		const kept = exact.filter((coordinate) => marked.has(JSON.stringify(coordinate)));
+		if (kept.length > 0) next.noEchoExactEchoLeaves = kept;
+		else delete next.noEchoExactEchoLeaves;
+	}
+	const attributes = next.attributes;
+	if (attributes !== void 0 && attributes !== null && attributeNames.length > 0) {
+		const masked = { ...attributes };
+		for (const name of attributeNames) if (Object.hasOwn(masked, name)) masked[name] = maskWholeValue(masked[name]);
+		next.attributes = masked;
+		next.noEchoAttributeNames = [...attributeNames];
+	}
+	return next;
+}
+function withoutFnIf(value) {
+	if (Array.isArray(value)) return value.map(withoutFnIf);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.hasOwn(value, "Fn::If")) return null;
+	const out = nullPrototypeRecord();
+	for (const [key, inner] of Object.entries(value)) out[key] = withoutFnIf(inner);
+	return out;
+}
+function noEchoFilledRowParameters(rowProperties, sources, needleSources) {
+	const names = [];
+	const conditional = [];
+	if (rowProperties === null || typeof rowProperties !== "object") return {
+		names,
+		conditional
+	};
+	const passed = rowProperties["Parameters"];
+	if (passed === null || typeof passed !== "object" || Array.isArray(passed)) return {
+		names,
+		conditional
+	};
+	const unconditioned = {
+		parameters: sources.parameters,
+		...sources.attributeIsNoEcho !== void 0 && { attributeIsNoEcho: sources.attributeIsNoEcho }
+	};
+	for (const [name, value] of Object.entries(passed)) {
+		if (!readsNoEchoSource(value, unconditioned)) continue;
+		names.push(name);
+		if (!readsNoEchoSource(withoutFnIf(value), needleSources)) conditional.push(name);
+	}
+	return {
+		names,
+		conditional
+	};
+}
 
 //#endregion
 //#region src/analyzer/drift-normalize.ts
@@ -7979,33 +8172,60 @@ function equalModuloMask(state, aws, mask) {
 	if (aKeys.length !== Object.keys(bObj).length) return false;
 	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMask(aObj[key], bObj[key], mask));
 }
-function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked) {
+function equalModuloMarkedMask(state, aws, mask, coordinate, isMarked, isWithinMarked = isMarked) {
 	const a = jsonForm(state);
 	const b = jsonForm(aws);
-	if (isMarked(coordinate) && isWhollyMask(a, mask)) return b !== void 0 && b !== null;
+	if (isMarked(coordinate) && b !== void 0 && b !== null) {
+		if (a === mask) return true;
+		if (isWithinMarked(coordinate) ? isWhollyMask(a, mask) : sameJson(a, wholeMaskOf(b, mask))) return holdsMask(a, mask);
+	}
 	if (a === mask && typeof b === "string") return true;
 	if (a === b) return true;
 	if (a === null || b === null || a === void 0 || b === void 0) return a === b;
 	if (typeof a !== typeof b || typeof a !== "object") return false;
 	if (Array.isArray(a) || Array.isArray(b)) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked));
+		return a.every((v, i) => equalModuloMarkedMask(v, b[i], mask, [...coordinate, i], isMarked, isWithinMarked));
 	}
 	const aObj = a;
 	const bObj = b;
 	const aKeys = Object.keys(aObj);
 	if (aKeys.length !== Object.keys(bObj).length) return false;
-	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked));
+	return aKeys.every((key) => Object.prototype.hasOwnProperty.call(bObj, key) && equalModuloMarkedMask(aObj[key], bObj[key], mask, [...coordinate, key], isMarked, isWithinMarked));
+}
+function wholeMaskOf(value, mask) {
+	if (value === null || value === void 0) return value;
+	if (Array.isArray(value)) return value.map((v) => wholeMaskOf(v, mask));
+	if (isPlainObject(value)) return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, wholeMaskOf(v, mask)]));
+	return mask;
 }
 function isWhollyMask(value, mask) {
+	const walk = (node) => {
+		if (node === mask || node === null) return true;
+		if (Array.isArray(node)) return node.every(walk);
+		if (isPlainObject(node)) return Object.values(node).every(walk);
+		return false;
+	};
+	return walk(value) && holdsMask(value, mask);
+}
+function holdsMask(value, mask) {
 	if (value === mask) return true;
-	if (Array.isArray(value)) return value.length > 0 && value.every((v) => isWhollyMask(v, mask));
-	if (isPlainObject(value)) {
-		const values = Object.values(value);
-		return values.length > 0 && values.every((v) => isWhollyMask(v, mask));
-	}
+	if (Array.isArray(value)) return value.some((v) => holdsMask(v, mask));
+	if (isPlainObject(value)) return Object.values(value).some((v) => holdsMask(v, mask));
 	return false;
 }
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null || typeof a !== "object" || typeof b !== "object") return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((v, i) => sameJson(v, b[i]));
+	}
+	const aObj = a;
+	const bObj = b;
+	const keys = Object.keys(aObj);
+	return keys.length === Object.keys(bObj).length && keys.every((k) => Object.prototype.hasOwnProperty.call(bObj, k) && sameJson(aObj[k], bObj[k]));
+}
 function isPlainObject(value) {
 	return typeof value === "object" && value !== null;
 }
@@ -8907,6 +9127,7 @@ function partitionNoEchoParameterChanges(changes, record, baseline) {
 	};
 	const properties = record.properties ?? {};
 	const isMarked = (coordinate) => isMarkedCoordinate(coordinate, marked) || marked.some((leaf) => leaf.length > coordinate.length && coordinate.every((segment, i) => String(segment) === String(leaf[i])));
+	const isWithinMarked = (coordinate) => marked.some((leaf) => leaf.length <= coordinate.length && leaf.every((segment, i) => String(segment) === String(coordinate[i])));
 	const kept = [];
 	const noEchoParameterPaths = [];
 	for (const change of changes) {
@@ -8915,7 +9136,7 @@ function partitionNoEchoParameterChanges(changes, record, baseline) {
 			const n = Math.min(leaf.length, coordinate.length);
 			for (let i = 0; i < n; i++) if (leaf[i] !== coordinate[i]) return false;
 			return true;
-		}) && carriesSecretMask(change.stateValue) && !pathCrossesDottedKey(properties, change.path) && !pathCrossesDottedKey(baseline, change.path) && equalModuloMarkedMask(change.stateValue, change.awsValue, "***", coordinate, isMarked)) {
+		}) && carriesSecretMask(change.stateValue) && !pathCrossesDottedKey(properties, change.path) && !pathCrossesDottedKey(baseline, change.path) && equalModuloMarkedMask(change.stateValue, change.awsValue, "***", coordinate, isMarked, isWithinMarked)) {
 			noEchoParameterPaths.push(change.path);
 			continue;
 		}
@@ -9432,12 +9653,14 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — after redaction cdkd state holds a different value at that property. Usually an unresolved '{{resolve:...}}' reference sits there and wins over an accepted value (change the template if that reference is wrong); a readback value cdkd cannot compare is never called recorded.`);
 				}
 				if (recordedChanges > 0) acceptedResourceCount++;
+				const written = maskMarkedNoEchoBaselineWithLeaves(redactedBaseline, existing, hasObserved);
 				resources[outcome.logicalId] = hasObserved ? {
 					...existing,
-					observedProperties: redactedBaseline
+					observedProperties: written.baseline
 				} : {
 					...existing,
-					properties: redactedBaseline
+					properties: written.baseline,
+					...written.noEchoLeaves !== void 0 && { noEchoLeaves: written.noEchoLeaves }
 				};
 			}
 			const { skippedOutputs: _droppedByAccept, ...carriedState } = report.state;
@@ -10047,12 +10270,13 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						}
 						if (!changed) continue;
 						recordedCount++;
+						const writtenBaseline = maskMarkedNoEchoBaseline(newBaseline, existing, hasObserved);
 						resources[logicalId] = hasObserved ? {
 							...existing,
-							observedProperties: newBaseline
+							observedProperties: writtenBaseline
 						} : {
 							...existing,
-							properties: newBaseline
+							properties: writtenBaseline
 						};
 					}
 					let reRecordedCount = 0;
@@ -10429,6 +10653,35 @@ function createDriftCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+function maskMarkedNoEchoBaseline(baseline, record, observed) {
+	return maskMarkedNoEchoBaselineWithLeaves(baseline, record, observed).baseline;
+}
+function maskMarkedNoEchoBaselineWithLeaves(baseline, record, observed) {
+	const marked = noEchoLeavesOf(record) ?? [];
+	if (observed) {
+		const coordinates = [...marked, ...maskedLeafCoordinatesOf(record.properties ?? {})];
+		return { baseline: coordinates.length === 0 ? baseline : maskReadbackAtCoordinates(baseline, record.properties ?? {}, coordinates) };
+	}
+	if (marked.length === 0) return { baseline };
+	const recorded = record.properties ?? {};
+	const listPathOf = (coordinate) => {
+		const list = coordinate.findIndex((segment) => typeof segment === "number");
+		return list < 0 ? void 0 : coordinate.slice(0, list);
+	};
+	const replaced = marked.filter((coordinate) => {
+		const path = listPathOf(coordinate);
+		if (path === void 0) return false;
+		const underList = marked.filter((other) => other.length > path.length && path.every((segment, i) => segment === other[i]));
+		return JSON.stringify(valueAtCoordinate(maskAtCoordinates(baseline, underList), path)) !== JSON.stringify(valueAtCoordinate(maskAtCoordinates(recorded, underList), path));
+	});
+	const byIndex = maskAtCoordinates(baseline, marked.filter((coordinate) => !replaced.includes(coordinate)));
+	if (replaced.length === 0) return { baseline: byIndex };
+	const widened = replaced.map((coordinate) => readbackPathFor(byIndex, recorded, coordinate)).filter((path, i) => path !== void 0 && path.length < replaced[i].length);
+	return {
+		baseline: maskReadbackAtCoordinates(byIndex, recorded, replaced),
+		...widened.length > 0 && { noEchoLeaves: canonicalCoordinates([...marked, ...widened]) }
+	};
+}
 
 //#endregion
 //#region src/cli/commands/stack-lock-guard.ts
@@ -14289,15 +14542,16 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			continue;
 		}
 		const noEchoLeaves = noEchoLeavesOf(stateEntry);
-		if (noEchoLeaves !== void 0 && noEchoLeaves.length > 0 && carriesSecretMask(stateEntry.properties) && !carriesSecretMask(withoutCoordinates(stateEntry.properties, noEchoLeaves))) {
+		const masksOnlyAtNoEchoLeaves = noEchoLeaves !== void 0 && noEchoLeaves.length > 0 && carriesSecretMask(stateEntry.properties) && !carriesSecretMask(withoutCoordinates(stateEntry.properties, noEchoLeaves));
+		if (masksOnlyAtNoEchoLeaves && IMPORT_UNSUPPORTED_RECREATABLE_TYPES.has(resourceType) && noEchoLeaves.some((coordinate) => typeof coordinate[0] === "string" && NOECHO_PRE_DELETE_KEYS.has(coordinate[0]))) {
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "a NoEcho template parameter feeds at least one property, and cdkd state holds only the redaction mask ('***') there, so the export has no value to declare for it. Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
+				reason: "a NoEcho template parameter feeds a property this resource's pre-delete reads (its principals or its name), and cdkd state holds only the redaction mask ('***') there, so the export cannot tell what to remove. Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
 			});
 			continue;
 		}
-		if (carriesSecretMask(stateEntry.properties)) {
+		if (!masksOnlyAtNoEchoLeaves && carriesSecretMask(stateEntry.properties)) {
 			blocked.push({
 				logicalId,
 				resourceType,
@@ -14388,6 +14642,14 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			continue;
 		}
 		const propertiesOverlay = resolved.propertiesOverlay ?? resolved.resourceIdentifier;
+		if ((JSON.stringify(resolved.resourceIdentifier).includes("***") || JSON.stringify(propertiesOverlay).includes("***")) && !(carriesSecretMask(resolved.resourceIdentifier) || carriesSecretMask(propertiesOverlay))) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: "the CloudFormation import identifier of this resource embeds the redaction mask ('***'): it is built from a value cdkd stores only as the mask (a NoEcho value). Export this stack without that resource and adopt it into CloudFormation by hand, passing the parameter value yourself."
+			});
+			continue;
+		}
 		if (carriesSecretMask(resolved.resourceIdentifier) || carriesSecretMask(propertiesOverlay)) {
 			blocked.push({
 				logicalId,
@@ -15202,28 +15464,31 @@ async function resolveChildImportParameters(parentTemplate, parentResolverContex
 	const stillSkipped = [];
 	for (const key of base.intrinsicSkipped) {
 		const intrinsicValue = rawParams[key];
+		let result;
 		try {
-			const result = await resolver.resolve(intrinsicValue, parentResolverContext);
-			if (result === void 0 || result === null) {
-				stillSkipped.push(key);
-				continue;
-			}
-			if (typeof result === "string") resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: result
-			});
-			else if (typeof result === "number" || typeof result === "boolean") resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: String(result)
-			});
-			else if (Array.isArray(result)) resolvedParams.push({
-				ParameterKey: key,
-				ParameterValue: result.map((e) => String(e)).join(",")
-			});
-			else stillSkipped.push(key);
+			result = await resolver.resolve(intrinsicValue, parentResolverContext);
 		} catch {
 			stillSkipped.push(key);
+			continue;
+		}
+		if (JSON.stringify(result ?? null).includes("***")) throw new CdkdError(`Cannot export the nested stack row ${quotedOrNotShown(childLogicalId)}: its parameter ${quotedOrNotShown(key)} resolves from a value cdkd stores only as the redaction mask (***), a NoEcho value, so the export has no value to pass to the child. Export the stack without that nested stack and adopt it into CloudFormation by hand, passing the parameter value yourself.`, "EXPORT_MASKED_CHILD_PARAMETER");
+		if (result === void 0 || result === null) {
+			stillSkipped.push(key);
+			continue;
 		}
+		if (typeof result === "string") resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: result
+		});
+		else if (typeof result === "number" || typeof result === "boolean") resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: String(result)
+		});
+		else if (Array.isArray(result)) resolvedParams.push({
+			ParameterKey: key,
+			ParameterValue: result.map((e) => String(e)).join(",")
+		});
+		else stillSkipped.push(key);
 	}
 	return {
 		params: resolvedParams,
@@ -15803,6 +16068,12 @@ function createExportCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+const NOECHO_PRE_DELETE_KEYS = /* @__PURE__ */ new Set([
+	"Roles",
+	"Users",
+	"Groups",
+	"PolicyName"
+]);
 function withoutCoordinates(bag, coordinates) {
 	const placeholder = Symbol("noecho-leaf");
 	const marked = coordinates.reduce((current, coordinate) => replaceAtCoordinate(current, coordinate, placeholder), bag);
@@ -19634,6 +19905,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stateBackend,
 		stackName: stackState.stackName
 	};
+	const noEchoInputs = /* @__PURE__ */ new Map();
 	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
 		const unresolvedProperties = resource.properties ?? {};
@@ -19644,6 +19916,11 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 				recordedSecretValues
 			});
 			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
+			noEchoInputs.set(logicalId, {
+				template: unresolvedProperties,
+				resolved,
+				attributes: resource.attributes
+			});
 		} catch (err) {
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(describeAwsFailure(err).detail, recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
@@ -19675,8 +19952,94 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			logger.warn(`${refusedHere.length} resource(s) in ${displayStackName(stackState.stackName)} depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
 		}
 	}
+	positionImportedNoEcho(stackState, noEchoInputs, template, conditions, unsafeObservedBaselineLogicalIds, logger);
 	return unsafeObservedBaselineLogicalIds;
 }
+function positionImportedNoEcho(stackState, inputs, template, conditions, refusals, logger) {
+	if (inputs.size === 0) return;
+	const resources = stackState.resources ?? {};
+	const declared = /* @__PURE__ */ new Map();
+	for (const [id, record] of Object.entries(resources)) {
+		const names = noEchoAttributeNamesOf(record);
+		if (names !== void 0) declared.set(id, new Set(names));
+	}
+	const sources = {
+		parameters: noEchoParametersOrAll(template),
+		attributeIsNoEcho: (id, attribute) => declared.get(id)?.has(attribute) === true,
+		...Object.keys(conditions).length > 0 && { conditions }
+	};
+	const leavesOf = /* @__PURE__ */ new Map();
+	const failed = /* @__PURE__ */ new Map();
+	for (let round = 0; round <= inputs.size; round++) {
+		let grew = false;
+		for (const [id, input] of inputs) {
+			let leaves = failed.get(id);
+			if (leaves === void 0) try {
+				leaves = canonicalCoordinates(noEchoCoordinatesOf(input.template, input.resolved, sources));
+			} catch (err) {
+				logger.debug(safeMsg`NoEcho position walk failed for imported ${id}: ${err instanceof Error ? err.name : typeof err} — masking each property that reads a NoEcho source whole and refusing its baseline, fail-closed.`);
+				leaves = topLevelNoEchoProperties(input.template, sources);
+				failed.set(id, leaves);
+				refusals.add(id);
+			}
+			leavesOf.set(id, leaves);
+			const physicalId = Object.hasOwn(resources, id) ? resources[id].physicalId : void 0;
+			for (const [name, attribute] of Object.entries(input.attributes ?? {})) {
+				if (attribute === physicalId) continue;
+				if (!leaves.some((coordinate) => coordinate[0] === name && JSON.stringify(valueAtCoordinate(input.resolved, coordinate)) === JSON.stringify(attribute))) continue;
+				let names = declared.get(id);
+				if (names === void 0) {
+					names = /* @__PURE__ */ new Set();
+					declared.set(id, names);
+				}
+				if (!names.has(name)) {
+					names.add(name);
+					grew = true;
+				}
+			}
+		}
+		if (!grew) break;
+	}
+	for (const [id, leaves] of leavesOf) {
+		if (!Object.hasOwn(resources, id)) continue;
+		const resource = resources[id];
+		if (leaves.length > 0) {
+			resource.properties = maskAtCoordinates(resource.properties, leaves);
+			resource.noEchoLeaves = leaves.map((coordinate) => [...coordinate]);
+		}
+		const echoed = [...declared.get(id) ?? []].filter((name) => resource.attributes !== void 0 && Object.hasOwn(resource.attributes, name));
+		if (echoed.length > 0 && resource.attributes !== void 0) {
+			const attributes = { ...resource.attributes };
+			for (const name of echoed) attributes[name] = maskWholeValue(attributes[name]);
+			resource.attributes = attributes;
+			resource.noEchoAttributeNames = [.../* @__PURE__ */ new Set([...noEchoAttributeNamesOf(resource) ?? [], ...echoed])].sort();
+		}
+	}
+}
+function topLevelNoEchoProperties(template, sources) {
+	const leaves = [];
+	for (const [key, value] of Object.entries(template)) {
+		let reads;
+		try {
+			reads = readsNoEchoSource(value, sources);
+		} catch {
+			reads = true;
+		}
+		if (reads) leaves.push([key]);
+	}
+	return canonicalCoordinates(leaves);
+}
+function noEchoParametersOrAll(template) {
+	try {
+		return noEchoParameterNamesOf(template);
+	} catch {
+		try {
+			return new Set(Object.keys(template.Parameters ?? {}));
+		} catch {
+			return /* @__PURE__ */ new Set();
+		}
+	}
+}
 const DYNAMIC_REFERENCE_OPENER = "{{resolve:";
 function countDynamicReferenceOpeners(bag) {
 	let text;
@@ -19823,7 +20186,10 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
-			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+			if (observed !== void 0 && observed !== RESOURCE_NOT_FOUND) {
+				const marked = noEchoLeavesOf(resource) ?? [];
+				resource.observedProperties = redactSecretsForState(marked.length > 0 ? maskReadbackAtCoordinates(observed, resource.properties ?? {}, marked) : observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+			}
 		} catch (err) {
 			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
@@ -27379,4 +27745,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program--_T76pFz.js.map
+//# sourceMappingURL=program-CXVhqA7j.js.map