@go-to-k/cdkd 0.288.2 → 0.288.3

package/dist/{program-BRon74Fc.js → program-BXH3FeeV.js}

@@ -1,8 +1,8 @@
-import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-Cxt3gn8N.js";
+import { $ as ProviderRegistry, $n as redactDockerArgvValues, $r as ResourceUpdateNotSupportedError, $t as STATE_SOURCED_READBACK_RULES, A as renderStatefulReason, An as createAssetRedirectResolver, Ar as AssemblyReader, At as configStringRefusal, B as red, Bn as readBootstrapMarkerBody, Bt as s3BucketDualStackDomainName, C as refusesFinalSnapshot, Cn as importableOutputKeys, Cr as uploadCfnTemplate, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as stringifyValue, Dr as PARTITION_TABLE, Dt as assertRegionMatch, E as extractDeploymentEventError, En as AssetPublisher, Er as expectedOwnerParam, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as assertAssetBucketRegion, Fr as getAwsClients, Ft as requireConfigString, G as isExportAliasCollision, Gn as buildDockerImage, Gr as IntrinsicResolutionRefusalError, Gt as INTRINSIC_KEYS, H as collectDeclaredOutputNames, Hn as validateContainerRepoName, Ht as s3BucketWebsiteUrl, I as bold, In as ensureAssetStorage, Ir as resetAwsClients, It as classifyReplaySecretRegion, J as stateKeySecretExposure, Jn as describeDockerFailure, Jt as describeTypeWithThrottleRetry, K as secretBearingStateKeyWarning, Kn as describeDockerCapturedOutput, Kr as LocalInvokeBuildError$1, Kt as findActionableSilentDrops, L as cyan, Ln as getBootstrapMarkerKey, Lr as setAwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as rewriteTemplateAssetReferences, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as AssetModeResolver, Nr as resolveBucketRegion, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as WorkGraph, Or as canonicalizeRegion, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as BOOTSTRAP_MARKER_PREFIX, Pr as AwsClients, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as partitionSensitiveEnv, Qr as ResourceTimeoutError, Qt as STATE_SOURCED_CROSS_GENERATION_RULES, R as gray, Rn as isCrossRegionRedirect, Rt as s3BucketArn, S as isFinalSnapshotError, Sn as exportNamesCarriedFrom, Sr as findLargeInlineResources, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as shouldRetainResource, Tr as displaySafe, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as buildDenyExternalAccessPolicy, Ur as DeployCancelledError, Ut as applyRoleArnIfSet, V as yellow, Vn as validateAssetBucketName, Vr as CrossAccountSecretRefusalError, Vt as s3BucketRegionalDomainName, W as exportAliasCollisionScrubWarning, Wn as describeAwsFailure, Wr as DynamicReferenceRegionAmbiguousError, Wt as DiffCalculator, X as IAMRoleProvider, Xn as formatDockerLoginError, Xr as PartialFailureError, Xt as DagBuilder, Y as getCurrentResourceSecrets, Yn as dockerSpawnEnvWithSensitive, Yr as NestedStackChildDirectDestroyError, Yt as withRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as getDockerCmd, Zr as ProvisioningError, Zt as TemplateParser, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as buildLockContentionMessage, _r as stateBucketExistenceConfirmed, _t as carriesDynamicReference, a as DeploymentEventsStore, an as isSingleDynamicReferenceToken, ar as getDockerImageBySourceHash, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as CUSTOM_RESOURCE_RESPONSE_PREFIX, br as CFN_TEMPLATE_URL_LIMIT, bt as getAccountInfo, c as replayFailedOperations, ci as isMarkedNonRetryable, cn as recordMaskOnlyValue, cr as getDefaultStateBucketName, ct as startInterruptWatch, d as updatePartialReason, di as isTransientServerError, dn as scrubResourceRecord, dr as resolveAutoAssetStorage, dt as UNSPECIFIED_SKIP_REASON, ei as StackHasActiveImportsError, en as TEMPLATE_SOURCED_RULES, er as runDockerForeground, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as markNonRetryable, fn as LockManager, fr as resolveCaptureObservedState, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gn as buildForceUnlockCommand, gr as resolveUseCdkBootstrapAssets, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hn as UNRENDERABLE, hr as resolveStateBucketWithDefaultAndSource, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, in as errorCauseChain, ir as AssetManifestLoader, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as loadPublishableAssetManifest, jr as processStackMessages, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as buildAssetRedirectMap, kr as derivePartitionAndUrlSuffix, kt as configBooleanRefusal, l as replayRollback, li as isRetryableTransientError, ln as recoverMaskedOutput, lr as getLegacyStateBucketName, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as retryClassificationText, mn as rebuildClientForBucketRegion, mr as resolveStateBucketWithDefault, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as createSecretMasker, nr as escapeRegExp, nt as maskDeep, o as planFailedOps, oi as normalizeAwsError, on as maskSecretsInError, or as Synthesizer, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as markRedactedCause, pn as S3StateBackend, pr as resolveSkipPrefix, pt as deleteSkipReason, q as secretSafeKeyDisplay, qn as describeDockerExecFailure, qr as LocalStartServiceError, qt as findSilentDropProperties, r as DeployEngine, rn as dynamicReferenceTokens, rr as stripControlChars, rt as maskerOrIdentity, s as planRollback, si as withErrorHandling, sn as maskSecretsInText, sr as synthesisStatusMessage, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as StackTerminationProtectionError, tn as carriesSecretMask, tr as runDockerStreaming, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as isThrottlingError, un as redactSecretsForState, ur as resolveApp, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as forceQuitRecoveryClause, vr as warnDeprecatedNoPrefixCliFlag, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as importableOutputs, wr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as DEFAULT_STATE_PREFIX, xr as MIGRATE_TMP_PREFIX, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as shellQuote, yr as CFN_TEMPLATE_BODY_LIMIT, yt as coerceParameterTypedValue, z as green, zn as parseBootstrapMarker, zr as CdkdError, zt as s3BucketDomainName } from "./deploy-engine-CfxcC3q3.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BRByznpy.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-DUlRn84u.js";
+import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CQrHElrl.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3470,6 +3470,67 @@ function mapsEqual(a, b) {
 	}
 	return true;
 }
+/**
+* Describe a `JSON.parse` failure WITHOUT echoing the body (issue
+* [#2667](https://github.com/go-to-k/cdkd/issues/2667) review).
+*
+* V8 embeds a window of the INPUT in its parse error, so interpolating
+* `err.message` republishes whatever bytes sat near the syntax error. Measured
+* on node v24.19.0:
+*
+* ```
+* JSON.parse('{"exports":{"K":{"value":hunter2SECRET}}}')
+* -> Unexpected token 'h', ..."K":{"value":hunter2SEC"... is not valid JSON
+* ```
+*
+* This index holds resolved Output VALUES, and for the unscrubbed state
+* `cdkd scrub` targets those are exactly the plaintext — which then reaches a
+* `logger.error` and the command's failure message, i.e. `--dry-run --fail` CI
+* logs. Same class as the `import.ts` parse-snippet leak issue
+* [#2829](https://github.com/go-to-k/cdkd/issues/2829) closed.
+*
+* What survives is the SIZE, plus the OFFSET WHEN V8 STATES ONE — neither is a
+* function of the body's content, and both help an operator holding the object
+* locate the damage. The offset is extracted by pattern rather than passed
+* through, so a message worded differently yields no offset instead of leaking
+* the rest of the sentence. The two numbers are in DIFFERENT UNITS and the
+* message says so: V8 counts `at position` in UTF-16 code units while the size
+* is UTF-8 bytes, so `'{ n\u00f6t json'` reports position 2 and 11 bytes. Measured on node v24.19.0: the `Expected ...`
+* family carries `at position N` and the `Unexpected token 'X', ...snippet...`
+* family — the one that embeds the body, i.e. the case this exists for — does
+* NOT, so the size is what is always present and the offset is a bonus. Both
+* arms are driven by tests.
+*/
+function describeParseFailure(err, bytes) {
+	const raw = err instanceof Error ? err.message : String(err);
+	const at = /at position (\d+)/.exec(raw);
+	return `invalid JSON${at ? ` at code-unit position ${at[1]}` : ""}; ${bytes} byte(s) read`;
+}
+/**
+* UTF-8 byte length of a decoded body, for {@link describeParseFailure}.
+*
+* `body.length` counts UTF-16 CODE UNITS, so reporting it as "byte(s)" is
+* wrong for any non-ASCII index — an export name outside the BMP counts 2
+* where the object holds 4 (issue #2667 review). The number is meant to help
+* an operator match the message against the object S3 holds, so it has to be
+* the same unit S3 reports.
+*/
+function utf8ByteLength(body) {
+	return Buffer.byteLength(body, "utf8");
+}
+/**
+* Describe an `indexVersion` that is not a usable number, WITHOUT rendering it.
+*
+* `String(x)` renders a body-controlled value verbatim for two of the three
+* non-number shapes — measured on node v24.19.0: a JSON string yields itself
+* and a one-element array yields its element, while only an object degrades to
+* `[object Object]`. The field is attacker-controlled in the same sense the
+* rest of the body is, so the message reports its TYPE and, for a number, its
+* value — the only shape whose value is safe because it is a number.
+*/
+function describeIndexVersion(value) {
+	return typeof value === "number" ? String(value) : `a non-numeric value (${typeof value})`;
+}
 const DEFAULT_OPTIONS = {
 	maxWriteRetries: 5,
 	initialBackoffMs: 100,
@@ -3597,12 +3658,57 @@ var ExportIndexStore = class {
 		await this.enqueueWrite("update", () => this.applyStackUpdate(stackName, producerRegion, outputs));
 	}
 	/**
+	* A snapshot of the persisted index, read WITHOUT the rebuild that
+	* {@link lookup} triggers on a missing or corrupt object.
+	*
+	* Every S3 call THIS METHOD makes is a GET, so a caller that must perform no
+	* S3 write (`cdkd scrub --dry-run`) can read the entries here — with ONE
+	* documented exception, which such a caller has to know about: when another
+	* caller on the same instance already has a `doLoad` in flight, the first
+	* line below awaits IT, and `doLoad` rebuilds (a PUT) on a missing or
+	* corrupt object. Unreachable from `cdkd scrub`, which never calls `lookup`
+	* and drives one store per region serially — but the guarantee is the thing
+	* a future no-write caller would rely on, so it is stated with its bound
+	* rather than unconditionally.
+	*
+	* THREE OUTCOMES, and only ONE of them is `undefined`. A MISSING object
+	* returns `undefined`: there is nothing to audit and nothing to repair. A
+	* body that does not PARSE, and an `indexVersion` this binary cannot
+	* interpret, both THROW — because the caller's question is "what does this
+	* index hold", and for those two the honest answer is "this call could not
+	* find out". Collapsing the corrupt case into `undefined` reads as an empty
+	* index, so a caller reports nothing over bytes it never interpreted, which
+	* for `cdkd scrub` is a green gate over a file that may still hold the
+	* plaintext (issue [#2667](https://github.com/go-to-k/cdkd/issues/2667)) —
+	* the exact shape that issue exists to close, one level down. `doLoad`'s own
+	* corrupt arm is unaffected: it REBUILDS, which is a write, and is why this
+	* read cannot share it.
+	*
+	* The returned map is a COPY, and a `patchEntry` on this same instance
+	* afterwards writes under the etag this read cached rather than re-reading.
+	*/
+	async readPersistedEntries() {
+		if (this.loadState.kind === "loading") await this.loadState.promise;
+		if (this.loadState.kind === "loaded") return new Map(this.loadState.entries);
+		const outcome = await this.loadPersisted();
+		if (outcome.kind === "missing") return void 0;
+		if (outcome.kind === "corrupt") throw new Error(`Exports index at ${this.indexKey()} could not be parsed (${describeParseFailure(outcome.error, outcome.bytes)}). Its contents were NOT examined.`);
+		return new Map(outcome.entries);
+	}
+	/**
 	* Patch a single entry into the index after a `lookup` miss fell back
 	* to a state.json scan and found the value. Lightweight write that
 	* does NOT require a full rebuild.
+	*
+	* Returns whether the index now holds `entry` — `false` when the write
+	* was abandoned (a non-retryable S3 failure, or an exhausted If-Match
+	* retry budget), which `runWithRetry` logs and does not throw. A caller
+	* for which an unwritten entry is the outcome it must report — `cdkd
+	* scrub`, where the entry keeps whatever value it held — reads this
+	* return; the deploy path treats the index as a perf hint and ignores it.
 	*/
-	async patchEntry(exportName, entry) {
-		await this.enqueueWrite("patch", () => this.applyPatch(exportName, entry));
+	async patchEntry(exportName, entry, opts = {}) {
+		return this.enqueueWrite("patch", () => this.applyPatch(exportName, entry, opts.requireOwner));
 	}
 	/**
 	* Drop all entries owned by `(stackName, producerRegion)`. Used after
@@ -3623,7 +3729,7 @@ var ExportIndexStore = class {
 	*/
 	async enqueueWrite(label, op) {
 		const next = this.writeChain.then(() => this.runWithRetry(label, op));
-		this.writeChain = next.catch(() => {});
+		this.writeChain = next.then(() => {}, () => {});
 		return next;
 	}
 	/**
@@ -3658,31 +3764,54 @@ var ExportIndexStore = class {
 		};
 		await promise;
 	}
+	/**
+	* GET the index object and, when it parses, install it as `loadState`.
+	* Performs no PUT: the missing / corrupt REBUILD lives one level up in
+	* {@link doLoad}, so {@link readPersistedEntries} can share this parse
+	* without writing. A `indexVersion` above this binary's still throws
+	* here rather than reporting `corrupt` — a rebuild would overwrite an
+	* index a newer binary wrote with this binary's view of it.
+	*/
+	async loadPersisted() {
+		const raw = await this.readIndexRaw();
+		if (raw === null) return { kind: "missing" };
+		const { body, etag } = raw;
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch (err) {
+			return {
+				kind: "corrupt",
+				error: err,
+				bytes: utf8ByteLength(body)
+			};
+		}
+		if (typeof parsed.indexVersion !== "number" || parsed.indexVersion > 1) throw new Error(`Exports index uses indexVersion ${describeIndexVersion(parsed.indexVersion)} which is newer than this cdkd binary supports (max ${1}). Upgrade cdkd.`);
+		const entries = /* @__PURE__ */ new Map();
+		for (const [name, entry] of Object.entries(parsed.exports ?? {})) entries.set(name, entry);
+		this.loadState = {
+			kind: "loaded",
+			etag,
+			entries
+		};
+		return {
+			kind: "loaded",
+			entries
+		};
+	}
 	async doLoad() {
 		try {
-			const raw = await this.readIndexRaw();
-			if (raw === null) {
+			const outcome = await this.loadPersisted();
+			if (outcome.kind === "missing") {
 				this.logger.info("Exports index missing; rebuilding from state.json files");
 				await this.rebuild();
 				return;
 			}
-			const { body, etag } = raw;
-			let parsed;
-			try {
-				parsed = JSON.parse(body);
-			} catch (err) {
-				this.logger.warn(`Exports index corrupt (${err instanceof Error ? err.message : String(err)}); rebuilding from state.json files`);
+			if (outcome.kind === "corrupt") {
+				this.logger.warn(`Exports index corrupt (${outcome.error instanceof Error ? outcome.error.message : String(outcome.error)}); rebuilding from state.json files`);
 				await this.rebuild();
 				return;
 			}
-			if (typeof parsed.indexVersion !== "number" || parsed.indexVersion > 1) throw new Error(`Exports index uses indexVersion ${String(parsed.indexVersion)} which is newer than this cdkd binary supports (max ${1}). Upgrade cdkd.`);
-			const entries = /* @__PURE__ */ new Map();
-			for (const [name, entry] of Object.entries(parsed.exports ?? {})) entries.set(name, entry);
-			this.loadState = {
-				kind: "loaded",
-				etag,
-				entries
-			};
 		} catch (err) {
 			this.loadState = { kind: "unloaded" };
 			throw err;
@@ -3764,7 +3893,7 @@ var ExportIndexStore = class {
 	}
 	async applyStackUpdate(stackName, producerRegion, outputs) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const next = new Map(this.loadState.entries);
 		for (const [name, entry] of next) if (entry.producerStack === stackName && entry.producerRegion === producerRegion) next.delete(name);
 		for (const [name, value] of Object.entries(outputs)) {
@@ -3775,8 +3904,8 @@ var ExportIndexStore = class {
 				producerRegion
 			});
 		}
-		if (mapsEqual(this.loadState.entries, next)) return;
-		await this.persist(next);
+		if (mapsEqual(this.loadState.entries, next)) return true;
+		return this.persist(next);
 	}
 	/**
 	* Two stacks publishing one export name (issue #2193). CloudFormation
@@ -3793,27 +3922,34 @@ var ExportIndexStore = class {
 		const safeName = displaySafe(exportName);
 		this.logger.warn(`Export '${safeName}' is published by both '${existing.producerStack}' (${existing.producerRegion}) and '${stackName}' (${producerRegion}); the exports index keeps the latest writer, so an Fn::ImportValue on it binds to whichever deployed last. CloudFormation refuses a second producer of the same export name — rename one of the two exports. (If '${existing.producerStack}' predates cdkd's state schema v9, this is its stale entry for a plain output of that name, and its next deploy clears it.)`);
 	}
-	async applyPatch(exportName, entry) {
+	async applyPatch(exportName, entry, requireOwner) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
+		if (requireOwner) {
+			const current = this.loadState.entries.get(exportName);
+			if (!current || current.producerStack !== requireOwner.producerStack || current.producerRegion !== requireOwner.producerRegion) {
+				this.logger.warn(`Exports index entry ownership changed under a patch; refusing to write it. Expected producer '${displaySafe(requireOwner.producerStack)}' (${displaySafe(requireOwner.producerRegion)}), found ${current ? `'${displaySafe(current.producerStack)}' (${displaySafe(current.producerRegion)})` : "no entry"}.`);
+				return false;
+			}
+		}
 		const next = new Map(this.loadState.entries);
 		next.set(exportName, entry);
-		await this.persist(next);
+		return this.persist(next);
 	}
 	async applyRemoveStack(stackName, producerRegion) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const next = new Map(this.loadState.entries);
 		let changed = false;
 		for (const [name, entry] of next) if (entry.producerStack === stackName && entry.producerRegion === producerRegion) {
 			next.delete(name);
 			changed = true;
 		}
-		if (!changed) return;
-		await this.persist(next);
+		if (!changed) return true;
+		return this.persist(next);
 	}
 	async persist(entries) {
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const file = {
 			indexVersion: 1,
 			region: this.region,
@@ -3826,12 +3962,20 @@ var ExportIndexStore = class {
 			etag,
 			entries
 		};
+		return true;
 	}
+	/**
+	* Run `op` under the If-Match retry budget. `true` means `op` reported the
+	* index now holds what it was asked to write (a PUT, or a no-op skip whose
+	* result was already there); `false` means this store abandoned the write
+	* and logged the warn below. It does NOT throw on either arm — `state.json`
+	* is the canonical record for the deploy path, and a caller that needs the
+	* failure surfaced reads the return value (see {@link patchEntry}).
+	*/
 	async runWithRetry(label, op) {
 		let lastErr;
 		for (let attempt = 0; attempt < this.opts.maxWriteRetries; attempt++) try {
-			await op();
-			return;
+			return await op();
 		} catch (err) {
 			lastErr = err;
 			if (this.isPreconditionFailed(err)) {
@@ -3841,9 +3985,10 @@ var ExportIndexStore = class {
 				continue;
 			}
 			this.logger.warn(`Exports index ${label} failed (non-retryable): ${err instanceof Error ? err.message : String(err)}; continuing without index update`);
-			return;
+			return false;
 		}
 		this.logger.warn(`Exports index ${label} exhausted ${this.opts.maxWriteRetries} retries due to concurrent writers; continuing without index update. Last error: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+		return false;
 	}
 	isNoSuchKey(err) {
 		if (!err || typeof err !== "object") return false;
@@ -31089,11 +31234,13 @@ var ApiGatewayV2Provider = class {
 			const apiId = response.ApiId;
 			const apiEndpoint = response.ApiEndpoint;
 			this.logger.debug(`Successfully created API Gateway V2 Api ${logicalId}: ${apiId}`);
+			const executeApiArn = await this.buildExecuteApiArn(apiId);
 			return {
 				physicalId: apiId,
 				attributes: {
 					ApiId: apiId,
-					ApiEndpoint: apiEndpoint
+					ApiEndpoint: apiEndpoint,
+					...executeApiArn !== void 0 ? { ExecuteApiArn: executeApiArn } : {}
 				}
 			};
 		} catch (error) {
@@ -31117,6 +31264,52 @@ var ApiGatewayV2Provider = class {
 			throw new ProvisioningError(`Failed to delete API Gateway V2 Api ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* `arn:{partition}:execute-api:{region}:{account}:{apiId}` — the ARN AWS
+	* documents for an API Gateway v2 API, which no API call returns.
+	*
+	* Refuses to record a FABRICATED account, exactly as
+	* `SSMParameterProvider.buildParameterArn` does: an ARN naming a placeholder
+	* account is worse than an absent one, because it is persisted into
+	* `state.json` and outlives the deploy that produced it. The partition is
+	* DERIVED through the same closed region mapping `${AWS::Partition}` uses,
+	* and the region segment is canonicalized — defence in depth rather than the
+	* only fold, since `getAccountInfo` already canonicalizes what it returns
+	* (the issue #1795 / #1814 class: an unfolded `US-EAST-1` matches no IAM
+	* policy and is persisted).
+	*
+	* **NEVER THROWS, and callers depend on it.** Every call site is INSIDE the
+	* `try` of an operation that has already created or found the API, so an
+	* escape here would report a failed create over a resource that exists —
+	* an orphan. A failure means the attribute is absent, which is the state
+	* every deploy before this change was in.
+	*
+	* Takes NO `SecretMaskingContext`, where its SSM twin takes one, and the
+	* difference is not an oversight: every interpolated value here is
+	* non-secret BY CONSTRUCTION — an AWS-minted api id (or, on import, the
+	* CLI's own `--resource` argument), a derived partition, a region, an
+	* account id — and the catch names the error CLASS rather than its message.
+	* `SSMParameterProvider.buildParameterArn` needs a masker because it
+	* interpolates `error.message`, which quotes a resolved parameter value
+	* back. **Widening this catch to `error.message` therefore requires
+	* threading the masker in the same change**; the invariant is what makes
+	* the omission safe, not the current absence of a caller.
+	*/
+	async buildExecuteApiArn(apiId) {
+		try {
+			const region = await this.getClient().config.region();
+			const accountInfo = await getAccountInfo(region);
+			if (accountInfo.fabricated) {
+				this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the ExecuteApiArn attribute for API ${apiId} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+				return;
+			}
+			const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+			return `arn:${partition}:execute-api:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:${apiId}`;
+		} catch (error) {
+			this.logger.warn(`Could not build the ExecuteApiArn attribute for API ${apiId} (${error instanceof Error ? error.name : typeof error}), so it is NOT recorded. An Fn::GetAtt on it will fail until a later deploy records it.`);
+			return;
+		}
+	}
 	getApiAttribute(physicalId, attributeName) {
 		if (attributeName === "ApiId") return physicalId;
 	}
@@ -31541,10 +31734,15 @@ var ApiGatewayV2Provider = class {
 		}
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) try {
-			await this.getClient().send(new GetApiCommand({ ApiId: explicit }));
+			const got = await this.getClient().send(new GetApiCommand({ ApiId: explicit }));
+			const executeApiArn = await this.buildExecuteApiArn(explicit);
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: {
+					ApiId: explicit,
+					...got.ApiEndpoint !== void 0 ? { ApiEndpoint: got.ApiEndpoint } : {},
+					...executeApiArn !== void 0 ? { ExecuteApiArn: executeApiArn } : {}
+				}
 			};
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return null;
@@ -31623,11 +31821,25 @@ var ApiGatewayV2Provider = class {
 		}
 		this.logger.debug(`Updating API Gateway V2 Api ${logicalId}: ${physicalId}`);
 		try {
-			if (changed) await this.getClient().send(new UpdateApiCommand(input));
+			let apiEndpoint;
+			if (changed) apiEndpoint = (await this.getClient().send(new UpdateApiCommand(input))).ApiEndpoint;
 			if (corsRemoved) {
 				this.logger.debug(`Clearing CORS configuration for Api ${logicalId}: ${physicalId}`);
 				await this.getClient().send(new DeleteCorsConfigurationCommand({ ApiId: physicalId }));
 			}
+			if (apiEndpoint !== void 0) {
+				const executeApiArn = await this.buildExecuteApiArn(physicalId);
+				if (executeApiArn !== void 0) return {
+					physicalId,
+					wasReplaced: false,
+					attributes: {
+						ApiId: physicalId,
+						ApiEndpoint: apiEndpoint,
+						ExecuteApiArn: executeApiArn
+					}
+				};
+				this.logger.debug(`Skipping the ExecuteApiArn heal for API ${physicalId}: the ARN could not be built. The previously recorded attributes are kept.`);
+			}
 			return {
 				physicalId,
 				wasReplaced: false
@@ -63333,12 +63545,30 @@ function valuesEqual(a, b) {
 * the expression that state stores post-redaction.
 *
 * `storedOutputs` is the bag currently in state. It is consulted for exactly
-* one decision — the LITERAL `Export.Name` of a secret-bearing stack, see issue
-* #1942 at that branch — and never merged into the result: everything else here
+* two decisions — the LITERAL `Export.Name` of a secret-bearing stack, see issue
+* #1942 at that branch, and whether a skipped-output record still applies, see
+* issue #2740 below — and never merged into the result: everything else here
 * previews what the template says, and reading state anywhere else would make
 * the preview agree with the past instead of with the next deploy.
-*/
-async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs) {
+*
+* `skippedOutputKeys` (issue #2740) are the keys the LAST DEPLOY could not
+* resolve and skipped, already narrowed by the caller on BOTH halves of the
+* binding rule: the recorded digest still matches today's template, AND no
+* resource the output references is changing on this run
+* (`bindingSkippedOutputs`, over a pre-resolution snapshot and this run's
+* resource diff — see `skipped-outputs.ts` for why the snapshot is the
+* caller's and why the change map cannot come from the digest). Such a key,
+* while still absent from `storedOutputs`, is previewed as ABSENT — skipped
+* without resolving, no bag entry, no row — because that is what the next
+* deploy will leave in state: this resolver runs
+* with `skipDynamicReferences`, so a failure that happened inside a secret
+* lookup would otherwise assemble cleanly and preview an `ADD` the deploy will
+* never perform. NOT a resolution failure: the sibling outputs are previewed
+* normally, so a genuine change beside the broken output still renders and
+* `--fail` still exits 1 for it. The key appearing in state (a later deploy
+* resolved it) ends the suppression.
+*/
+async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs, skippedOutputKeys) {
 	const logger = getLogger().child("OutputsDiff");
 	const outputs = Object.create(null);
 	const exportNames = /* @__PURE__ */ new Set();
@@ -63379,6 +63609,10 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 			continue;
 		}
+		if (skippedOutputKeys?.has(outputKey) && !(storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, outputKey))) {
+			logger.debug(`Diff previewing output ${stripControlChars(outputKey)} as absent — the last deploy could not resolve it and its template inputs are unchanged`);
+			continue;
+		}
 		const sourceUsedSub = templateUsesSub(output.Value);
 		let value;
 		try {
@@ -64706,6 +64940,10 @@ function tokenValueForComparison(token, declaredType) {
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
 	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate } = options;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
+	const outputsDigestSource = structuredClone({
+		...template,
+		Resources: {}
+	});
 	let mergedParameters = parameters;
 	let parametersBound = false;
 	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
@@ -64755,7 +64993,9 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		skipDynamicReferences: true
 	});
 	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
-	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs);
+	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
+	const bindingSkipped = bindingSkippedOutputs(outputsDigestSource, currentState.skippedOutputs, changedLogicalIds);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs, bindingSkipped);
 	let outputChanges = [];
 	if (resolved.resolutionFailed) {
 		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
@@ -65399,6 +65639,24 @@ var ScrubNeededError = class ScrubNeededError extends CdkdError {
 * leak" from "scrub refused to look" — the two call for opposite responses
 * (rotate the secret vs. re-spell the reference and re-run).
 */
+/**
+* An internal invariant of the exports-index repair, thrown where this code
+* believes a case is unreachable (issue #2667 review).
+*
+* A distinct CLASS because the repair runs inside the per-stack `try` whose
+* `catch` attributes everything to "the exports index could not be READ": a
+* plain `Error` there is reported as an S3 read failure, sending an operator to
+* their bucket policy over a bug in cdkd. That catch rethrows this class
+* instead, so it surfaces as the per-stack failure it actually is.
+*/
+var ScrubIndexInvariantError = class ScrubIndexInvariantError extends CdkdError {
+	exitCode = 2;
+	constructor(message) {
+		super(message, "SCRUB_EXPORT_INDEX_INVARIANT");
+		this.name = "ScrubIndexInvariantError";
+		Object.setPrototypeOf(this, ScrubIndexInvariantError.prototype);
+	}
+};
 var ScrubRefusalError = class ScrubRefusalError extends CdkdError {
 	exitCode = 2;
 	constructor(message, code) {
@@ -65443,6 +65701,140 @@ function scrubStacksFailedError(failures) {
 	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
 }
 /**
+* Which of `entries` this stack's post-scrub `outputs` bag disagrees with.
+*
+* OWNERSHIP is read off the entry (`producerStack` / `producerRegion`), never
+* inferred from the name: a pre-v9 state record makes `importableOutputKeys`
+* return every output key (`src/types/state.ts`), so a rebuild can key an entry
+* by a plain output name, and on a name collision the index keeps the latest
+* writer — so a name alone says nothing about whose entry it is.
+*
+* The rule is CONVERGENCE, not a match against scrub's plaintext map. The map
+* is built by LIVE RESOLUTION against Secrets Manager / SSM, so it holds the
+* secret's value AS IT IS NOW; an index entry written before a rotation holds
+* the value as it was THEN, and the two are different strings. Keying on
+* `state.outputs` instead means the rule reads the record a redeploy and
+* `ExportIndexStore.rebuild()` both write, and the plaintext map is not
+* consulted here at all.
+*
+* The lookup runs in ONE direction, and the inverse is not available: an
+* `Export.Name` alias is written into the outputs bag itself
+* (`deploy-engine.ts`, beside `resolvedExportNames.push(exportName)`), so an
+* index entry NAME is a key of that bag — while `ExportIndexEntry` carries no
+* output-key field, so nothing maps an entry back to the output it came from.
+*
+* WHAT CAN STILL GO WRONG. A name absent from `outputs` is reported and
+* nothing is written for it, so an entry in that position keeps its value —
+* `outputs` is `undefined` here whenever the stack has no state record at all,
+* which puts every one of its entries in that arm. An entry whose state value
+* carries no `{{resolve:` is left alone, so a plaintext an index entry holds
+* whose state counterpart is also plaintext is not reported by this pass and
+* not written by it. And `entries` is one region's index: an entry in another
+* region's `exports.json` is outside this call.
+*/
+function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
+	const examined = [];
+	const findings = [];
+	for (const [exportName, entry] of entries) {
+		if (entry.producerStack !== stackName || entry.producerRegion !== producerRegion) continue;
+		examined.push(exportName);
+		if (outputs === void 0 || !Object.hasOwn(outputs, exportName)) {
+			findings.push({
+				kind: "absent",
+				exportName
+			});
+			continue;
+		}
+		const stateValue = outputs[exportName];
+		if (!carriesDynamicReference(stateValue)) continue;
+		if (JSON.stringify(entry.value) === JSON.stringify(stateValue)) continue;
+		findings.push({
+			kind: "converge",
+			exportName,
+			stateValue
+		});
+	}
+	return {
+		examined,
+		findings
+	};
+}
+/**
+* The error a run ends with when `state.json` was rewritten and the exports
+* index was not (issue #2667).
+*
+* EXPLICIT rather than a warn: an entry this run went to converge and did not
+* keeps the value it held, in a region-wide object every principal with
+* `s3:GetObject` on the state bucket can read. `ExportIndexStore.patchEntry`
+* does not throw on a non-retryable S3 failure or an exhausted If-Match budget
+* — it logs and returns `false` — so without this the command would exit 0
+* over exactly that.
+*
+* Naming the remainder is what makes the re-run instruction actionable: the
+* convergence rule reads `state.outputs`, which a completed half already
+* matches, so a second invocation of the same command decides `converge` only
+* for the entries still differing.
+*/
+function exportIndexIncompleteError(unwritten, unreadable, dryRun) {
+	const parts = [dryRun ? "no state written (--dry-run)" : "state.json complete"];
+	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${u.region}`).join(", ")})`);
+	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${u.region}: ${u.reason}`).join("; ")})`);
+	return new ScrubRefusalError(`${parts.join("; ")}. Re-run the same command once the cause is cleared: each entry is written only while its value differs from the producer's state.outputs, so a re-run writes the remainder and leaves the rest alone.`, "SCRUB_EXPORT_INDEX_INCOMPLETE");
+}
+/**
+* Converge one scrubbed stack's entries in one region's exports index.
+*
+* Run as its OWN step by `scrubCommand`, after `scrubStack` returned — never
+* from inside the resolver. `scrubStack`'s resolve contexts deliberately
+* withhold `exportIndex` so `resolveImportValue`'s scan arm cannot `patchEntry`
+* as a side effect of resolution, at a point in the run nothing chose; that
+* withholding is unchanged, and this is a separate call with its own condition.
+*
+* Under `dryRun` no `patchEntry` is issued. The READ still happens:
+* `readPersistedEntries` is a GET that does not rebuild, so the audit half runs
+* without an S3 write.
+*
+* TWO PROPERTIES OF THE WRITE a reader will ask about. It runs OUTSIDE the
+* stack lock — `scrubStack` releases that in its own `finally` — because the
+* lock guards `state.json`, one key per stack, while `exports.json` is shared
+* region-wide and carries its own If-Match optimistic lock plus bounded retry;
+* that is the same concurrency control the deploy path's index write relies on.
+* And it is ONE PutObject PER ENTRY rather than one for the batch: `patchEntry`
+* is the operation that changes a value without touching membership, and a
+* remediation command pays that round trip so a failure names the entry it
+* could not write.
+*/
+async function repairExportIndexForStack(store, stackName, producerRegion, outputs, opts) {
+	const entries = await store.readPersistedEntries();
+	if (!entries) return {
+		examined: [],
+		findings: [],
+		unwritten: []
+	};
+	const plan = planExportIndexRepair(entries, stackName, producerRegion, outputs);
+	const unwritten = [];
+	if (opts.dryRun) return {
+		...plan,
+		unwritten
+	};
+	for (const finding of plan.findings) {
+		if (finding.kind !== "converge") continue;
+		const entry = entries.get(finding.exportName);
+		if (!entry) throw new ScrubIndexInvariantError("exports index repair: a planned entry is absent from the snapshot it was planned from");
+		if (!await store.patchEntry(finding.exportName, {
+			...entry,
+			value: finding.stateValue
+		}, { requireOwner: {
+			producerStack: stackName,
+			producerRegion
+		} })) unwritten.push(finding.exportName);
+	}
+	return {
+		...plan,
+		unwritten
+	};
+}
+/**
 * `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
 * reference is stored as its UNRESOLVED expression rather than the plaintext
 * value (GHSA fix). "Secret" here is whatever the RESOLVER classifies as one,
@@ -65462,10 +65854,14 @@ function scrubStacksFailedError(failures) {
 * re-resolves each resource's properties to learn the resolved secret VALUES
 * (recorded, never printed or re-persisted), and replaces those values in the
 * state record's `properties` / `attributes` / `observedProperties` with the
-* expression. No AWS resource is created, updated, or deleted; only state.json
-* is rewritten. This is why it is a top-level command and not `cdkd state
-* scrub` — the `cdkd state ...` family operates on the state bucket alone and
-* deliberately needs no CDK code.
+* expression. No AWS resource is created, updated, or deleted. What it WRITES
+* is the state bucket: each targeted stack's state.json, and — since issue
+* [#2667](https://github.com/go-to-k/cdkd/issues/2667) — the entries a scrubbed
+* stack publishes in the shared exports index at
+* `{prefix}/_index/{region}/exports.json`, as a separate step after that
+* stack's state.json write. This is why it is a top-level command and not
+* `cdkd state scrub` — the `cdkd state ...` family operates on the state bucket
+* alone and deliberately needs no CDK code.
 *
 * IMPORTANT: scrubbing does not un-expose an already-leaked secret. A value
 * that was stored in plaintext should be treated as compromised and ROTATED at
@@ -65567,6 +65963,20 @@ async function scrubCommand(stacks, options) {
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
 	const failures = [];
+	const exportIndexStores = /* @__PURE__ */ new Map();
+	const exportIndexFor = (indexRegion) => {
+		const existing = exportIndexStores.get(indexRegion);
+		if (existing) return existing;
+		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend);
+		exportIndexStores.set(indexRegion, store);
+		return store;
+	};
+	const examinedIndexNames = /* @__PURE__ */ new Map();
+	let totalIndexEntriesConverged = 0;
+	let totalIndexEntriesAbsent = 0;
+	let totalIndexEntriesUnexamined = 0;
+	const indexUnwritten = [];
+	const indexUnreadable = [];
 	for (const stack of targetStacks) {
 		const stackRegion = stack.region || region;
 		let scrubbed;
@@ -65583,10 +65993,51 @@ async function scrubCommand(stacks, options) {
 			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
 			continue;
 		}
+		let indexConverged = 0;
+		try {
+			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stack.stackName, stackRegion, scrubbed.outputs, { dryRun: options.dryRun ?? false });
+			const seen = examinedIndexNames.get(stackRegion) ?? /* @__PURE__ */ new Set();
+			for (const name of repair.examined) seen.add(name);
+			examinedIndexNames.set(stackRegion, seen);
+			const named = (exportName) => {
+				const shown = scrubbed.exportNameDisplay(exportName);
+				switch (shown.kind) {
+					case "safe": return `'${shown.text}'`;
+					case "masked": return `(masked: "${shown.text}")`;
+					case "withheld": return "(name withheld: it holds a secret this run recorded)";
+				}
+			};
+			const unwrittenNames = new Set(repair.unwritten);
+			for (const exportName of repair.unwritten) indexUnwritten.push({
+				region: stackRegion,
+				shown: named(exportName)
+			});
+			for (const finding of repair.findings) if (finding.kind === "converge") {
+				indexConverged++;
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) differs from ${stack.stackName}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				else {
+					totalIndexEntriesConverged++;
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${stackRegion}) to ${stack.stackName}'s state.outputs value.`);
+				}
+			} else {
+				totalIndexEntriesAbsent++;
+				logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) is published by ${stack.stackName}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${stack.stackName} to rewrite the index from its own outputs.`);
+			}
+		} catch (err) {
+			if (err instanceof ScrubIndexInvariantError) throw err;
+			if (!indexUnreadable.some((u) => u.region === stackRegion)) {
+				const reason = displaySafe(err instanceof Error ? err.message : String(err));
+				indexUnreadable.push({
+					region: stackRegion,
+					reason
+				});
+				logger.error(`Exports index for ${stackRegion} could not be read (first seen while scrubbing ${stack.stackName}): ${reason}`);
+			}
+		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -65596,7 +66047,28 @@ async function scrubCommand(stacks, options) {
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0) {
+	for (const [indexRegion, store] of exportIndexStores) {
+		if (indexUnreadable.some((u) => u.region === indexRegion)) continue;
+		let entries;
+		try {
+			entries = await store.readPersistedEntries();
+		} catch (err) {
+			const reason = displaySafe(err instanceof Error ? err.message : String(err));
+			indexUnreadable.push({
+				region: indexRegion,
+				reason
+			});
+			logger.error(`Exports index for ${indexRegion} could not be read for the coverage report: ${reason}`);
+			continue;
+		}
+		if (!entries) continue;
+		const examined = examinedIndexNames.get(indexRegion) ?? /* @__PURE__ */ new Set();
+		const unexamined = [...entries.keys()].filter((name) => !examined.has(name));
+		if (unexamined.length === 0) continue;
+		totalIndexEntriesUnexamined += unexamined.length;
+		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
+	}
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -65607,16 +66079,25 @@ async function scrubCommand(stacks, options) {
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
+	const indexNote = (() => {
+		const parts = [];
+		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
+		if (totalIndexEntriesAbsent > 0) parts.push(` ${totalIndexEntriesAbsent} exports index entr${totalIndexEntriesAbsent === 1 ? "y is" : "ies are"} published by a scrubbed stack under a name its state.outputs does not carry; nothing was written for ${totalIndexEntriesAbsent === 1 ? "it" : "them"} — redeploy that producer.`);
+		if (totalIndexEntriesUnexamined > 0) parts.push(` ${totalIndexEntriesUnexamined} exports index entr${totalIndexEntriesUnexamined === 1 ? "y" : "ies"} belong to producers outside this run and were NOT examined.`);
+		return parts.join("");
+	})();
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
+		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${failureNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
+	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67240,7 +67721,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordsChanged: 0,
 				secretsFound: 0,
 				secretBearingKeys: 0,
-				unverifiableReads: 0
+				unverifiableReads: 0,
+				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
 		}
 		const state = loaded.state;
@@ -67383,7 +67865,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			recordsChanged: 0,
 			secretsFound: 0,
 			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length
+			unverifiableReads: prePassFindings.unverifiable.length,
+			outputs: state.outputs,
+			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 		let recordsChanged = 0;
 		const newResources = {};
@@ -67402,8 +67886,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
+			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
 			const nextState = {
-				...state,
+				...carriedState,
 				resources: newResources,
 				outputs: newOutputs,
 				lastModified: Date.now()
@@ -67414,7 +67899,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			recordsChanged,
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length
+			unverifiableReads: prePassFindings.unverifiable.length,
+			outputs: newOutputs,
+			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 	} catch (err) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
@@ -69759,8 +70246,9 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					properties: redactedBaseline
 				};
 			}
+			const { skippedOutputs: _droppedByAccept, ...carriedState } = report.state;
 			const newState = {
-				...report.state,
+				...carriedState,
 				resources,
 				lastModified: Date.now()
 			};
@@ -70580,8 +71068,9 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					};
 				}
 				if (recordedCount === 0) continue;
+				const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 				const newState = {
-					...report.state,
+					...carriedState,
 					resources,
 					lastModified: Date.now()
 				};
@@ -76371,7 +76860,7 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 * Shared rather than constructed per resource because nothing writes to it:
 * `redactSecretsForState` only reads its argument.
 */
-const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+const NO_RECORDED_SECRETS$1 = /* @__PURE__ */ new Map();
 /**
 * Warn before `cdkd state orphan` force-releases a lock that is still LIVE.
 *
@@ -76484,7 +76973,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						unsupported++;
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS$1, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -76494,6 +76983,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 			await Promise.all(tasks);
 		});
 		state.lastModified = Date.now();
+		if (refreshed > 0) delete state.skippedOutputs;
 		const saveOptions = { expectedEtag: etag };
 		if (migrationPending) saveOptions.migrateLegacy = true;
 		await stateBackend.saveState(stackName, region, state, saveOptions);
@@ -76785,8 +77275,9 @@ async function rollbackCommand(stackArg, options) {
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
+				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
-					...baseState,
+					...carriedState,
 					version: 9,
 					region,
 					resources: { ...stateResources },
@@ -78830,9 +79321,10 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	}
 	const newOutputs = {};
 	for (const [name, value] of Object.entries(state.outputs ?? {})) newOutputs[name] = await rewriteValue(value, `outputs.${name}`, `<output:${name}>`, orphanSet, fetcher, rewrites, unresolvable);
+	const { skippedOutputs: _droppedByOrphanRewrite, ...carriedState } = state;
 	return {
 		state: {
-			...state,
+			...carriedState,
 			resources: newResources,
 			outputs: newOutputs,
 			lastModified: Date.now()
@@ -79771,8 +80263,7 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger);
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -80205,14 +80696,90 @@ function defaultOnlyParameterTemplate(template) {
 * already-stored, which on the v3 baseline is already resolved-shape
 * from a prior import / deploy, so re-resolving is a no-op.
 *
+* RETURNS the logical ids for which an `observedProperties` baseline must NOT
+* be captured, because this walk cannot vouch that the persisted `properties`
+* still SPELL the dynamic reference the template had.
+* `captureObservedForImportedResources` refuses to write a baseline for those
+* (issue [#2828](https://github.com/go-to-k/cdkd/issues/2828) review); the
+* redaction it performs is POSITION-based, so a bag that no longer spells the
+* reference gives it no evidence and the DECRYPTED readback is persisted in
+* the clear.
+*
+* The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
+* decision a review round paid for. Two arms:
+*
+*  - **Resolution THREW** — refuse, unconditionally. A throw means the
+*    resolver could not finish, so nothing about the persisted bag is
+*    trustworthy evidence. This is BEHAVIOURALLY IDENTICAL to the arm this PR
+*    first shipped: two attempts to sharpen it in between each shipped a leak
+*    (the wrapped-complete-token shape, then the
+*    reference-sourced-from-outside-the-bag shape), and saying so is the
+*    strongest available form of "every sharpening leaked". The arm's own
+*    comment carries both measurements.
+*  - **Resolution SUCCEEDED but LOST an opener.** An `Fn::If` whose condition
+*    was DOWNGRADED resolves without throwing and selects the branch AWS did
+*    not take, so `properties` hold the false-branch literal and no reference
+*    at all. The downgrade needs a parameter with NO `Default` — `cdkd import`
+*    accepts no parameter VALUES from the user, but a `Default`-carrying
+*    parameter IS bound (issue #2321's retry), so only an unbindable one leaves
+*    `evaluateConditions` catching per condition and recording `false`.
+*
+*    ARM 2 IS KNOWN OVER-BROAD for a PUBLIC `{{resolve:ssm:...}}` reference: a
+*    `String` / `StringList` parameter is stored RESOLVED (issue #1901), so its
+*    opener disappears across the resolve and the resource is refused although
+*    nothing was ever secret, costing it a drift baseline on a common config
+*    pattern. Threading the resolve's own `recordedSecretValues` into the
+*    capture corrects it -- measured on issue
+*    [#2852](https://github.com/go-to-k/cdkd/issues/2852), which carries that
+*    remedy -- because a populated map makes absence from it real evidence of
+*    a public parameter, exactly as the deploy path already relies on.
+*
+* The cost of a false refusal is one resource's drift baseline until its next
+* deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
+* unmeasurable bag refuses too.
+*
+* WHAT CAN STILL GO WRONG. No claim is made here about what this closes, and
+* that is deliberate: successive review rounds falsified a closure claim, then
+* a closed-set list, then a "reduces" claim -- the mechanism survived every
+* round of measurement and the SENTENCES about it did not. What follows states only
+* the DANGER direction, which can become false only once the residue is gone.
+*
+* PLAINTEXT CAN STILL BE PERSISTED by this capture. Known ways, each with its
+* issue and none of them proven to be all of them:
+*
+*  - the resolve drops a reference, or trades one away, in a manner the opener
+*    comparison below cannot see --
+*    [#2850](https://github.com/go-to-k/cdkd/issues/2850);
+*  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
+*    the reference, so no opener exists in any template this walk is handed --
+*    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
+*  - `redactSecretsForState` cannot PAIR the readback against the source and
+*    returns the bag unchanged: a reshaped container, an identity key AWS
+*    normalised, a readback key the source lacks, an array whose anchors do not
+*    corroborate -- [#2852](https://github.com/go-to-k/cdkd/issues/2852), which
+*    carries the measured probe table;
+*  - the readback holds a secret with NO counterpart in the source at all, set
+*    out of band -- [#2868](https://github.com/go-to-k/cdkd/issues/2868), filed
+*    as a remit question rather than a defect in this mechanism.
+*
+* WHY NO EXHAUSTIVE LIST IS OFFERED, as mechanism rather than framing: this
+* redaction's only evidence is a POST-HOC comparison between the persisted bag
+* and the readback, so anything that comparison cannot see is trusted.
+* Establishing more needs PROVENANCE carried out of the resolver or the
+* deployer, which is where the structural remedy for all of the above lives.
+*
+* The set is returned rather than recorded on the state, because it describes
+* THIS run's resolution and nothing downstream of the save has any use for it.
+*
 * Exported for unit testing — internal to the command flow otherwise. The
 * masking this walk applies (issue #2803) is only provable against the REAL
 * resolver, since the plaintext reaches the message through the resolver's
 * own throw rather than through anything this function writes.
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
+	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
 	const entries = Object.entries(stackState.resources);
-	if (entries.length === 0) return;
+	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
 	let parameters = {};
 	let conditions = {};
@@ -80247,8 +80814,9 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	};
 	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
+		const unresolvedProperties = resource.properties ?? {};
+		let threw = false;
 		try {
-			const unresolvedProperties = resource.properties ?? {};
 			const resolved = await resolver.resolve(unresolvedProperties, {
 				...baseContext,
 				recordedSecretValues
@@ -80256,7 +80824,46 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
 		} catch (err) {
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+			threw = true;
 		}
+		if (threw) {
+			unsafeObservedBaselineLogicalIds.add(logicalId);
+			continue;
+		}
+		const rawOpeners = countDynamicReferenceOpeners(unresolvedProperties);
+		const persistedOpeners = countDynamicReferenceOpeners(resource.properties);
+		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners) unsafeObservedBaselineLogicalIds.add(logicalId);
+	}
+	return unsafeObservedBaselineLogicalIds;
+}
+/** The opener every dynamic reference starts with, secret-bearing or not. */
+const DYNAMIC_REFERENCE_OPENER = "{{resolve:";
+/**
+* How many dynamic-reference OPENERS a property bag carries, counted over its
+* JSON serialization rather than by walking string leaves — which is the whole
+* point on the RAW side: a token assembled by `Fn::Join` is SPLIT across array
+* elements, so `{{resolve:secretsmanager:` survives as a fragment that no scan
+* for a COMPLETE token would see. `secretValueFromJson` renders exactly that
+* shape, so the split form is the common one, not the exotic one.
+*
+* `undefined` when the bag cannot be serialized. Callers treat that as "cannot
+* vouch for this bag" rather than as zero — the only safe direction, since the
+* cost of a false refusal is a drift baseline and the cost of a false pass is a
+* plaintext secret in `state.json`.
+*/
+function countDynamicReferenceOpeners(bag) {
+	let text;
+	try {
+		text = JSON.stringify(bag ?? {}) ?? "";
+	} catch {
+		return;
+	}
+	let count = 0;
+	for (let from = 0;;) {
+		const at = text.indexOf(DYNAMIC_REFERENCE_OPENER, from);
+		if (at === -1) return count;
+		count++;
+		from = at + 10;
 	}
 }
 function printSummary(rows) {
@@ -80348,6 +80955,14 @@ function collectMultiple(value, previous) {
 	return [...previous ?? [], value];
 }
 /**
+* The empty secrets map the observed-capture redaction below passes. Shared
+* and module-level because `redactSecretsForState` only ever READS its map,
+* and because an empty one is not an oversight here but the POSITION-only
+* configuration the call site's note argues for — the same constant
+* `cdkd state refresh-observed` passes for the same reason.
+*/
+const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Populate `observedProperties` for every resource in a freshly-built
 * import StackState by calling the matching provider's
 * `readCurrentState`. Mirrors what `cdkd deploy` does after each
@@ -80366,11 +80981,25 @@ function collectMultiple(value, previous) {
 * (incremental rollout — see `ResourceProvider.readCurrentState`'s
 * doc-comment) keep `observedProperties: undefined`; the drift comparator
 * falls back to `properties` for those, matching pre-v3 behavior.
+*
+* Exported for unit testing -- internal to the command flow otherwise. The
+* input-space matrix drives THIS function rather than replaying its
+* `redactSecretsForState` call by hand, so a change to the arguments it passes
+* cannot leave that fence green.
+*
+* Every captured bag is REDACTED before it lands on the record, and a resource
+* whose redaction POSITION SOURCE is unusable is skipped entirely — see the
+* call site's own note (issue
+* [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
-async function captureObservedForImportedResources(stackState, providerRegistry, logger) {
+async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds) {
 	const entries = Object.entries(stackState.resources);
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
+		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			return;
+		}
 		try {
 			const provider = providerRegistry.getProviderFor({
 				resourceType: resource.resourceType,
@@ -80378,9 +81007,9 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
-			if (observed !== void 0) resource.observedProperties = observed;
+			if (observed !== void 0) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 		} catch (err) {
-			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.message : String(err)} — drift will fall back to template properties for this resource until the next successful deploy.`);
+			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
 	}));
 }
@@ -80550,8 +81179,7 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger);
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger);
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -89782,4 +90410,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BRon74Fc.js.map
+//# sourceMappingURL=program-BXH3FeeV.js.map