@go-to-k/cdkd 0.288.5 → 0.288.7

package/dist/{deploy-engine-Dsf9bTqH.js → deploy-engine-BQUjVO_m.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BFmq8S23.js";
+import { t as getCdkdVersion } from "./version-DPtrXz0m.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12263,7 +12263,7 @@ const TEMPLATE_SOURCED_RULES = {
 *
 * Does NOT fail closed. This is the constant a caller reaches for when it knows
 * the SHAPE of its two bags and nothing about where the result lands —
-* `cdkd drift`'s two writers and `cdkd import`'s capture pass it, and so does
+* `cdkd drift`'s two writers pass it, and so does
 * `DeployEngine.redactOperationsForJournal` for the journal's `previousState`
 * (issue [#2886](https://github.com/go-to-k/cdkd/issues/2886): a REPLAYED
 * baseline must not gain masks a rollback restore then persists). See
@@ -12285,10 +12285,19 @@ const STATE_SOURCED_READBACK_RULES = {
 * readback path already had applies unchanged; the only difference is that a
 * position this pass cannot certify is written as {@link SECRET_MASK} rather
 * than as the DECRYPTED readback. Passed by `cdkd state refresh-observed` and
-* derived by {@link scrubResourceRecord} for the observed bag — the deploy's
-* `drainObservedCaptures` baseline reaches it that way. `cdkd import`'s own
-* capture still passes the non-failing constant and keeps the residue; moving
-* it is a one-constant change in `src/cli/commands/import.ts`.
+* by `cdkd import`'s observed capture (issue
+* [#2885](https://github.com/go-to-k/cdkd/issues/2885), which moved it off the
+* non-failing constant), and derived by {@link scrubResourceRecord} for the
+* observed bag — the deploy's `drainObservedCaptures` baseline reaches it that
+* way.
+*
+* WHAT SELECTS IT IS THE DESTINATION, which is why it cannot be derived from
+* the two bags: `cdkd drift --accept` walks with the same shape flags and then
+* writes its result into `properties` for a record with no
+* `observedProperties`, where a mask is a REGRESSION rather than a refusal
+* (`cdkd export` blocks such a record and the rollback replay refuses the
+* operation). A caller declares this constant when it knows its bag becomes a
+* drift baseline and nothing else.
 */
 const STATE_SOURCED_BASELINE_RULES = {
 	descendArrays: false,
@@ -16589,7 +16598,7 @@ async function fetchCreateOnlyPropertyPaths(resourceType) {
 		if (Array.isArray(createOnly)) for (const path of createOnly) {
 			if (typeof path !== "string") continue;
 			if (!path.startsWith("/properties/")) continue;
-			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$1).filter((segment) => segment.length > 0);
+			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$2).filter((segment) => segment.length > 0);
 			if (segments.length > 0) result.push(segments);
 		}
 	}
@@ -16599,7 +16608,7 @@ async function fetchCreateOnlyPropertyPaths(resourceType) {
 /**
 * Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
 */
-function unescapeJsonPointerSegment$1(segment) {
+function unescapeJsonPointerSegment$2(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
 
@@ -22067,16 +22076,106 @@ const REF_RETURNS_ARN_FROM_STATE = /* @__PURE__ */ new Map([
 * Only non-empty string values qualify — an intrinsic-shaped or empty value is
 * skipped so the caller falls back to the raw physical id rather than emitting
 * a broken `[object Object]` / `''`.
-*/
-function refStateLookupFromResource(resource) {
+*
+* A leaf carrying {@link SECRET_MASK} is handled specially, and that handling
+* is a SECURITY property rather than a shape one (issue
+* [#2847](https://github.com/go-to-k/cdkd/issues/2847)). Both bags this reads
+* can hold the mask: `attributes` because `CloudControlProvider.import` masks
+* every model key it cannot certify is a read-only attribute, and `properties`
+* because the mask-only channel (issue #2274) writes it there too.
+* `SECRET_MASK` is a non-empty string, so the lookup HITS and
+* `cfnRefValueFromPhysicalId` returns `'***'` as the resource's `Ref` value —
+* which `resolveRefValue` hands back verbatim and a green deploy substitutes
+* into the consumer's property and sends to AWS. That is the #1498 / #1501
+* corrupted-write class, reached through the ONE attribute reader that is not
+* an `Fn::GetAtt`.
+*
+* ## The skip is OPT-IN, and that is the load-bearing design decision
+*
+* `onMaskedValue` is not a notification bolted onto a global behaviour change;
+* it is the SWITCH. With no callback this function returns the mask exactly as
+* it did before issue #2847 — same value, same callers, nothing to audit. Only
+* a caller that passes one gets the skip, and by passing one it declares it
+* will ACT on the report.
+*
+* IT WAS UNCONDITIONAL FOR THREE REVIEW ROUNDS, and each round found a fresh
+* caller broken by it, because skipping a mask is only an improvement for a
+* caller that has somewhere to put the refusal. For everyone else it REMOVES a
+* guarded sentinel and substitutes an unguarded wrong value: the fall-through
+* emits the raw physical id — for `AWS::S3Tables::Table` an ARN ending in a
+* UUID rather than the table name CFn `Ref` returns — which
+* `refuseMaskedReplayBaseline`, `cdkd export`'s blocker, `cdkd drift`'s mask
+* handling and the deploy-time refusal all pass, where every one of them
+* REJECTS `'***'` loudly. The rounds found it in `cdkd orphan`, then in
+* `resolveOutputs`, then in `cdkd import`; the pattern was the design, not the
+* call sites, so the design changed rather than the sites.
+*
+* A caller therefore chooses between exactly two things, and doing NOTHING is
+* the safe default rather than a hole:
+*
+* 1. **Pass no callback** — pre-#2847 behaviour, the mask travels, downstream
+*    readers catch it. Every caller that has not opted in is in this bucket by
+*    construction, so there is no per-caller audit to keep current.
+* 2. **Pass one and act on it** — skip the mask and refuse. `resolveRefValue`
+*    → `noteRefStateMask` → `ResolverContext.redactedAttributeReads`, read by
+*    `DeployEngine.refuseRedactedAttributeReads` on the CREATE / UPDATE arms
+*    and by `resolveOutputs`' own per-output check;
+*    `src/analyzer/orphan-rewriter.ts` has no resolver context and reports the
+*    site as `unresolvable` instead (under `--force` it warns and substitutes
+*    `SECRET_MASK`, i.e. it opts back into bucket 1's VALUE deliberately).
+*
+* BUCKET 1 IS NOT "the harmless callers", and one of them was mis-described as
+* display-only before the opt-in existed: `cdkd export`'s
+* `resolveChildImportParameters` builds a bagless context whose result becomes
+* a `Parameter[]` on `CreateChangeSet --change-set-type IMPORT` — a re-apply to
+* a live system. It is safe for bucket 1's ORDINARY reason rather than a
+* special one: bagless, so it ships `'***'`, which CloudFormation rejects
+* loudly, exactly as it did before issue #2847. Whether it should REFUSE
+* instead is a separate choice nobody has made. That is the shape of the
+* argument every bucket-1 caller gets: not "this value goes nowhere" but "the
+* mask still reaches a reader that recognises it".
+*
+* The resolver passes a callback from ONE site — `resolveRefValue` — and it
+* passes one only when `context.redactedAttributeReads` EXISTS. Testing the
+* bag at the call site rather than inside `noteRefStateMask` is the whole
+* point: the note returning early still leaves the SKIP done, so a bagless
+* context took the fall-through with nowhere to record the refusal. That is
+* how `cdkd import` came to PERSIST a raw physical id into
+* `resource.properties` — from where `cdkd export` writes it into the imported
+* template and `cdkd drift --revert` sends it to AWS. `cdkd diff` and
+* `cdkd scrub` are bagless too and simply resolve as they did before.
+*
+* `onMaskedValue` fires only when the WHOLE lookup came up empty, not at the
+* masked leaf. The scan spans two bags and several alias keys, so a masked
+* `properties.TableName` beside a live `attributes.TableName` is an ordinary,
+* fully resolvable record — `cdkd import`'s own shape — and notifying there
+* would fail a deploy that has the value it needs. The distinction is "cdkd
+* could not answer, and the reason was a redaction", which is the only case
+* that must refuse. An ABSENT key keeps degrading to the physical id exactly as
+* before: the recovery branches document that graceful fall-through for a
+* pre-#1045 / pre-#1681 record, and nothing about that case changed.
+*/
+function refStateLookupFromResource(resource, onMaskedValue) {
 	return (keys) => {
+		let masked;
 		for (const source of [resource.properties, resource.attributes]) {
 			if (!source) continue;
 			for (const key of keys) {
 				const value = source[key];
-				if (typeof value === "string" && value.length > 0) return value;
+				if (typeof value === "string" && value.length > 0) {
+					if (carriesSecretMask(value)) {
+						if (onMaskedValue === void 0) return value;
+						masked ??= {
+							key,
+							notify: onMaskedValue
+						};
+						continue;
+					}
+					return value;
+				}
 			}
 		}
+		if (masked !== void 0) masked.notify(masked.key);
 	};
 }
 /**
@@ -23825,7 +23924,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async resolveRef(logicalId, context) {
 		const resource = Object.hasOwn(context.resources, logicalId) ? context.resources[logicalId] : void 0;
 		if (resource) {
-			const refValue = this.resolveRefValue(resource);
+			const refValue = this.resolveRefValue(logicalId, resource, context);
 			this.logger.debug(`Resolved Ref to resource: ${logicalId} -> ${refValue}`);
 			return refValue;
 		}
@@ -23907,8 +24006,77 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* children, whose `Ref` is an ARN recovered from the provider-recorded ARN
 	* attribute through the same `stateLookup` seam.
 	*/
-	resolveRefValue(resource) {
-		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId, refStateLookupFromResource(resource));
+	resolveRefValue(logicalId, resource, context) {
+		const canRefuse = context.redactedAttributeReads !== void 0;
+		return cfnRefValueFromPhysicalId(resource.resourceType, resource.physicalId, canRefuse ? refStateLookupFromResource(resource, (key) => this.noteRefStateMask(logicalId, key, context)) : refStateLookupFromResource(resource));
+	}
+	/**
+	* The `Ref` twin of {@link noteAttributeSecrecy} (issue
+	* [#2847](https://github.com/go-to-k/cdkd/issues/2847) review).
+	*
+	* `noteAttributeSecrecy`'s own contract is "every branch serving a value out
+	* of a PERSISTED `attributes` bag must call this", and `Ref` was the branch
+	* that did not: {@link refStateLookupFromResource} reads `properties` then
+	* `attributes` to recover a `Ref` value the physical id cannot yield, and a
+	* masked leaf there travelled all the way to AWS with `redactedAttributeReads`
+	* left empty.
+	*
+	* It is a SEPARATE method rather than a call into `noteAttributeSecrecy` for
+	* two reasons, and both are about what the entry has to SAY. The refusal
+	* joins these entries into a user-facing sentence whose `Fn::GetAtt` arm ends
+	* "stop reading it" — advice that is wrong here, because this read is CDKD's
+	* own: CloudFormation defines these types' `Ref` as a state key rather than
+	* the physical id, so no template edit stops it. And `noteAttributeSecrecy`'s
+	* other half — recording a `NoEcho`-declared value as a mask-only needle — has
+	* nothing to do at this site: the value has ALREADY been masked in state, so
+	* there is no plaintext to register.
+	*
+	* The SPELLING (`Ref <LogicalId> (state key <Key>)`) is what
+	* `DeployEngine.maskedRecordRemedyFor` partitions on, so it is load-bearing
+	* rather than cosmetic — that helper reads the logical id out of it to emit
+	* the re-import command, and pins the shape in a test.
+	*
+	* `key` is never masked before interpolation because it is not template text:
+	* it comes from the fixed key lists `cfnRefValueFromPhysicalId` passes
+	* (`TableName` / `Name` / `SelectionId` / `RepositoryId` / the AppSync ARN
+	* attributes), all cdkd literals.
+	*/
+	noteRefStateMask(logicalId, key, context) {
+		this.pushRedactedAttributeRead(context, {
+			kind: "ref-state-key",
+			logicalId,
+			key,
+			display: `Ref ${logicalId} (state key ${key})`
+		});
+	}
+	/**
+	* The ONE writer of {@link ResolverContext.redactedAttributeReads}, so the
+	* bag's absent-context check and its de-duplication rule live in one place
+	* rather than being re-spelled at each of the three pushing branches.
+	*
+	* DE-DUPES ON THE WHOLE TUPLE, not on `display` alone, and that is the last
+	* decision this file moved out of string space (issue #2847 round-5 review).
+	* An earlier revision compared renderings, which is where two of this PR's
+	* blockers came from: a decision keyed on a joined human-readable string.
+	* Here it gated entry EXISTENCE while `DeployEngine`'s Outputs guard filters
+	* the surviving entries by `kind`, so an `attribute` entry whose `display`
+	* collided with a later `ref-state-key` one suppressed the refusal outright.
+	* Reachable only through an adversarial logical id (`Ref Foo (state key Table`
+	* with an attribute named `Name)`) — `main`'s string bag is equally
+	* contrived, which is why review called it a cleanup rather than a defect —
+	* but the class is the point, not this instance.
+	*
+	* `key` carries its weight here: for the `attribute` kind it is the
+	* ALREADY-MASKED attribute name, so two names differing only ABOVE the mask
+	* still render and compare identically and still collapse, exactly as they
+	* did when the bag held strings. Nothing else reads it, and comparing it is
+	* what keeps it from being a field written by two producers and read by none.
+	*/
+	pushRedactedAttributeRead(context, read) {
+		const bag = context.redactedAttributeReads;
+		if (bag === void 0) return;
+		if (bag.some((entry) => entry.kind === read.kind && entry.logicalId === read.logicalId && entry.key === read.key && entry.display === read.display)) return;
+		bag.push(read);
 	}
 	/**
 	* Resolve Fn::GetAtt intrinsic function
@@ -24013,8 +24181,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const declared = context.noEchoAttributeResources?.get(logicalId);
 		if ((declared === true || declared !== void 0 && declared.has(attributeName)) && context.recordedSecretValues) recordMaskOnlyValuesIn(value, context.recordedSecretValues);
 		if (context.redactedAttributeReads !== void 0 && carriesSecretMask(value)) {
-			const read = `${logicalId}.${this.maskSecretsForLog(attributeName, context)}`;
-			if (!context.redactedAttributeReads.includes(read)) context.redactedAttributeReads.push(read);
+			const maskedAttributeName = this.maskSecretsForLog(attributeName, context);
+			this.pushRedactedAttributeRead(context, {
+				kind: "attribute",
+				logicalId,
+				key: maskedAttributeName,
+				display: `${logicalId}.${maskedAttributeName}`
+			});
 		}
 		return value;
 	}
@@ -24999,7 +25172,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			if (context.redactedAttributeReads !== void 0) {
 				const loggedOrigin = this.maskSecretsForLog(origin, context);
-				if (!context.redactedAttributeReads.includes(loggedOrigin)) context.redactedAttributeReads.push(loggedOrigin);
+				this.pushRedactedAttributeRead(context, {
+					kind: "cross-stack",
+					display: loggedOrigin
+				});
 			}
 		}
 		if (!carriesDynamicReference(value)) return value;
@@ -26434,7 +26610,7 @@ async function fetchTopLevelWriteOnlyProperties(resourceType) {
 		if (Array.isArray(writeOnly)) for (const path of writeOnly) {
 			if (typeof path !== "string") continue;
 			const match = /^\/properties\/([^/]+)/.exec(path);
-			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
 		}
 	}
 	logger.debug(`Resolved ${result.size} top-level write-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
@@ -26443,6 +26619,128 @@ async function fetchTopLevelWriteOnlyProperties(resourceType) {
 /**
 * Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
 */
+function unescapeJsonPointerSegment$1(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
+//#endregion
+//#region src/provisioning/read-only-properties.ts
+/**
+* Read-only property resolution for `CloudControlProvider.import()` (issue
+* [#2847](https://github.com/go-to-k/cdkd/issues/2847)) — the read-side sibling
+* of {@link file://./write-only-properties.ts}, sharing its `DescribeType` +
+* per-type cache + top-level reduction, and differing from it in exactly one
+* way that is the point of the module: it distinguishes "this type declares no
+* read-only properties" from "cdkd could not find out".
+*
+* WHY THE DISTINCTION IS LOAD-BEARING. The write-only caller degrades SAFELY to
+* the empty set (a smaller UPDATE patch). This caller does not: its empty set
+* would mean "surface no attributes", while its `undefined` means "cdkd cannot
+* tell an attribute from a property for this type". Collapsing the two into one
+* `Set` — which is what the write-only sibling's signature does — makes a
+* missing `cloudformation:DescribeType` permission indistinguishable from a
+* type with no attributes, and the CALLER's fail-closed arm then cannot be
+* written at all. So the return type is `ReadonlySet<string> | undefined` and
+* the failure is the `undefined`.
+*
+* WHAT `readOnlyProperties` MEANS HERE. In the CloudFormation registry schema a
+* type's `readOnlyProperties` are exactly the values `Fn::GetAtt` may read —
+* that is the definition CloudFormation itself applies, and it is why the
+* narrowing this module enables is a CORRECTNESS fix as much as a security one.
+* Cloud Control's `GetResource` returns the whole resource MODEL, whose keys are
+* every readable property, writable ones included; a `Fn::GetAtt` naming one of
+* those is rejected by CloudFormation at template validation, so nothing cdkd
+* drops here was ever a legitimate attribute.
+*
+* TOP-LEVEL REDUCTION, deliberately the same convention as the write-only
+* sibling: a nested pointer `/properties/Endpoint/Address` reduces to
+* `Endpoint`, so the whole containing property is kept. Keeping the container is
+* what makes the resolver's nested-path walk (`Endpoint.Address`, issue #381)
+* keep working; reducing to the leaf instead would drop the object the walk
+* descends into.
+*
+* WHAT THAT COSTS, stated because the caller is a redaction and the reduction
+* WIDENS what survives it: certifying `Endpoint` certifies the WHOLE container,
+* including sibling leaves the schema does not declare read-only. A type whose
+* schema marks `/properties/Endpoint/Address` read-only while `Endpoint` also
+* carries, say, a credential member would keep that member in the clear. The
+* alternative — reduce to the leaf and mask the rest of the container — was
+* rejected because it breaks `Fn::GetAtt Endpoint.Port` for every ordinary
+* type, which is a certain regression against a hypothetical exposure; a
+* PATH-precise certification is the real fix and is not what this module does.
+* The residual sits inside the wider one `import()`'s doc already states (a
+* read-only attribute that IS a credential is persisted in the clear), so it
+* adds a shape rather than a new class.
+*
+* CACHING matches the sibling exactly, including the part that is easy to get
+* wrong: the promise stored in the cache is the ALREADY-RECOVERED one, and what
+* keeps a failure from being cached is the handler DELETING its own entry, not
+* the cache holding a raw promise. An earlier revision of this module cached
+* the raw promise and recovered only the calling side — which meant a second
+* caller arriving inside the failure window received a REJECTION out of a
+* function whose contract says it never throws. Unreachable at the time (both
+* `importOne` loops are sequential `for…await`), but the contract is what the
+* caller's fail-closed arm is written against, so it is honoured here rather
+* than left to the call graph.
+*
+* Only SUCCESSFUL lookups therefore survive in the cache for the process
+* lifetime, so a transient throttle on the first imported resource of a type
+* cannot poison every later one. A schema-less response is a SUCCESSFUL lookup
+* of an empty set, not a failure — a type AWS publishes with no
+* `readOnlyProperties` genuinely has no attributes, and answering `undefined`
+* there would make the caller emit a missing-permission warning for a healthy
+* type.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only, holding the in-flight promise so
+* concurrent imports of the same type share one `DescribeType` call. A failed
+* lookup removes its own entry so a later call retries.
+*/
+const readOnlyPropertiesCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the TOP-LEVEL read-only (i.e. `Fn::GetAtt`-able) property names for a
+* resource type.
+*
+* Returns `undefined` when the schema could not be resolved — a missing
+* `cloudformation:DescribeType` permission, an exhausted throttle retry, or a
+* type with no registry entry at all. Callers MUST treat `undefined` as "cannot
+* certify" rather than as "none": the two are different answers and this
+* function is the only place that can still tell them apart.
+*
+* Never throws.
+*/
+function getTopLevelReadOnlyProperties(resourceType) {
+	if (hasNoRegistrySchema(resourceType)) return Promise.resolve(void 0);
+	const cached = readOnlyPropertiesCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchTopLevelReadOnlyProperties(resourceType).catch((error) => {
+		readOnlyPropertiesCache.delete(resourceType);
+		const message = error instanceof Error ? error.message : String(error);
+		getLogger().child("ReadOnlyProperties").debug(`Failed to resolve read-only properties for ${displaySafe(resourceType, { asciiOnly: true })} via cloudformation:DescribeType (${message}).`);
+	});
+	readOnlyPropertiesCache.set(resourceType, entry);
+	return entry;
+}
+/**
+* Fetch + parse the type's read-only properties. THROWS on a DescribeType
+* failure — the caller catches, reports `undefined`, and declines to cache.
+*/
+async function fetchTopLevelReadOnlyProperties(resourceType) {
+	const logger = getLogger().child("ReadOnlyProperties");
+	const response = await describeTypeWithThrottleRetry(resourceType);
+	const result = /* @__PURE__ */ new Set();
+	if (response.Schema) {
+		const readOnly = JSON.parse(response.Schema).readOnlyProperties;
+		if (Array.isArray(readOnly)) for (const path of readOnly) {
+			if (typeof path !== "string") continue;
+			const match = /^\/properties\/([^/]+)/.exec(path);
+			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+		}
+	}
+	logger.debug(`Resolved ${result.size} top-level read-only properties for ${displaySafe(resourceType, { asciiOnly: true })}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	return result;
+}
+/** Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`). */
 function unescapeJsonPointerSegment(segment) {
 	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
 }
@@ -27124,6 +27422,12 @@ var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
 	patchGenerator = new JsonPatchGenerator();
+	/**
+	* Types whose unresolvable-schema import warning has already been printed —
+	* see `maskUncertifiedModelValues`. Per-instance so a test cannot inherit
+	* another test's suppression.
+	*/
+	warnedUnresolvableSchemaTypes = /* @__PURE__ */ new Set();
 	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
@@ -27283,7 +27587,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-C_AHAmgD.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CRxRmEzr.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -27644,10 +27948,18 @@ var CloudControlProvider = class {
 	/**
 	* Enrich resource attributes with computed values
 	*
-	* CC API GetResource returns property names that match CloudFormation
-	* Fn::GetAtt attribute names, so all properties are passed through as-is.
 	* This method adds fallback attributes for edge cases where CC API
 	* may not return certain values.
+	*
+	* It passes every other key through AS-IS, and on the CREATE / UPDATE path
+	* that bag is still the WHOLE resource model. This comment used to justify
+	* that by saying the model's property names match `Fn::GetAtt` attribute
+	* names; they do not — the model is every readable property, and
+	* CloudFormation rejects a `Fn::GetAtt` naming a writable one. Issue
+	* [#2847](https://github.com/go-to-k/cdkd/issues/2847) narrowed the IMPORT
+	* path for that reason; the deploy path is issue
+	* [#2925](https://github.com/go-to-k/cdkd/issues/2925), which also carries
+	* why the same narrowing cannot simply be copied here.
 	*/
 	async enrichResourceAttributes(resourceType, physicalId, attributes) {
 		const enriched = { ...attributes };
@@ -28100,7 +28412,9 @@ var CloudControlProvider = class {
 	*   - With `knownPhysicalId` (from `--resource <id>=<physicalId>` or
 	*     `--resource-mapping`): call `GetResource(TypeName, Identifier)`,
 	*     parse `ResourceModel` (returned as a JSON string by CC API), and
-	*     return its keys as `attributes`.
+	*     return the ATTRIBUTE keys as `attributes` — see
+	*     {@link maskUncertifiedModelValues} for what "attribute" means here and
+	*     why every other key comes back MASKED rather than dropped.
 	*   - Without `knownPhysicalId`: return `null`. CC API has no efficient
 	*     `aws:cdk:path`-tag lookup — `ListResources` returns identifiers
 	*     only, so tag lookup would require one `GetResource` per resource
@@ -28112,6 +28426,107 @@ var CloudControlProvider = class {
 	* SDK providers (S3, Lambda, IAM Role, etc.) implement their own
 	* `import` with tag-based auto-lookup; this fallback only kicks in for
 	* resource types that don't have a dedicated SDK provider.
+	*
+	* ---
+	*
+	* The rest of this block is the design of the attribute narrowing
+	* {@link maskUncertifiedModelValues} performs — every LEAF of a model key
+	* cdkd cannot certify is an ATTRIBUTE is replaced with {@link SECRET_MASK},
+	* container shape preserved, and the certified attributes are left untouched
+	* (issue [#2847](https://github.com/go-to-k/cdkd/issues/2847)).
+	*
+	* It lives HERE, on `import()`, rather than in a second block above the
+	* method, and that is deliberate: two consecutive block comments attach only
+	* the LAST one, so splitting this back out silently orphans whichever doc
+	* ends up first. Keep it as ONE block.
+	*
+	* ## What is being fixed
+	*
+	* `GetResource` returns the resource MODEL — every readable property, not
+	* just the attributes. `cdkd import` persisted that model verbatim into
+	* `ResourceState.attributes`, through no redactor, for every
+	* Cloud-Control-routed type. Where the model carries a credential, the
+	* credential landed in `state.json` in the clear.
+	*
+	* ## Why "attribute" means `readOnlyProperties`
+	*
+	* That is CloudFormation's own definition: a type's `readOnlyProperties` are
+	* exactly what `Fn::GetAtt` may read, and CloudFormation REJECTS a
+	* `Fn::GetAtt` naming a writable property at template validation. So a key
+	* outside that set was never a legitimate attribute, and cdkd persisting it
+	* bought nothing a valid template could use.
+	*
+	* ## Why MASK and not DROP — the load-bearing decision
+	*
+	* Dropping looks cleaner and is WRONG here, because there is no live
+	* fallback on the read side. `IntrinsicFunctionResolver.resolveGetAtt` looks
+	* the key up in this bag and, on a miss, falls through to
+	* `constructAttribute` — which synthesizes from `physicalId` alone and, for
+	* an attribute name that is neither `*Arn` nor `*Url`, WARNS and returns the
+	* physical id. That is a silently wrong value shipped to AWS. There is no
+	* `provider.getAttribute` rescue on the deploy path (the only caller of it
+	* outside the providers is `cdkd orphan`), and this class has no
+	* `getAttribute` at all.
+	*
+	* Masking keeps the KEY present, so the lookup HITS and the value flows
+	* through `noteAttributeSecrecy` into `ResolverContext.redactedAttributeReads`,
+	* where `DeployEngine.refuseRedactedAttributeReads` FAILS the resource rather
+	* than sending the mask. So the outcome is a loud, named refusal instead of a
+	* wrong value — which is the trade this repo already made for the mask-only
+	* channel (issue #2274), reusing its machinery rather than inventing a second
+	* sentinel nothing downstream recognises.
+	*
+	* ONE SHAPE ESCAPES THAT, and it is stated rather than left to be discovered:
+	* an uncertified EMPTY container (`{}` / `[]`) has no leaf to mask, so no
+	* `SECRET_MASK` lands under that key and no refusal can fire for it. A DOTTED
+	* read through it breaks at `Object.hasOwn` and falls to `constructAttribute`;
+	* a FLAT read returns the empty container itself. It is not a DISCLOSURE — the
+	* container was empty at AWS, so there was nothing to disclose — but the
+	* refusal genuinely does not fire there.
+	*
+	* ## The unresolvable-schema arm is FAIL-CLOSED
+	*
+	* `getTopLevelReadOnlyProperties` answers `undefined` when it could not find
+	* out — a missing `cloudformation:DescribeType` grant, an exhausted throttle
+	* retry, or a type with no registry entry. cdkd then cannot tell an attribute
+	* from a property for this type, so it certifies NOTHING and masks the whole
+	* model, warning at default verbosity with the grant to add. Failing OPEN
+	* here would make a missing IAM permission silently restore the exact
+	* disclosure this method exists to close.
+	*
+	* ## An UNREADABLE MODEL warns at the same volume as an unreadable schema
+	*
+	* The two arms below the `GetResource` — a `JSON.parse` failure, and a model
+	* that parsed to something other than an object — cannot mask anything (there
+	* is no bag to walk), so they yield `attributes: {}`. That is the DROP
+	* outcome this design rejects one section up: the key is absent,
+	* `resolveGetAtt` falls through to `constructAttribute`, and the physical id
+	* ships. "cdkd could not read the model" is the same epistemic state as "cdkd
+	* could not read the schema", so both report at DEFAULT verbosity. They used
+	* to differ — the schema arm warned while these logged at `debug` — which
+	* meant the one outcome that ships a wrong value silently was the one nobody
+	* was told about. Neither line prints any part of the model: the parse arm
+	* prints the error's NAME only (V8 embeds an input snippet in a
+	* `SyntaxError`'s message) and the non-object arm prints the SHAPE only.
+	*
+	* ## What this does NOT close, stated as the danger direction
+	*
+	* A CREDENTIAL THAT IS ITSELF A READ-ONLY ATTRIBUTE IS STILL PERSISTED IN THE
+	* CLEAR. `readOnlyProperties` is a structural test, not a sensitivity one, and
+	* the registry schema offers nothing better to key on: it has no general
+	* sensitivity marking. The nearest things it does have were both checked and
+	* neither serves — `"format": "password"` is declared by a single property in
+	* AWS's whole published bundle, and `writeOnlyProperties` (a real "cannot be
+	* returned by a read" marker, declared by a minority of types) describes
+	* values `GetResource` never returns, so masking them would be inert here. So
+	* the "mask by the schema's own marking" shape the issue floated is NARROWED
+	* to nothing usable rather than refuted outright. Known members of the
+	* surviving class include `AWS::IAM::AccessKey`'s `SecretAccessKey`,
+	* `AWS::Cognito::UserPoolClient`'s `ClientSecret` and
+	* `AWS::EC2::IpamExternalResourceVerificationToken`'s `TokenValue`. The list
+	* is not claimed to be exhaustive and no count is quoted here, because
+	* nothing in the tree fences one; the derivation and its residual are
+	* recorded on the issue.
 	*/
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
@@ -28120,14 +28535,21 @@ var CloudControlProvider = class {
 				TypeName: input.resourceType,
 				Identifier: input.knownPhysicalId
 			}));
-			let attributes = {};
+			const safeType = displaySafe(input.resourceType, { asciiOnly: true });
+			const safeId = displaySafe(input.knownPhysicalId, { asciiOnly: true });
+			let parsedModel;
 			const raw = resp.ResourceDescription?.Properties;
 			if (typeof raw === "string" && raw.length > 0) try {
 				const parsed = JSON.parse(raw);
-				if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) attributes = parsed;
+				if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) parsedModel = parsed;
+				else {
+					const shape = parsed === null ? "null" : Array.isArray(parsed) ? "an array" : typeof parsed;
+					this.logger.warn(`CC API ResourceModel for ${safeType}/${safeId} parsed to ${shape}, not an object — recording no attributes for it. An Fn::GetAtt against this resource will fall back to a value constructed from its physical id.`);
+				}
 			} catch (parseErr) {
-				this.logger.debug(`Failed to parse CC API ResourceModel for ${input.resourceType}/${input.knownPhysicalId}: ${parseErr instanceof Error ? parseErr.message : String(parseErr)}`);
+				this.logger.warn(`Failed to parse CC API ResourceModel for ${safeType}/${safeId}: ${parseErr instanceof Error ? parseErr.name : typeof parseErr}. Recording no attributes for it; an Fn::GetAtt against this resource will fall back to a value constructed from its physical id.`);
 			}
+			const attributes = parsedModel === void 0 ? {} : await this.maskUncertifiedModelValues(parsedModel, input.resourceType, input.knownPhysicalId);
 			return {
 				physicalId: input.knownPhysicalId,
 				attributes
@@ -28137,7 +28559,81 @@ var CloudControlProvider = class {
 			throw error;
 		}
 	}
+	/**
+	* Replace every LEAF cdkd cannot certify belongs to an ATTRIBUTE with
+	* {@link SECRET_MASK}, preserving container SHAPE, and leave the certified
+	* attributes untouched. The argument for masking rather than dropping, and
+	* for the fail-closed `undefined` arm, is on {@link import} above.
+	*
+	* ## Why the walk is RECURSIVE — this was a measured defect, not caution
+	*
+	* The first cut replaced the whole VALUE, so an uncertified `Endpoint`
+	* object became the string `'***'`. `IntrinsicFunctionResolver.resolveGetAtt`
+	* resolves `Endpoint.Address` by WALKING the dotted path: it tests
+	* `typeof cursor === 'object'`, which a string fails, so the walk breaks with
+	* `cursor === undefined`, `noteAttributeSecrecy` is NEVER called, and control
+	* reaches `constructAttribute` — the physical-id fallback. That is precisely
+	* the silently-wrong-value outcome the mask exists to prevent, so
+	* whole-value masking DEFEATED its own justification for every nested
+	* attribute. Masking leaves keeps the containers walkable, so the walk lands
+	* on a `'***'` LEAF and notes it, and the refusal fires — for any container
+	* that HAS a leaf. An EMPTY one has none, and `import()`'s doc carries that
+	* gap; do not read this sentence as covering it.
+	*
+	* Arrays keep their length and element positions for the same reason.
+	*
+	* ## The bag is null-prototype
+	*
+	* `JSON.parse` can yield a legal own key `__proto__`; assigning that on an
+	* ordinary object literal writes the PROTOTYPE instead of an own property and
+	* the key vanishes from the bag — a DROP, the one outcome this method must
+	* never produce. `Object.create(null)` makes the assignment ordinary.
+	*/
+	async maskUncertifiedModelValues(model, resourceType, physicalId) {
+		const safeType = displaySafe(resourceType, { asciiOnly: true });
+		const safeId = displaySafe(physicalId, { asciiOnly: true });
+		const attributeNames = await getTopLevelReadOnlyProperties(resourceType);
+		if (attributeNames === void 0) {
+			if (!this.warnedUnresolvableSchemaTypes.has(resourceType)) {
+				this.warnedUnresolvableSchemaTypes.add(resourceType);
+				this.logger.warn(`Could not resolve the CloudFormation schema for ${safeType}, so cdkd cannot tell which of its Cloud Control model keys are Fn::GetAtt attributes. Every imported attribute for this type is recorded as "${"***"}" rather than risking a credential in state.json; an Fn::GetAtt against such a resource fails with a named refusal until that resource is next created or updated by a deploy. Grant cloudformation:DescribeType and re-import to record its attributes.`);
+			}
+		}
+		const masked = Object.create(null);
+		let maskedCount = 0;
+		for (const [key, value] of Object.entries(model)) if (attributeNames?.has(key)) masked[key] = value;
+		else {
+			masked[key] = maskLeavesDeep(value);
+			maskedCount++;
+		}
+		if (maskedCount > 0 && attributeNames !== void 0) this.logger.debug(`Masked ${maskedCount} non-attribute key(s) out of the ${safeType} Cloud Control model for ${safeId}: they are not in the type's readOnlyProperties, so CloudFormation would reject an Fn::GetAtt naming them and cdkd has no evidence they are safe to persist.`);
+		return masked;
+	}
 };
+/**
+* Every LEAF of `value` replaced by {@link SECRET_MASK}, with object and array
+* CONTAINERS rebuilt at the same shape. See
+* `CloudControlProvider.maskUncertifiedModelValues` for why the shape must
+* survive.
+*
+* A `JSON.parse` result is acyclic by construction, so no visited-set is
+* needed — that answers CYCLES and nothing else. It is NOT a depth guarantee:
+* measured on this repo's node, `JSON.parse` survives ~100,000 nesting levels
+* while this recursion throws `RangeError` between 1,000 and 5,000. No Cloud
+* Control resource model comes close, and the `try` in `import()` is narrowed
+* to the parse, so such a `RangeError` would fail the import loudly rather than
+* degrade it silently — which is the direction this design wants. Recorded so
+* the acyclic sentence is not read as covering depth.
+*/
+function maskLeavesDeep(value) {
+	if (Array.isArray(value)) return value.map((element) => maskLeavesDeep(element));
+	if (value !== null && typeof value === "object") {
+		const out = Object.create(null);
+		for (const [key, nested] of Object.entries(value)) out[key] = maskLeavesDeep(nested);
+		return out;
+	}
+	return "***";
+}
 
 //#endregion
 //#region src/provisioning/interrupt-watch.ts
@@ -34772,7 +35268,7 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 */
 function refuseMaskedReplayBaseline(props, logicalId) {
 	if (props === void 0 || !carriesSecretMask(props)) return;
-	throw new CdkdError(`Cannot roll ${logicalId} back: its recorded baseline holds the redaction mask ('${"***"}') where a NoEcho custom-resource value was resolved, so cdkd would write that literal to the live resource. Restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
+	throw new CdkdError(`Cannot roll ${logicalId} back: its recorded baseline holds the redaction mask ('${"***"}'), so cdkd would write that literal to the live resource. There are two ways a baseline comes to hold it. (1) A NoEcho custom-resource value was resolved there: restore the property with 'cdkd deploy' AFTER forcing that custom resource to update (change one of its properties, e.g. a nonce), so its handler runs again and supplies the real value — an ordinary re-deploy leaves the resource unchanged, so the handler does not run and the mask stays. (2) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. See https://github.com/go-to-k/cdkd/issues/2449.`, "ROLLBACK_REDACTED_BASELINE");
 }
 /**
 * The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
@@ -36317,7 +36813,7 @@ function unionCrossStackReads(previous, recorded, identity) {
 	}
 	return out;
 }
-var DeployEngine = class {
+var DeployEngine = class DeployEngine {
 	logger = getLogger().child("DeployEngine");
 	resolver;
 	interrupted = false;
@@ -36586,7 +37082,7 @@ var DeployEngine = class {
 			...this.options.inheritedSecrets && this.options.inheritedSecrets.size > 0 && { inheritedSecrets: this.options.inheritedSecrets },
 			recordedSecretValues,
 			noEchoAttributeResources: this.noEchoAttributeResources,
-			redactedAttributeReads: []
+			...base.redactedAttributeReads && { redactedAttributeReads: base.redactedAttributeReads }
 		};
 	}
 	/**
@@ -36740,6 +37236,147 @@ var DeployEngine = class {
 		for (const name of names) recordMaskOnlyValuesIn(attributes[name], secrets, excluded);
 	}
 	/**
+	* The remedy clause of {@link refuseRedactedAttributeReads}'s import arm,
+	* derived from the `reads` entries rather than described in prose.
+	*
+	* `ResolverContext.redactedAttributeReads` is HETEROGENEOUS, and the split
+	* that matters is NOT which function pushed the entry — it is whether the
+	* masked record lives in THIS stack's state, because only then can a
+	* `--resource` re-import here reach it. FOUR populations reach the bag, and
+	* each entry now says which it is IN ITS OWN FIELDS
+	* ({@link RedactedAttributeRead}) rather than in a rendered string this
+	* function re-parses:
+	*
+	*  - `kind: 'attribute'` with a `logicalId` — `noteAttributeSecrecy`, a
+	*    resource in this stack. LOCAL.
+	*  - `kind: 'attribute'` whose `logicalId` names an
+	*    `AWS::CloudFormation::Stack` — ALSO `noteAttributeSecrecy`, and the
+	*    reason `kind` alone cannot partition. A nested stack's output attribute
+	*    reaches the cross-stack re-resolution arm only when it
+	*    `carriesDynamicReference`, and a value that is already `SECRET_MASK`
+	*    does NOT (that predicate tests for `{{resolve:`), so a masked child
+	*    output falls through to `noteAttributeSecrecy` and is pushed as an
+	*    ordinary local attribute read. Its record is the CHILD's
+	*    `state.outputs`, from which the parent's attributes are rebuilt every
+	*    deploy, so no `--resource` in THIS stack clears it:
+	*    `NestedStackProvider` implements no `import()` at all, so the command
+	*    would report `skipped-no-impl` and change nothing. FOREIGN, despite
+	*    being local by kind.
+	*  - `kind: 'cross-stack'` — `reresolveCrossStackValue`'s `Fn::ImportValue` /
+	*    `Fn::GetStackOutput` / `nested stack <Child> Outputs.<Key>` forms. It
+	*    carries NO `logicalId`, because there is no id in THIS stack to name.
+	*    FOREIGN.
+	*  - `kind: 'ref-state-key'` — `noteRefStateMask`, a resource in this stack
+	*    whose CFn `Ref` value is recovered from a state key rather than from the
+	*    physical id. LOCAL, and it earns a sentence of its own: the read is
+	*    cdkd's, not the template's, so the `Fn::GetAtt` remedy "stop reading it"
+	*    does not apply.
+	*
+	* Successive review rounds tried to express this as an instruction the reader
+	* applies ("the name to the left of the dot"), and each phrasing was wrong
+	* for a shape it had not considered — twice naming a REAL-but-wrong logical
+	* id that the import typo guard ACCEPTS, so following it would
+	* `--force`-overwrite an innocent row. Partitioning here makes each arm say
+	* only what is true of its own shape, and makes a new shape a change to THIS
+	* function rather than a silent widening of a sentence.
+	*
+	* **AND THE PARTITION READS FIELDS, NEVER A REGEX OVER `display`** (round-4
+	* review). Two revisions parsed the rendering back into structure and each
+	* shipped a defect: a hand-spelled pattern that a producer rename disarms,
+	* then an `[A-Za-z0-9]+` id class that a HYPHENATED logical id falls out of —
+	* and cdkd accepts one, because it validates no logical-id charset and never
+	* hands the template to CloudFormation. Here falling out cost a re-import
+	* command withheld; at `resolveOutputs`' guard the same miss cost the REFUSAL
+	* itself. One rendering serving two consumers whose safe directions are
+	* OPPOSITE is not a pattern to tune, so the structure moved into the data.
+	*
+	* The nested-stack case is excluded BY RESOURCE TYPE, not by an `Outputs.`
+	* spelling. Keying on the segment over-reaches: a local
+	* `AWS::ServiceCatalog::CloudFormationProvisionedProduct` documents
+	* `Outputs.<Key>` as a real `Fn::GetAtt` attribute, so a masked one would be
+	* misrouted to the foreign arm and the reachable remedy withheld. `resources`
+	* is on the context already, so the type is available and exact.
+	*
+	* A LOCAL target whose type cannot be repaired by `cdkd import` at all gets
+	* a THIRD arm since the issue #2847 round-2 review — a `Custom::*` /
+	* `AWS::CloudFormation::CustomResource`, whose provider records no
+	* attributes, so the import's same-physical-id carry-over restores the
+	* masked bag and the refusal repeats forever. It is NOT simply excluded from
+	* `isLocal`: that would route it to the FOREIGN arm, which asserts the record
+	* lives in another stack, and for a custom resource in this very template
+	* that is false. Its arm names the resource and withholds the command.
+	*
+	* An entry carrying NO `logicalId` is treated as foreign, which is both
+	* correct (`cross-stack` is the only kind that omits it) and the safe
+	* direction for a kind nobody has added yet: the foreign arm names no
+	* command, so an unrecognised shape costs a vaguer message rather than a
+	* destructive one.
+	*
+	* A logical id spelled `Ref Foo (state key X)`, or `My-Table`, or anything
+	* else cdkd accepts, now routes on the FIELD and cannot be misread as another
+	* row — the misparse the pre-round-4 regexes had to be anchored against.
+	*/
+	static maskedRecordRemedyFor(reads, resources) {
+		const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+		/**
+		* Types whose `import()` can NEVER clear a mask, so advising a re-import
+		* for them is a guaranteed no-op (issue #2847 round-2 review).
+		*
+		* TRACED, not assumed. `CustomResourceProvider.import` returns
+		* `{ physicalId, attributes: {} }` unconditionally; `import.ts`'s
+		* `rowAttributes` normalises an empty bag to `undefined` and the coalesce
+		* behind it CARRIES FORWARD the prior record's attributes whenever the
+		* physical id matches — which it does, since the command is run with that
+		* very id. So the masked bag is copied back verbatim and the refusal
+		* repeats, forever.
+		*
+		* This is the NoEcho population — arm (1) of the refusal's own message —
+		* which already has the right remedy there (force the custom resource to
+		* update so its handler runs again). It gets its OWN arm rather than being
+		* excluded from `isLocal`: excluding it would route the read to the FOREIGN
+		* arm, which says the record lives in ANOTHER stack, and for a custom
+		* resource sitting in this very template that is simply false. Narrower
+		* than issue #2927, which is about a re-import whose `GetResource` merely
+		* came back empty; here the provider cannot produce attributes at all.
+		*/
+		const importCannotClearMask = (type) => type === "AWS::CloudFormation::CustomResource" || (type?.startsWith("Custom::") ?? false);
+		const typeOf = (read) => read.logicalId !== void 0 && Object.hasOwn(resources, read.logicalId) ? resources[read.logicalId]?.resourceType : void 0;
+		const isLocal = (read) => {
+			if (read.logicalId === void 0) return false;
+			return typeOf(read) !== NESTED_STACK_RESOURCE_TYPE;
+		};
+		/** LOCAL, but no `cdkd import` can rewrite it — see above. */
+		const isUnclearableLocal = (read) => isLocal(read) && importCannotClearMask(typeOf(read));
+		const targetOf = (read) => read.logicalId;
+		const localTargets = [...new Set(reads.filter((read) => isLocal(read) && !isUnclearableLocal(read)).map(targetOf).filter((id) => id !== void 0))];
+		const unclearableTargets = [...new Set(reads.filter(isUnclearableLocal).map(targetOf).filter((id) => id !== void 0))];
+		const foreignReads = reads.filter((read) => !isLocal(read));
+		const hasRefStateRead = reads.some((read) => read.kind === "ref-state-key" && isLocal(read));
+		/**
+		* A logical id rendered inside the single-quoted command below.
+		*
+		* cdkd validates no logical-id charset, so the id can contain a `'` — and
+		* the line it lands in is meant to be COPY-PASTED into a shell, where an
+		* unescaped one closes the quoting early and the rest of the command
+		* reparses as something else. POSIX single-quote escaping (`'` becomes
+		* `'\\''`) is the fix: close, emit an escaped quote, reopen.
+		*
+		* cdkd never EXECUTES this string — it is advice in an error message — so
+		* this is about the pasted command being correct, not about injection into
+		* cdkd itself (issue #2847 round-5 review).
+		*/
+		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
+		const parts = [];
+		if (localTargets.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + localTargets.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
+		if (foreignReads.length > 0) {
+			const subject = reads.length === 1 ? "The read above resolves" : foreignReads.length === 1 ? "One of the reads above resolves" : "Some of the reads above resolve";
+			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
+		}
+		if (hasRefStateRead) parts.push("A 'Ref <LogicalId> (state key <Key>)' entry above is CDKD's own read, not one the template can stop making: CloudFormation defines that resource type's Ref value as that state key rather than the physical id, so the record must be repaired (re-import it, or let a deploy create or update the resource) — the \"stop reading it\" remedy does not apply to such an entry.");
+		return parts.join(" ");
+	}
+	/**
 	* Refuse to provision a resource whose resolution served a REDACTED attribute
 	* out of a previous deploy's state (issue #2274).
 	*
@@ -36757,17 +37394,30 @@ var DeployEngine = class {
 	* class. A loud failure naming the remedy is strictly better than a silent
 	* wrong write.
 	*
-	* NARROW BY CONSTRUCTION. The bag is only non-empty when a `Fn::GetAtt`
-	* actually served a masked attribute during THIS resource's resolution, so a
+	* NARROW BY CONSTRUCTION. The bag is only non-empty when a resolution
+	* actually served a masked value during THIS resource's resolution, so a
 	* resource whose properties merely happen to contain the string `***` is
 	* untouched — which is why the check is not "does `resolvedProps` hold the
 	* mask". And the diff pass does not consult the bag at all, so an untouched
 	* stack still reports NO_CHANGE and deploys.
+	*
+	* "A resolution", not "an `Fn::GetAtt`": the pushers are
+	* `noteAttributeSecrecy`, `reresolveCrossStackValue` and — since the issue
+	* #2847 review — `noteRefStateMask`, the `Ref` branch that reads a recovery
+	* key out of the same persisted bags. {@link maskedRecordRemedyFor} is the
+	* authority on the full shape list.
+	*
+	* This block sits DIRECTLY above its subject, and the previous revision's did
+	* not: `maskedRecordRemedyFor` was inserted between the two, so JavaScript's
+	* "only the LAST of two consecutive block comments attaches" rule (the same
+	* one `cloud-control-provider.ts`'s `import()` doc warns about) silently
+	* re-pointed 25 lines of doc at the wrong function and left this one with
+	* none. Keep a new helper OUT of the gap.
 	*/
 	refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const reads = context.redactedAttributeReads;
 		if (reads === void 0 || reads.length === 0) return;
-		throw new ProvisioningError(`Cannot resolve ${reads.join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. That happens when a custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Two remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
+		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)} If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
 	}
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
@@ -37899,7 +38549,8 @@ var DeployEngine = class {
 					template,
 					resources: stateResources,
 					...parameterValues && { parameters: parameterValues },
-					...conditions && { conditions }
+					...conditions && { conditions },
+					redactedAttributeReads: []
 				}, stackName);
 				if (context.recordedSecretValues) this.perResourceSecrets.set(logicalId, context.recordedSecretValues);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
@@ -37947,7 +38598,8 @@ var DeployEngine = class {
 					template,
 					resources: stateResources,
 					...parameterValues && { parameters: parameterValues },
-					...conditions && { conditions }
+					...conditions && { conditions },
+					redactedAttributeReads: []
 				}, stackName);
 				const updateSecrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
 				this.perResourceSecrets.set(logicalId, updateSecrets);
@@ -38784,6 +39436,83 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
+		/**
+		* Fail an output whose resolution served a value out of a MASKED state
+		* record, instead of publishing what the fall-through produced (issue
+		* [#2847](https://github.com/go-to-k/cdkd/issues/2847), independent
+		* round-2 review — the BLOCKER).
+		*
+		* `refuseRedactedAttributeReads` is called at exactly TWO sites, both
+		* per-resource CREATE / UPDATE. `resolveOutputs` builds its own context
+		* and consulted nothing, so the note this pass records was written and
+		* never read — and once `refStateLookupFromResource` learned to refuse a
+		* masked leaf, "never read" stopped being harmless. A `{"Ref": <record
+		* whose TableName / SelectionId / RepositoryId / AppSync ARN is masked>}`
+		* in `Outputs` publishes the RAW PHYSICAL ID: for a Cloud-Control-routed
+		* `AWS::S3Tables::Table`, a UUID-tailed ARN where the table NAME belongs.
+		*
+		* THE ASYMMETRY IS WHY THIS IS A REFUSAL RATHER THAN A WARNING. Before the
+		* refusal existed this published `'***'`, which the CONSUMER stack rejects
+		* — `reresolveCrossStackValue` tests `carriesSecretMask` and refuses. An
+		* ARN passes that test, so the consumer resolves its `Fn::ImportValue` to
+		* a wrong value and sends it to AWS, with both deploys green. Publishing
+		* nothing is the only outcome that keeps the consumer's guard meaningful.
+		*
+		* PER-OUTPUT BY ITS OWN BAG, and a length DELTA over the shared one is
+		* what this replaced (issue #2847 round-3 review, and the reason it is a
+		* bag rather than a `slice`). All three pushers are IDEMPOTENT — each
+		* guards with `if (!reads.includes(read))` — and `resolveOutputs` shares
+		* ONE context across every output, unlike the CREATE / UPDATE arms which
+		* build a fresh context per resource. So a second output reading the SAME
+		* masked record produced an EMPTY delta and was PUBLISHED:
+		*
+		*     Outputs:
+		*       TableRef:  { Value: { Ref: Tbl } }   # refused
+		*       TableRef2: { Value: { Ref: Tbl } }   # published the raw ARN
+		*
+		* `resolveRef` memoizes nothing, so the second resolution really does
+		* re-enter `noteRefStateMask` and really is refused a push. Giving each
+		* output its own array and MERGING the entries back afterwards keeps both
+		* properties: the guard sees exactly this output's reads, and the shared
+		* bag still accumulates for anything reading it later.
+		*
+		* SCOPED TO THE `ref-state-key` KIND, and that is a narrowing rather than
+		* an oversight. The refusal exists because of the FALL-THROUGH: when the
+		* lookup skips a masked leaf, `cfnRefValueFromPhysicalId` emits the raw
+		* physical id, which no downstream reader recognises. Every OTHER pusher —
+		* `noteAttributeSecrecy`'s `Fn::GetAtt`, `reresolveCrossStackValue`'s
+		* `Fn::ImportValue` / `Fn::GetStackOutput` / nested-stack forms — serves
+		* the MASK itself as the value, which `reresolveCrossStackValue` and the
+		* export blocker DO recognise. Firing there would silently change the
+		* pre-existing issue #2274 behaviour (an output that published `'***'`
+		* would vanish) for no safety gain, and would render this message's
+		* "would publish the resource's raw physical id" over a read for which
+		* there is no physical-id fall-through — the wrong-advice class this PR
+		* has spent three rounds removing.
+		*
+		* **SELECTED BY THE `kind` FIELD, NEVER BY A PATTERN OVER `display`**
+		* (round-4 review, BLOCKER). The previous revision filtered with the same
+		* regex `maskedRecordRemedyFor` used, whose id class was `[A-Za-z0-9]+` —
+		* so for `{"Ref": "My-Table"}` (an `overrideLogicalId`, or a migrated
+		* template; cdkd validates no logical-id charset and never hands the
+		* template to CloudFormation) the filter matched NOTHING, this function
+		* returned, and the output published the raw physical id. That is an
+		* earlier round's blocker reopened through a CHARSET. Falling out of the
+		* pattern is the SAFE direction at the remedy — a vaguer message — and the
+		* INVERTED one here, where it is the refusal itself; one rendering cannot
+		* serve two consumers whose safe directions are opposite, so the structure
+		* moved into the entry and both consumers now ask a field.
+		*
+		* It routes through {@link handleOutputResolutionFailure} rather than
+		* throwing its own way out, so it inherits that method's whole contract:
+		* warn-and-skip by default, promoted to a deploy error under
+		* `--strict-getatt`, and masked against both secret bags on the way.
+		*/
+		const refuseMaskedOutputReads = (outputKey, ownReads) => {
+			const added = ownReads.filter((read) => read.kind === "ref-state-key");
+			if (added.length === 0) return;
+			throw markNonRetryable(/* @__PURE__ */ new Error(`Cannot resolve ${added.map((read) => read.display).join(", ")} for output ${outputKey}: cdkd's recorded state holds only the redaction mask there, so this output would publish the resource's raw physical id instead of the value CloudFormation's Ref returns — a wrong value that a consuming stack's Fn::ImportValue would accept and send to AWS. The output is not published. ${DeployEngine.maskedRecordRemedyFor(added, context.resources)}`));
+		};
 		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
 		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
@@ -38794,8 +39523,14 @@ var DeployEngine = class {
 					this.logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 					continue;
 				}
+				const ownReads = [];
 				try {
-					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
+					const resolved = await this.resolver.resolve(output.Value, {
+						...context,
+						redactedAttributeReads: ownReads
+					});
+					refuseMaskedOutputReads(outputKey, ownReads);
+					outputs[outputKey] = resolved;
 				} catch (error) {
 					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				}
@@ -38806,13 +39541,16 @@ var DeployEngine = class {
 				const value = outputs[outputKey];
 				if (value === void 0) continue;
 				const nameSecrets = /* @__PURE__ */ new Map();
+				const nameReads = [];
 				let exportName;
 				try {
 					try {
 						exportName = typeof output.Export.Name === "string" ? output.Export.Name : await this.resolver.resolve(output.Export.Name, {
 							...context,
-							recordedSecretValues: nameSecrets
+							recordedSecretValues: nameSecrets,
+							redactedAttributeReads: nameReads
 						});
+						refuseMaskedOutputReads(outputKey, nameReads);
 					} finally {
 						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
@@ -38858,4 +39596,4 @@ var DeployEngine = class {
 
 //#endregion
 export { ProviderRegistry as $, formatDockerLoginError as $n, PartialFailureError as $r, STATE_SOURCED_BASELINE_RULES as $t, renderStatefulReason as A, stringifyValue as An, PARTITION_TABLE as Ar, configStringRefusal as At, red as B, getBootstrapMarkerKey as Bn, setAwsClients as Br, s3BucketDomainName as Bt, refusesFinalSnapshot as C, CUSTOM_RESOURCE_RESPONSE_PREFIX as Cn, CFN_TEMPLATE_URL_LIMIT as Cr, refStateLookupFromResource as Ct, MULTI_REGION_RECREATE_BLOCKED_TYPES as D, importableOutputs as Dn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Dr, assertRegionMatch as Dt, extractDeploymentEventError as E, importableOutputKeys as En, uploadCfnTemplate as Er, resolveExplicitPhysicalId as Et, formatResourceLine as F, rewriteTemplateAssetReferences as Fn, clearBucketRegionCache as Fr, requireConfigString as Ft, isExportAliasCollision as G, validateContainerRepoName as Gn, DependencyError as Gr, DiffCalculator as Gt, collectDeclaredOutputNames as H, parseBootstrapMarker as Hn, CdkdError as Hr, s3BucketRegionalDomainName as Ht, bold as I, AssetModeResolver as In, resolveBucketRegion as Ir, classifyReplaySecretRegion as It, secretSafeKeyDisplay as J, buildDockerImage as Jn, IntrinsicResolutionRefusalError as Jr, findSilentDropProperties as Jt, secretBearing as K, buildDenyExternalAccessPolicy as Kn, DeployCancelledError as Kr, INTRINSIC_KEYS as Kt, cyan as L, BOOTSTRAP_MARKER_PREFIX as Ln, AwsClients as Lr, producerRegionsFromState as Lt, coerceWarmThroughput as M, buildAssetRedirectMap as Mn, derivePartitionAndUrlSuffix as Mr, replayWarn as Mt, isWarmThroughputDecrease as N, createAssetRedirectResolver as Nn, AssemblyReader as Nr, requireConfigArray as Nt, isStatefulRecreateTargetForReplace as O, shouldRetainResource as On, displaySafe as Or, coerceCfnBoolean as Ot, toFiniteNumber as P, loadPublishableAssetManifest as Pn, processStackMessages as Pr, requireConfigObject as Pt, clearOnUpdateRemoval as Q, dockerSpawnEnvWithSensitive as Qn, NestedStackChildDirectDestroyError as Qr, TemplateParser as Qt, gray as R, assertAssetBucketRegion as Rn, getAwsClients as Rr, withSharedDrainBudget as Rt, isFinalSnapshotError as S, shellQuote as Sn, CFN_TEMPLATE_BODY_LIMIT as Sr, parameterTypeMayLoseSecretIdentity as St, makeCanonicalizePropertiesFn as T, exportNamesCarriedFrom as Tn, findLargeInlineResources as Tr, normalizeAwsTagsToCfn as Tt, collectPublishedOutputNames as U, readBootstrapMarkerBody as Un, ConfigError as Ur, s3BucketWebsiteUrl as Ut, yellow as V, isCrossRegionRedirect as Vn, AssetError as Vr, s3BucketDualStackDomainName as Vt, exportAliasCollisionScrubWarning as W, validateAssetBucketName as Wn, CrossAccountSecretRefusalError as Wr, applyRoleArnIfSet as Wt, IAMRoleProvider as X, describeDockerExecFailure as Xn, LocalStartServiceError as Xr, withRetry as Xt, getCurrentResourceSecrets as Y, describeDockerCapturedOutput as Yn, LocalInvokeBuildError as Yr, describeTypeWithThrottleRetry as Yt, collectInlinePolicyNamesManagedBySiblings as Z, describeDockerFailure as Zn, LockError as Zr, DagBuilder as Zt, ATOMIC_FINAL_SNAPSHOT_TYPES as _, retryClassificationText as _i, rebuildClientForBucketRegion as _n, resolveStateBucketWithDefault as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, StateError as ai, dynamicReferenceTokens as an, escapeRegExp$1 as ar, endCommandInterruptScope as at, ccRoutedFinalSnapshotError as b, buildLockContentionMessage as bn, stateBucketExistenceConfirmed as br, getAccountInfo as bt, replayFailedOperations as c, isCdkdError as ci, isSingleDynamicReferenceToken as cn, getDockerImageBySourceHash as cr, startInterruptWatch as ct, updatePartialReason as d, isMarkedNonRetryable as di, recordMaskOnlyValue as dn, getDefaultStateBucketName as dr, UNSPECIFIED_SKIP_REASON as dt, ProvisioningError as ei, STATE_SOURCED_CROSS_GENERATION_RULES as en, getDockerCmd as er, wouldReturnToSdkProvider as et, withResourceDeadline as f, isRetryableTransientError as fi, recoverMaskedOutput as fn, getLegacyStateBucketName as fr, deleteIndeterminateGuards as ft, bindingSkippedOutputs as g, markRedactedCause as gi, S3StateBackend as gn, resolveSkipPrefix as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, markNonRetryable as hi, LockManager as hn, resolveCaptureObservedState as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, StackTerminationProtectionError as ii, createSecretMasker as in, runDockerStreaming as ir, beginCommandInterruptScope as it, WARM_THROUGHPUT_MEMBERS as j, WorkGraph as jn, canonicalizeRegion as jr, readConfigString as jt, isStatefulRecreateTargetSync as k, AssetPublisher as kn, expectedOwnerParam as kr, configBooleanRefusal as kt, replayRollback as l, normalizeAwsError as li, maskSecretsInError as ln, Synthesizer as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, isTransientServerError as mi, scrubResourceRecord as mn, resolveAutoAssetStorage as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, ResourceUpdateNotSupportedError as ni, TEMPLATE_SOURCED_RULES as nn, redactDockerArgvValues as nr, maskDeep as nt, planFailedOps as o, SynthesisError as oi, errorCauseChain as on, stripControlChars as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, isThrottlingError as pi, redactSecretsForState as pn, resolveApp as pr, deleteSkipReason as pt, secretBearingStateKeyWarning as q, describeAwsFailure as qn, DynamicReferenceRegionAmbiguousError as qr, findActionableSilentDrops as qt, DeployEngine as r, StackHasActiveImportsError as ri, carriesSecretMask as rn, runDockerForeground as rr, maskerOrIdentity as rt, planRollback as s, formatError as si, identityKeyFor as sn, AssetManifestLoader as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, ResourceTimeoutError as ti, STATE_SOURCED_READBACK_RULES as tn, partitionSensitiveEnv as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, withErrorHandling as ui, maskSecretsInText as un, synthesisStatusMessage as ur, slowCcOperationTimeoutMs as ut, PRE_DELETE_SNAPSHOT_TYPES as v, __exportAll as vi, UNRENDERABLE as vn, resolveStateBucketWithDefaultAndSource as vr, cfnRefValueFromPhysicalId as vt, unsupportedFinalSnapshotError as w, DEFAULT_STATE_PREFIX as wn, MIGRATE_TMP_PREFIX as wr, WAFv2WebACLProvider as wt, createPreDeleteFinalSnapshot as x, forceQuitRecoveryClause as xn, warnDeprecatedNoPrefixCliFlag as xr, isUnboundTemplateParameter as xt, buildFinalSnapshotIdentifier as y, buildForceUnlockCommand as yn, resolveUseCdkBootstrapAssets as yr, coerceParameterTypedValue as yt, green as z, ensureAssetStorage as zn, resetAwsClients as zr, s3BucketArn as zt };
-//# sourceMappingURL=deploy-engine-Dsf9bTqH.js.map
+//# sourceMappingURL=deploy-engine-BQUjVO_m.js.map