@go-to-k/cdkd 0.283.18 → 0.283.20

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-B-0iA5XV.js";
+import { $ as coerceCfnBoolean, $t as resolveCaptureObservedState, A as cyan, An as LocalStartServiceError, At as rewriteTemplateAssetReferences, B as findSilentDropProperties, Bt as buildDockerImage, C as makeCanonicalizePropertiesFn, Ct as shouldRetainResource, D as renderStatefulReason, Dn as DeployCancelledError, Dt as buildAssetRedirectMap, E as isStatefulRecreateTargetSync, Et as WorkGraph, F as IAMRoleProvider, Fn as ProvisioningError, Ft as getBootstrapMarkerKey, G as IntrinsicFunctionResolver, Gn as withErrorHandling, Gt as AssetManifestLoader, H as slowCcOperationTimeoutMs, Ht as getDockerCmd, I as collectInlinePolicyNamesManagedBySiblings, In as ResourceTimeoutError, It as parseBootstrapMarker, J as refStateLookupFromResource, Jn as isThrottlingError, Jt as synthesisStatusMessage, K as cfnRefValueFromPhysicalId, Kn as isMarkedNonRetryable, Kt as getDockerImageBySourceHash, L as clearOnUpdateRemoval, Ln as ResourceUpdateNotSupportedError, Lt as validateAssetBucketName, M as green, Mn as MissingCdkCliError, Mt as AssetModeResolver, N as red, Nn as NestedStackChildDirectDestroyError, Nt as BOOTSTRAP_MARKER_PREFIX, O as formatResourceLine, On as LocalInvokeBuildError$1, Ot as createAssetRedirectResolver, P as yellow, Pn as PartialFailureError, Pt as ensureAssetStorage, Q as assertRegionMatch, Qt as resolveAutoAssetStorage, R as ProviderRegistry, Rn as StackHasActiveImportsError, Rt as validateContainerRepoName, S as unsupportedFinalSnapshotError, Sn as setAwsClients, St as rebuildClientForBucketRegion, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as stringifyValue, U as disableInstanceApiTermination, Ut as runDockerForeground, V as CloudControlProvider, Vt as formatDockerLoginError, W as isTerminationProtectionPropagationError, Wn as normalizeAwsError, Wt as runDockerStreaming, X as normalizeAwsTagsToCfn, Xt as getLegacyStateBucketName, Y as WAFv2WebACLProvider, Yn as markNonRetryable, Yt as getDefaultStateBucketName, Z as resolveExplicitPhysicalId, Zt as resolveApp, _ as buildFinalSnapshotIdentifier, _t as withRetry, a as DeploymentEventsStore, an as warnDeprecatedNoPrefixCliFlag, at as requireConfigObject, b as isFinalSnapshotError, bn as getAwsClients, bt as LockManager, c as replayFailedOperations, cn as MIGRATE_TMP_PREFIX, ct as scrubResourceRecord, d as deleteSkipReason, dn as expectedOwnerParam, dt as s3BucketDualStackDomainName, en as resolveSkipPrefix, et as configBooleanRefusal, f as withResourceDeadline, fn as PARTITION_TABLE, ft as s3BucketRegionalDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as processStackMessages, gt as describeTypeWithThrottleRetry, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as AssemblyReader, ht as DiffCalculator, i as DeploymentEventsReader, in as stateBucketExistenceConfirmed, it as requireConfigArray, j as gray, jt as escapeRegExp, k as bold, kn as LocalMigrateError, kt as loadPublishableAssetManifest, l as replayRollback, ln as findLargeInlineResources, lt as s3BucketArn, m as computeImplicitDeleteEdges, mn as derivePartitionAndUrlSuffix, mt as applyRoleArnIfSet, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefaultAndSource, nt as readConfigString, o as planFailedOps, on as CFN_TEMPLATE_BODY_LIMIT, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as canonicalizeRegion, pt as s3BucketWebsiteUrl, q as getAccountInfo, qn as isRetryableTransientError, qt as Synthesizer, r as DeployEngine, rn as resolveUseCdkBootstrapAssets, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_URL_LIMIT, st as redactSecretsForState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefault, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as uploadCfnTemplate, ut as s3BucketDomainName, v as ccRoutedFinalSnapshotError, vn as resolveBucketRegion, vt as DagBuilder, w as extractDeploymentEventError, wn as CdkdError, wt as AssetPublisher, x as refusesFinalSnapshot, xn as resetAwsClients, xt as S3StateBackend, y as createPreDeleteFinalSnapshot, yn as AwsClients, yt as TemplateParser, z as findActionableSilentDrops, zn as StackTerminationProtectionError, zt as buildDenyExternalAccessPolicy } from "./deploy-engine-ISOKkuun.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-D8Ln3-ij.js";
+import { t as ASGProvider } from "./asg-provider-k-TEX_Ej.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -38111,6 +38111,58 @@ var Route53Provider = class {
 		};
 	}
 	/**
+	* The attribute set for a hosted zone adopted through the NAME-lookup
+	* branch (issue #1875). `null` means DECLINE the row.
+	*
+	* Unlike the `knownPhysicalId` branch — whose verification call already
+	* carries the delegation set — this branch resolves the zone through
+	* `ListHostedZonesByName`, which does NOT return one, so the attributes
+	* cost one extra `GetHostedZone`.
+	*
+	* **A vanished zone DECLINES, it does not degrade.** `NoSuchHostedZone`
+	* between the list and this read is exactly the condition the
+	* `knownPhysicalId` branch answers with `null` / `skipped-not-found`, and
+	* adopting a zone that demonstrably no longer exists is worse than
+	* declining it — the next deploy would compare against a record for
+	* something AWS does not have. The two branches must agree; everything
+	* else degrades.
+	*
+	* **The degraded answer is the EMPTY map, and that is load-bearing rather
+	* than tidy.** `import.ts`'s attribute carry-over is gated on the returned
+	* map being NON-empty (`row.attributes && Object.keys(...).length > 0 ?
+	* row.attributes : undefined`, then `?? priorAttributes ?? {}`) — a gate
+	* that exists precisely because almost every provider spells
+	* `attributes: {}` explicitly. So a partial `{ Id }` is NON-empty, takes
+	* the row branch, and OVERWRITES a previously-recorded good map: a zone
+	* imported successfully once and re-imported while `route53:GetHostedZone`
+	* is denied would LOSE its stored `NameServers`, leaving state strictly
+	* worse than before this fix. `{}` falls through and preserves it. Do NOT
+	* "improve" this into keeping what it can — that is the one change that
+	* makes the failure path destructive.
+	*
+	* NEVER throws otherwise, matching the convention the neighbouring
+	* adoption paths already use (`AppSyncProvider.childImportAttributes`,
+	* issue #1728, and `importRecordSet`'s canonicalization, which adopts
+	* VERBATIM rather than declining): an import must not hard-fail because
+	* one optional attribute could not be read. `import.ts` only aborts when
+	* ZERO resources import, so under `--migrate-from-cloudformation` a throw
+	* here would cost the row at exactly the moment the CloudFormation stack
+	* is being retired — the resource would end up in NEITHER CloudFormation
+	* nor cdkd state.
+	*/
+	async hostedZoneImportAttributes(zoneId, logicalId) {
+		try {
+			return {
+				Id: zoneId,
+				NameServers: (await this.getClient().send(new GetHostedZoneCommand({ Id: zoneId }))).DelegationSet?.NameServers ?? []
+			};
+		} catch (error) {
+			if (error instanceof Error && error.name === "NoSuchHostedZone") return null;
+			this.logger.warn(`Imported hosted zone ${zoneId} but could not read its NameServers: ${error instanceof Error ? error.message : String(error)}. The zone is adopted without them (any attributes already in state for this zone are kept). Re-run \`cdkd import --resource ${logicalId}=${zoneId} --force\` once the permission is granted, or make a template change that forces an UPDATE — a plain \`cdkd deploy\` does NOT heal the record, because an unchanged zone is NO_CHANGE and never calls update().`);
+			return {};
+		}
+	}
+	/**
 	* Adopt an existing hosted zone (issue #1702).
 	*
 	* An explicit `--resource` id is ground truth and is only VERIFIED. With no
@@ -38132,13 +38184,44 @@ var Route53Provider = class {
 	* (`skipped-not-found`, the next deploy creates the zone) while an
 	* ambiguous name or a failed lookup throws, which `importOne` records as
 	* `failed` for this row alone.
+	*
+	* BOTH branches record the same `{ Id, NameServers }` attribute set a
+	* `cdkd deploy` CREATE records (issue #1875). Recording `attributes: {}`
+	* left an adopted zone with no `NameServers` in state, and nothing else
+	* rescues it: `IntrinsicFunctionResolver.resolveGetAtt`'s flat-attribute
+	* branch misses (so PR #1868's legacy comma-string normalization, which
+	* lives in that branch, never runs either), `constructAttribute` has no
+	* `AWS::Route53::HostedZone` case, and resolution falls through to
+	* `guardedPhysicalIdFallback`, which hands back the zone id STRING — so a
+	* downstream `Fn::Join` threw `second argument must be a list` and the
+	* Output was silently dropped. `provider.getAttribute` does return the list
+	* but is only reached from the orphan-rewriter path, never from ordinary
+	* template resolution.
+	*
+	* The delegation set is normalized `?? []` — a LIST, never a comma string —
+	* exactly as `createHostedZone` / `updateHostedZone` / `getHostedZoneAttribute`
+	* do, so an imported zone and a deployed one resolve IDENTICALLY. A
+	* divergence here would be a phantom-drift hazard as well as a resolution
+	* one.
+	*
+	* **A plain `cdkd deploy` does NOT rewrite these attributes**, so do not
+	* offer one as the remedy when a read fails. `deploy-engine.ts` `continue`s
+	* on `NO_CHANGE`, so an unchanged zone never reaches `update()` and its
+	* `attributes` are never rewritten; `kickOffAutoRefreshObservedProperties`
+	* refreshes `observedProperties`, a different field. What DOES rewrite the
+	* record is re-running the import for that row
+	* (`cdkd import --resource <logicalId>=<zoneId> --force`, which re-enters
+	* this method) or a template change that forces a real UPDATE.
 	*/
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
+			const response = await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: {
+					Id: input.knownPhysicalId.replace("/hostedzone/", ""),
+					NameServers: response.DelegationSet?.NameServers ?? []
+				}
 			};
 		} catch (err) {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
@@ -38147,16 +38230,19 @@ var Route53Provider = class {
 		const zoneName = input.properties["Name"];
 		if (typeof zoneName !== "string" || !zoneName) return null;
 		try {
+			const zoneId = await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
+				requireUnambiguousZoneName: true,
+				requirePrivateZone: templateZoneVisibility(input.properties),
+				subject: {
+					noun: "hosted zone",
+					remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
+				}
+			});
+			const attributes = await this.hostedZoneImportAttributes(zoneId, input.logicalId);
+			if (attributes === null) return null;
 			return {
-				physicalId: await this.resolveHostedZoneId({ HostedZoneName: zoneName }, input.logicalId, input.resourceType, void 0, {
-					requireUnambiguousZoneName: true,
-					requirePrivateZone: templateZoneVisibility(input.properties),
-					subject: {
-						noun: "hosted zone",
-						remedy: `pass --resource ${input.logicalId}=<hostedZoneId> to adopt it explicitly`
-					}
-				}),
-				attributes: {}
+				physicalId: zoneId,
+				attributes
 			};
 		} catch (error) {
 			if (error instanceof HostedZoneNameNotFoundError) return null;
@@ -57660,7 +57746,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		stackName,
 		bestEffort: true,
 		...mergedParameters && { parameters: mergedParameters },
-		...conditions && { conditions }
+		...conditions && { conditions },
+		skipDynamicReferences: true
 	});
 	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
 }
@@ -58177,6 +58264,254 @@ function createDiffCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/scrub.ts
+/**
+* Signals `cdkd scrub` found stacks whose state still holds plaintext secrets.
+* Only thrown under `--dry-run --fail`; carries no message (the plan was
+* already printed) and maps to a non-zero exit so CI can gate on it.
+*/
+var ScrubNeededError = class ScrubNeededError extends CdkdError {
+	silent = true;
+	constructor() {
+		super("scrub needed", "SCRUB_NEEDED");
+		this.name = "ScrubNeededError";
+		Object.setPrototypeOf(this, ScrubNeededError.prototype);
+	}
+};
+/**
+* `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
+* reference (`{{resolve:secretsmanager:...}}`) is stored as its UNRESOLVED
+* expression rather than the plaintext value (GHSA fix).
+*
+* A normal `cdkd deploy` already scrubs state as a side effect (the deploy
+* engine redacts every persisted bag), so this command is for cleaning up
+* existing state WITHOUT a redeploy — e.g. after upgrading cdkd on a stack you
+* do not want to re-provision right now.
+*
+* It needs the CDK app (`--app`) because a state file records the RESOLVED
+* plaintext with no marker of which values are secrets: only the template
+* carries the `{{resolve:...}}` expressions. So scrub synthesizes the template,
+* re-resolves each resource's properties to learn the resolved secret VALUES
+* (recorded, never printed or re-persisted), and replaces those values in the
+* state record's `properties` / `attributes` / `observedProperties` with the
+* expression. No AWS resource is created, updated, or deleted; only state.json
+* is rewritten. This is why it is a top-level command and not `cdkd state
+* scrub` — the `cdkd state ...` family operates on the state bucket alone and
+* deliberately needs no CDK code.
+*
+* IMPORTANT: scrubbing does not un-expose an already-leaked secret. A value
+* that was stored in plaintext should be treated as compromised and ROTATED in
+* Secrets Manager; scrub only stops it from being re-read out of state going
+* forward.
+*
+* ORDERING: scrub matches the CURRENT resolved secret value against what state
+* holds, so run it BEFORE rotating. Once the secret is rotated, the value in
+* state no longer matches the current one and scrub cannot find it (it reports
+* "nothing to scrub"). A rotated-away stale value in state is invalidated by
+* the rotation, but to remove it, redeploy the stack (which rewrites the record
+* with the expression).
+*/
+async function scrubCommand(stacks, options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	warnIfDeprecatedRegion(options);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region
+	});
+	const app = resolveApp(options.app);
+	if (!app) throw new Error("CDK app is required (scrub needs the template to identify secret references). Pass --app, set CDKD_APP, or add \"app\" to cdk.json.");
+	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	setAwsClients(new AwsClients({
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile }
+	}));
+	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
+	const synthesizer = new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOptions = {
+		app,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context },
+		stateBucket,
+		deferMacroExpansion: true
+	};
+	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
+	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
+	let targetStacks;
+	if (options.all) targetStacks = allStacks;
+	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+	else if (allStacks.length === 1) targetStacks = allStacks;
+	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
+	if (targetStacks.length === 0) throw new Error("No stacks matched.");
+	await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
+	const stateConfig = {
+		bucket: stateBucket,
+		prefix: options.statePrefix
+	};
+	const stateS3 = new AwsClients({
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	const stateBackend = new S3StateBackend(stateS3.s3, stateConfig, {
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	const lockManager = new LockManager(stateS3.s3, stateConfig);
+	let totalStacksScrubbed = 0;
+	for (const stack of targetStacks) {
+		const scrubbed = await scrubStack(stack, stack.region || region, stateBackend, lockManager, {
+			dryRun: options.dryRun ?? false,
+			roleArn: options.roleArn,
+			logger
+		});
+		if (scrubbed.recordsChanged > 0) {
+			totalStacksScrubbed++;
+			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
+		} else logger.info(`No plaintext secrets found in ${stack.stackName}`);
+	}
+	if (totalStacksScrubbed === 0) {
+		logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+		return;
+	}
+	if (options.dryRun) {
+		logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written). ROTATE any exposed secret in Secrets Manager.`);
+		if (options.fail) throw new ScrubNeededError();
+		return;
+	}
+	logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).`);
+}
+/**
+* Scrub one stack's state. Re-resolves the template's per-resource properties to
+* learn the resolved secret VALUES, then replaces those values in the state
+* record with their `{{resolve:...}}` expressions. Returns counts; performs no
+* AWS mutation. Acquires the stack lock for the read-modify-write unless
+* `dryRun`.
+*/
+async function scrubStack(stack, region, stateBackend, lockManager, opts) {
+	const { logger } = opts;
+	const acquired = !opts.dryRun;
+	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
+	try {
+		const loaded = await stateBackend.getState(stack.stackName, region);
+		if (!loaded) {
+			logger.debug(`No state for ${stack.stackName} (${region}) — skipping`);
+			return {
+				recordsChanged: 0,
+				secretsFound: 0
+			};
+		}
+		const state = loaded.state;
+		const perResourceSecrets = /* @__PURE__ */ new Map();
+		const outputSecrets = /* @__PURE__ */ new Map();
+		const resolver = new IntrinsicFunctionResolver(region);
+		let parameters = {};
+		let conditions = {};
+		try {
+			parameters = await resolver.resolveParameters(stack.template);
+		} catch (err) {
+			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		try {
+			conditions = await resolver.evaluateConditions({
+				template: stack.template,
+				resources: state.resources,
+				...Object.keys(parameters).length > 0 && { parameters },
+				bestEffort: true
+			});
+		} catch (err) {
+			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		const templateResources = stack.template.Resources ?? {};
+		for (const logicalId of Object.keys(state.resources)) {
+			const templateResource = templateResources[logicalId];
+			if (!templateResource?.Properties) continue;
+			const recordedSecretValues = /* @__PURE__ */ new Map();
+			try {
+				await resolver.resolve(templateResource.Properties, {
+					template: stack.template,
+					resources: state.resources,
+					...Object.keys(parameters).length > 0 && { parameters },
+					...Object.keys(conditions).length > 0 && { conditions },
+					stackName: stack.stackName,
+					recordedSecretValues,
+					bestEffort: true
+				});
+			} catch (err) {
+				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
+		}
+		const templateOutputs = stack.template.Outputs ?? {};
+		for (const [name, output] of Object.entries(templateOutputs)) {
+			const value = output.Value;
+			if (value === void 0) continue;
+			try {
+				await resolver.resolve(value, {
+					template: stack.template,
+					resources: state.resources,
+					...Object.keys(parameters).length > 0 && { parameters },
+					...Object.keys(conditions).length > 0 && { conditions },
+					stackName: stack.stackName,
+					recordedSecretValues: outputSecrets,
+					bestEffort: true
+				});
+			} catch (err) {
+				logger.debug(`Resolution of output ${name} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0);
+		if (totalSecrets === 0) return {
+			recordsChanged: 0,
+			secretsFound: 0
+		};
+		let recordsChanged = 0;
+		const newResources = {};
+		for (const [logicalId, record] of Object.entries(state.resources)) {
+			const secrets = perResourceSecrets.get(logicalId);
+			const scrubbed = secrets ? scrubResourceRecord(record, secrets) : record;
+			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
+			newResources[logicalId] = scrubbed;
+		}
+		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets) : state.outputs;
+		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
+		if (recordsChanged > 0 && !opts.dryRun) {
+			const nextState = {
+				...state,
+				resources: newResources,
+				outputs: newOutputs,
+				lastModified: Date.now()
+			};
+			await stateBackend.saveState(stack.stackName, region, nextState, { expectedEtag: loaded.etag });
+		}
+		return {
+			recordsChanged,
+			secretsFound: totalSecrets
+		};
+	} finally {
+		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
+			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		});
+	}
+}
+function createScrubCommand() {
+	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path)").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate)");
+	[
+		...commonOptions,
+		...appOptions,
+		...stateOptions,
+		...stackOptions,
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(deprecatedRegionOption);
+	cmd.action(withErrorHandling(scrubCommand));
+	return cmd;
+}
+
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -58538,6 +58873,7 @@ function isIgnoredPath(path, ignorePaths) {
 */
 function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
 	if (deepEqual(stateValue, awsValue)) return;
+	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
 	if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
 		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
 		for (const key of keys) {
@@ -68569,7 +68905,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stackName: stackState.stackName
 	};
 	for (const [logicalId, resource] of entries) try {
-		resource.properties = await resolver.resolve(resource.properties ?? {}, baseContext);
+		const recordedSecretValues = /* @__PURE__ */ new Map();
+		const resolved = await resolver.resolve(resource.properties ?? {}, {
+			...baseContext,
+			recordedSecretValues
+		});
+		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues) : resolved;
 	} catch (err) {
 		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.`);
 	}
@@ -78728,7 +79069,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.18");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.20");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;
@@ -78741,6 +79082,7 @@ function buildProgram() {
 	program.addCommand(createDriftCommand());
 	program.addCommand(createDestroyCommand());
 	program.addCommand(createRollbackCommand());
+	program.addCommand(createScrubCommand());
 	program.addCommand(createEventsCommand());
 	program.addCommand(createGcCommand());
 	program.addCommand(createOrphanCommand());