@go-to-k/cdkd 0.283.19 → 0.283.21

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefault, A as cyan, An as MissingCdkCliError, At as AssetModeResolver, B as findSilentDropProperties, Bt as getDockerCmd, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalMigrateError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalInvokeBuildError$1, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as ResourceUpdateNotSupportedError, Ft as validateAssetBucketName, G as IntrinsicFunctionResolver, Gn as isRetryableTransientError, Gt as Synthesizer, H as slowCcOperationTimeoutMs, Hn as normalizeAwsError, Ht as runDockerStreaming, I as collectInlinePolicyNamesManagedBySiblings, In as StackHasActiveImportsError, It as validateContainerRepoName, J as refStateLookupFromResource, Jt as getLegacyStateBucketName, K as cfnRefValueFromPhysicalId, Kn as isThrottlingError, Kt as synthesisStatusMessage, L as clearOnUpdateRemoval, Ln as StackTerminationProtectionError, Lt as buildDenyExternalAccessPolicy, M as green, Mn as PartialFailureError, Mt as ensureAssetStorage, N as red, Nn as ProvisioningError, Nt as getBootstrapMarkerKey, O as formatResourceLine, On as LocalStartServiceError, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceTimeoutError, Pt as parseBootstrapMarker, Q as assertRegionMatch, Qt as resolveSkipPrefix, R as ProviderRegistry, Rt as buildDockerImage, S as unsupportedFinalSnapshotError, Sn as CdkdError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as DeployCancelledError, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as withErrorHandling, Ut as AssetManifestLoader, V as CloudControlProvider, Vt as runDockerForeground, W as isTerminationProtectionPropagationError, Wn as isMarkedNonRetryable, Wt as getDockerImageBySourceHash, X as normalizeAwsTagsToCfn, Xt as resolveAutoAssetStorage, Y as WAFv2WebACLProvider, Yt as resolveApp, Z as resolveExplicitPhysicalId, Zt as resolveCaptureObservedState, _ as buildFinalSnapshotIdentifier, _n as AwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as CFN_TEMPLATE_URL_LIMIT, at as requireConfigObject, b as isFinalSnapshotError, bn as setAwsClients, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as uploadCfnTemplate, ct as s3BucketDomainName, d as deleteSkipReason, dn as canonicalizeRegion, dt as s3BucketWebsiteUrl, en as resolveStateBucketWithDefaultAndSource, et as configBooleanRefusal, f as withResourceDeadline, fn as derivePartitionAndUrlSuffix, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as resolveBucketRegion, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_BODY_LIMIT, it as requireConfigArray, j as gray, jn as NestedStackChildDirectDestroyError, jt as BOOTSTRAP_MARKER_PREFIX, k as bold, kt as escapeRegExp, l as replayRollback, ln as expectedOwnerParam, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mn as processStackMessages, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as stateBucketExistenceConfirmed, nt as readConfigString, o as planFailedOps, on as MIGRATE_TMP_PREFIX, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as AssemblyReader, pt as DiffCalculator, q as getAccountInfo, qn as markNonRetryable, qt as getDefaultStateBucketName, r as DeployEngine, rn as warnDeprecatedNoPrefixCliFlag, rt as replayWarn, s as planRollback, sn as findLargeInlineResources, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveUseCdkBootstrapAssets, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as PARTITION_TABLE, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as getAwsClients, vt as LockManager, w as extractDeploymentEventError, wt as WorkGraph, x as refusesFinalSnapshot, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as resetAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as formatDockerLoginError } from "./deploy-engine-UVLw029j.js";
+import { $ as coerceCfnBoolean, $t as resolveCaptureObservedState, A as cyan, An as LocalStartServiceError, At as rewriteTemplateAssetReferences, B as findSilentDropProperties, Bt as buildDockerImage, C as makeCanonicalizePropertiesFn, Ct as shouldRetainResource, D as renderStatefulReason, Dn as DeployCancelledError, Dt as buildAssetRedirectMap, E as isStatefulRecreateTargetSync, Et as WorkGraph, F as IAMRoleProvider, Fn as ProvisioningError, Ft as getBootstrapMarkerKey, G as IntrinsicFunctionResolver, Gn as withErrorHandling, Gt as AssetManifestLoader, H as slowCcOperationTimeoutMs, Ht as getDockerCmd, I as collectInlinePolicyNamesManagedBySiblings, In as ResourceTimeoutError, It as parseBootstrapMarker, J as refStateLookupFromResource, Jn as isThrottlingError, Jt as synthesisStatusMessage, K as cfnRefValueFromPhysicalId, Kn as isMarkedNonRetryable, Kt as getDockerImageBySourceHash, L as clearOnUpdateRemoval, Ln as ResourceUpdateNotSupportedError, Lt as validateAssetBucketName, M as green, Mn as MissingCdkCliError, Mt as AssetModeResolver, N as red, Nn as NestedStackChildDirectDestroyError, Nt as BOOTSTRAP_MARKER_PREFIX, O as formatResourceLine, On as LocalInvokeBuildError$1, Ot as createAssetRedirectResolver, P as yellow, Pn as PartialFailureError, Pt as ensureAssetStorage, Q as assertRegionMatch, Qt as resolveAutoAssetStorage, R as ProviderRegistry, Rn as StackHasActiveImportsError, Rt as validateContainerRepoName, S as unsupportedFinalSnapshotError, Sn as setAwsClients, St as rebuildClientForBucketRegion, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tt as stringifyValue, U as disableInstanceApiTermination, Ut as runDockerForeground, V as CloudControlProvider, Vt as formatDockerLoginError, W as isTerminationProtectionPropagationError, Wn as normalizeAwsError, Wt as runDockerStreaming, X as normalizeAwsTagsToCfn, Xt as getLegacyStateBucketName, Y as WAFv2WebACLProvider, Yn as markNonRetryable, Yt as getDefaultStateBucketName, Z as resolveExplicitPhysicalId, Zt as resolveApp, _ as buildFinalSnapshotIdentifier, _t as withRetry, a as DeploymentEventsStore, an as warnDeprecatedNoPrefixCliFlag, at as requireConfigObject, b as isFinalSnapshotError, bn as getAwsClients, bt as LockManager, c as replayFailedOperations, cn as MIGRATE_TMP_PREFIX, ct as scrubResourceRecord, d as deleteSkipReason, dn as expectedOwnerParam, dt as s3BucketDualStackDomainName, en as resolveSkipPrefix, et as configBooleanRefusal, f as withResourceDeadline, fn as PARTITION_TABLE, ft as s3BucketRegionalDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as processStackMessages, gt as describeTypeWithThrottleRetry, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as AssemblyReader, ht as DiffCalculator, i as DeploymentEventsReader, in as stateBucketExistenceConfirmed, it as requireConfigArray, j as gray, jt as escapeRegExp, k as bold, kn as LocalMigrateError, kt as loadPublishableAssetManifest, l as replayRollback, ln as findLargeInlineResources, lt as s3BucketArn, m as computeImplicitDeleteEdges, mn as derivePartitionAndUrlSuffix, mt as applyRoleArnIfSet, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveStateBucketWithDefaultAndSource, nt as readConfigString, o as planFailedOps, on as CFN_TEMPLATE_BODY_LIMIT, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as canonicalizeRegion, pt as s3BucketWebsiteUrl, q as getAccountInfo, qn as isRetryableTransientError, qt as Synthesizer, r as DeployEngine, rn as resolveUseCdkBootstrapAssets, rt as replayWarn, s as planRollback, sn as CFN_TEMPLATE_URL_LIMIT, st as redactSecretsForState, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefault, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as uploadCfnTemplate, ut as s3BucketDomainName, v as ccRoutedFinalSnapshotError, vn as resolveBucketRegion, vt as DagBuilder, w as extractDeploymentEventError, wn as CdkdError, wt as AssetPublisher, x as refusesFinalSnapshot, xn as resetAwsClients, xt as S3StateBackend, y as createPreDeleteFinalSnapshot, yn as AwsClients, yt as TemplateParser, z as findActionableSilentDrops, zn as StackTerminationProtectionError, zt as buildDenyExternalAccessPolicy } from "./deploy-engine-ISSt01TI.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B260vt0k.js";
+import { t as ASGProvider } from "./asg-provider-DKjoomrX.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -57746,7 +57746,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		stackName,
 		bestEffort: true,
 		...mergedParameters && { parameters: mergedParameters },
-		...conditions && { conditions }
+		...conditions && { conditions },
+		skipDynamicReferences: true
 	});
 	return diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
 }
@@ -58263,6 +58264,259 @@ function createDiffCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/scrub.ts
+/**
+* Signals `cdkd scrub` found stacks whose state still holds plaintext secrets.
+* Only thrown under `--dry-run --fail`; carries no message (the plan was
+* already printed) and maps to a non-zero exit so CI can gate on it.
+*/
+var ScrubNeededError = class ScrubNeededError extends CdkdError {
+	silent = true;
+	constructor() {
+		super("scrub needed", "SCRUB_NEEDED");
+		this.name = "ScrubNeededError";
+		Object.setPrototypeOf(this, ScrubNeededError.prototype);
+	}
+};
+/**
+* `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
+* reference is stored as its UNRESOLVED expression rather than the plaintext
+* value (GHSA fix). "Secret" here is whatever the RESOLVER classifies as one,
+* which is the single source of truth this command shares with the deploy
+* path: every `{{resolve:secretsmanager:...}}`, plus a `{{resolve:ssm:...}}`
+* naming a `SecureString` parameter (issue #1901). scrub therefore gains a new
+* secret class automatically, with no second list to keep in sync.
+*
+* A normal `cdkd deploy` already scrubs state as a side effect (the deploy
+* engine redacts every persisted bag), so this command is for cleaning up
+* existing state WITHOUT a redeploy — e.g. after upgrading cdkd on a stack you
+* do not want to re-provision right now.
+*
+* It needs the CDK app (`--app`) because a state file records the RESOLVED
+* plaintext with no marker of which values are secrets: only the template
+* carries the `{{resolve:...}}` expressions. So scrub synthesizes the template,
+* re-resolves each resource's properties to learn the resolved secret VALUES
+* (recorded, never printed or re-persisted), and replaces those values in the
+* state record's `properties` / `attributes` / `observedProperties` with the
+* expression. No AWS resource is created, updated, or deleted; only state.json
+* is rewritten. This is why it is a top-level command and not `cdkd state
+* scrub` — the `cdkd state ...` family operates on the state bucket alone and
+* deliberately needs no CDK code.
+*
+* IMPORTANT: scrubbing does not un-expose an already-leaked secret. A value
+* that was stored in plaintext should be treated as compromised and ROTATED at
+* its source — in Secrets Manager, or by re-putting the `SecureString` SSM
+* parameter; scrub only stops it from being re-read out of state going
+* forward.
+*
+* ORDERING: scrub matches the CURRENT resolved secret value against what state
+* holds, so run it BEFORE rotating. Once the secret is rotated, the value in
+* state no longer matches the current one and scrub cannot find it (it reports
+* "nothing to scrub"). A rotated-away stale value in state is invalidated by
+* the rotation, but to remove it, redeploy the stack (which rewrites the record
+* with the expression).
+*/
+async function scrubCommand(stacks, options) {
+	const logger = getLogger();
+	if (options.verbose) logger.setLevel("debug");
+	warnIfDeprecatedRegion(options);
+	await applyRoleArnIfSet({
+		roleArn: options.roleArn,
+		region: options.region
+	});
+	const app = resolveApp(options.app);
+	if (!app) throw new Error("CDK app is required (scrub needs the template to identify secret references). Pass --app, set CDKD_APP, or add \"app\" to cdk.json.");
+	const region = options.region || process.env["AWS_REGION"] || "us-east-1";
+	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	setAwsClients(new AwsClients({
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile }
+	}));
+	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
+	const synthesizer = new Synthesizer();
+	const context = parseContextOptions(options.context);
+	const synthOptions = {
+		app,
+		output: options.output,
+		...options.region && { region: options.region },
+		...options.profile && { profile: options.profile },
+		...Object.keys(context).length > 0 && { context },
+		stateBucket,
+		deferMacroExpansion: true
+	};
+	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
+	const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
+	let targetStacks;
+	if (options.all) targetStacks = allStacks;
+	else if (stackPatterns.length > 0) targetStacks = matchStacks(allStacks, stackPatterns);
+	else if (allStacks.length === 1) targetStacks = allStacks;
+	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
+	if (targetStacks.length === 0) throw new Error("No stacks matched.");
+	await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
+	const stateConfig = {
+		bucket: stateBucket,
+		prefix: options.statePrefix
+	};
+	const stateS3 = new AwsClients({
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	const stateBackend = new S3StateBackend(stateS3.s3, stateConfig, {
+		region,
+		...options.profile && { profile: options.profile }
+	});
+	const lockManager = new LockManager(stateS3.s3, stateConfig);
+	let totalStacksScrubbed = 0;
+	for (const stack of targetStacks) {
+		const scrubbed = await scrubStack(stack, stack.region || region, stateBackend, lockManager, {
+			dryRun: options.dryRun ?? false,
+			roleArn: options.roleArn,
+			logger
+		});
+		if (scrubbed.recordsChanged > 0) {
+			totalStacksScrubbed++;
+			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
+		} else logger.info(`No plaintext secrets found in ${stack.stackName}`);
+	}
+	if (totalStacksScrubbed === 0) {
+		logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+		return;
+	}
+	if (options.dryRun) {
+		logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written). ROTATE any exposed secret in Secrets Manager.`);
+		if (options.fail) throw new ScrubNeededError();
+		return;
+	}
+	logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).`);
+}
+/**
+* Scrub one stack's state. Re-resolves the template's per-resource properties to
+* learn the resolved secret VALUES, then replaces those values in the state
+* record with their `{{resolve:...}}` expressions. Returns counts; performs no
+* AWS mutation. Acquires the stack lock for the read-modify-write unless
+* `dryRun`.
+*/
+async function scrubStack(stack, region, stateBackend, lockManager, opts) {
+	const { logger } = opts;
+	const acquired = !opts.dryRun;
+	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
+	try {
+		const loaded = await stateBackend.getState(stack.stackName, region);
+		if (!loaded) {
+			logger.debug(`No state for ${stack.stackName} (${region}) — skipping`);
+			return {
+				recordsChanged: 0,
+				secretsFound: 0
+			};
+		}
+		const state = loaded.state;
+		const perResourceSecrets = /* @__PURE__ */ new Map();
+		const outputSecrets = /* @__PURE__ */ new Map();
+		const resolver = new IntrinsicFunctionResolver(region);
+		let parameters = {};
+		let conditions = {};
+		try {
+			parameters = await resolver.resolveParameters(stack.template);
+		} catch (err) {
+			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		try {
+			conditions = await resolver.evaluateConditions({
+				template: stack.template,
+				resources: state.resources,
+				...Object.keys(parameters).length > 0 && { parameters },
+				bestEffort: true
+			});
+		} catch (err) {
+			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		const templateResources = stack.template.Resources ?? {};
+		for (const logicalId of Object.keys(state.resources)) {
+			const templateResource = templateResources[logicalId];
+			if (!templateResource?.Properties) continue;
+			const recordedSecretValues = /* @__PURE__ */ new Map();
+			try {
+				await resolver.resolve(templateResource.Properties, {
+					template: stack.template,
+					resources: state.resources,
+					...Object.keys(parameters).length > 0 && { parameters },
+					...Object.keys(conditions).length > 0 && { conditions },
+					stackName: stack.stackName,
+					recordedSecretValues,
+					bestEffort: true
+				});
+			} catch (err) {
+				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
+		}
+		const templateOutputs = stack.template.Outputs ?? {};
+		for (const [name, output] of Object.entries(templateOutputs)) {
+			const value = output.Value;
+			if (value === void 0) continue;
+			try {
+				await resolver.resolve(value, {
+					template: stack.template,
+					resources: state.resources,
+					...Object.keys(parameters).length > 0 && { parameters },
+					...Object.keys(conditions).length > 0 && { conditions },
+					stackName: stack.stackName,
+					recordedSecretValues: outputSecrets,
+					bestEffort: true
+				});
+			} catch (err) {
+				logger.debug(`Resolution of output ${name} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+			}
+		}
+		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0);
+		if (totalSecrets === 0) return {
+			recordsChanged: 0,
+			secretsFound: 0
+		};
+		let recordsChanged = 0;
+		const newResources = {};
+		for (const [logicalId, record] of Object.entries(state.resources)) {
+			const secrets = perResourceSecrets.get(logicalId);
+			const scrubbed = secrets ? scrubResourceRecord(record, secrets) : record;
+			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
+			newResources[logicalId] = scrubbed;
+		}
+		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets) : state.outputs;
+		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
+		if (recordsChanged > 0 && !opts.dryRun) {
+			const nextState = {
+				...state,
+				resources: newResources,
+				outputs: newOutputs,
+				lastModified: Date.now()
+			};
+			await stateBackend.saveState(stack.stackName, region, nextState, { expectedEtag: loaded.etag });
+		}
+		return {
+			recordsChanged,
+			secretsFound: totalSecrets
+		};
+	} finally {
+		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
+			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+		});
+	}
+}
+function createScrubCommand() {
+	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path)").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate)");
+	[
+		...commonOptions,
+		...appOptions,
+		...stateOptions,
+		...stackOptions,
+		...contextOptions
+	].forEach((opt) => cmd.addOption(opt));
+	cmd.addOption(deprecatedRegionOption);
+	cmd.action(withErrorHandling(scrubCommand));
+	return cmd;
+}
+
 //#endregion
 //#region src/analyzer/drift-normalize.ts
 /**
@@ -58624,6 +58878,7 @@ function isIgnoredPath(path, ignorePaths) {
 */
 function diffAt(path, stateValue, awsValue, out, ignorePaths, unionWalkObjects) {
 	if (deepEqual(stateValue, awsValue)) return;
+	if (typeof stateValue === "string" && stateValue.includes("{{resolve:")) return;
 	if (isPlainObject(stateValue) && isPlainObject(awsValue) && !Array.isArray(stateValue) && !Array.isArray(awsValue)) {
 		const keys = unionWalkObjects ? /* @__PURE__ */ new Set([...Object.keys(stateValue), ...Object.keys(awsValue)]) : Object.keys(stateValue);
 		for (const key of keys) {
@@ -68655,7 +68910,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		stackName: stackState.stackName
 	};
 	for (const [logicalId, resource] of entries) try {
-		resource.properties = await resolver.resolve(resource.properties ?? {}, baseContext);
+		const recordedSecretValues = /* @__PURE__ */ new Map();
+		const resolved = await resolver.resolve(resource.properties ?? {}, {
+			...baseContext,
+			recordedSecretValues
+		});
+		resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues) : resolved;
 	} catch (err) {
 		logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${err instanceof Error ? err.message : String(err)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.`);
 	}
@@ -78814,7 +79074,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.19");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.21");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;
@@ -78827,6 +79087,7 @@ function buildProgram() {
 	program.addCommand(createDriftCommand());
 	program.addCommand(createDestroyCommand());
 	program.addCommand(createRollbackCommand());
+	program.addCommand(createScrubCommand());
 	program.addCommand(createEventsCommand());
 	program.addCommand(createGcCommand());
 	program.addCommand(createOrphanCommand());