@go-to-k/cdkd 0.283.31 → 0.283.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as coerceCfnBoolean, $t as getLegacyStateBucketName, A as cyan, An as DeployCancelledError, At as buildAssetRedirectMap, B as findSilentDropProperties, Bn as ResourceUpdateNotSupportedError, Bt as validateAssetBucketName, C as makeCanonicalizePropertiesFn, Cn as getAwsClients, Ct as LockManager, D as renderStatefulReason, Dn as CdkdError, Dt as AssetPublisher, E as isStatefulRecreateTargetSync, Et as shouldRetainResource, F as IAMRoleProvider, Fn as MissingCdkCliError, Ft as AssetModeResolver, G as IntrinsicFunctionResolver, Gt as getDockerCmd, H as slowCcOperationTimeoutMs, Hn as StackTerminationProtectionError, Ht as buildDenyExternalAccessPolicy, I as collectInlinePolicyNamesManagedBySiblings, In as NestedStackChildDirectDestroyError, It as BOOTSTRAP_MARKER_PREFIX, J as refStateLookupFromResource, Jn as withErrorHandling, Jt as AssetManifestLoader, K as cfnRefValueFromPhysicalId, Kt as runDockerForeground, L as clearOnUpdateRemoval, Ln as PartialFailureError, Lt as ensureAssetStorage, M as green, Mn as LocalMigrateError, Mt as loadPublishableAssetManifest, N as red, Nn as LocalStartServiceError, Nt as rewriteTemplateAssetReferences, O as formatResourceLine, Ot as stringifyValue, P as yellow, Pt as escapeRegExp, Q as assertRegionMatch, Qn as markNonRetryable, Qt as getDefaultStateBucketName, R as ProviderRegistry, Rn as ProvisioningError, Rt as getBootstrapMarkerKey, S as unsupportedFinalSnapshotError, Sn as AwsClients, St as TemplateParser, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as setAwsClients, Tt as rebuildClientForBucketRegion, U as disableInstanceApiTermination, Ut as buildDockerImage, V as CloudControlProvider, Vn as StackHasActiveImportsError, Vt as validateContainerRepoName, W as isTerminationProtectionPropagationError, Wt as formatDockerLoginError, X as normalizeAwsTagsToCfn, Xn as isRetryableTransientError, Xt as Synthesizer, Y as WAFv2WebACLProvider, Yn as isMarkedNonRetryable, Yt as getDockerImageBySourceHash, Z as resolveExplicitPhysicalId, Zn as isThrottlingError, Zt as synthesisStatusMessage, _ as buildFinalSnapshotIdentifier, _n as derivePartitionAndUrlSuffix, _t as DiffCalculator, a as DeploymentEventsStore, an as resolveStateBucketWithDefaultAndSource, at as requireConfigObject, b as isFinalSnapshotError, bt as withRetry, c as replayFailedOperations, cn as warnDeprecatedNoPrefixCliFlag, ct as TEMPLATE_SOURCED_RULES, d as deleteSkipReason, dn as MIGRATE_TMP_PREFIX, dt as s3BucketArn, en as resolveApp, et as configBooleanRefusal, f as withResourceDeadline, fn as findLargeInlineResources, ft as s3BucketDomainName, g as PRE_DELETE_SNAPSHOT_TYPES, gn as canonicalizeRegion, gt as applyRoleArnIfSet, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as PARTITION_TABLE, ht as s3BucketWebsiteUrl, i as DeploymentEventsReader, in as resolveStateBucketWithDefault, it as requireConfigArray, j as gray, jn as LocalInvokeBuildError$1, jt as createAssetRedirectResolver, k as bold, kt as WorkGraph, l as replayRollback, ln as CFN_TEMPLATE_BODY_LIMIT, lt as redactSecretsForState, m as computeImplicitDeleteEdges, mn as expectedOwnerParam, mt as s3BucketRegionalDomainName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveCaptureObservedState, nt as readConfigString, o as planFailedOps, on as resolveUseCdkBootstrapAssets, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as uploadCfnTemplate, pt as s3BucketDualStackDomainName, q as getAccountInfo, qn as normalizeAwsError, qt as runDockerStreaming, r as DeployEngine, rn as resolveSkipPrefix, rt as replayWarn, s as planRollback, sn as stateBucketExistenceConfirmed, st as STATE_SOURCED_CROSS_GENERATION_RULES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveAutoAssetStorage, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as CFN_TEMPLATE_URL_LIMIT, ut as scrubResourceRecord, v as ccRoutedFinalSnapshotError, vn as AssemblyReader, vt as INTRINSIC_KEYS, w as extractDeploymentEventError, wn as resetAwsClients, wt as S3StateBackend, x as refusesFinalSnapshot, xn as resolveBucketRegion, xt as DagBuilder, y as createPreDeleteFinalSnapshot, yn as processStackMessages, yt as describeTypeWithThrottleRetry, z as findActionableSilentDrops, zn as ResourceTimeoutError, zt as parseBootstrapMarker } from "./deploy-engine-AWFiXyhp.js";
+import { $ as getAccountInfo, $t as runDockerForeground, A as cyan, An as getAwsClients, At as S3StateBackend, B as stateKeySecretExposure, Bn as LocalStartServiceError, Bt as escapeRegExp, C as makeCanonicalizePropertiesFn, Cn as canonicalizeRegion, Ct as DiffCalculator, D as renderStatefulReason, Dt as DagBuilder, E as isStatefulRecreateTargetSync, En as processStackMessages, Et as withRetry, F as collectDeclaredOutputNames, Ft as WorkGraph, G as findActionableSilentDrops, Gn as ProvisioningError, Gt as getBootstrapMarkerKey, H as collectInlinePolicyNamesManagedBySiblings, Hn as MissingCdkCliError, Ht as AssetModeResolver, I as collectPublishedOutputNames, It as buildAssetRedirectMap, J as slowCcOperationTimeoutMs, Jn as StackHasActiveImportsError, Jt as validateContainerRepoName, K as findSilentDropProperties, Kn as ResourceTimeoutError, Kt as parseBootstrapMarker, L as exportAliasCollisionScrubWarning, Ln as DeployCancelledError, Lt as createAssetRedirectResolver, M as green, Mn as setAwsClients, Mt as shouldRetainResource, N as red, Nt as AssetPublisher, O as formatResourceLine, On as resolveBucketRegion, Ot as TemplateParser, P as yellow, Pn as CdkdError, Pt as stringifyValue, Q as cfnRefValueFromPhysicalId, Qt as getDockerCmd, R as isExportAliasCollision, Rn as LocalInvokeBuildError$1, Rt as loadPublishableAssetManifest, S as unsupportedFinalSnapshotError, Sn as PARTITION_TABLE, St as applyRoleArnIfSet, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as AssemblyReader, Tt as describeTypeWithThrottleRetry, U as clearOnUpdateRemoval, Un as NestedStackChildDirectDestroyError, Ut as BOOTSTRAP_MARKER_PREFIX, V as IAMRoleProvider, Vt as stripControlChars, W as ProviderRegistry, Wn as PartialFailureError, Wt as ensureAssetStorage, X as isTerminationProtectionPropagationError, Xt as buildDockerImage, Y as disableInstanceApiTermination, Yn as StackTerminationProtectionError, Yt as buildDenyExternalAccessPolicy, Z as IntrinsicFunctionResolver, Zt as formatDockerLoginError, _ as buildFinalSnapshotIdentifier, _n as CFN_TEMPLATE_URL_LIMIT, _t as s3BucketArn, a as DeploymentEventsStore, an as getDefaultStateBucketName, ar as markNonRetryable, at as coerceCfnBoolean, b as isFinalSnapshotError, bn as uploadCfnTemplate, bt as s3BucketRegionalDomainName, c as replayFailedOperations, cn as resolveAutoAssetStorage, ct as readConfigString, d as deleteSkipReason, dn as resolveStateBucketWithDefault, dt as requireConfigObject, en as runDockerStreaming, er as normalizeAwsError, et as refStateLookupFromResource, f as withResourceDeadline, fn as resolveStateBucketWithDefaultAndSource, ft as requireConfigString, g as PRE_DELETE_SNAPSHOT_TYPES, gn as CFN_TEMPLATE_BODY_LIMIT, gt as scrubResourceRecord, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as warnDeprecatedNoPrefixCliFlag, ht as redactSecretsForState, i as DeploymentEventsReader, in as synthesisStatusMessage, ir as isThrottlingError, it as assertRegionMatch, j as gray, jn as resetAwsClients, jt as rebuildClientForBucketRegion, k as bold, kn as AwsClients, kt as LockManager, l as replayRollback, ln as resolveCaptureObservedState, lt as replayWarn, m as computeImplicitDeleteEdges, mn as stateBucketExistenceConfirmed, mt as TEMPLATE_SOURCED_RULES, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as getDockerImageBySourceHash, nr as isMarkedNonRetryable, nt as normalizeAwsTagsToCfn, o as planFailedOps, on as getLegacyStateBucketName, ot as configBooleanRefusal, p as IMPLICIT_DELETE_DEPENDENCIES, pn as resolveUseCdkBootstrapAssets, pt as STATE_SOURCED_CROSS_GENERATION_RULES, q as CloudControlProvider, qn as ResourceUpdateNotSupportedError, qt as validateAssetBucketName, r as DeployEngine, rn as Synthesizer, rr as isRetryableTransientError, rt as resolveExplicitPhysicalId, s as planRollback, sn as resolveApp, st as configStringRefusal, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetManifestLoader, tr as withErrorHandling, tt as WAFv2WebACLProvider, u as UNSPECIFIED_SKIP_REASON, un as resolveSkipPrefix, ut as requireConfigArray, v as ccRoutedFinalSnapshotError, vn as MIGRATE_TMP_PREFIX, vt as s3BucketDomainName, w as extractDeploymentEventError, wn as derivePartitionAndUrlSuffix, wt as INTRINSIC_KEYS, x as refusesFinalSnapshot, xn as expectedOwnerParam, xt as s3BucketWebsiteUrl, y as createPreDeleteFinalSnapshot, yn as findLargeInlineResources, yt as s3BucketDualStackDomainName, z as secretBearingStateKeyWarning, zn as LocalMigrateError, zt as rewriteTemplateAssetReferences } from "./deploy-engine-rYTNzst0.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-SQ0V0nFd.js";
+import { t as ASGProvider } from "./asg-provider-CVoisQ0L.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -57389,6 +57389,25 @@ function isSecretDynamicReference(value) {
 	if (typeof value !== "string") return false;
 	return value.includes("{{resolve:secretsmanager:") || value.includes("{{resolve:ssm-secure:");
 }
+/**
+* The same question asked of a whole template VALUE, walking every string leaf.
+*
+* The leaf predicate answers `false` for a non-string, and an output's `Value`
+* is very often an OBJECT: `secret.secretValueFromJson(...)` renders the
+* secret's ARN as a `Ref`, so the value is an `Fn::Join` / `Fn::Sub` — which
+* CLAUDE.md's #1916 note calls the DOMINANT CDK shape, not an edge case.
+* Feeding the raw value to the leaf predicate therefore reported "no secret
+* here" for exactly the templates most likely to have one, which silently
+* disarmed BOTH signals built on it: the export-alias decision below (issue
+* #1919) and the legacy-record withholding that keeps a pre-GHSA plaintext out
+* of the rendered diff (issue #1921).
+*/
+function containsSecretDynamicReference(value) {
+	if (typeof value === "string") return isSecretDynamicReference(value);
+	if (Array.isArray(value)) return value.some(containsSecretDynamicReference);
+	if (value !== null && typeof value === "object") return Object.values(value).some(containsSecretDynamicReference);
+	return false;
+}
 /** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
 function valuesEqual(a, b) {
 	if (a === b) return true;
@@ -57446,6 +57465,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 	const failedKeys = /* @__PURE__ */ new Set();
 	const secretSourceKeys = /* @__PURE__ */ new Set();
 	let resolutionFailed = false;
+	const publishedOutputNames = collectPublishedOutputNames(template.Outputs ?? {}, conditions);
 	if (!template.Outputs) return {
 		outputs,
 		exportNames,
@@ -57464,7 +57484,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		if (typeof output.Export?.Name === "string") failedKeys.add(output.Export.Name);
 	};
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
-		if (!isSecretDynamicReference(output.Value)) continue;
+		if (!containsSecretDynamicReference(output.Value)) continue;
 		secretSourceKeys.add(outputKey);
 		if (typeof output.Export?.Name === "string") secretSourceKeys.add(output.Export.Name);
 	}
@@ -57493,6 +57513,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 		if (output.Export?.Name) {
 			let exportName = output.Export.Name;
 			const exportSourceUsedSub = templateUsesSub(output.Export.Name);
+			const declaredExportIsIntrinsic = typeof output.Export.Name !== "string";
 			if (typeof exportName !== "string") try {
 				exportName = await resolveFn(structuredClone(exportName));
 			} catch (error) {
@@ -57500,10 +57521,17 @@ async function resolveTemplateOutputs(template, resolveFn, conditions) {
 				resolutionFailed = true;
 				continue;
 			}
-			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
+			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
+			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) {
+				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret`);
+				failedKeys.add(exportName);
+				resolutionFailed = true;
+			} else {
 				outputs[exportName] = value;
 				exportNames.add(exportName);
-			} else resolutionFailed = true;
+			}
+			else resolutionFailed = true;
 		}
 	}
 	return {
@@ -57553,8 +57581,8 @@ function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /*
 	const changes = [];
 	const currentBag = current ?? {};
 	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
-		if (isSecretDynamicReference(oldValue)) return false;
-		return isSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
+		if (typeof oldValue === "string" && isSecretDynamicReference(oldValue)) return false;
+		return containsSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
 	});
 	const push = (change) => {
 		if (legacyRecord && change.changeType !== "ADD") {
@@ -58988,10 +59016,10 @@ const REDACTED_LEGACY_PLAINTEXT = "<redacted: legacy plaintext in state — run
 * consumer may match on, and silently mutating it there would trade a real
 * correctness regression for a display concern belonging to whatever renders
 * the JSON. `JSON.stringify` already escapes everything below 0x20.
+*
+* The helper itself now lives in `src/utils/regexp.ts` — `outputs-export-alias`
+* prints the same class of string and had grown a second copy.
 */
-function stripControlChars(value) {
-	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
-}
 /**
 * The same guard for an already-JSON-SERIALIZED value: C1 and the bidi marks
 * only, deliberately NOT C0.
@@ -59211,9 +59239,11 @@ function createDiffCommand() {
 //#endregion
 //#region src/cli/commands/scrub.ts
 /**
-* Signals `cdkd scrub` found stacks whose state still holds plaintext secrets.
-* Only thrown under `--dry-run --fail`; carries no message (the plan was
-* already printed) and maps to a non-zero exit so CI can gate on it.
+* Signals `cdkd scrub` found plaintext it is reporting rather than removing.
+* Thrown under `--fail`: with `--dry-run` when any plaintext secret is in state,
+* and on a REAL run when a leak was found that scrub cannot rewrite (a
+* secret-bearing output KEY, issue #1919). Carries no message — the plan was
+* already printed — and maps to a non-zero exit so CI can gate on it.
 */
 var ScrubNeededError = class ScrubNeededError extends CdkdError {
 	silent = true;
@@ -59312,6 +59342,7 @@ async function scrubCommand(stacks, options) {
 	});
 	const lockManager = new LockManager(stateS3.s3, stateConfig);
 	let totalStacksScrubbed = 0;
+	let totalStacksWithUnscrubbableKeys = 0;
 	for (const stack of targetStacks) {
 		const scrubbed = await scrubStack(stack, stack.region || region, stateBackend, lockManager, {
 			dryRun: options.dryRun ?? false,
@@ -59321,18 +59352,26 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.secretBearingKeys > 0) {
+			totalStacksWithUnscrubbableKeys++;
+			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
+		}
 	}
-	if (totalStacksScrubbed === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0) {
 		logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 		return;
 	}
+	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	if (options.dryRun) {
-		logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written). ROTATE any exposed secret in Secrets Manager.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote} ROTATE any exposed secret.`);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}`);
+	else logger.info(`\nNothing could be rewritten.${keyNote} ROTATE any exposed secret.`);
+	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
 }
 /**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
@@ -59351,7 +59390,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			logger.debug(`No state for ${stack.stackName} (${region}) — skipping`);
 			return {
 				recordsChanged: 0,
-				secretsFound: 0
+				secretsFound: 0,
+				secretBearingKeys: 0
 			};
 		}
 		const state = loaded.state;
@@ -59399,12 +59439,42 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
 		}
 		const templateOutputs = stack.template.Outputs ?? {};
+		const declaredOutputNames = collectDeclaredOutputNames(templateOutputs);
+		const ambiguousKeys = /* @__PURE__ */ new Set();
+		const collisions = [];
+		let outputsSourceUntrusted = false;
+		for (const [name, output] of Object.entries(templateOutputs)) {
+			const declaredExportName = output.Export?.Name;
+			let exportName = declaredExportName;
+			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") try {
+				exportName = await resolver.resolve(declaredExportName, {
+					template: stack.template,
+					resources: state.resources,
+					...Object.keys(parameters).length > 0 && { parameters },
+					...Object.keys(conditions).length > 0 && { conditions },
+					stackName: stack.stackName,
+					recordedSecretValues: outputSecrets,
+					bestEffort: true
+				});
+			} catch (err) {
+				outputsSourceUntrusted = true;
+				logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${err instanceof Error ? err.message : String(err)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+			}
+			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
+			if (declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName))) {
+				outputsSourceUntrusted = true;
+				logger.warn(`Export.Name of output ${name} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+			} else if (typeof exportName === "string" && isExportAliasCollision(exportName, name, declaredOutputNames)) {
+				ambiguousKeys.add(exportName);
+				collisions.push([name, exportName]);
+			}
+		}
 		for (const [name, output] of Object.entries(templateOutputs)) {
 			const value = output.Value;
 			if (value === void 0) continue;
-			outputsTemplateSource[name] = value;
+			if (!ambiguousKeys.has(name)) outputsTemplateSource[name] = value;
 			const exportName = output.Export?.Name;
-			if (typeof exportName === "string") outputsTemplateSource[exportName] = value;
+			if (typeof exportName === "string" && !ambiguousKeys.has(exportName)) outputsTemplateSource[exportName] = value;
 			try {
 				await resolver.resolve(value, {
 					template: stack.template,
@@ -59419,10 +59489,19 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.debug(`Resolution of output ${name} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
 			}
 		}
+		for (const [name, exportName] of collisions) logger.warn(exportAliasCollisionScrubWarning(name, exportName, outputSecrets));
+		const secretBearingKeys = [];
+		for (const key of Object.keys(state.outputs ?? {})) {
+			const exposure = stateKeySecretExposure(key, outputSecrets);
+			if (!exposure) continue;
+			secretBearingKeys.push(key);
+			logger.warn(secretBearingStateKeyWarning(stack.stackName, key, exposure));
+		}
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0);
 		if (totalSecrets === 0) return {
 			recordsChanged: 0,
-			secretsFound: 0
+			secretsFound: 0,
+			secretBearingKeys: 0
 		};
 		let recordsChanged = 0;
 		const newResources = {};
@@ -59438,7 +59517,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsTemplateSource) : state.outputs;
+		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource) : state.outputs;
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const nextState = {
@@ -59451,7 +59530,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		}
 		return {
 			recordsChanged,
-			secretsFound: totalSecrets
+			secretsFound: totalSecrets,
+			secretBearingKeys: secretBearingKeys.length
 		};
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
@@ -59460,7 +59540,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	}
 }
 function createScrubCommand() {
-	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path)").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate)");
+	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path)").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate). Also exits non-zero on a real run when a leak was found that scrub cannot rewrite.");
 	[
 		...commonOptions,
 		...appOptions,
@@ -80334,7 +80414,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.31");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.32");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;