@go-to-k/cdkd 0.284.22 → 0.284.24

package/dist/{deploy-engine-DOlhIeGv.js → deploy-engine-BJQbni1s.js}

@@ -16860,7 +16860,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DLU0EEhO.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Bh0odlSk.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -17575,6 +17575,47 @@ const CR_NO_SERVICE_TOKEN_SKIP_REASON = "no ServiceToken in state — Delete han
 */
 const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did not complete — resource unproven";
 /**
+* Fourth sibling of the three above, for the arm where the handler RAN, was
+* reached, and answered `Status: 'FAILED'` (issue
+* [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* The terminal FAILED arm used to warn and fall through to `return undefined`,
+* which `deleteSkipReason` reads as DELETED — so cdkd dropped the state
+* record, printed the row as deleted and exited 0 over a resource the handler
+* had EXPLICITLY said it did not delete. It is the same silent-orphan class
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON} removed from the throw arm,
+* reached through the handler's RESPONSE instead.
+*
+* **Unconditional, with no already-gone classifier.** A handler that reports
+* FAILED because the thing it manages was already absent is a real and common
+* shape, and today's leniency lets those destroys finish green. Classifying
+* the reason to keep them green was rejected: the reason is free text a user's
+* handler writes, so any classifier is a guess, and a wrong guess
+* re-introduces exactly the orphan this arm exists to stop.
+*
+* This is therefore a COMPATIBILITY BREAK: a destroy whose delete handler
+* reports FAILED now exits 2 with the record kept, where it used to exit 0
+* with the record dropped.
+*
+* **The two callers have DIFFERENT escape hatches, and only one of them is a
+* flag.** On `cdkd deploy` the skip is forced back to exit 0 by
+* `--allow-unaddressed` (issue #1960, the flag that settled the analogous
+* exit-code question). `cdkd destroy` has no such flag — a skip raises
+* `PartialFailureError` unconditionally (`src/cli/commands/destroy.ts`) — so
+* there the remedy is the one that command's own summary names: confirm the
+* resource is gone, then drop the record with `cdkd state orphan <stack>`.
+* Messages must not offer the flag on the destroy path, which is the path this
+* arm is mostly reached from.
+*
+* **Fixed wording, no interpolation**, for the reason spelled out on
+* {@link CR_DELETE_INVOKE_FAILED_SKIP_REASON}: the handler's own `Reason` is a
+* user-authored string, it goes out on the `logger.warn` beside this, and a
+* `Reason` carrying `does not exist` / `not found` would make the deploy-side
+* replacement sites classify the skip as "already gone" and drop the record
+* one layer further out.
+*/
+const CR_DELETE_HANDLER_FAILED_SKIP_REASON = "Delete handler reported FAILED — resource unproven";
+/**
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
@@ -17585,6 +17626,29 @@ const CR_DELETE_INVOKE_FAILED_SKIP_REASON = "Delete request to the handler did n
 * torn down by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
+/**
+* The bound BOTH delete-path skips in this file have to state (found in review
+* of issue [#2054](https://github.com/go-to-k/cdkd/issues/2054)).
+*
+* A skip KEEPS the state record, and the natural thing to promise is that a
+* re-run retries the handler. **On `cdkd destroy` that promise is false**, and
+* it is false in the direction that matters. `destroy-runner.ts` walks every
+* reverse-DAG level regardless of skips, so the SAME run that skipped the
+* custom resource goes on to delete its backing Lambda. The next
+* `cdkd destroy` therefore reaches the issue-#804 pre-check above, finds the
+* function gone, and treats the resource as already deleted — dropping the
+* record and exiting 0 over a resource the handler explicitly refused to
+* remove, which is the very silent orphan #2054 removed one run earlier.
+*
+* Closing it properly means making that pre-check answer `'skipped'` when the
+* teardown was never PROVEN, which needs a durable "a prior run skipped this"
+* signal. Every candidate is outside this file: a `ResourceState` field (a
+* state-schema bump), or a `DeleteContext` flag threaded from
+* `destroy-runner.ts`. So the record is described here as what it actually is
+* — a POINTER to something that has to be torn down by hand — rather than as a
+* retry that will not happen.
+*/
+const CR_SKIP_NOT_A_RETRY_CAVEAT = "NOTE this record is a POINTER, not a retry: the same destroy run deletes the backing Lambda, so the next 'cdkd destroy' finds the handler gone and DROPS this record (issue 804 pre-check). Tear the resource down by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one.";
 const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, tear the resource down by hand.";
 /**
 * Type guard to validate Lambda response payload structure
@@ -17898,25 +17962,50 @@ const CR_LOG_TAIL_BOILERPLATE = /^(START|END|REPORT|XRAY|INIT_START|INIT_REPORT|
 */
 const SNS_SERVICE_TOKEN_ARN_RE = /^arn:aws[a-z0-9-]*:sns:/;
 /**
+* Account segment {@link syntheticStackId} falls back to when STS could not
+* answer (`AwsAccountInfo.fabricated`, issue
+* [#1730](https://github.com/go-to-k/cdkd/issues/1730)).
+*
+* The Cloud Control enrichment sites answer a fabricated account by OMITTING
+* the value they would have built. That is not available here — `StackId` is a
+* REQUIRED member of the custom-resource request payload — so the choice is
+* between two wrong strings, and the honest one is the one a handler cannot
+* mistake for real. `getAccountInfo`'s own fallback id (`123456789012`) is
+* shaped exactly like a live account; the all-zero id is not a valid AWS
+* account and reads as the placeholder it is.
+*/
+const SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT = "000000000000";
+/**
 * The synthetic `StackId` handed to a custom-resource handler in place of the
 * CloudFormation stack ARN cdkd does not have.
 *
-* **Its `arn:aws:` prefix is deliberately NOT partition-derived** (issue
-* #1815, which fixed the SNS routing predicate above). Every segment of this
-* value is fabricated — the region is a fixed `us-east-1` rather than the
-* deploy region, and the account is the all-zero placeholder — so it addresses
-* nothing and cannot be made to. Deriving ONLY the partition would produce a
-* strictly LESS coherent ARN (`arn:aws-cn:cloudformation:us-east-1:0000...`,
-* a China partition carrying a commercial region) while fixing nothing a
-* handler could rely on. The coherent fix is to synthesize the real
-* partition / region / account together, which changes what every handler
-* observes and belongs in its own change.
+* Partition / region / account are synthesized TOGETHER from the real deploy
+* context (issue [#1866](https://github.com/go-to-k/cdkd/issues/1866)). Every
+* segment used to be fabricated — `arn:aws:cloudformation:us-east-1:0000...`
+* regardless of where the deploy actually ran — and CloudFormation-authored
+* handlers DO read `event.StackId`: to re-derive the region / account they are
+* running in, to build ARNs, to name log streams, to correlate a response.
+* Each of those read a coherent-looking ARN and got an answer that addresses
+* nothing.
+*
+* Deriving only ONE segment is worse than deriving none, which is why issue
+* #1815 deliberately left the hardcoded `arn:aws:` prefix alone rather than
+* partition-deriving it in isolation: `arn:aws-cn:cloudformation:us-east-1:…`
+* is a China partition carrying a commercial region, strictly LESS coherent
+* than a uniformly-commercial fabrication. So this takes the whole
+* {@link AwsAccountInfo} — where `partition` is already derived FROM `region`
+* — rather than any one field.
+*
+* The stack-NAME segment stays synthetic (`cdkd-<logicalId>`): cdkd has no
+* CloudFormation stack, so there is no real value to put there.
 *
 * Factored into one place so the rationale cannot go stale against two other
-* copies: the create / update / delete request builders all use it.
+* copies: the create / update / delete request builders all use it, through
+* {@link CustomResourceProvider.resolveSyntheticStackId}.
 */
-function syntheticStackId(logicalId) {
-	return `arn:aws:cloudformation:us-east-1:000000000000:stack/cdkd-${logicalId}/cdkd`;
+function syntheticStackId(logicalId, accountInfo) {
+	const account = accountInfo.fabricated ? SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT : accountInfo.accountId;
+	return `arn:${accountInfo.partition}:cloudformation:${accountInfo.region}:${account}:stack/cdkd-${logicalId}/cdkd`;
 }
 /**
 * `true` when the tail contains at least one line the HANDLER produced.
@@ -18109,11 +18198,29 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* the placeholder `PutObject`'s `withRetry` takes no knob either.
 	*/
 	preDeliveryAuthzMaxRetries = 26;
+	/**
+	* The region the client bag this provider was built from was EXPLICITLY
+	* configured with, or `undefined` (issue #1866).
+	*
+	* Captured in the constructor, beside the clients, rather than read per call:
+	* `cdkd deploy` builds a region-configured `AwsClients` and a fresh
+	* `ProviderRegistry` per stack, and with `--stack-concurrency` (default 4) it
+	* swaps the process-global bag while other stacks are mid-flight — so a
+	* call-time read can hand a SIBLING stack's region. Pairing it with the
+	* clients keeps the two consistent by construction.
+	*
+	* `AwsClients.configuredRegion` is deliberately the only region a client bag
+	* will answer (see its own note on why `client.config.region()` is unsound),
+	* and `undefined` means no region was pinned anywhere — which
+	* {@link getAccountInfo} then resolves from `AWS_REGION` itself.
+	*/
+	configuredRegion;
 	constructor(config) {
 		const awsClients = getAwsClients();
 		this.lambdaClient = awsClients.lambda;
 		this.snsClient = awsClients.sns;
 		this.s3Client = awsClients.s3;
+		this.configuredRegion = awsClients.configuredRegion;
 		this.responseBucket = config?.responseBucket;
 		this.responsePrefix = config?.responsePrefix ?? "custom-resource-responses";
 		this.asyncResponseTimeoutMs = config?.asyncResponseTimeoutMs ?? CustomResourceProvider.DEFAULT_ASYNC_RESPONSE_TIMEOUT_MS;
@@ -18211,6 +18318,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return this.responseClientResolveInFlight;
 	}
 	/**
+	* Resolve {@link syntheticStackId} against this deploy's REAL account /
+	* region / partition (issue #1866).
+	*
+	* `getAccountInfo` never throws — it answers a `fabricated` account when STS
+	* cannot, which {@link SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT} handles — so
+	* this cannot turn a working deploy into a failing one on the credential
+	* path. It is resolved ONCE per `create` / `update` / `delete` rather than
+	* per invocation attempt: the value does not vary between attempts, and the
+	* request builder the retry loop re-runs is synchronous.
+	*/
+	async resolveSyntheticStackId(logicalId) {
+		const accountInfo = await getAccountInfo(this.configuredRegion);
+		if (accountInfo.fabricated) this.logger.warn(`Custom resource ${logicalId}: STS did not report this deploy's account id, so the synthetic StackId handed to the handler carries the placeholder account ${SYNTHETIC_STACK_ID_PLACEHOLDER_ACCOUNT}. A handler that parses StackId to re-derive the account it is running in will not get a usable one — fix the credentials (or set AWS_ACCOUNT_ID) and re-run.`);
+		return syntheticStackId(logicalId, accountInfo);
+	}
+	/**
 	* Create a custom resource by invoking its Lambda handler
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -18225,7 +18348,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResponseURL: invocation.responseURL,
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
 			if (cfnResponse.Status === "FAILED") throw new Error(`Custom resource handler returned FAILED: ${cfnResponse.Reason || "Unknown reason"}`);
@@ -18257,7 +18380,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties),
 				OldResourceProperties: this.stringifyProperties(previousProperties)
 			}));
@@ -18298,7 +18421,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 		}
 		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run \`cdkd import\` or \`cdkd state orphan <stack>\` to recover.`, resourceType, logicalId, physicalId);
 		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
-			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted`);
+			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted and DROPPING its state record. The handler can never run again, so if its teardown was never PROVEN — e.g. an earlier run reported this resource as skipped (issue 2054) — whatever it manages is still LIVE and is now untracked by cdkd. Check for leftovers before treating the stack as gone.`);
 			return;
 		}
 		try {
@@ -18309,13 +18432,19 @@ var CustomResourceProvider = class CustomResourceProvider {
 				ResourceType: resourceType,
 				LogicalResourceId: logicalId,
 				PhysicalResourceId: physicalId,
-				StackId: syntheticStackId(logicalId),
+				StackId: invocation.stackId,
 				ResourceProperties: this.stringifyProperties(properties)
 			}));
-			if (cfnResponse.Status === "FAILED") this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}`);
-			else this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
+			if (cfnResponse.Status === "FAILED") {
+				this.logger.warn(`Custom resource delete handler returned FAILED for ${logicalId}: ${cfnResponse.Reason || "Unknown reason"}. The handler reported that it did NOT delete, so anything this custom resource manages is LEFT IN PLACE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ('cdkd deploy' also accepts --allow-unaddressed, which forces exit 0; 'cdkd destroy' has no such flag.) ${DEPLOY_SKIP_CAVEAT}`);
+				return {
+					outcome: "skipped",
+					reason: CR_DELETE_HANDLER_FAILED_SKIP_REASON
+				};
+			}
+			this.logger.debug(`Successfully deleted custom resource ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record so a re-run can retry it. ${DEPLOY_SKIP_CAVEAT}`);
+			this.logger.warn(`Failed to delete custom resource ${logicalId}, but continuing: ${error instanceof Error ? error.message : String(error)}. The Delete handler did not complete, so anything this custom resource manages may still be LIVE — cdkd is KEEPING the state record and the run exits non-zero. ${CR_SKIP_NOT_A_RETRY_CAVEAT} ${DEPLOY_SKIP_CAVEAT}`);
 			return {
 				outcome: "skipped",
 				reason: CR_DELETE_INVOKE_FAILED_SKIP_REASON
@@ -18391,13 +18520,22 @@ var CustomResourceProvider = class CustomResourceProvider {
 	* PRE-delivery throw is safe to replay at all.
 	*
 	* `buildRequest` is called once per attempt with the fresh invocation so the
-	* CFn request body always carries the matching ResponseURL / RequestId.
+	* CFn request body always carries the matching ResponseURL / RequestId. The
+	* synthetic `StackId` rides the same bag although it is stable across
+	* attempts (issue #1866), for an ORDERING reason rather than a freshness one:
+	* resolving it needs an `await`, and every await before the SIGINT watch
+	* below is installed is a window in which Ctrl-C is dead — `docs/
+	* provider-development.md` requires a new wait site to be interruptible, and
+	* the pre-delivery backoff this method owns is 47.75s long.
+	*
 	* Returns the final response; the caller decides what a terminal FAILED means
-	* (create/update throw, delete warns-and-continues).
+	* (create / update throw; delete warns and returns `'skipped'` — issue
+	* #2054, which replaced its warn-and-continue).
 	*/
 	async invokeCustomResourceWithRetry(serviceToken, logicalId, operation, buildRequest) {
 		const watch = this.startInterruptWatch(logicalId);
 		try {
+			const stackId = await this.resolveSyntheticStackId(logicalId);
 			let preDeliveryRetries = 0;
 			let failedResponseRetries = 0;
 			for (let attempt = 0;; attempt++) {
@@ -18407,7 +18545,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 				let invocation;
 				try {
 					invocation = await this.prepareInvocation(logicalId, watch);
-					const request = buildRequest(invocation);
+					const request = buildRequest({
+						...invocation,
+						stackId
+					});
 					this.logger.debug(`Sending custom resource ${operation.toLowerCase()} request: ${serviceToken}`);
 					const sent = await this.sendRequest(serviceToken, request, invocation.responseKey, logicalId, operation, () => {
 						delivered = true;
@@ -24227,7 +24368,7 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 		eventType: "ROLLBACK_STARTED",
 		stackName
 	});
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
+	const resolver = new ReplayResolvers(ctx.region);
 	const { createOps, otherOps } = partitionOps(operations);
 	for (let i = otherOps.length - 1; i >= 0; i--) {
 		if (options.isInterrupted?.()) {
@@ -24292,6 +24433,21 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * Cognito `client_secret`). Rollback is synth-free, so re-resolve straight from
 * the expression string here.
 *
+* BOTH SIDES OF A DIFF ARE CLASSIFIED, not just the bag that is written, and
+* that is deliberate (issue #2057 review). The `revert` / `--revert-failed`
+* arms call this twice — once for the desired bag and once for the CURRENT /
+* ATTEMPTED one, which only becomes the provider's `previousProperties`. Two
+* things make a wrong-region value there consequential rather than cosmetic:
+* a patch-based provider computes its patch previous-vs-desired, so a wrong
+* previous side can emit a wrong patch or, when both sides carry the same
+* expression and resolve to the same wrong value, silently compute a NO-OP and
+* skip the revert entirely; and every resolved plaintext lands in the SHARED
+* per-op `secrets` map, which is the redaction needle for the state record this
+* op persists, so a foreign-region plaintext mis-redacts that record. In
+* practice both bags carry the SAME expression (state redacts them identically),
+* so scoping the refusal to the written bag would buy a rare case at the cost of
+* a rule nobody could apply by reading one call site.
+*
 * Records each `plaintext -> expression` into `secrets` so the caller can redact
 * the persisted state record back to the expression — the same
 * resolve-for-provider + redact-for-state split the deploy engine applies at its
@@ -24305,28 +24461,365 @@ async function replayRollback(operations, stateResources, stackName, ctx, option
 * `StringList` parameter is public config, stored resolved, and never appears
 * as an expression in the journal.
 */
-async function resolveReplayProps(props, resolver, secrets) {
+async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId) {
 	if (props === void 0) return void 0;
-	const ctx = {
+	const resolverContext = {
 		template: { Resources: {} },
 		resources: {},
 		recordedSecretValues: secrets
 	};
-	const walk = async (v) => {
-		if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, ctx) : v;
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes("{{resolve:")) return v;
+			return await resolveLeafByRegion(v, path, logicalId, execCtx, resolvers, resolverContext);
+		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
-			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i]);
+			for (let i = 0; i < v.length; i++) out[i] = await walk(v[i], `${path}[${i}]`);
 			return out;
 		}
 		if (v !== null && typeof v === "object") {
 			const out = {};
-			for (const [k, val] of Object.entries(v)) out[k] = await walk(val);
+			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
 			return out;
 		}
 		return v;
 	};
-	return await walk(props);
+	return await walk(props, "");
+}
+/**
+* The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
+* therefore the only ones the region question below is asked about: every
+* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
+* exactly when its parameter is a `SecureString` (issue #1901).
+*
+* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
+* because it is public. `ssm-secure` is the live example and is emphatically
+* not public: `resolveDynamicReferences` has no arm for it, so the literal
+* token is passed through to AWS and CloudFormation resolves it SERVER-side.
+* cdkd never holds its value, so there is no region for cdkd to get wrong —
+* which is the only reason it can be waved through here.
+*/
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
+/**
+* Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
+*
+* Mirrors `IntrinsicFunctionResolver.resolveSecretsManagerReference`'s own
+* split — including the END-ANCHORED whole-secret form — because a secret ID
+* may legitimately contain colons (an ARN always does), so `split(':')[1]` is
+* wrong for exactly the shape this file cares about most.
+*/
+function secretsManagerSecretId(inner) {
+	const afterService = inner.substring(15);
+	let stringIdx = afterService.indexOf(":SecretString:");
+	let binaryIdx = afterService.indexOf(":SecretBinary:");
+	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
+	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
+	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
+	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
+}
+/**
+* The parameter name an `{{resolve:ssm:...}}` reference asks for — byte-for-byte
+* what `IntrinsicFunctionResolver.resolveSSMReference` passes as `GetParameter`'s
+* `Name`, which is `parts.slice(1).join(':')` on the colon-split inner body.
+*
+* The whole remainder, deliberately, with NOTHING stripped:
+*
+*  - An SSM dynamic reference CAN name a full ARN. The resolver joins the tail
+*    back together, so `{{resolve:ssm:arn:aws:ssm:us-west-2:111122223333:parameter/db/pw}}`
+*    reaches AWS as that ARN. A `split(':')[1]` here would yield the literal
+*    `'arn'` — a parameter that does not exist — and then report the reference
+*    as region-LESS and refuse it, which is the guess-in-the-other-direction the
+*    `named-region` arm exists to prevent.
+*  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
+*    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
+*    a different thing in the refusal message than the one that would be read.
+*/
+function ssmParameterName(inner) {
+	return inner.substring(4);
+}
+/**
+* The region an ARN names, or `undefined` for anything that is not an ARN with
+* a populated region field (`arn:<partition>:<service>:<region>:...`).
+*/
+function arnRegion(secretId) {
+	if (!secretId.startsWith("arn:")) return void 0;
+	const region = secretId.split(":")[3];
+	return region ? region : void 0;
+}
+/**
+* The producer regions a stack's persisted cross-stack reads name, for
+* {@link RollbackExecutorContext.importedProducerRegions} (issue #2057).
+*
+* Both record kinds count, and for the same reason: each one is a value this
+* stack read out of ANOTHER region's state, so each one is a way a
+* foreign-region `{{resolve:...}}` expression can have reached this stack's own
+* record. `imports` is the strong `Fn::ImportValue` edge; `outputReads` is the
+* weak `Fn::GetStackOutput` one (schema v8), which is the EASIER of the two to
+* point across a region boundary because the reference carries its own
+* `Region` argument.
+*
+* Deduplicated case-insensitively, keeping each region's first-recorded
+* spelling so the refusal message echoes what the user will see in
+* `state.json`. The consumer's own region is deliberately NOT filtered here —
+* {@link classifyReplaySecretRegion} does that, because it is the one that
+* knows which region is asking.
+*
+* Exported so the two `RollbackExecutorContext` construction sites derive the
+* list identically — `cdkd rollback` from the state it loaded, and
+* `DeployEngine.rollbackExecutorContext` from `crossStackReadsForPartialSave`,
+* which unions that snapshot with the reads the failing deploy itself made.
+*/
+function producerRegionsFromState(state) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
+		const canonical = canonicalizeRegion(entry.sourceRegion);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(entry.sourceRegion);
+	}
+	return regions;
+}
+/**
+* Decide which region must answer for a single `{{resolve:...}}` expression a
+* rollback replay is about to re-resolve — issue
+* [#2057](https://github.com/go-to-k/cdkd/issues/2057).
+*
+* WHY A REPLAY CAN BE HOLDING A FOREIGN REGION'S EXPRESSION AT ALL. Since
+* issue #1934 a cross-stack consumer re-resolves a redacted producer value in
+* the PRODUCER's region (`reresolveCrossStackValue` /
+* `resolverForProducerRegion`) — correct, because a Secrets Manager secret or
+* an SSM `SecureString` of the same NAME in two regions is two independent
+* values. The plaintext is then recorded into the CONSUMER's
+* `recordedSecretValues`, so the consumer's `state.json` (and from there the
+* rollback journal) persists the PRODUCER's spelling of the expression. That is
+* the right thing to persist, and it is region-less: the reader cannot tell
+* from the string which region produced it.
+*
+* The replay rebuilds its resolver from the CONSUMER's region alone, so
+* re-resolving that expression locally answers from a same-named secret in the
+* wrong region and writes it to a LIVE resource. Silent, and on the recovery
+* path. The rule applied here is the family's, from issue #1957: A NAMED REGION
+* BINDS; NEVER SUBSTITUTE A GUESS. The three verdicts are that one sentence:
+*
+*  - **`named-region`** — the expression's SECRET_ID is an ARN, which names its
+*    own region. The region is ESTABLISHED, so it binds: the caller resolves
+*    through a resolver pinned to it ({@link ReplayResolvers.forRegion}) rather
+*    than refusing. Refusing here would be the guess in the other direction.
+*
+*    cdkd would otherwise get this wrong, which is why the arm exists at all:
+*    `resolveSecretsManagerReference` builds its client from
+*    `this.explicitRegion` and passes the ARN through as an opaque `SecretId`,
+*    and `@aws-sdk/client-secrets-manager`'s endpoint ruleset has NO
+*    ARN-derived endpoint rule (unlike, say, S3 access points), so a
+*    foreign-region ARN is sent to the stack's own regional endpoint. What the
+*    SERVICE then does with it is not something this repo can settle offline —
+*    see the fixture note in
+*    `tests/integration/rollback-cross-region-secret/README.md`. Pinning the
+*    client to the ARN's region is correct either way: if Secrets Manager would
+*    have refused the foreign ARN, this turns a hard failure into a correct
+*    resolution; if it would have honoured it, this reaches the same value by
+*    the documented route. Neither outcome is a regression.
+*
+*  - **`ambiguous`** — the expression names no region (the plain name form) AND
+*    this stack has a foreign producer region on record
+*    ({@link RollbackExecutorContext.importedProducerRegions}). Nothing on hand
+*    can establish the origin, so the replay refuses instead of guessing.
+*
+*    KNOWN OVER-REFUSAL, accepted deliberately, and WIDER THAN THE SSM CASE
+*    ALONE — state both, because the second one is the common shape:
+*
+*    (a) Any NAME-FORM `secretsmanager` reference in a stack that has ANY
+*    foreign producer region on record is refused, even when that secret is
+*    the stack's own purely-local one and has nothing to do with the
+*    cross-region read. The evidence is per-STACK, not per-reference, so one
+*    cross-region export plus one ordinary
+*    `{{resolve:secretsmanager:mysecret:SecretString:pw}}` is enough — and CDK's
+*    `secretValueFromJson` emits exactly that name form, so this is the shape
+*    most people will meet. It also persists: with the union the producer
+*    region stays on record until the next SUCCESSFUL deploy. Per-reference
+*    evidence is what would narrow it, and that needs the region recorded
+*    ALONGSIDE the expression — the persisted-shape change issue #2057
+*    deliberately deferred (its options 1 and 2). Until then the refusal is
+*    loud, names the ARN spelling as the remedy, and is the fail-closed side
+*    of a trade whose other side is a silent wrong-secret write.
+*
+*    (b) An `ssm` reference is secret only when its parameter is a
+*    `SecureString`, and this arm cannot tell. So a `{{resolve:ssm:/app/env}}`
+*    naming a PUBLIC `String` that reached a persisted bag (issue #2036's
+*    acknowledged over-redaction) is refused too. Narrowing it by
+*    `isRecordedSecretExpression` was considered and REJECTED, and not because
+*    the store is unreachable — it is imported by this very file. It is
+*    unusable: `recordedSecretExpressions` is populated BY resolution, and in
+*    the standalone `cdkd rollback` process nothing has resolved anything when
+*    the first op is classified, so the store is empty and every `ssm` verdict
+*    would come back "not secret" — turning the protection off for exactly the
+*    SecureString case it exists for. Worse, once one op DID resolve a
+*    reference the store would be warm for the next, so the verdict would
+*    depend on OP ORDER. A resolve-the-type-first probe is unsound for the
+*    same reason the whole issue exists: the TYPE is region-dependent (#1957),
+*    so probing locally can report `String` for a name that is `SecureString`
+*    in the producer's region and wave through the very write this refuses.
+*    The residual is therefore a loud, actionable error on a narrow
+*    intersection (an over-redacted public ssm reference AND a cross-region
+*    read on record), which is the fail-closed side of the trade.
+*
+*  - **`local`** — everything else, which is the overwhelmingly common case:
+*    every non-secret service, every same-region ARN (the ordinary CDK
+*    `secretValueFromJson` shape), and every name-form expression in a stack
+*    with no foreign producer region recorded. Resolved exactly as before this
+*    change.
+*
+* A same-region ARN answers `local` even when a foreign producer region IS on
+* record: the expression settles the question itself, so the weaker evidence
+* never gets consulted.
+*/
+function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
+	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
+	if (inner === void 0) return { kind: "local" };
+	const service = inner.split(":")[0];
+	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return { kind: "local" };
+	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
+	if (!secretName) return { kind: "local" };
+	const named = arnRegion(secretName);
+	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "named-region",
+		secretName,
+		region: named
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const foreignProducerRegions = [];
+	for (const candidate of importedProducerRegions ?? []) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreignProducerRegions.push(candidate);
+	}
+	if (foreignProducerRegions.length === 0) return { kind: "local" };
+	return {
+		kind: "ambiguous",
+		secretName,
+		foreignProducerRegions
+	};
+}
+/**
+* The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
+* region an ARN-named reference asks for (issue #2057).
+*
+* One instance per replay, not per op — the resolved-value cache lives on the
+* resolver INSTANCE since issue #1933, so a resolver per op would re-fetch every
+* referenced secret once per op. The pinned siblings are cached here for the
+* same reason: a 100-op replay of a bag carrying one foreign ARN must pay one
+* `GetSecretValue`, not a hundred.
+*
+* A pinned sibling is a PLAIN resolver, deliberately NOT the resolver class's
+* own `producerRegionGuest` (which the class sets on the siblings
+* `resolverForProducerRegion` builds, to stop a foreign region pinning a verdict
+* in the process-global `recordedSecretExpressions` store — the issue #1933
+* shape, where an `ssm` parameter whose TYPE differs by region has one region's
+* verdict decide the other's redaction).
+*
+* WHY A GUEST FLAG IS NOT NEEDED HERE, and the argument has to be this one
+* rather than "only `secretsmanager` routes to a sibling" (that earlier claim
+* was FALSE — `resolveSSMReference` joins its colon-split tail back together, so
+* an `ssm` reference CAN name a full ARN and CAN therefore route here):
+*
+*   {@link ReplayResolvers.forRegion} is reached ONLY from a `named-region`
+*   verdict, which `classifyReplaySecretRegion` returns only when the
+*   SECRET_ID / parameter name starts with `arn:` and carries a region. So a
+*   pinned sibling only ever resolves an expression whose KEY EMBEDS THE
+*   REGION IT IS BEING RESOLVED IN.
+*
+* The store is keyed by the expression string alone, and that is exactly what
+* makes #1933 possible: two regions sharing one key. An ARN-form key cannot be
+* shared by two regions, so a verdict pinned from a sibling can never contradict
+* another region's for the same key. If a future change ever routes a
+* region-LESS expression to `forRegion`, this argument dies with it and the
+* sibling needs the guest flag.
+*/
+var ReplayResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* The refusal an `ambiguous` replay reference throws (issue #2057).
+*
+* A plain throw, like the final-snapshot refusals above and for the same
+* reason: the per-op catch in {@link replaySingle} /
+* {@link replayFailedOperations} counts it as a failure, which keeps the
+* journal segment and lets the user re-run once the reference is disambiguated.
+* Refusing is strictly better than the alternative it replaces — resolving a
+* producer-region reference against the consumer's region does not fail, it
+* succeeds with the WRONG credential and writes it to a resource that is live.
+*
+* Names the reference, the regions, and the remedy. Never the resolved value:
+* nothing here has resolved anything yet, and the expression is the same string
+* `state.json` already stores in the clear.
+*/
+function regionAmbiguousReplaySecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
+	return new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} cannot re-resolve the secret reference '${secretName}': the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so replaying this would write the WRONG secret to a live resource. Refusing instead. Resolve the reference in its own region and set the property directly (or spell it as a full ARN, which names its region and is resolved there), then re-run 'cdkd rollback'.`, "ROLLBACK_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
+* the region {@link classifyReplaySecretRegion} says must answer (issue #2057).
+*
+* Refuses FIRST, over the whole leaf, before any reference is fetched: a leaf
+* can splice several references together, and resolving the safe ones first
+* would leave half a credential fetched (and cached, and recorded as a
+* redaction needle) for an op that is about to be refused anyway.
+*
+* Then TWO paths, and the split is deliberate rather than an optimisation:
+*
+*  - With no foreign-region reference — every leaf on every existing code path
+*    — the leaf goes to `resolveDynamicReferences` WHOLE, exactly as before this
+*    change. That method has its own well-tested substitution semantics (it
+*    collects matches from the ORIGINAL string, so a resolved plaintext that is
+*    itself token-shaped is never re-resolved — issue #1917), and this change
+*    does not want to relitigate any of it.
+*  - With one, the leaf is rebuilt segment by segment so each reference can be
+*    resolved by its OWN region's resolver. `resolveDynamicReferences` resolves
+*    every token in the string it is handed with the one resolver it is called
+*    on, so a mixed leaf cannot be served by a single call. Each token is
+*    resolved ALONE and its result concatenated, which means no resolved value
+*    is ever re-scanned for tokens either.
+*
+* `dynamicReferenceTokens` returns the tokens in order and non-overlapping, so
+* walking the leaf with a moving `indexOf` cursor reproduces their positions
+* exactly, duplicates included.
+*/
+async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resolvers, resolverContext) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, execCtx.region, execCtx.importedProducerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousReplaySecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, execCtx.region);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, resolverContext);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new CdkdError(`Rollback of ${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`} could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${execCtx.region}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "ROLLBACK_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		out += await resolver.resolveDynamicReferences(token, resolverContext);
+		cursor = at + token.length;
+	}
+	return out + leaf.slice(cursor);
 }
 /**
 * Redact resolved secret plaintext back out of a post-rollback state record
@@ -24650,7 +25143,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 			case "reverse-replacement": {
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
-				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets) ?? {};
+				const resolvedPrevProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId) ?? {};
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — re-creating the old resource and deleting the new one`);
 				if (STATEFUL_TYPES.has(op.resourceType)) logger.warn(`  ⚠ ${op.logicalId} (${op.resourceType}) is a stateful type — the old physical resource's data was destroyed by the replacement and CANNOT be recovered; the re-created resource starts empty.`);
 				const { provider: createProvider } = ctx.providerRegistry.getProviderFor({
@@ -24742,8 +25235,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: op.provisionedBy
 				});
-				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets);
-				const currentProps = await resolveReplayProps(current.properties, resolver, secrets);
+				const desiredProps = await resolveReplayProps(previousState.properties, resolver, secrets, ctx, op.logicalId);
+				const currentProps = await resolveReplayProps(current.properties, resolver, secrets, ctx, op.logicalId);
 				const revertResult = await updateWithRollbackRetry(provider, [
 					op.logicalId,
 					current.physicalId,
@@ -24803,7 +25296,7 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 		remainingFailedOps: []
 	};
 	const { logger } = ctx;
-	const resolver = new IntrinsicFunctionResolver(ctx.region);
+	const resolver = new ReplayResolvers(ctx.region);
 	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
 	if (emitEnvelope) ctx.recordEvent?.({
 		eventType: "ROLLBACK_STARTED",
@@ -24894,8 +25387,8 @@ async function replayFailedOperations(failedOps, stateResources, stackName, ctx,
 						resourceType: op.resourceType,
 						provisionedBy: op.provisionedBy ?? current.provisionedBy
 					});
-					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets);
-					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets);
+					const desiredProps = await resolveReplayProps(prev.properties, resolver, secrets, ctx, op.logicalId);
+					const attemptedProps = await resolveReplayProps(op.attemptedProperties ?? current.properties, resolver, secrets, ctx, op.logicalId);
 					const revertFailedResult = await updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
@@ -25033,7 +25526,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.22";
+	return "0.284.24";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25583,6 +26076,92 @@ function deepEqualValue(a, b) {
 	}
 	return true;
 }
+/**
+* The `imports` / `outputReads` records to persist on a save that is NOT the
+* final success save — the UNION of the pre-deploy snapshot and what THIS
+* session resolved (issue
+* [#2057](https://github.com/go-to-k/cdkd/issues/2057) review).
+*
+* Every non-success save used to write `currentState.imports` /
+* `currentState.outputReads` verbatim, i.e. the PRE-DEPLOY snapshot, while
+* writing the POST-deploy `newResources` beside it. So a deploy that
+* introduced a cross-stack read and then failed persisted resources built FROM
+* that read next to a record that does not mention it. Two consequences, and
+* only the first is about #2057:
+*
+*  1. A rollback journal exists only after a FAILED deploy, so
+*     {@link producerRegionsFromState} saw an empty list on exactly the deploy
+*     that introduces a cross-region secret read — and
+*     `classifyReplaySecretRegion` answered `local`, resolving the producer's
+*     region-less expression in the consumer's region. The refusal was inert
+*     where it mattered most.
+*  2. INDEPENDENT PRE-EXISTING BUG. `state.imports[]` is what
+*     `findActiveImportConsumers` (`src/cli/commands/destroy-runner.ts`) scans
+*     to refuse destroying a producer while a consumer still imports from it,
+*     and `state.outputReads[]` is what `findDownstreamConsumers`
+*     (`src/cli/commands/recreate-downstream-consumers.ts`) enumerates. A
+*     failed deploy therefore silently DOWNGRADED a fresh strong reference to
+*     no reference: the consumer's resource is live and recorded, its import is
+*     not, and `cdkd destroy` on the producer sails through the strong-ref
+*     pre-flight. This exists on main today, with or without #2057.
+*
+* DIRECTION OF THE RESIDUAL, stated rather than left to be discovered: a union
+* never drops a record, so a stack that STOPS reading across a region keeps the
+* stale entry until its next SUCCESSFUL deploy, whose save replaces the list
+* wholesale (`imports: [...this.recordedImports]`). Until then a purely-local
+* rollback can be refused on the strength of a read the template no longer has.
+* That is the fail-closed side — a clear error naming the region to reconcile,
+* versus a silent wrong-secret write — and the same asymmetry already justifies
+* preserving the snapshot at all (dropping it would strip a live strong-ref
+* record on every diff-clean deploy).
+*
+* THE RULE IS "EVERY SAVE EXCEPT THE TERMINAL SUCCESS ONE", and it is stated
+* that way rather than as "every non-success save" because the latter is loose
+* in both directions: the diff-clean no-change save in `doDeploy` is a SUCCESS
+* outcome and unions anyway (nothing was re-resolved, so the union is an
+* identity there and one rule beats an exception), while
+* `persistStateAfterOutputFailure` looks like a success save — provisioning
+* was clean — and is not one.
+*
+* THE ENUMERATION IS NOT KEPT HERE, DELIBERATELY. Two prose counts in this
+* lane were measured wrong (an "ALL FIVE" that missed
+* `persistStateAfterOutputFailure`, and a "three post-rollback saves" that is
+* two), and each wrong count is worse than none: it is the sentence a reader
+* uses to conclude the rule is already applied everywhere.
+* `tests/unit/deployment/deploy-engine-cross-stack-read-writers.test.ts`
+* derives the set instead — it SCANS this file for every `imports:` /
+* `outputReads:` object key that writes a VALUE and fails on any that is not
+* the one allow-listed success-path write, with a positive control proving the
+* scan can see a violation. A save site added here fails that test rather than
+* escaping silently, so the authority on "where is this applied" is a grep the
+* test performs, not a number anybody has to maintain.
+*/
+function crossStackReadsForPartialSave(previous, recordedImports, recordedOutputReads) {
+	const imports = unionCrossStackReads(previous.imports, recordedImports, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.exportName}`);
+	const outputReads = unionCrossStackReads(previous.outputReads, recordedOutputReads, (e) => `${e.sourceStack}\u0000${canonicalizeRegion(e.sourceRegion)}\u0000${e.outputName}`);
+	return {
+		...imports.length > 0 && { imports },
+		...outputReads.length > 0 && { outputReads }
+	};
+}
+/**
+* Concatenate two cross-stack-read lists, dropping a later duplicate of an
+* identity an earlier entry already carries. First-seen wins, so the PRE-DEPLOY
+* spelling of a region survives — entries are COMPARED on a canonicalized
+* region but STORED verbatim, mirroring `producerRegionsFromState`.
+*/
+function unionCrossStackReads(previous, recorded, identity) {
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const entry of [...previous ?? [], ...recorded]) {
+		if (entry === null || typeof entry !== "object") continue;
+		const key = identity(entry);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		out.push(entry);
+	}
+	return out;
+}
 var DeployEngine = class {
 	logger = getLogger().child("DeployEngine");
 	resolver;
@@ -26128,8 +26707,7 @@ var DeployEngine = class {
 							stackName: currentState.stackName,
 							resources: currentState.resources,
 							outputs: outputsChanged ? resolvedOutputs : persistedOutputs,
-							...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-							...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+							...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 							lastModified: Date.now()
 						};
 						const saveOptions = {};
@@ -26247,8 +26825,7 @@ var DeployEngine = class {
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
-						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-						...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
 					const migrate = pendingMigration;
@@ -26378,8 +26955,7 @@ var DeployEngine = class {
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
-					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-					...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
 				const migrate = pendingMigration;
@@ -26405,7 +26981,7 @@ var DeployEngine = class {
 				this.logger.warn("Partial state has been saved. Run 'cdkd deploy' to resume, 'cdkd rollback' to revert, or destroy to clean up.");
 			} else {
 				await this.writeRollbackJournalSegment(stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
-				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName)).failures === 0;
+				autoRollbackClean = (await this.performRollback(completedOperations, newResources, stackName, currentState)).failures === 0;
 			}
 			try {
 				const postRollbackState = {
@@ -26414,8 +26990,7 @@ var DeployEngine = class {
 					stackName: currentState.stackName,
 					resources: newResources,
 					outputs: currentState.outputs,
-					...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-					...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+					...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 					lastModified: Date.now()
 				};
 				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...currentEtag !== void 0 && { expectedEtag: currentEtag } });
@@ -26431,8 +27006,7 @@ var DeployEngine = class {
 						stackName: currentState.stackName,
 						resources: newResources,
 						outputs: currentState.outputs,
-						...currentState.imports && currentState.imports.length > 0 && { imports: currentState.imports },
-						...currentState.outputReads && currentState.outputReads.length > 0 && { outputReads: currentState.outputReads },
+						...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 						lastModified: Date.now()
 					};
 					await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(postRollbackState), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
@@ -26497,8 +27071,7 @@ var DeployEngine = class {
 			stackName: currentState.stackName,
 			resources: newResources,
 			outputs: currentState.outputs,
-			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
-			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
+			...crossStackReadsForPartialSave(currentState, this.recordedImports, this.recordedOutputReads),
 			lastModified: Date.now()
 		});
 		try {
@@ -26525,8 +27098,8 @@ var DeployEngine = class {
 	* command drives identical semantics). Thin wrapper that builds the
 	* executor context from the engine's collaborators and delegates.
 	*/
-	async performRollback(completedOperations, stateResources, stackName) {
-		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext());
+	async performRollback(completedOperations, stateResources, stackName, previousState) {
+		const result = await replayRollback(completedOperations, stateResources, stackName, this.rollbackExecutorContext(previousState));
 		return {
 			failures: result.failures,
 			warnings: result.warnings
@@ -26585,14 +27158,15 @@ var DeployEngine = class {
 		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, run 'cdkd rollback ${stackName} --revert-failed' to revert it.`);
 	}
 	/** Build the {@link RollbackExecutorContext} from the engine's fields. */
-	rollbackExecutorContext() {
+	rollbackExecutorContext(previousState) {
 		return {
 			providerRegistry: this.providerRegistry,
 			region: this.stackRegion,
 			logger: this.logger,
 			recordEvent: (event) => this.recordEvent(event),
 			finalSnapshotClients: this.options.finalSnapshotClients,
-			skipFinalSnapshot: this.options.skipFinalSnapshot
+			skipFinalSnapshot: this.options.skipFinalSnapshot,
+			importedProducerRegions: producerRegionsFromState(crossStackReadsForPartialSave(previousState, this.recordedImports, this.recordedOutputReads))
 		};
 	}
 	/**
@@ -27572,5 +28146,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { isTerminationProtectionPropagationError as $, PartialFailureError as $n, getBootstrapMarkerKey as $t, renderStatefulReason as A, expectedOwnerParam as An, applyRoleArnIfSet as At, exportAliasCollisionScrubWarning as B, resetAwsClients as Bn, shouldRetainResource as Bt, isFinalSnapshotError as C, stateBucketExistenceConfirmed as Cn, redactSecretsForState as Ct, extractDeploymentEventError as D, MIGRATE_TMP_PREFIX as Dn, s3BucketDualStackDomainName as Dt, makeCanonicalizePropertiesFn as E, CFN_TEMPLATE_URL_LIMIT as En, s3BucketDomainName as Et, green as F, processStackMessages as Fn, DagBuilder as Ft, collectInlinePolicyNamesManagedBySiblings as G, DependencyError as Gn, createAssetRedirectResolver as Gt, secretBearingStateKeyWarning as H, AssetError as Hn, stringifyValue as Ht, red as I, clearBucketRegionCache as In, TemplateParser as It, findActionableSilentDrops as J, LocalMigrateError as Jn, escapeRegExp$1 as Jt, clearOnUpdateRemoval as K, DeployCancelledError as Kn, loadPublishableAssetManifest as Kt, yellow as L, resolveBucketRegion as Ln, LockManager as Lt, bold as M, canonicalizeRegion as Mn, INTRINSIC_KEYS as Mt, cyan as N, derivePartitionAndUrlSuffix as Nn, describeTypeWithThrottleRetry as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, findLargeInlineResources as On, s3BucketRegionalDomainName as Ot, gray as P, AssemblyReader as Pn, withRetry as Pt, disableInstanceApiTermination as Q, NestedStackChildDirectDestroyError as Qn, ensureAssetStorage as Qt, collectDeclaredOutputNames as R, AwsClients as Rn, S3StateBackend as Rt, createPreDeleteFinalSnapshot as S, resolveUseCdkBootstrapAssets as Sn, maskSecretsInText as St, unsupportedFinalSnapshotError as T, CFN_TEMPLATE_BODY_LIMIT as Tn, s3BucketArn as Tt, stateKeySecretExposure as U, CdkdError as Un, WorkGraph as Ut, isExportAliasCollision as V, setAwsClients as Vn, AssetPublisher as Vt, IAMRoleProvider as W, ConfigError as Wn, buildAssetRedirectMap as Wt, CloudControlProvider as X, LockError as Xn, AssetModeResolver as Xt, findSilentDropProperties as Y, LocalStartServiceError as Yn, stripControlChars as Yt, slowCcOperationTimeoutMs as Z, MissingCdkCliError as Zn, BOOTSTRAP_MARKER_PREFIX as Zt, computeImplicitDeleteEdges as _, resolveAutoAssetStorage as _n, STATE_SOURCED_READBACK_RULES as _t, DeploymentEventsStore as a, buildDockerImage as an, StateError as ar, normalizeAwsTagsToCfn as at, buildFinalSnapshotIdentifier as b, resolveStateBucketWithDefault as bn, dynamicReferenceTokens as bt, replayFailedOperations as c, runDockerForeground as cn, isCdkdError as cr, coerceCfnBoolean as ct, updatePartialReason as d, getDockerImageBySourceHash as dn, isMarkedNonRetryable as dr, readConfigString as dt, parseBootstrapMarker as en, ProvisioningError as er, IntrinsicFunctionResolver as et, UNSPECIFIED_SKIP_REASON as f, Synthesizer as fn, isRetryableTransientError as fr, replayWarn as ft, IMPLICIT_DELETE_DEPENDENCIES as g, resolveApp as gn, STATE_SOURCED_CROSS_GENERATION_RULES as gt, maskingRetryLogger as h, getLegacyStateBucketName as hn, __exportAll as hr, requireConfigString as ht, DeploymentEventsReader as i, buildDenyExternalAccessPolicy as in, StackTerminationProtectionError as ir, WAFv2WebACLProvider as it, formatResourceLine as j, PARTITION_TABLE as jn, DiffCalculator as jt, isStatefulRecreateTargetSync as k, uploadCfnTemplate as kn, s3BucketWebsiteUrl as kt, replayRollback as l, runDockerStreaming as ln, normalizeAwsError as lr, configBooleanRefusal as lt, withResourceDeadline as m, getDefaultStateBucketName as mn, markNonRetryable as mr, requireConfigObject as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, validateAssetBucketName as nn, ResourceUpdateNotSupportedError as nr, getAccountInfo as nt, planFailedOps as o, formatDockerLoginError as on, SynthesisError as or, resolveExplicitPhysicalId as ot, deleteSkipReason as p, synthesisStatusMessage as pn, isThrottlingError as pr, requireConfigArray as pt, ProviderRegistry as q, LocalInvokeBuildError as qn, rewriteTemplateAssetReferences as qt, DeployEngine as r, validateContainerRepoName as rn, StackHasActiveImportsError as rr, refStateLookupFromResource as rt, planRollback as s, getDockerCmd as sn, formatError as sr, assertRegionMatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, readBootstrapMarkerBody as tn, ResourceTimeoutError as tr, cfnRefValueFromPhysicalId as tt, updatePartialMessage as u, AssetManifestLoader as un, withErrorHandling as ur, configStringRefusal as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, resolveCaptureObservedState as vn, TEMPLATE_SOURCED_RULES as vt, refusesFinalSnapshot as w, warnDeprecatedNoPrefixCliFlag as wn, scrubResourceRecord as wt, ccRoutedFinalSnapshotError as x, resolveStateBucketWithDefaultAndSource as xn, isSingleDynamicReferenceToken as xt, PRE_DELETE_SNAPSHOT_TYPES as y, resolveSkipPrefix as yn, createSecretMasker as yt, collectPublishedOutputNames as z, getAwsClients as zn, rebuildClientForBucketRegion as zt };
-//# sourceMappingURL=deploy-engine-DOlhIeGv.js.map
+export { disableInstanceApiTermination as $, NestedStackChildDirectDestroyError as $n, ensureAssetStorage as $t, isStatefulRecreateTargetSync as A, uploadCfnTemplate as An, s3BucketWebsiteUrl as At, collectPublishedOutputNames as B, getAwsClients as Bn, rebuildClientForBucketRegion as Bt, createPreDeleteFinalSnapshot as C, resolveUseCdkBootstrapAssets as Cn, maskSecretsInText as Ct, makeCanonicalizePropertiesFn as D, CFN_TEMPLATE_URL_LIMIT as Dn, s3BucketDomainName as Dt, unsupportedFinalSnapshotError as E, CFN_TEMPLATE_BODY_LIMIT as En, s3BucketArn as Et, gray as F, AssemblyReader as Fn, withRetry as Ft, IAMRoleProvider as G, ConfigError as Gn, buildAssetRedirectMap as Gt, isExportAliasCollision as H, setAwsClients as Hn, AssetPublisher as Ht, green as I, processStackMessages as In, DagBuilder as It, ProviderRegistry as J, LocalInvokeBuildError as Jn, rewriteTemplateAssetReferences as Jt, collectInlinePolicyNamesManagedBySiblings as K, DependencyError as Kn, createAssetRedirectResolver as Kt, red as L, clearBucketRegionCache as Ln, TemplateParser as Lt, formatResourceLine as M, PARTITION_TABLE as Mn, DiffCalculator as Mt, bold as N, canonicalizeRegion as Nn, INTRINSIC_KEYS as Nt, extractDeploymentEventError as O, MIGRATE_TMP_PREFIX as On, s3BucketDualStackDomainName as Ot, cyan as P, derivePartitionAndUrlSuffix as Pn, describeTypeWithThrottleRetry as Pt, slowCcOperationTimeoutMs as Q, MissingCdkCliError as Qn, BOOTSTRAP_MARKER_PREFIX as Qt, yellow as R, resolveBucketRegion as Rn, LockManager as Rt, ccRoutedFinalSnapshotError as S, resolveStateBucketWithDefaultAndSource as Sn, isSingleDynamicReferenceToken as St, refusesFinalSnapshot as T, warnDeprecatedNoPrefixCliFlag as Tn, scrubResourceRecord as Tt, secretBearingStateKeyWarning as U, AssetError as Un, stringifyValue as Ut, exportAliasCollisionScrubWarning as V, resetAwsClients as Vn, shouldRetainResource as Vt, stateKeySecretExposure as W, CdkdError as Wn, WorkGraph as Wt, findSilentDropProperties as X, LocalStartServiceError as Xn, stripControlChars as Xt, findActionableSilentDrops as Y, LocalMigrateError as Yn, escapeRegExp$1 as Yt, CloudControlProvider as Z, LockError as Zn, AssetModeResolver as Zt, IMPLICIT_DELETE_DEPENDENCIES as _, resolveApp as _n, STATE_SOURCED_CROSS_GENERATION_RULES as _t, DeploymentEventsStore as a, buildDenyExternalAccessPolicy as an, StackTerminationProtectionError as ar, WAFv2WebACLProvider as at, PRE_DELETE_SNAPSHOT_TYPES as b, resolveSkipPrefix as bn, createSecretMasker as bt, producerRegionsFromState as c, getDockerCmd as cn, formatError as cr, assertRegionMatch as ct, updatePartialMessage as d, AssetManifestLoader as dn, withErrorHandling as dr, configStringRefusal as dt, getBootstrapMarkerKey as en, PartialFailureError as er, isTerminationProtectionPropagationError as et, updatePartialReason as f, getDockerImageBySourceHash as fn, isMarkedNonRetryable as fr, readConfigString as ft, maskingRetryLogger as g, getLegacyStateBucketName as gn, __exportAll as gr, requireConfigString as gt, withResourceDeadline as h, getDefaultStateBucketName as hn, markNonRetryable as hr, requireConfigObject as ht, DeploymentEventsReader as i, validateContainerRepoName as in, StackHasActiveImportsError as ir, refStateLookupFromResource as it, renderStatefulReason as j, expectedOwnerParam as jn, applyRoleArnIfSet as jt, MULTI_REGION_RECREATE_BLOCKED_TYPES as k, findLargeInlineResources as kn, s3BucketRegionalDomainName as kt, replayFailedOperations as l, runDockerForeground as ln, isCdkdError as lr, coerceCfnBoolean as lt, deleteSkipReason as m, synthesisStatusMessage as mn, isThrottlingError as mr, requireConfigArray as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, readBootstrapMarkerBody as nn, ResourceTimeoutError as nr, cfnRefValueFromPhysicalId as nt, planFailedOps as o, buildDockerImage as on, StateError as or, normalizeAwsTagsToCfn as ot, UNSPECIFIED_SKIP_REASON as p, Synthesizer as pn, isRetryableTransientError as pr, replayWarn as pt, clearOnUpdateRemoval as q, DeployCancelledError as qn, loadPublishableAssetManifest as qt, DeployEngine as r, validateAssetBucketName as rn, ResourceUpdateNotSupportedError as rr, getAccountInfo as rt, planRollback as s, formatDockerLoginError as sn, SynthesisError as sr, resolveExplicitPhysicalId as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, parseBootstrapMarker as tn, ProvisioningError as tr, IntrinsicFunctionResolver as tt, replayRollback as u, runDockerStreaming as un, normalizeAwsError as ur, configBooleanRefusal as ut, computeImplicitDeleteEdges as v, resolveAutoAssetStorage as vn, STATE_SOURCED_READBACK_RULES as vt, isFinalSnapshotError as w, stateBucketExistenceConfirmed as wn, redactSecretsForState as wt, buildFinalSnapshotIdentifier as x, resolveStateBucketWithDefault as xn, dynamicReferenceTokens as xt, ATOMIC_FINAL_SNAPSHOT_TYPES as y, resolveCaptureObservedState as yn, TEMPLATE_SOURCED_RULES as yt, collectDeclaredOutputNames as z, AwsClients as zn, S3StateBackend as zt };
+//# sourceMappingURL=deploy-engine-BJQbni1s.js.map