@go-to-k/cdkd 0.284.26 → 0.284.28

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-DNCs229s.js";
+import { $ as endCommandInterruptScope, $n as LocalInvokeBuildError$1, $t as rewriteTemplateAssetReferences, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as warnDeprecatedNoPrefixCliFlag, At as scrubResourceRecord, B as collectDeclaredOutputNames, Bn as AssemblyReader, Bt as withRetry, C as ccRoutedFinalSnapshotError, Cn as resolveAutoAssetStorage, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveStateBucketWithDefaultAndSource, Dt as isSingleDynamicReferenceToken, E as refusesFinalSnapshot, En as resolveStateBucketWithDefault, Et as dynamicReferenceTokens, F as cyan, Fn as uploadCfnTemplate, Ft as s3BucketWebsiteUrl, G as stateKeySecretExposure, Gn as getAwsClients, Gt as rebuildClientForBucketRegion, H as exportAliasCollisionScrubWarning, Ht as TemplateParser, I as gray, In as expectedOwnerParam, It as applyRoleArnIfSet, J as clearOnUpdateRemoval, Jt as stringifyValue, K as IAMRoleProvider, Kn as resetAwsClients, Kt as shouldRetainResource, L as green, Ln as PARTITION_TABLE, Lt as DiffCalculator, M as renderStatefulReason, Mn as CFN_TEMPLATE_URL_LIMIT, Mt as s3BucketDomainName, N as formatResourceLine, Nn as MIGRATE_TMP_PREFIX, Nt as s3BucketDualStackDomainName, O as makeCanonicalizePropertiesFn, On as resolveUseCdkBootstrapAssets, Ot as maskSecretsInText, P as bold, Pn as findLargeInlineResources, Pt as s3BucketRegionalDomainName, Q as beginCommandInterruptScope, Qn as DeployCancelledError, Qt as loadPublishableAssetManifest, R as red, Rn as canonicalizeRegion, Rt as INTRINSIC_KEYS, S as buildFinalSnapshotIdentifier, Sn as resolveApp, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveSkipPrefix, Tt as createSecretMasker, U as isExportAliasCollision, Un as resolveBucketRegion, Ut as LockManager, V as collectPublishedOutputNames, Vn as processStackMessages, Vt as DagBuilder, W as secretBearingStateKeyWarning, Wn as AwsClients, Wt as S3StateBackend, X as findActionableSilentDrops, Xt as buildAssetRedirectMap, Y as ProviderRegistry, Yn as CdkdError, Yt as WorkGraph, Z as findSilentDropProperties, Zt as createAssetRedirectResolver, _ as maskingRetryLogger, _n as getDockerImageBySourceHash, _r as isMarkedNonRetryable, _t as readConfigString, a as DeploymentEventsStore, an as getBootstrapMarkerKey, ar as PartialFailureError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as getDefaultStateBucketName, br as markNonRetryable, bt as requireConfigObject, c as planRollback, cn as validateAssetBucketName, cr as ResourceUpdateNotSupportedError, ct as getAccountInfo, d as replayRollback, dn as buildDockerImage, dt as normalizeAwsTagsToCfn, en as escapeRegExp, er as LocalMigrateError, et as isInterruptedWaitError, f as updatePartialMessage, fn as formatDockerLoginError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as AssetManifestLoader, gr as withErrorHandling, gt as configStringRefusal, h as deleteSkipReason, hn as runDockerStreaming, hr as normalizeAwsError, ht as configBooleanRefusal, i as DeploymentEventsReader, in as ensureAssetStorage, ir as NestedStackChildDirectDestroyError, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as CFN_TEMPLATE_BODY_LIMIT, jt as s3BucketArn, k as extractDeploymentEventError, kn as stateBucketExistenceConfirmed, kt as redactSecretsForState, l as producerRegionsFromState, ln as validateContainerRepoName, lr as StackHasActiveImportsError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as runDockerForeground, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssetModeResolver, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as parseBootstrapMarker, or as ProvisioningError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as getDockerCmd, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as setAwsClients, qt as AssetPublisher, r as DeployEngine, rn as BOOTSTRAP_MARKER_PREFIX, rr as MissingCdkCliError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as readBootstrapMarkerBody, sr as ResourceTimeoutError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stripControlChars, tr as LocalStartServiceError, tt as startInterruptWatch, u as replayFailedOperations, un as buildDenyExternalAccessPolicy, ur as StackTerminationProtectionError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as Synthesizer, vr as isRetryableTransientError, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveCaptureObservedState, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as getLegacyStateBucketName, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as synthesisStatusMessage, yr as isThrottlingError, yt as requireConfigArray, z as yellow, zn as derivePartitionAndUrlSuffix, zt as describeTypeWithThrottleRetry } from "./deploy-engine-DP_MejgP.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CS5j-5z6.js";
+import { t as ASGProvider } from "./asg-provider-DWL4tZYx.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -63648,6 +63648,90 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 	}
 };
 /**
+* Detection found NO drift, but cdkd DELIBERATELY REFUSED to compare at least
+* one resource's secret-bearing properties (issue #2108).
+*
+* SCOPED TO REFUSALS, not to everything the report calls `notCompared`. The
+* roll-up also contains resources whose only problem is a surviving
+* `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
+* for nobody, which can never clear on a re-run, and which this change did not
+* create. Exiting non-zero for them would break `cdkd drift` in CI forever over
+* an unrelated defect, so the exit reads `comparisonRefused` and the report
+* reads `referencesUnresolved`. See that field's note.
+*
+* WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
+* Pre-#2108 that population resolved the reference in the WRONG region, the
+* baseline could never equal what AWS held, and the resource was reported
+* `drifted` -- so `cdkd drift` exited 1 and every CI gate keyed on the exit code
+* fired. #2108 correctly stopped comparing against a foreign region's plaintext,
+* which made the same population report `clean`; without this the command would
+* exit 0 and print `no drift detected` for a stack whose secret-bearing
+* properties were never looked at. Round 1 of that change surfaced the refusal
+* in `--json` (`notCompared`) and in the human report, but the exit code -- the
+* signal most CI gates actually read -- still said "pass".
+*
+* WHY EXIT 2 RATHER THAN 1. `2` is this repo's established "work completed but
+* something was SKIPPED" code (`cdkd destroy` / `cdkd deploy` / `cdkd rollback`,
+* and this command's own `--revert` partial failure), and the three outcomes are
+* genuinely distinct: nothing drifted and everything was compared (0), drift was
+* detected (1), nothing drifted but the comparison was incomplete (2). Drift
+* WINS when both hold -- a drifted resource is the stronger, actionable signal
+* and keeps exiting 1 exactly as it does today.
+*
+* SCOPE: detection-only mode. `--accept` / `--revert` keep their documented exit
+* codes (an `--accept` that refuses a secret-bearing property still exits 0, and
+* a partially-failed `--revert` still exits 2 through `PartialFailureError`) --
+* those modes report per-resource refusals on their own paths, and changing them
+* would alter what a remediation run means, which is not what this closes.
+*
+* WHAT DOES NOT TRIGGER IT: a stack whose properties reference
+* `{{resolve:ssm-secure:...}}` still exits 0. Those properties genuinely are not
+* compared and the report says so, but nothing REFUSED them — cdkd has never
+* resolved that spelling — so the condition is permanent, unclearable by any
+* action the user can take, and predates this change. It is reported as
+* information and kept out of the exit code.
+*
+* Carries no message of its own for the same reason {@link DriftDetectedError}
+* does -- the report was already printed.
+*/
+var DriftComparisonRefusedError = class DriftComparisonRefusedError extends CdkdError {
+	silent = true;
+	exitCode = 2;
+	constructor() {
+		super("drift comparison refused", "DRIFT_COMPARISON_REFUSED");
+		this.name = "DriftComparisonRefusedError";
+		Object.setPrototypeOf(this, DriftComparisonRefusedError.prototype);
+	}
+};
+/**
+* Every outcome on one report that was only PARTIALLY compared -- `drifted` or
+* `clean`, carrying `referencesUnresolved` (issue #2108).
+*
+* ONE spelling, because there are now THREE readers that must agree: the
+* `--json` `notCompared` roll-up, the human report's `PARTIALLY compared` block,
+* and the EXIT CODE. A predicate spelled per reader is how the payload and the
+* exit code come to disagree about the same run.
+*/
+function notComparedOutcomes(report) {
+	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.referencesUnresolved);
+}
+/**
+* Every outcome whose comparison cdkd DELIBERATELY REFUSED (issue #2108) — the
+* strict subset of {@link notComparedOutcomes} that drives the EXIT CODE.
+*
+* Deliberately NOT the same predicate, and the asymmetry is the point: the
+* REPORT covers everything that was not compared, because as information both
+* populations matter equally, while the exit code covers only the population
+* this change created. Driving it off `referencesUnresolved` would exit
+* non-zero forever for every stack holding an `{{resolve:ssm-secure:...}}`
+* reference — permanent, unclearable, and unrelated to this issue. See the
+* `comparisonRefused` field note, and issue
+* [#2135](https://github.com/go-to-k/cdkd/issues/2135) for the structural fix.
+*/
+function refusedComparisonOutcomes(report) {
+	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.comparisonRefused);
+}
+/**
 * `cdkd drift [<stack>...]` command implementation.
 *
 * Three operating modes (mutually exclusive):
@@ -63716,8 +63800,10 @@ async function driftCommand(stacks, options) {
 		if (options.json) writeJsonReport(reports);
 		else writeHumanReport(reports);
 		const drifted = reports.some((r) => r.outcomes.some((o) => o.kind === "drifted"));
+		const anyRefused = reports.some((r) => refusedComparisonOutcomes(r).length > 0);
 		if (!options.accept && !options.revert) {
 			if (drifted) throw new DriftDetectedError();
+			if (anyRefused) throw new DriftComparisonRefusedError();
 			return;
 		}
 		if (!drifted) {
@@ -63938,6 +64024,164 @@ function collectDynamicReferencePaths(value, into, path = "") {
 	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
 }
 /**
+* The drift command's resolvers for ONE stack: the stack's own, plus one pinned
+* sibling per FOREIGN region an ARN-named reference asks for (issue
+* [#2108](https://github.com/go-to-k/cdkd/issues/2108)).
+*
+* The structural twin of the rollback replay's `ReplayResolvers`
+* (`src/deployment/rollback-executor.ts`), and deliberately a SEPARATE class
+* rather than an export of that one: the two are ~20 lines of caching around a
+* constructor, and exporting the replay's would put a rollback-internal name on
+* the drift command's contract for no behavioural gain. What is SHARED is the
+* part with a decision in it — `classifyReplaySecretRegion`, imported.
+*
+* One instance per STACK, not per resource and not per op — the resolved-value
+* cache lives on the resolver INSTANCE since issue
+* [#1933](https://github.com/go-to-k/cdkd/issues/1933), so a resolver per
+* resource would re-fetch every referenced secret once per resource. The pinned
+* siblings are cached for the same reason: a 50-resource stack sharing one
+* foreign ARN must pay one `GetSecretValue`, not fifty.
+*
+* A pinned sibling is a PLAIN resolver, deliberately NOT the resolver class's
+* own `producerRegionGuest`, and the argument is `ReplayResolvers`' verbatim:
+* {@link forRegion} is reached ONLY from a `named-region` verdict, which
+* `classifyReplaySecretRegion` returns only when the SECRET_ID / parameter name
+* starts with `arn:` and carries a region. So a pinned sibling only ever
+* resolves an expression whose KEY EMBEDS THE REGION IT IS BEING RESOLVED IN,
+* and the process-global `recordedSecretExpressions` store — keyed by the
+* expression string alone — cannot have two regions sharing that key. If a
+* future change ever routes a region-LESS expression here, the argument dies
+* with it and the sibling needs the guest flag.
+*/
+var DriftSecretResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* A DELIBERATE refusal to resolve a state-recorded dynamic reference (issue
+* #2108) — as opposed to a failure to READ one.
+*
+* The distinction is load-bearing for what the user is told: "could not
+* resolve" sends a reader hunting for a missing `secretsmanager:GetSecretValue`
+* grant, while a refusal is cdkd declining to resolve a reference it CAN read
+* but cannot attribute to a region. Both call sites that catch
+* `resolveStateSecretExpressions` pick their wording from this class.
+*
+* DEFINED POSITIVELY, and that is the whole point of the class existing rather
+* than a second `err.code === ...` comparison at each site. Both sites used to
+* enumerate the one code they knew (`DRIFT_SECRET_REGION_AMBIGUOUS`) while
+* `DRIFT_SECRET_TOKEN_SCAN_MISMATCH` — whose own message says "Refusing rather
+* than resolving" — silently took the read-failure wording. Enumerating bad
+* shapes loses that race every time a third refusal is added; a refusal that
+* has to declare itself one cannot be added without answering the question.
+*
+* The `code` stays per-refusal: it is what the message and any future
+* programmatic consumer key on. What this class adds is the CATEGORY.
+*/
+var DriftSecretRefusalError = class DriftSecretRefusalError extends CdkdError {
+	/** Marker read by {@link isDriftSecretRefusal}; see the class note. */
+	driftSecretRefusal = true;
+	constructor(message, code) {
+		super(message, code);
+		this.name = "DriftSecretRefusalError";
+		Object.setPrototypeOf(this, DriftSecretRefusalError.prototype);
+	}
+};
+/**
+* Whether an error thrown out of `resolveStateSecretExpressions` is a
+* deliberate REFUSAL rather than a failed read. See
+* {@link DriftSecretRefusalError}.
+*/
+function isDriftSecretRefusal(err) {
+	return err instanceof DriftSecretRefusalError;
+}
+/**
+* The refusal a region-AMBIGUOUS drift reference throws (issue #2108).
+*
+* A plain throw: BOTH call sites already wrap `resolveStateSecretExpressions`
+* in a per-resource catch that degrades instead of aborting the command, and
+* the degradation each one performs is exactly the fail-closed behaviour this
+* refusal wants.
+*
+*  - DETECTION falls back to the UNRESOLVED baseline, whose `{{resolve:...}}`
+*    leaves `calculateResourceDrift` skips — so the secret-bearing property is
+*    NOT COMPARED rather than compared against a foreign region's plaintext.
+*    That is strictly better than the phantom drift this issue reports, and the
+*    offline `seededSecretPaths` still masks the position.
+*  - REVERT counts the resource as unresolvable and returns BEFORE
+*    `provider.update`, so nothing is written. Refusing is strictly better than
+*    the alternative it replaces: resolving a producer-region reference against
+*    the consumer's region does not fail, it succeeds with the WRONG credential
+*    and writes it to a live resource.
+*
+* Names the reference, the regions and the remedy. Never a resolved value:
+* nothing has been resolved when this is thrown (the refusal runs over the
+* WHOLE leaf before any reference in it is fetched), and the expression is the
+* same string `state.json` already stores in the clear.
+*/
+function regionAmbiguousDriftSecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
+	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
+	return new DriftSecretRefusalError(`${logicalId}${where}: the secret reference '${secretName}' carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so cdkd would compare against — and with --revert WRITE — the WRONG secret. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd drift'.`, "DRIFT_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
+* the region {@link classifyReplaySecretRegion} says must answer (issue #2108).
+*
+* Mirrors the rollback replay's `resolveLeafByRegion` down to the ordering, and
+* for the same reasons:
+*
+*  - Refuses FIRST, over the whole leaf, before any reference is fetched. A leaf
+*    can splice several references together, and resolving the safe ones first
+*    would leave half a credential fetched — and CACHED, and recorded as a
+*    redaction needle — for a resource that is about to be refused anyway.
+*  - With no foreign-region reference (every leaf on every pre-#2108 code path)
+*    the leaf goes to `resolveDynamicReferences` WHOLE, byte-for-byte as before.
+*    That method collects its matches from the ORIGINAL string, so a resolved
+*    plaintext that is itself token-shaped is never re-resolved (issue #1917),
+*    and this change does not want to relitigate any of it.
+*  - With one, the leaf is rebuilt segment by segment so each reference can be
+*    resolved by its OWN region's resolver, since `resolveDynamicReferences`
+*    resolves every token in the string it is handed with the one resolver it
+*    is called on. Each token is resolved ALONE and concatenated, so no resolved
+*    value is re-scanned for tokens either.
+*
+* `dynamicReferenceTokens` returns the tokens in order and non-overlapping, so
+* walking the leaf with a moving `indexOf` cursor reproduces their positions
+* exactly, duplicates included.
+*/
+async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, consumerRegion, producerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		out += await resolver.resolveDynamicReferences(token, ctx);
+		cursor = at + token.length;
+	}
+	return out + leaf.slice(cursor);
+}
+/**
 * Re-resolve the SECRET dynamic references (`{{resolve:secretsmanager:...}}`,
 * and an `{{resolve:ssm:...}}` naming a `SecureString`) held by a bag read back
 * out of cdkd STATE (issue #1914).
@@ -63975,10 +64219,15 @@ function collectDynamicReferencePaths(value, into, path = "") {
 *
 * Returns the input by identity when it holds no dynamic reference, so the
 * non-secret path is unchanged down to object identity.
+*
+* Issue [#2108](https://github.com/go-to-k/cdkd/issues/2108): every reference
+* is now routed to the region that must ANSWER for it rather than to the
+* consumer's, through {@link DriftSecretResolvers} — see
+* {@link resolveDriftLeafByRegion}.
 */
-async function resolveStateSecretExpressions(props, resolver, secrets, options = {}) {
+async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
 	if (!containsDynamicReference(props)) return props;
-	const { secretPaths, onUnresolved } = options;
+	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
 	const ctx = {
 		template: { Resources: {} },
 		resources: {},
@@ -63987,7 +64236,7 @@ async function resolveStateSecretExpressions(props, resolver, secrets, options =
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			const resolved = await resolver.resolveDynamicReferences(v, ctx);
+			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions, resolvers, ctx);
 			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
 			if (survivors.length > 0) {
 				if (survivors.some(isSecretBySpelling)) secretPaths?.add(path);
@@ -64148,7 +64397,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 		const outcomes = [];
 		const state = result.state;
 		const logger = getLogger();
-		const secretResolver = new IntrinsicFunctionResolver(region);
+		const secretResolvers = new DriftSecretResolvers(region);
+		const producerRegions = producerRegionsFromState(state);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 		for (const [logicalId, resource] of entries) {
 			if (providerRegistry.shouldSkipResource(resource.resourceType)) continue;
@@ -64220,18 +64470,25 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			let comparisonBaseline = baseline;
 			let secretResolutionFailed = false;
 			try {
-				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolver, secrets, {
+				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
 					secretPaths,
-					onUnresolved: noteUnresolved
+					onUnresolved: noteUnresolved,
+					logicalId,
+					consumerRegion: region,
+					producerRegions
 				});
-				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolver, secrets, {
+				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
 					secretPaths,
-					onUnresolved: noteUnresolved
+					onUnresolved: noteUnresolved,
+					logicalId,
+					consumerRegion: region,
+					producerRegions
 				});
 			} catch (err) {
 				secretResolutionFailed = true;
 				comparisonBaseline = baseline;
-				logger.warn(`${logicalId} (${resource.resourceType}): could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				const refused = isDriftSecretRefusal(err);
+				logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				secrets.clear();
 			}
 			if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
@@ -64247,10 +64504,14 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				unionWalkObjects: useObserved,
 				unorderedPaths
 			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+			const referencesUnresolved = secretResolutionFailed || unresolvedTokens.size > 0;
+			const comparisonRefused = secretResolutionFailed;
 			if (reported.changes.length === 0) outcomes.push({
 				kind: "clean",
 				logicalId,
-				resourceType: resource.resourceType
+				resourceType: resource.resourceType,
+				referencesUnresolved,
+				comparisonRefused
 			});
 			else outcomes.push({
 				kind: "drifted",
@@ -64259,7 +64520,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				...reported,
 				awsProperties: aws,
 				secrets,
-				referencesUnresolved: secretResolutionFailed || unresolvedTokens.size > 0
+				referencesUnresolved,
+				comparisonRefused
 			});
 		}
 		return {
@@ -64978,7 +65240,8 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
-		const revertSecretResolver = new IntrinsicFunctionResolver(report.region);
+		const revertSecretResolvers = new DriftSecretResolvers(report.region);
+		const revertProducerRegions = producerRegionsFromState(report.state);
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -64999,11 +65262,21 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				};
 				let desiredProperties;
 				try {
-					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
-					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolvers, secrets, {
+						onUnresolved: noteUnresolved,
+						logicalId: outcome.logicalId,
+						consumerRegion: report.region,
+						producerRegions: revertProducerRegions
+					});
+					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolvers, secrets, {
+						onUnresolved: noteUnresolved,
+						logicalId: outcome.logicalId,
+						consumerRegion: report.region,
+						producerRegions: revertProducerRegions
+					});
 				} catch (err) {
 					totalUnresolvable++;
-					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not re-resolve the dynamic reference(s) this resource's state records — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ` + (isDriftSecretRefusal(err) ? `refused to re-resolve a dynamic reference this resource's state records — ` : `could not re-resolve the dynamic reference(s) this resource's state records — `) + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
@@ -65204,9 +65477,15 @@ function writeJsonReport(reports) {
 		const drifted = r.outcomes.filter((o) => o.kind === "drifted").map((o) => ({
 			logicalId: o.logicalId,
 			type: o.resourceType,
-			changes: o.changes
+			changes: o.changes,
+			referencesUnresolved: o.referencesUnresolved
 		}));
 		const clean = r.outcomes.filter((o) => o.kind === "clean").map((o) => ({
+			logicalId: o.logicalId,
+			type: o.resourceType,
+			referencesUnresolved: o.referencesUnresolved
+		}));
+		const notCompared = notComparedOutcomes(r).map((o) => ({
 			logicalId: o.logicalId,
 			type: o.resourceType
 		}));
@@ -65224,7 +65503,8 @@ function writeJsonReport(reports) {
 			drifted,
 			clean,
 			notSupported,
-			skipped
+			skipped,
+			notCompared
 		};
 	});
 	process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
@@ -65234,8 +65514,11 @@ function writeHumanReport(reports) {
 		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
 		const unsupported = report.outcomes.filter((o) => o.kind === "unsupported");
 		const skippedCount = report.outcomes.filter((o) => o.kind === "skipped").length;
-		const checked = report.outcomes.length - skippedCount;
-		if (drifted.length === 0) process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
+		const inspected = report.outcomes.length - skippedCount;
+		const notCompared = notComparedOutcomes(report);
+		const checked = inspected - notCompared.length;
+		if (drifted.length === 0) if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked (${notCompared.length} only partially compared, ${unsupported.length} unsupported)\n`);
+		else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		else {
 			const word = drifted.length === 1 ? "resource" : "resources";
 			process.stdout.write(`\n⚠ ${report.stackName} (${report.region}): drift detected on ${drifted.length} ${word}\n\n`);
@@ -65248,6 +65531,10 @@ function writeHumanReport(reports) {
 				process.stdout.write("\n");
 			}
 		}
+		if (notCompared.length > 0) {
+			process.stdout.write(`\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n`);
+			for (const o of notCompared) process.stdout.write(`    ! ${o.logicalId} (${o.resourceType})\n`);
+		}
 		if (unsupported.length > 0) {
 			process.stdout.write(`\n  ${unsupported.length} resource(s) reported as drift unknown — provider does not yet support drift detection:\n`);
 			for (const o of unsupported) process.stdout.write(`    ? ${o.logicalId} (${o.resourceType})\n`);
@@ -65276,7 +65563,7 @@ function stackRegionOption$2() {
 * Create the `drift` command.
 */
 function createDriftCommand() {
-	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when no drift, 1 when drift is detected. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
+	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when nothing drifted, 1 when drift is detected, and 2 when nothing drifted but cdkd REFUSED to compare a resource, because a dynamic reference its state records could not be attributed to a region. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
 	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -84259,7 +84546,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.26");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.28");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;