@go-to-k/cdkd 0.284.27 → 0.284.29

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as isInterruptedWaitError, $n as LocalMigrateError, $t as escapeRegExp, A as isStatefulRecreateTargetSync, An as CFN_TEMPLATE_BODY_LIMIT, At as s3BucketArn, B as collectPublishedOutputNames, Bn as processStackMessages, Bt as DagBuilder, C as createPreDeleteFinalSnapshot, Cn as resolveCaptureObservedState, Ct as TEMPLATE_SOURCED_RULES, D as makeCanonicalizePropertiesFn, Dn as resolveUseCdkBootstrapAssets, Dt as maskSecretsInText, E as unsupportedFinalSnapshotError, En as resolveStateBucketWithDefaultAndSource, Et as isSingleDynamicReferenceToken, F as gray, Fn as expectedOwnerParam, Ft as applyRoleArnIfSet, G as IAMRoleProvider, Gn as resetAwsClients, Gt as shouldRetainResource, H as isExportAliasCollision, Hn as resolveBucketRegion, Ht as LockManager, I as green, In as PARTITION_TABLE, It as DiffCalculator, J as ProviderRegistry, Jn as CdkdError, Jt as WorkGraph, K as collectInlinePolicyNamesManagedBySiblings, Kn as setAwsClients, Kt as AssetPublisher, L as red, Ln as canonicalizeRegion, Lt as INTRINSIC_KEYS, M as formatResourceLine, Mn as MIGRATE_TMP_PREFIX, Mt as s3BucketDualStackDomainName, N as bold, Nn as findLargeInlineResources, Nt as s3BucketRegionalDomainName, O as extractDeploymentEventError, On as stateBucketExistenceConfirmed, Ot as redactSecretsForState, P as cyan, Pn as uploadCfnTemplate, Pt as s3BucketWebsiteUrl, Q as endCommandInterruptScope, Qn as LocalInvokeBuildError$1, Qt as rewriteTemplateAssetReferences, R as yellow, Rn as derivePartitionAndUrlSuffix, Rt as describeTypeWithThrottleRetry, S as ccRoutedFinalSnapshotError, Sn as resolveAutoAssetStorage, St as STATE_SOURCED_READBACK_RULES, T as refusesFinalSnapshot, Tn as resolveStateBucketWithDefault, Tt as dynamicReferenceTokens, U as secretBearingStateKeyWarning, Un as AwsClients, Ut as S3StateBackend, V as exportAliasCollisionScrubWarning, Vt as TemplateParser, W as stateKeySecretExposure, Wn as getAwsClients, Wt as rebuildClientForBucketRegion, X as findSilentDropProperties, Xt as createAssetRedirectResolver, Y as findActionableSilentDrops, Yt as buildAssetRedirectMap, Z as beginCommandInterruptScope, Zn as DeployCancelledError, Zt as loadPublishableAssetManifest, _ as IMPLICIT_DELETE_DEPENDENCIES, _n as Synthesizer, _r as isRetryableTransientError, _t as replayWarn, a as DeploymentEventsStore, an as parseBootstrapMarker, ar as ProvisioningError, at as IntrinsicFunctionResolver, b as PRE_DELETE_SNAPSHOT_TYPES, bn as getLegacyStateBucketName, bt as requireConfigString, c as producerRegionsFromState, cn as validateContainerRepoName, cr as StackHasActiveImportsError, ct as refStateLookupFromResource, d as updatePartialMessage, dn as formatDockerLoginError, dt as resolveExplicitPhysicalId, en as stripControlChars, er as LocalStartServiceError, et as startInterruptWatch, f as updatePartialReason, fn as getDockerCmd, ft as assertRegionMatch, g as maskingRetryLogger, gn as getDockerImageBySourceHash, gr as isMarkedNonRetryable, gt as readConfigString, h as withResourceDeadline, hn as AssetManifestLoader, hr as withErrorHandling, ht as configStringRefusal, i as DeploymentEventsReader, in as getBootstrapMarkerKey, ir as PartialFailureError, it as isTerminationProtectionPropagationError, j as renderStatefulReason, jn as CFN_TEMPLATE_URL_LIMIT, jt as s3BucketDomainName, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as warnDeprecatedNoPrefixCliFlag, kt as scrubResourceRecord, l as replayFailedOperations, ln as buildDenyExternalAccessPolicy, lr as StackTerminationProtectionError, lt as WAFv2WebACLProvider, m as deleteSkipReason, mn as runDockerStreaming, mr as normalizeAwsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as BOOTSTRAP_MARKER_PREFIX, nr as MissingCdkCliError, nt as slowCcOperationTimeoutMs, o as planFailedOps, on as readBootstrapMarkerBody, or as ResourceTimeoutError, ot as cfnRefValueFromPhysicalId, p as UNSPECIFIED_SKIP_REASON, pn as runDockerForeground, pt as coerceCfnBoolean, q as clearOnUpdateRemoval, qt as stringifyValue, r as DeployEngine, rn as ensureAssetStorage, rr as NestedStackChildDirectDestroyError, rt as disableInstanceApiTermination, s as planRollback, sn as validateAssetBucketName, sr as ResourceUpdateNotSupportedError, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as AssetModeResolver, tt as CloudControlProvider, u as replayRollback, un as buildDockerImage, ut as normalizeAwsTagsToCfn, v as computeImplicitDeleteEdges, vn as synthesisStatusMessage, vr as isThrottlingError, vt as requireConfigArray, w as isFinalSnapshotError, wn as resolveSkipPrefix, wt as createSecretMasker, x as buildFinalSnapshotIdentifier, xn as resolveApp, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as getDefaultStateBucketName, yr as markNonRetryable, yt as requireConfigObject, z as collectDeclaredOutputNames, zn as AssemblyReader, zt as withRetry } from "./deploy-engine-Bidb8N3p.js";
+import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-CE-tOz2d.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-CpNMUO45.js";
+import { t as ASGProvider } from "./asg-provider-DzbiUvJi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -62212,6 +62212,62 @@ var ScrubNeededError = class ScrubNeededError extends CdkdError {
 	}
 };
 /**
+* Every `cdkd scrub` REFUSAL — a reference this command cannot safely
+* re-resolve, and the per-stack failures that refusal produces under `--all`
+* (issue [#2109](https://github.com/go-to-k/cdkd/issues/2109) review).
+*
+* `exitCode = 2` rather than `CdkdError`'s default of 1, because 1 is already
+* SPOKEN FOR: `--fail` throws {@link ScrubNeededError} for "plaintext is in
+* state", and `docs/cli-reference.md` documents the pair as `1` (`--fail` found
+* plaintext) / `2` (error). A refusal is the second one, and left on the default
+* a CI gate reading the exit code alone could not tell "scrub looked and found a
+* leak" from "scrub refused to look" — the two call for opposite responses
+* (rotate the secret vs. re-spell the reference and re-run).
+*/
+var ScrubRefusalError = class ScrubRefusalError extends CdkdError {
+	exitCode = 2;
+	constructor(message, code) {
+		super(message, code);
+		this.name = "ScrubRefusalError";
+		Object.setPrototypeOf(this, ScrubRefusalError.prototype);
+	}
+};
+/**
+* One failed stack's reason, INCLUDING its `cause` chain (issue #2109 review).
+*
+* `err.message` alone drops the actionable half of a wrapped failure: a
+* provider or AWS error is routinely a generic sentence over the link that
+* names the role, the bucket or the denied action. The chain is walked with
+* `errorCauseChain` rather than a local loop so the links PRINTED are exactly
+* the links `maskSecretsInError` masked at `scrubStack`'s boundary — a private
+* walk would eventually render a link past that function's depth cap, which
+* still carries its original, unmasked message.
+*/
+function describeFailure(err) {
+	if (!(err instanceof Error)) return String(err);
+	return errorCauseChain(err).map((link, i) => i === 0 ? link.message : `\n    Caused by: ${link.message}`).join("");
+}
+/**
+* The error a `--all` run ends with when one or more stacks could not be
+* scrubbed (issue #2109 review).
+*
+* Every stack is NAMED: the per-stack boundary keeps the run going, and a
+* single "3 stacks failed" line would make the operator re-run the command to
+* find out which. `exitCode = 2` for the same reason every other scrub refusal
+* carries it — `1` means "`--fail` found plaintext".
+*
+* The REASONS are deliberately not repeated here. Each was already logged at
+* `error` level, in run order, next to the progress lines for the stacks around
+* it; `handleError` then prints this message, so restating every reason made
+* the whole failure set appear TWICE in one terminal — directly under a summary
+* whose own note says "see the errors above". Names are kept because they are
+* what a reader needs to FIND those lines, and because the count alone is the
+* thing the paragraph above rejects.
+*/
+function scrubStacksFailedError(failures) {
+	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
+}
+/**
 * `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
 * reference is stored as its UNRESOLVED expression rather than the plaintext
 * value (GHSA fix). "Secret" here is whatever the RESOLVER classifies as one,
@@ -62332,12 +62388,22 @@ async function scrubCommand(stacks, options) {
 	const lockManager = new LockManager(stateS3.s3, stateConfig);
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
+	const failures = [];
 	for (const stack of targetStacks) {
-		const scrubbed = await scrubStack(stack, stack.region || region, stateBackend, lockManager, {
-			dryRun: options.dryRun ?? false,
-			roleArn: options.roleArn,
-			logger
-		});
+		const stackRegion = stack.region || region;
+		let scrubbed;
+		try {
+			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
+				dryRun: options.dryRun ?? false,
+				roleArn: options.roleArn,
+				logger
+			});
+		} catch (err) {
+			failures.push({ stackName: stack.stackName });
+			logger.error(`Scrub of ${stack.stackName} failed: ${describeFailure(err)}`);
+			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
+			continue;
+		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
@@ -62348,18 +62414,25 @@ async function scrubCommand(stacks, options) {
 		}
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0) {
-		logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
-		return;
+		if (failures.length === 0) {
+			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+			return;
+		}
+		logger.info(`\nNo plaintext secrets found in the ${targetStacks.length - failures.length} stack(s) this run could examine. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.`);
+		throw scrubStacksFailedError(failures);
 	}
+	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${failureNote} ROTATE any exposed secret.`);
+		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${failureNote}`);
+	else logger.info(`\nNothing could be rewritten.${keyNote}${failureNote} ROTATE any exposed secret.`);
+	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
 }
 /**
@@ -62554,6 +62627,351 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	return repaired ?? positioned;
 }
 /**
+* The producer regions that are genuinely FOREIGN to this stack, canonicalized
+* and de-duplicated (issue #2109 review).
+*
+* The same filter {@link classifyReplaySecretRegion} applies to its own
+* `importedProducerRegions` argument, spelled here because the
+* unclassifiable-reference guard needs the answer WITHOUT an expression to hand
+* to the classifier. A same-region cross-stack read is the common case and
+* raises no cross-region question, so it must not arm a refusal.
+*/
+function foreignRegionsOf(producerRegions, stackRegion) {
+	const seen = /* @__PURE__ */ new Set();
+	const foreign = [];
+	for (const candidate of producerRegions) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(stackRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreign.push(candidate);
+	}
+	return foreign;
+}
+/**
+* The `cdkd scrub` resolvers: the stack's own, plus one pinned sibling per
+* FOREIGN region an ARN-named secret reference asks for (issue
+* [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
+*
+* The same shape as `rollback-executor.ts`'s `ReplayResolvers`, and for the
+* same reasons. One instance per stack rather than per reference, because the
+* resolved-value cache lives on the resolver INSTANCE (issue #1933) — a
+* resolver per reference would re-fetch every secret once per reference. And
+* the pinned sibling is a PLAIN resolver, not a `producerRegionGuest`: it is
+* reached ONLY from a `named-region` verdict, which
+* {@link classifyReplaySecretRegion} returns only for an expression whose
+* SECRET_ID / parameter name starts with `arn:` and carries a region, so a
+* sibling only ever resolves an expression whose key EMBEDS the region it is
+* being resolved in. The process-global verdict store is keyed by the
+* expression STRING alone, and an ARN-form key cannot be shared by two regions,
+* so a sibling can never pin one region's verdict for another region's key. If
+* a future change ever routes a region-LESS expression here, that argument dies
+* with it and the sibling needs the guest flag.
+*/
+var ScrubResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* The refusal a region-AMBIGUOUS reference raises (issue #2109), the twin of
+* `rollback-executor.ts`'s `regionAmbiguousReplaySecretError`.
+*
+* A `CdkdError`, so it leaves `scrubStack` -> `scrubCommand` ->
+* `withErrorHandling` as a NON-ZERO EXIT with the message printed. That
+* visibility is the acceptance criterion of the issue, not a detail of it: the
+* one outcome that must not survive is scrub reporting success over a document
+* it did not scrub, and a debug log next to a `Done: scrubbed 0 stack(s)` line
+* IS that outcome.
+*
+* It refuses the whole STACK rather than the one reference, which is wider than
+* it needs to be and is the deliberate side of the trade. Scrubbing the rest
+* and reporting success would leave the operator with "no plaintext secrets
+* found" over state that still holds one — the failure this command exists to
+* prevent, arriving through the remediation. Names the reference, both regions
+* and the remedy so the refusal is actionable.
+*
+* Never the resolved value: nothing has been resolved for this reference, and
+* the expression is the same string `state.json` already stores in the clear.
+*/
+function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion) {
+	return new ScrubRefusalError(`Scrub of ${stackName} cannot re-resolve the secret reference '${secretName}' in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${stackRegion}'. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* The refusal a `named-region` reference raises when its OWN region cannot
+* answer for it (issue #2109).
+*
+* Continuing would hand the leaf back to the stack's own resolver, which is
+* issue #2109 verbatim — so this fails closed for the same reason the ambiguous
+* arm does. The cause is echoed because it is the actionable half (a denied
+* read in the producer region reads very differently from a missing secret) —
+* but MASKED against everything this run has recorded so far (issue #2109
+* review). No resolver error carries a plaintext today; the rule on this repo is
+* that a path which interpolates a foreign message into user-visible text masks
+* it anyway, because the day one does is the day the remediation command prints
+* the secret it exists to remove. The map is the SAME one the resolution records
+* into, so a value recorded a moment earlier in this very leaf is covered.
+*/
+function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
+	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the secret reference '${secretName}' in ${origin} in the region its ARN names ('${region}'): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+}
+/**
+* The literal that OPENS a dynamic reference. Used as the CHEAP pre-filter that
+* decides whether a leaf is walked at all — see {@link pinCrossRegionSecrets}.
+*/
+const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
+/**
+* The openings the assembled-reference guard actually COUNTS: `{{resolve:`
+* followed by a service whose VALUE CloudFormation defines as a secret. Counted
+* against the number of WHOLE tokens of the same class the scan matched, which
+* is how an ASSEMBLED reference is detected without parsing intrinsics — see
+* {@link unclassifiableScrubSecretError}.
+*
+* WHY THE SERVICE IS PART OF THE OPENING (issue #2109 review). Counting the bare
+* `{{resolve:` made the guard fire on any leaf that merely MENTIONS the syntax
+* — measured: `Use the {{resolve: prefix for dynamic references` and
+* `{{resolve:}}` both count one opening and zero tokens. A description, an IAM
+* policy document, a UserData script or an environment variable saying that is
+* ordinary, and the refusal is permanent for the whole stack (exit 2, no bypass
+* flag) with a remedy — "spell the reference as one complete literal" — that is
+* unactionable for prose. Requiring the service makes the count a count of
+* SECRET references rather than of the characters `{{resolve:`.
+*
+* `secretsmanager` / `ssm` mirror `REPLAY_SECRET_SERVICES` in
+* `rollback-executor.ts`, whose {@link classifyReplaySecretRegion} is what
+* classifies the tokens below — the same set on both sides, so the count and
+* the classification never disagree about what is in scope. `ssm-secure` is
+* added on top: it IS a CloudFormation secret spelling, and although cdkd does
+* not resolve it today (the resolver's unsupported-service arm leaves it
+* verbatim, so it can never become a wrong-region needle), counting it costs
+* only an assembled `ssm-secure` reference in a cross-region stack and keeps
+* the guard correct the day that arm changes.
+*
+* THE TRADE, stated rather than hidden: an `Fn::Join` that splits BEFORE the
+* service name (`['{{resolve:', 'secretsmanager:db:SecretString:pw}}']`) has no
+* counted opening in either part and stops being caught by this guard. The part
+* carrying the service has no `{{resolve:` at all, so `pinCrossRegionSecrets`
+* returns it by identity too. That shape falls to the same resolver-side
+* classification issue [#2134](https://github.com/go-to-k/cdkd/issues/2134)
+* tracks.
+*/
+const SECRET_REFERENCE_OPENINGS = [
+	`${DYNAMIC_REFERENCE_OPENING}secretsmanager:`,
+	`${DYNAMIC_REFERENCE_OPENING}ssm:`,
+	`${DYNAMIC_REFERENCE_OPENING}ssm-secure:`
+];
+/**
+* What an `Fn::Sub` placeholder opens with. A whole token that CONTAINS one is
+* the third assembled shape — see {@link unclassifiableScrubSecretError}.
+*/
+const SUB_PLACEHOLDER_OPENING = "${";
+/** How many SECRET references {@link SECRET_REFERENCE_OPENINGS} `leaf` opens. */
+function countSecretReferenceOpenings(leaf) {
+	let count = 0;
+	for (const opening of SECRET_REFERENCE_OPENINGS) count += leaf.split(opening).length - 1;
+	return count;
+}
+/** Whether a WHOLE token the scan matched is one of the secret spellings. */
+function isSecretReferenceToken(token) {
+	return SECRET_REFERENCE_OPENINGS.some((opening) => token.startsWith(opening));
+}
+/**
+* The refusal an ASSEMBLED reference raises (issue #2109 review): a leaf that
+* OPENS more SECRET references than the scan found COMPLETE tokens of that
+* class in it, or a whole token that still carries an `Fn::Sub` placeholder.
+*
+* WHY THIS EXISTS, and it is the load-bearing half of this pre-pass rather than
+* an edge case. The region split runs on the RAW template leaf, BEFORE intrinsic
+* resolution, and the shared token scan is `\{\{resolve:[^}]+\}\}` — a class
+* that cannot cross a `}`. So none of the three shapes that assemble a
+* reference out of parts yields the ONE WHOLE token a literal reference does,
+* and the third one is why this guard needs two tests rather than one
+* (all four rows MEASURED):
+*
+* ```text
+*   "{{resolve:secretsmanager:my-secret:SecretString:pw}}"        1 opening, 1 token   literal
+*   "{{resolve:secretsmanager:${Env}-db:SecretString:password}}"  1 opening, 0 tokens  Fn::Sub, MID-string
+*   "{{resolve:secretsmanager:"  (one Fn::Join part)              1 opening, 0 tokens  Fn::Join split
+*   "{{resolve:secretsmanager:x:SecretString:${Field}}}"          1 opening, 1 token   Fn::Sub, TRAILING
+* ```
+*
+* The first two assembled rows are caught by the COUNT. The fourth is not, and
+* the count can never catch it: `[^}]+` stops at the `}` of `${Field}` and the
+* `}}` that follows closes the match one brace short, so the scan returns
+* `"{{resolve:secretsmanager:x:SecretString:${Field}"` + `}` — a token, of the
+* right class, exactly one per opening. It is caught instead by the second
+* test: a WHOLE token that still contains `${` has not been assembled yet.
+* Neither a Secrets Manager secret name nor an SSM parameter name may contain
+* `$` or `{`, so the only false positive that test can produce is a JSON key
+* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and
+* this guard is the fail-closed side of a command whose subject is a leaked
+* plaintext.
+*
+* With no token there is nothing to classify: {@link pinCrossRegionSecrets}
+* returns the leaf BY IDENTITY, and `resolveJoin` / `resolveSub` then call
+* `resolveDynamicReferences` on the PRIMARY resolver once they have joined the
+* parts — issue #2109 verbatim, with the `ambiguous` refusal never firing. The
+* trailing-placeholder row got there a different way before this guard's second
+* test: the token WAS classified, and only downstream luck kept it safe (the
+* name form then classifies `ambiguous`, the ARN form fails into
+* `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it looks up still has a
+* literal `${Field}` in it). Both are pinned by the suite rather than assumed.
+* Fixing all of this inside the resolver (classify AFTER assembly) is the
+* structurally right answer and is NOT what this does: the resolver's
+* dynamic-reference path is shared with deploy and is out of this change's
+* scope. This guard buys the same SAFETY property — a reference whose region
+* cannot be established is never resolved in the stack's own region — by
+* refusing instead.
+*
+* GATED ON A FOREIGN PRODUCER REGION BEING ON RECORD, which is what keeps it
+* from refusing the world. With no foreign region on record there is no
+* cross-region question to get wrong: every reference in the stack resolves
+* locally, which is what an assembled one would have done anyway, so proceeding
+* is exactly today's behavior. Two residuals, stated rather than hidden:
+* an assembled reference that names a FOREIGN ARN inside an `Fn::Sub` in a
+* stack with NO cross-stack read on record is still resolved locally; and an
+* `Fn::Join` that splits BEFORE the service name is not counted at all (see
+* {@link SECRET_REFERENCE_OPENINGS}). Closing either needs the resolver-side
+* classification above — issue
+* [#2134](https://github.com/go-to-k/cdkd/issues/2134).
+*/
+function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProducerRegions, stackRegion) {
+	return new ScrubRefusalError(`Scrub of ${stackName} cannot classify a secret reference in ${origin}${leafPath ? ` at '${leafPath}'` : ""}: the value opens a '{{resolve:...}}' reference that is ASSEMBLED by an intrinsic (an Fn::Sub placeholder inside it, or an Fn::Join that splits it across parts), so the reference does not exist as a complete expression until AFTER it is resolved — and its region therefore cannot be determined before resolution. This stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so resolving it in '${stackRegion}' may look for a different region's secret: scrub would then miss the plaintext it exists to remove and report the stack clean. Refusing instead. Spell the reference as one complete literal '{{resolve:secretsmanager:<full ARN>:SecretString:...}}' — an ARN names its own region — then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE");
+}
+/**
+* Resolve every FOREIGN-region `{{resolve:...}}` reference in one leaf through
+* a resolver pinned to the region the expression NAMES, and refuse the ones
+* whose region cannot be established (issue #2109).
+*
+* The returned string is what the primary resolver is handed, so a foreign
+* reference is already a value by the time the stack's own region sees the
+* leaf — the local endpoint is never asked about it at all. A leaf with no
+* foreign reference is returned BY IDENTITY and takes exactly the pre-#2109
+* path: `resolveDynamicReferences` has well-tested substitution semantics (it
+* collects matches from the ORIGINAL string, so a resolved plaintext that is
+* itself token-shaped is never re-resolved — issue #1917) and this change does
+* not relitigate any of it.
+*
+* That #1917 guarantee does NOT cross this seam — the primary receives a string
+* this function already substituted into — so the result is re-scanned and a
+* token the substitution INTRODUCED is refused rather than passed on. Fail
+* closed: a stopped scrub is recoverable, a lookup for a secret id spliced
+* together out of a plaintext is not.
+*/
+async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
+	const tokens = dynamicReferenceTokens(leaf);
+	const secretTokens = tokens.filter(isSecretReferenceToken);
+	if ((countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING))) && ctx.foreignProducerRegions.length > 0) throw unclassifiableScrubSecretError(ctx.origin, leafPath, stackName, ctx.foreignProducerRegions, ctx.stackRegion);
+	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
+	const localTokens = [];
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new ScrubRefusalError(`Scrub of ${stackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in '${ctx.stackRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		if (verdict.kind === "named-region") {
+			const resolver = ctx.resolvers.forRegion(verdict.region);
+			try {
+				out += await resolver.resolveDynamicReferences(token, {
+					template: { Resources: {} },
+					resources: {},
+					recordedSecretValues: ctx.recordedSecretValues
+				});
+			} catch (err) {
+				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues);
+			}
+		} else {
+			out += token;
+			localTokens.push(token);
+		}
+		cursor = at + token.length;
+	}
+	out += leaf.slice(cursor);
+	const surviving = dynamicReferenceTokens(out);
+	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${stackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
+	return out;
+}
+/**
+* Rewrite one template bag so every FOREIGN-region secret reference in it is
+* already resolved — in the region the expression NAMES — before the stack's
+* own resolver walks it (issue
+* [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
+*
+* WHY SCRUB NEEDS THIS AT ALL. `scrubStack` learns which plaintexts to look for
+* by RE-RESOLVING the template through one resolver built from the stack's own
+* region, and `resolveSecretsManagerReference` builds its client from that
+* region and passes the SECRET_ID through as an opaque string — the AWS SDK's
+* endpoint ruleset has no ARN-derived endpoint rule, so a reference naming
+* another region's ARN is sent to this stack's regional endpoint. Both halves
+* of that go wrong at once, and the second is the one that is easy to miss: the
+* plaintext scrub exists to remove is never found (the needle is the wrong
+* region's value), so the command reports the stack CLEAN over state that still
+* holds the secret; and the foreign value is a real string, so scanning for it
+* can rewrite an unrelated stored literal that happens to coincide.
+*
+* The split is `classifyReplaySecretRegion`'s, imported from
+* `rollback-executor.ts` rather than re-spelled — one answer to "which region
+* must answer for this expression", shared by the rollback replay (#2057) and
+* by scrub. Its known OVER-refusal is inherited with it: a name-form reference
+* in a stack with ANY foreign producer region on record is refused even when it
+* is the stack's own purely-local secret, because the evidence
+* (`state.imports` / `state.outputReads`) is per-STACK and not per-reference.
+* That is the fail-closed side of a trade whose other side is a silently
+* unscrubbed state file.
+*
+* Returns the bag BY IDENTITY when nothing was foreign, which is every bag on
+* every existing code path. The caller keeps the ORIGINAL bag as its position
+* source either way — a substituted copy must never reach
+* `redactSecretsForState`, whose whole job is to read UNRESOLVED expressions
+* off it.
+*/
+async function pinCrossRegionSecrets(bag, stackName, ctx) {
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes(DYNAMIC_REFERENCE_OPENING)) return v;
+			return await resolveForeignRegionTokens(v, stackName, ctx, path);
+		}
+		if (Array.isArray(v)) {
+			const out = new Array(v.length);
+			let changed = false;
+			for (let i = 0; i < v.length; i++) {
+				out[i] = await walk(v[i], `${path}[${i}]`);
+				if (out[i] !== v[i]) changed = true;
+			}
+			return changed ? out : v;
+		}
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			let changed = false;
+			for (const [k, val] of Object.entries(v)) {
+				out[k] = await walk(val, path ? `${path}.${k}` : k);
+				if (out[k] !== val) changed = true;
+			}
+			return changed ? out : v;
+		}
+		return v;
+	};
+	return await walk(bag, "");
+}
+/**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
 * learn the resolved secret VALUES, then replaces those values in the state
 * record with their `{{resolve:...}}` expressions. Returns counts; performs no
@@ -62570,6 +62988,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const { logger } = opts;
 	const acquired = !opts.dryRun;
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
+	const perResourceSecrets = /* @__PURE__ */ new Map();
+	const outputSecrets = /* @__PURE__ */ new Map();
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -62581,11 +63001,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		}
 		const state = loaded.state;
-		const perResourceSecrets = /* @__PURE__ */ new Map();
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
-		const outputSecrets = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
-		const resolver = new IntrinsicFunctionResolver(region);
+		const resolvers = new ScrubResolvers(region);
+		const resolver = resolvers.primary;
+		const producerRegions = producerRegionsFromState(state);
+		const foreignProducerRegions = foreignRegionsOf(producerRegions, region);
 		let parameters = {};
 		let conditions = {};
 		try {
@@ -62608,8 +63029,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const templateResource = templateResources[logicalId];
 			if (!templateResource?.Properties) continue;
 			const recordedSecretValues = /* @__PURE__ */ new Map();
+			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
+				stackRegion: region,
+				producerRegions,
+				foreignProducerRegions,
+				resolvers,
+				recordedSecretValues,
+				origin: `resource '${logicalId}'`
+			});
 			try {
-				await resolver.resolve(templateResource.Properties, {
+				await resolver.resolve(resolveInput, {
 					template: stack.template,
 					resources: state.resources,
 					...Object.keys(parameters).length > 0 && { parameters },
@@ -62619,7 +63048,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					bestEffort: true
 				});
 			} catch (err) {
-				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 			}
 			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -62633,19 +63062,29 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		for (const [name, output] of Object.entries(templateOutputs)) {
 			const declaredExportName = output.Export?.Name;
 			let exportName = declaredExportName;
-			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") try {
-				exportName = await resolver.resolve(declaredExportName, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
+			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") {
+				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
+					stackRegion: region,
+					producerRegions,
+					foreignProducerRegions,
+					resolvers,
 					recordedSecretValues: outputSecrets,
-					bestEffort: true
+					origin: `Export.Name of output '${name}'`
 				});
-			} catch (err) {
-				outputsSourceUntrusted = true;
-				logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${err instanceof Error ? err.message : String(err)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+				try {
+					exportName = await resolver.resolve(nameSource, {
+						template: stack.template,
+						resources: state.resources,
+						...Object.keys(parameters).length > 0 && { parameters },
+						...Object.keys(conditions).length > 0 && { conditions },
+						stackName: stack.stackName,
+						recordedSecretValues: outputSecrets,
+						bestEffort: true
+					});
+				} catch (err) {
+					outputsSourceUntrusted = true;
+					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+				}
 			}
 			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
 			const exportNameUnresolved = declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName));
@@ -62664,8 +63103,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (!ambiguousKeys.has(name)) outputsTemplateSource[name] = value;
 			const exportName = output.Export?.Name;
 			if (typeof exportName === "string" && !ambiguousKeys.has(exportName)) outputsTemplateSource[exportName] = value;
+			const valueSource = await pinCrossRegionSecrets(value, stack.stackName, {
+				stackRegion: region,
+				producerRegions,
+				foreignProducerRegions,
+				resolvers,
+				recordedSecretValues: outputSecrets,
+				origin: `output '${name}'`
+			});
 			try {
-				await resolver.resolve(value, {
+				await resolver.resolve(valueSource, {
 					template: stack.template,
 					resources: state.resources,
 					...Object.keys(parameters).length > 0 && { parameters },
@@ -62675,7 +63122,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					bestEffort: true
 				});
 			} catch (err) {
-				logger.debug(`Resolution of output ${name} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 			}
 		}
 		for (const [name, exportName] of collisions) logger.warn(exportAliasCollisionScrubWarning(name, exportName, outputSecrets));
@@ -62706,7 +63153,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
+		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const nextState = {
@@ -62722,6 +63169,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length
 		};
+	} catch (err) {
+		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
 			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
@@ -63648,6 +64097,90 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 	}
 };
 /**
+* Detection found NO drift, but cdkd DELIBERATELY REFUSED to compare at least
+* one resource's secret-bearing properties (issue #2108).
+*
+* SCOPED TO REFUSALS, not to everything the report calls `notCompared`. The
+* roll-up also contains resources whose only problem is a surviving
+* `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
+* for nobody, which can never clear on a re-run, and which this change did not
+* create. Exiting non-zero for them would break `cdkd drift` in CI forever over
+* an unrelated defect, so the exit reads `comparisonRefused` and the report
+* reads `referencesUnresolved`. See that field's note.
+*
+* WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
+* Pre-#2108 that population resolved the reference in the WRONG region, the
+* baseline could never equal what AWS held, and the resource was reported
+* `drifted` -- so `cdkd drift` exited 1 and every CI gate keyed on the exit code
+* fired. #2108 correctly stopped comparing against a foreign region's plaintext,
+* which made the same population report `clean`; without this the command would
+* exit 0 and print `no drift detected` for a stack whose secret-bearing
+* properties were never looked at. Round 1 of that change surfaced the refusal
+* in `--json` (`notCompared`) and in the human report, but the exit code -- the
+* signal most CI gates actually read -- still said "pass".
+*
+* WHY EXIT 2 RATHER THAN 1. `2` is this repo's established "work completed but
+* something was SKIPPED" code (`cdkd destroy` / `cdkd deploy` / `cdkd rollback`,
+* and this command's own `--revert` partial failure), and the three outcomes are
+* genuinely distinct: nothing drifted and everything was compared (0), drift was
+* detected (1), nothing drifted but the comparison was incomplete (2). Drift
+* WINS when both hold -- a drifted resource is the stronger, actionable signal
+* and keeps exiting 1 exactly as it does today.
+*
+* SCOPE: detection-only mode. `--accept` / `--revert` keep their documented exit
+* codes (an `--accept` that refuses a secret-bearing property still exits 0, and
+* a partially-failed `--revert` still exits 2 through `PartialFailureError`) --
+* those modes report per-resource refusals on their own paths, and changing them
+* would alter what a remediation run means, which is not what this closes.
+*
+* WHAT DOES NOT TRIGGER IT: a stack whose properties reference
+* `{{resolve:ssm-secure:...}}` still exits 0. Those properties genuinely are not
+* compared and the report says so, but nothing REFUSED them — cdkd has never
+* resolved that spelling — so the condition is permanent, unclearable by any
+* action the user can take, and predates this change. It is reported as
+* information and kept out of the exit code.
+*
+* Carries no message of its own for the same reason {@link DriftDetectedError}
+* does -- the report was already printed.
+*/
+var DriftComparisonRefusedError = class DriftComparisonRefusedError extends CdkdError {
+	silent = true;
+	exitCode = 2;
+	constructor() {
+		super("drift comparison refused", "DRIFT_COMPARISON_REFUSED");
+		this.name = "DriftComparisonRefusedError";
+		Object.setPrototypeOf(this, DriftComparisonRefusedError.prototype);
+	}
+};
+/**
+* Every outcome on one report that was only PARTIALLY compared -- `drifted` or
+* `clean`, carrying `referencesUnresolved` (issue #2108).
+*
+* ONE spelling, because there are now THREE readers that must agree: the
+* `--json` `notCompared` roll-up, the human report's `PARTIALLY compared` block,
+* and the EXIT CODE. A predicate spelled per reader is how the payload and the
+* exit code come to disagree about the same run.
+*/
+function notComparedOutcomes(report) {
+	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.referencesUnresolved);
+}
+/**
+* Every outcome whose comparison cdkd DELIBERATELY REFUSED (issue #2108) — the
+* strict subset of {@link notComparedOutcomes} that drives the EXIT CODE.
+*
+* Deliberately NOT the same predicate, and the asymmetry is the point: the
+* REPORT covers everything that was not compared, because as information both
+* populations matter equally, while the exit code covers only the population
+* this change created. Driving it off `referencesUnresolved` would exit
+* non-zero forever for every stack holding an `{{resolve:ssm-secure:...}}`
+* reference — permanent, unclearable, and unrelated to this issue. See the
+* `comparisonRefused` field note, and issue
+* [#2135](https://github.com/go-to-k/cdkd/issues/2135) for the structural fix.
+*/
+function refusedComparisonOutcomes(report) {
+	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.comparisonRefused);
+}
+/**
 * `cdkd drift [<stack>...]` command implementation.
 *
 * Three operating modes (mutually exclusive):
@@ -63716,8 +64249,10 @@ async function driftCommand(stacks, options) {
 		if (options.json) writeJsonReport(reports);
 		else writeHumanReport(reports);
 		const drifted = reports.some((r) => r.outcomes.some((o) => o.kind === "drifted"));
+		const anyRefused = reports.some((r) => refusedComparisonOutcomes(r).length > 0);
 		if (!options.accept && !options.revert) {
 			if (drifted) throw new DriftDetectedError();
+			if (anyRefused) throw new DriftComparisonRefusedError();
 			return;
 		}
 		if (!drifted) {
@@ -63938,6 +64473,164 @@ function collectDynamicReferencePaths(value, into, path = "") {
 	if (value !== null && typeof value === "object") for (const [k, v] of Object.entries(value)) collectDynamicReferencePaths(v, into, path === "" ? k : `${path}.${k}`);
 }
 /**
+* The drift command's resolvers for ONE stack: the stack's own, plus one pinned
+* sibling per FOREIGN region an ARN-named reference asks for (issue
+* [#2108](https://github.com/go-to-k/cdkd/issues/2108)).
+*
+* The structural twin of the rollback replay's `ReplayResolvers`
+* (`src/deployment/rollback-executor.ts`), and deliberately a SEPARATE class
+* rather than an export of that one: the two are ~20 lines of caching around a
+* constructor, and exporting the replay's would put a rollback-internal name on
+* the drift command's contract for no behavioural gain. What is SHARED is the
+* part with a decision in it — `classifyReplaySecretRegion`, imported.
+*
+* One instance per STACK, not per resource and not per op — the resolved-value
+* cache lives on the resolver INSTANCE since issue
+* [#1933](https://github.com/go-to-k/cdkd/issues/1933), so a resolver per
+* resource would re-fetch every referenced secret once per resource. The pinned
+* siblings are cached for the same reason: a 50-resource stack sharing one
+* foreign ARN must pay one `GetSecretValue`, not fifty.
+*
+* A pinned sibling is a PLAIN resolver, deliberately NOT the resolver class's
+* own `producerRegionGuest`, and the argument is `ReplayResolvers`' verbatim:
+* {@link forRegion} is reached ONLY from a `named-region` verdict, which
+* `classifyReplaySecretRegion` returns only when the SECRET_ID / parameter name
+* starts with `arn:` and carries a region. So a pinned sibling only ever
+* resolves an expression whose KEY EMBEDS THE REGION IT IS BEING RESOLVED IN,
+* and the process-global `recordedSecretExpressions` store — keyed by the
+* expression string alone — cannot have two regions sharing that key. If a
+* future change ever routes a region-LESS expression here, the argument dies
+* with it and the sibling needs the guest flag.
+*/
+var DriftSecretResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* A DELIBERATE refusal to resolve a state-recorded dynamic reference (issue
+* #2108) — as opposed to a failure to READ one.
+*
+* The distinction is load-bearing for what the user is told: "could not
+* resolve" sends a reader hunting for a missing `secretsmanager:GetSecretValue`
+* grant, while a refusal is cdkd declining to resolve a reference it CAN read
+* but cannot attribute to a region. Both call sites that catch
+* `resolveStateSecretExpressions` pick their wording from this class.
+*
+* DEFINED POSITIVELY, and that is the whole point of the class existing rather
+* than a second `err.code === ...` comparison at each site. Both sites used to
+* enumerate the one code they knew (`DRIFT_SECRET_REGION_AMBIGUOUS`) while
+* `DRIFT_SECRET_TOKEN_SCAN_MISMATCH` — whose own message says "Refusing rather
+* than resolving" — silently took the read-failure wording. Enumerating bad
+* shapes loses that race every time a third refusal is added; a refusal that
+* has to declare itself one cannot be added without answering the question.
+*
+* The `code` stays per-refusal: it is what the message and any future
+* programmatic consumer key on. What this class adds is the CATEGORY.
+*/
+var DriftSecretRefusalError = class DriftSecretRefusalError extends CdkdError {
+	/** Marker read by {@link isDriftSecretRefusal}; see the class note. */
+	driftSecretRefusal = true;
+	constructor(message, code) {
+		super(message, code);
+		this.name = "DriftSecretRefusalError";
+		Object.setPrototypeOf(this, DriftSecretRefusalError.prototype);
+	}
+};
+/**
+* Whether an error thrown out of `resolveStateSecretExpressions` is a
+* deliberate REFUSAL rather than a failed read. See
+* {@link DriftSecretRefusalError}.
+*/
+function isDriftSecretRefusal(err) {
+	return err instanceof DriftSecretRefusalError;
+}
+/**
+* The refusal a region-AMBIGUOUS drift reference throws (issue #2108).
+*
+* A plain throw: BOTH call sites already wrap `resolveStateSecretExpressions`
+* in a per-resource catch that degrades instead of aborting the command, and
+* the degradation each one performs is exactly the fail-closed behaviour this
+* refusal wants.
+*
+*  - DETECTION falls back to the UNRESOLVED baseline, whose `{{resolve:...}}`
+*    leaves `calculateResourceDrift` skips — so the secret-bearing property is
+*    NOT COMPARED rather than compared against a foreign region's plaintext.
+*    That is strictly better than the phantom drift this issue reports, and the
+*    offline `seededSecretPaths` still masks the position.
+*  - REVERT counts the resource as unresolvable and returns BEFORE
+*    `provider.update`, so nothing is written. Refusing is strictly better than
+*    the alternative it replaces: resolving a producer-region reference against
+*    the consumer's region does not fail, it succeeds with the WRONG credential
+*    and writes it to a live resource.
+*
+* Names the reference, the regions and the remedy. Never a resolved value:
+* nothing has been resolved when this is thrown (the refusal runs over the
+* WHOLE leaf before any reference in it is fetched), and the expression is the
+* same string `state.json` already stores in the clear.
+*/
+function regionAmbiguousDriftSecretError(logicalId, propertyPath, secretName, foreignProducerRegions, consumerRegion) {
+	const where = propertyPath === "" ? "" : ` property '${propertyPath}'`;
+	return new DriftSecretRefusalError(`${logicalId}${where}: the secret reference '${secretName}' carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${consumerRegion}'. A secret of the same name in two regions is two independent values, so cdkd would compare against — and with --revert WRITE — the WRONG secret. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd drift'.`, "DRIFT_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* Re-resolve one LEAF string, sending each `{{resolve:...}}` reference in it to
+* the region {@link classifyReplaySecretRegion} says must answer (issue #2108).
+*
+* Mirrors the rollback replay's `resolveLeafByRegion` down to the ordering, and
+* for the same reasons:
+*
+*  - Refuses FIRST, over the whole leaf, before any reference is fetched. A leaf
+*    can splice several references together, and resolving the safe ones first
+*    would leave half a credential fetched — and CACHED, and recorded as a
+*    redaction needle — for a resource that is about to be refused anyway.
+*  - With no foreign-region reference (every leaf on every pre-#2108 code path)
+*    the leaf goes to `resolveDynamicReferences` WHOLE, byte-for-byte as before.
+*    That method collects its matches from the ORIGINAL string, so a resolved
+*    plaintext that is itself token-shaped is never re-resolved (issue #1917),
+*    and this change does not want to relitigate any of it.
+*  - With one, the leaf is rebuilt segment by segment so each reference can be
+*    resolved by its OWN region's resolver, since `resolveDynamicReferences`
+*    resolves every token in the string it is handed with the one resolver it
+*    is called on. Each token is resolved ALONE and concatenated, so no resolved
+*    value is re-scanned for tokens either.
+*
+* `dynamicReferenceTokens` returns the tokens in order and non-overlapping, so
+* walking the leaf with a moving `indexOf` cursor reproduces their positions
+* exactly, duplicates included.
+*/
+async function resolveDriftLeafByRegion(leaf, propertyPath, logicalId, consumerRegion, producerRegions, resolvers, ctx) {
+	const verdicts = dynamicReferenceTokens(leaf).map((token) => [token, classifyReplaySecretRegion(token, consumerRegion, producerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousDriftSecretError(logicalId, propertyPath, verdict.secretName, verdict.foreignProducerRegions, consumerRegion);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return await resolvers.primary.resolveDynamicReferences(leaf, ctx);
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new DriftSecretRefusalError(`${logicalId}${propertyPath === "" ? "" : ` property '${propertyPath}'`}: could not locate a scanned dynamic reference in the value it was scanned from. Refusing rather than resolving it in '${consumerRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "DRIFT_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		const resolver = verdict.kind === "named-region" ? resolvers.forRegion(verdict.region) : resolvers.primary;
+		out += await resolver.resolveDynamicReferences(token, ctx);
+		cursor = at + token.length;
+	}
+	return out + leaf.slice(cursor);
+}
+/**
 * Re-resolve the SECRET dynamic references (`{{resolve:secretsmanager:...}}`,
 * and an `{{resolve:ssm:...}}` naming a `SecureString`) held by a bag read back
 * out of cdkd STATE (issue #1914).
@@ -63975,10 +64668,15 @@ function collectDynamicReferencePaths(value, into, path = "") {
 *
 * Returns the input by identity when it holds no dynamic reference, so the
 * non-secret path is unchanged down to object identity.
+*
+* Issue [#2108](https://github.com/go-to-k/cdkd/issues/2108): every reference
+* is now routed to the region that must ANSWER for it rather than to the
+* consumer's, through {@link DriftSecretResolvers} — see
+* {@link resolveDriftLeafByRegion}.
 */
-async function resolveStateSecretExpressions(props, resolver, secrets, options = {}) {
+async function resolveStateSecretExpressions(props, resolvers, secrets, options) {
 	if (!containsDynamicReference(props)) return props;
-	const { secretPaths, onUnresolved } = options;
+	const { secretPaths, onUnresolved, producerRegions, logicalId, consumerRegion } = options;
 	const ctx = {
 		template: { Resources: {} },
 		resources: {},
@@ -63987,7 +64685,7 @@ async function resolveStateSecretExpressions(props, resolver, secrets, options =
 	const walk = async (v, path) => {
 		if (typeof v === "string") {
 			if (!v.includes("{{resolve:")) return v;
-			const resolved = await resolver.resolveDynamicReferences(v, ctx);
+			const resolved = await resolveDriftLeafByRegion(v, path, logicalId, consumerRegion, producerRegions, resolvers, ctx);
 			const survivors = survivingDynamicReferences(resolved).filter((t) => v.includes(t));
 			if (survivors.length > 0) {
 				if (survivors.some(isSecretBySpelling)) secretPaths?.add(path);
@@ -64148,7 +64846,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 		const outcomes = [];
 		const state = result.state;
 		const logger = getLogger();
-		const secretResolver = new IntrinsicFunctionResolver(region);
+		const secretResolvers = new DriftSecretResolvers(region);
+		const producerRegions = producerRegionsFromState(state);
 		const entries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 		for (const [logicalId, resource] of entries) {
 			if (providerRegistry.shouldSkipResource(resource.resourceType)) continue;
@@ -64220,18 +64919,25 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			let comparisonBaseline = baseline;
 			let secretResolutionFailed = false;
 			try {
-				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolver, secrets, {
+				comparisonBaseline = await resolveStateSecretExpressions(baseline, secretResolvers, secrets, {
 					secretPaths,
-					onUnresolved: noteUnresolved
+					onUnresolved: noteUnresolved,
+					logicalId,
+					consumerRegion: region,
+					producerRegions
 				});
-				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolver, secrets, {
+				if (useObserved) await resolveStateSecretExpressions(resource.properties ?? {}, secretResolvers, secrets, {
 					secretPaths,
-					onUnresolved: noteUnresolved
+					onUnresolved: noteUnresolved,
+					logicalId,
+					consumerRegion: region,
+					producerRegions
 				});
 			} catch (err) {
 				secretResolutionFailed = true;
 				comparisonBaseline = baseline;
-				logger.warn(`${logicalId} (${resource.resourceType}): could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				const refused = isDriftSecretRefusal(err);
+				logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				secrets.clear();
 			}
 			if (unresolvedTokens.size > 0) logger.warn(`${logicalId} (${resource.resourceType}): cdkd cannot resolve ${maskSecretsInText([...unresolvedTokens].join(", "), secrets)} — those properties are NOT compared. A revert leaves a property whose WHOLE value is one of these tokens untouched; where a token is EMBEDDED in a longer string, the revert writes that string with the token literal, exactly as 'cdkd deploy' does — so a resolved value AWS holds there WOULD be overwritten. cdkd resolves 'secretsmanager' and 'ssm' references only.`);
@@ -64247,10 +64953,14 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				unionWalkObjects: useObserved,
 				unorderedPaths
 			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
+			const referencesUnresolved = secretResolutionFailed || unresolvedTokens.size > 0;
+			const comparisonRefused = secretResolutionFailed;
 			if (reported.changes.length === 0) outcomes.push({
 				kind: "clean",
 				logicalId,
-				resourceType: resource.resourceType
+				resourceType: resource.resourceType,
+				referencesUnresolved,
+				comparisonRefused
 			});
 			else outcomes.push({
 				kind: "drifted",
@@ -64259,7 +64969,8 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				...reported,
 				awsProperties: aws,
 				secrets,
-				referencesUnresolved: secretResolutionFailed || unresolvedTokens.size > 0
+				referencesUnresolved,
+				comparisonRefused
 			});
 		}
 		return {
@@ -64978,7 +65689,8 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
-		const revertSecretResolver = new IntrinsicFunctionResolver(report.region);
+		const revertSecretResolvers = new DriftSecretResolvers(report.region);
+		const revertProducerRegions = producerRegionsFromState(report.state);
 		try {
 			await runWithConcurrency(driftedOutcomes.map((outcome) => async () => {
 				const stateResource = report.state.resources[outcome.logicalId];
@@ -64999,11 +65711,21 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 				};
 				let desiredProperties;
 				try {
-					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
-					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolver, secrets, { onUnresolved: noteUnresolved });
+					desiredProperties = await resolveStateSecretExpressions(revertBaseline, revertSecretResolvers, secrets, {
+						onUnresolved: noteUnresolved,
+						logicalId: outcome.logicalId,
+						consumerRegion: report.region,
+						producerRegions: revertProducerRegions
+					});
+					if (stateResource.observedProperties !== void 0) await resolveStateSecretExpressions(stateResource.properties ?? {}, revertSecretResolvers, secrets, {
+						onUnresolved: noteUnresolved,
+						logicalId: outcome.logicalId,
+						consumerRegion: report.region,
+						producerRegions: revertProducerRegions
+					});
 				} catch (err) {
 					totalUnresolvable++;
-					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not re-resolve the dynamic reference(s) this resource's state records — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ` + (isDriftSecretRefusal(err) ? `refused to re-resolve a dynamic reference this resource's state records — ` : `could not re-resolve the dynamic reference(s) this resource's state records — `) + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
@@ -65204,9 +65926,15 @@ function writeJsonReport(reports) {
 		const drifted = r.outcomes.filter((o) => o.kind === "drifted").map((o) => ({
 			logicalId: o.logicalId,
 			type: o.resourceType,
-			changes: o.changes
+			changes: o.changes,
+			referencesUnresolved: o.referencesUnresolved
 		}));
 		const clean = r.outcomes.filter((o) => o.kind === "clean").map((o) => ({
+			logicalId: o.logicalId,
+			type: o.resourceType,
+			referencesUnresolved: o.referencesUnresolved
+		}));
+		const notCompared = notComparedOutcomes(r).map((o) => ({
 			logicalId: o.logicalId,
 			type: o.resourceType
 		}));
@@ -65224,7 +65952,8 @@ function writeJsonReport(reports) {
 			drifted,
 			clean,
 			notSupported,
-			skipped
+			skipped,
+			notCompared
 		};
 	});
 	process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
@@ -65234,8 +65963,11 @@ function writeHumanReport(reports) {
 		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
 		const unsupported = report.outcomes.filter((o) => o.kind === "unsupported");
 		const skippedCount = report.outcomes.filter((o) => o.kind === "skipped").length;
-		const checked = report.outcomes.length - skippedCount;
-		if (drifted.length === 0) process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
+		const inspected = report.outcomes.length - skippedCount;
+		const notCompared = notComparedOutcomes(report);
+		const checked = inspected - notCompared.length;
+		if (drifted.length === 0) if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked (${notCompared.length} only partially compared, ${unsupported.length} unsupported)\n`);
+		else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		else {
 			const word = drifted.length === 1 ? "resource" : "resources";
 			process.stdout.write(`\n⚠ ${report.stackName} (${report.region}): drift detected on ${drifted.length} ${word}\n\n`);
@@ -65248,6 +65980,10 @@ function writeHumanReport(reports) {
 				process.stdout.write("\n");
 			}
 		}
+		if (notCompared.length > 0) {
+			process.stdout.write(`\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n`);
+			for (const o of notCompared) process.stdout.write(`    ! ${o.logicalId} (${o.resourceType})\n`);
+		}
 		if (unsupported.length > 0) {
 			process.stdout.write(`\n  ${unsupported.length} resource(s) reported as drift unknown — provider does not yet support drift detection:\n`);
 			for (const o of unsupported) process.stdout.write(`    ? ${o.logicalId} (${o.resourceType})\n`);
@@ -65276,7 +66012,7 @@ function stackRegionOption$2() {
 * Create the `drift` command.
 */
 function createDriftCommand() {
-	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when no drift, 1 when drift is detected. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
+	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when nothing drifted, 1 when drift is detected, and 2 when nothing drifted but cdkd REFUSED to compare a resource, because a dynamic reference its state records could not be attributed to a region. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
 	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -84259,7 +84995,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.27");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.29");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;