@go-to-k/cdkd 0.284.28 → 0.284.30

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as endCommandInterruptScope, $n as LocalInvokeBuildError$1, $t as rewriteTemplateAssetReferences, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as warnDeprecatedNoPrefixCliFlag, At as scrubResourceRecord, B as collectDeclaredOutputNames, Bn as AssemblyReader, Bt as withRetry, C as ccRoutedFinalSnapshotError, Cn as resolveAutoAssetStorage, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveStateBucketWithDefaultAndSource, Dt as isSingleDynamicReferenceToken, E as refusesFinalSnapshot, En as resolveStateBucketWithDefault, Et as dynamicReferenceTokens, F as cyan, Fn as uploadCfnTemplate, Ft as s3BucketWebsiteUrl, G as stateKeySecretExposure, Gn as getAwsClients, Gt as rebuildClientForBucketRegion, H as exportAliasCollisionScrubWarning, Ht as TemplateParser, I as gray, In as expectedOwnerParam, It as applyRoleArnIfSet, J as clearOnUpdateRemoval, Jt as stringifyValue, K as IAMRoleProvider, Kn as resetAwsClients, Kt as shouldRetainResource, L as green, Ln as PARTITION_TABLE, Lt as DiffCalculator, M as renderStatefulReason, Mn as CFN_TEMPLATE_URL_LIMIT, Mt as s3BucketDomainName, N as formatResourceLine, Nn as MIGRATE_TMP_PREFIX, Nt as s3BucketDualStackDomainName, O as makeCanonicalizePropertiesFn, On as resolveUseCdkBootstrapAssets, Ot as maskSecretsInText, P as bold, Pn as findLargeInlineResources, Pt as s3BucketRegionalDomainName, Q as beginCommandInterruptScope, Qn as DeployCancelledError, Qt as loadPublishableAssetManifest, R as red, Rn as canonicalizeRegion, Rt as INTRINSIC_KEYS, S as buildFinalSnapshotIdentifier, Sn as resolveApp, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveSkipPrefix, Tt as createSecretMasker, U as isExportAliasCollision, Un as resolveBucketRegion, Ut as LockManager, V as collectPublishedOutputNames, Vn as processStackMessages, Vt as DagBuilder, W as secretBearingStateKeyWarning, Wn as AwsClients, Wt as S3StateBackend, X as findActionableSilentDrops, Xt as buildAssetRedirectMap, Y as ProviderRegistry, Yn as CdkdError, Yt as WorkGraph, Z as findSilentDropProperties, Zt as createAssetRedirectResolver, _ as maskingRetryLogger, _n as getDockerImageBySourceHash, _r as isMarkedNonRetryable, _t as readConfigString, a as DeploymentEventsStore, an as getBootstrapMarkerKey, ar as PartialFailureError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as getDefaultStateBucketName, br as markNonRetryable, bt as requireConfigObject, c as planRollback, cn as validateAssetBucketName, cr as ResourceUpdateNotSupportedError, ct as getAccountInfo, d as replayRollback, dn as buildDockerImage, dt as normalizeAwsTagsToCfn, en as escapeRegExp, er as LocalMigrateError, et as isInterruptedWaitError, f as updatePartialMessage, fn as formatDockerLoginError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as AssetManifestLoader, gr as withErrorHandling, gt as configStringRefusal, h as deleteSkipReason, hn as runDockerStreaming, hr as normalizeAwsError, ht as configBooleanRefusal, i as DeploymentEventsReader, in as ensureAssetStorage, ir as NestedStackChildDirectDestroyError, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as CFN_TEMPLATE_BODY_LIMIT, jt as s3BucketArn, k as extractDeploymentEventError, kn as stateBucketExistenceConfirmed, kt as redactSecretsForState, l as producerRegionsFromState, ln as validateContainerRepoName, lr as StackHasActiveImportsError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as runDockerForeground, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AssetModeResolver, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as parseBootstrapMarker, or as ProvisioningError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as getDockerCmd, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as setAwsClients, qt as AssetPublisher, r as DeployEngine, rn as BOOTSTRAP_MARKER_PREFIX, rr as MissingCdkCliError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as readBootstrapMarkerBody, sr as ResourceTimeoutError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stripControlChars, tr as LocalStartServiceError, tt as startInterruptWatch, u as replayFailedOperations, un as buildDenyExternalAccessPolicy, ur as StackTerminationProtectionError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as Synthesizer, vr as isRetryableTransientError, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveCaptureObservedState, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as getLegacyStateBucketName, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as synthesisStatusMessage, yr as isThrottlingError, yt as requireConfigArray, z as yellow, zn as derivePartitionAndUrlSuffix, zt as describeTypeWithThrottleRetry } from "./deploy-engine-DP_MejgP.js";
+import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-BFgi0RJr.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DWL4tZYx.js";
+import { t as ASGProvider } from "./asg-provider-qMgJEhCM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -62212,6 +62212,62 @@ var ScrubNeededError = class ScrubNeededError extends CdkdError {
 	}
 };
 /**
+* Every `cdkd scrub` REFUSAL — a reference this command cannot safely
+* re-resolve, and the per-stack failures that refusal produces under `--all`
+* (issue [#2109](https://github.com/go-to-k/cdkd/issues/2109) review).
+*
+* `exitCode = 2` rather than `CdkdError`'s default of 1, because 1 is already
+* SPOKEN FOR: `--fail` throws {@link ScrubNeededError} for "plaintext is in
+* state", and `docs/cli-reference.md` documents the pair as `1` (`--fail` found
+* plaintext) / `2` (error). A refusal is the second one, and left on the default
+* a CI gate reading the exit code alone could not tell "scrub looked and found a
+* leak" from "scrub refused to look" — the two call for opposite responses
+* (rotate the secret vs. re-spell the reference and re-run).
+*/
+var ScrubRefusalError = class ScrubRefusalError extends CdkdError {
+	exitCode = 2;
+	constructor(message, code) {
+		super(message, code);
+		this.name = "ScrubRefusalError";
+		Object.setPrototypeOf(this, ScrubRefusalError.prototype);
+	}
+};
+/**
+* One failed stack's reason, INCLUDING its `cause` chain (issue #2109 review).
+*
+* `err.message` alone drops the actionable half of a wrapped failure: a
+* provider or AWS error is routinely a generic sentence over the link that
+* names the role, the bucket or the denied action. The chain is walked with
+* `errorCauseChain` rather than a local loop so the links PRINTED are exactly
+* the links `maskSecretsInError` masked at `scrubStack`'s boundary — a private
+* walk would eventually render a link past that function's depth cap, which
+* still carries its original, unmasked message.
+*/
+function describeFailure(err) {
+	if (!(err instanceof Error)) return String(err);
+	return errorCauseChain(err).map((link, i) => i === 0 ? link.message : `\n    Caused by: ${link.message}`).join("");
+}
+/**
+* The error a `--all` run ends with when one or more stacks could not be
+* scrubbed (issue #2109 review).
+*
+* Every stack is NAMED: the per-stack boundary keeps the run going, and a
+* single "3 stacks failed" line would make the operator re-run the command to
+* find out which. `exitCode = 2` for the same reason every other scrub refusal
+* carries it — `1` means "`--fail` found plaintext".
+*
+* The REASONS are deliberately not repeated here. Each was already logged at
+* `error` level, in run order, next to the progress lines for the stacks around
+* it; `handleError` then prints this message, so restating every reason made
+* the whole failure set appear TWICE in one terminal — directly under a summary
+* whose own note says "see the errors above". Names are kept because they are
+* what a reader needs to FIND those lines, and because the count alone is the
+* thing the paragraph above rejects.
+*/
+function scrubStacksFailedError(failures) {
+	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
+}
+/**
 * `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
 * reference is stored as its UNRESOLVED expression rather than the plaintext
 * value (GHSA fix). "Secret" here is whatever the RESOLVER classifies as one,
@@ -62332,12 +62388,22 @@ async function scrubCommand(stacks, options) {
 	const lockManager = new LockManager(stateS3.s3, stateConfig);
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
+	const failures = [];
 	for (const stack of targetStacks) {
-		const scrubbed = await scrubStack(stack, stack.region || region, stateBackend, lockManager, {
-			dryRun: options.dryRun ?? false,
-			roleArn: options.roleArn,
-			logger
-		});
+		const stackRegion = stack.region || region;
+		let scrubbed;
+		try {
+			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
+				dryRun: options.dryRun ?? false,
+				roleArn: options.roleArn,
+				logger
+			});
+		} catch (err) {
+			failures.push({ stackName: stack.stackName });
+			logger.error(`Scrub of ${stack.stackName} failed: ${describeFailure(err)}`);
+			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
+			continue;
+		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
@@ -62348,18 +62414,25 @@ async function scrubCommand(stacks, options) {
 		}
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0) {
-		logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
-		return;
+		if (failures.length === 0) {
+			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+			return;
+		}
+		logger.info(`\nNo plaintext secrets found in the ${targetStacks.length - failures.length} stack(s) this run could examine. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.`);
+		throw scrubStacksFailedError(failures);
 	}
+	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${failureNote} ROTATE any exposed secret.`);
+		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${failureNote}`);
+	else logger.info(`\nNothing could be rewritten.${keyNote}${failureNote} ROTATE any exposed secret.`);
+	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
 }
 /**
@@ -62554,6 +62627,351 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	return repaired ?? positioned;
 }
 /**
+* The producer regions that are genuinely FOREIGN to this stack, canonicalized
+* and de-duplicated (issue #2109 review).
+*
+* The same filter {@link classifyReplaySecretRegion} applies to its own
+* `importedProducerRegions` argument, spelled here because the
+* unclassifiable-reference guard needs the answer WITHOUT an expression to hand
+* to the classifier. A same-region cross-stack read is the common case and
+* raises no cross-region question, so it must not arm a refusal.
+*/
+function foreignRegionsOf(producerRegions, stackRegion) {
+	const seen = /* @__PURE__ */ new Set();
+	const foreign = [];
+	for (const candidate of producerRegions) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(stackRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreign.push(candidate);
+	}
+	return foreign;
+}
+/**
+* The `cdkd scrub` resolvers: the stack's own, plus one pinned sibling per
+* FOREIGN region an ARN-named secret reference asks for (issue
+* [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
+*
+* The same shape as `rollback-executor.ts`'s `ReplayResolvers`, and for the
+* same reasons. One instance per stack rather than per reference, because the
+* resolved-value cache lives on the resolver INSTANCE (issue #1933) — a
+* resolver per reference would re-fetch every secret once per reference. And
+* the pinned sibling is a PLAIN resolver, not a `producerRegionGuest`: it is
+* reached ONLY from a `named-region` verdict, which
+* {@link classifyReplaySecretRegion} returns only for an expression whose
+* SECRET_ID / parameter name starts with `arn:` and carries a region, so a
+* sibling only ever resolves an expression whose key EMBEDS the region it is
+* being resolved in. The process-global verdict store is keyed by the
+* expression STRING alone, and an ARN-form key cannot be shared by two regions,
+* so a sibling can never pin one region's verdict for another region's key. If
+* a future change ever routes a region-LESS expression here, that argument dies
+* with it and the sibling needs the guest flag.
+*/
+var ScrubResolvers = class {
+	/** The stack's own resolver — every `local` verdict resolves through this. */
+	primary;
+	pinned = /* @__PURE__ */ new Map();
+	stackRegion;
+	constructor(stackRegion) {
+		this.stackRegion = stackRegion;
+		this.primary = new IntrinsicFunctionResolver(stackRegion);
+	}
+	/** The resolver that must answer for `region` — `primary` when it is the stack's own. */
+	forRegion(region) {
+		const target = canonicalizeRegion(region);
+		if (target === canonicalizeRegion(this.stackRegion)) return this.primary;
+		const cached = this.pinned.get(target);
+		if (cached) return cached;
+		const scoped = new IntrinsicFunctionResolver(target);
+		this.pinned.set(target, scoped);
+		return scoped;
+	}
+};
+/**
+* The refusal a region-AMBIGUOUS reference raises (issue #2109), the twin of
+* `rollback-executor.ts`'s `regionAmbiguousReplaySecretError`.
+*
+* A `CdkdError`, so it leaves `scrubStack` -> `scrubCommand` ->
+* `withErrorHandling` as a NON-ZERO EXIT with the message printed. That
+* visibility is the acceptance criterion of the issue, not a detail of it: the
+* one outcome that must not survive is scrub reporting success over a document
+* it did not scrub, and a debug log next to a `Done: scrubbed 0 stack(s)` line
+* IS that outcome.
+*
+* It refuses the whole STACK rather than the one reference, which is wider than
+* it needs to be and is the deliberate side of the trade. Scrubbing the rest
+* and reporting success would leave the operator with "no plaintext secrets
+* found" over state that still holds one — the failure this command exists to
+* prevent, arriving through the remediation. Names the reference, both regions
+* and the remedy so the refusal is actionable.
+*
+* Never the resolved value: nothing has been resolved for this reference, and
+* the expression is the same string `state.json` already stores in the clear.
+*/
+function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion) {
+	return new ScrubRefusalError(`Scrub of ${stackName} cannot re-resolve the secret reference '${secretName}' in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${stackRegion}'. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
+}
+/**
+* The refusal a `named-region` reference raises when its OWN region cannot
+* answer for it (issue #2109).
+*
+* Continuing would hand the leaf back to the stack's own resolver, which is
+* issue #2109 verbatim — so this fails closed for the same reason the ambiguous
+* arm does. The cause is echoed because it is the actionable half (a denied
+* read in the producer region reads very differently from a missing secret) —
+* but MASKED against everything this run has recorded so far (issue #2109
+* review). No resolver error carries a plaintext today; the rule on this repo is
+* that a path which interpolates a foreign message into user-visible text masks
+* it anyway, because the day one does is the day the remediation command prints
+* the secret it exists to remove. The map is the SAME one the resolution records
+* into, so a value recorded a moment earlier in this very leaf is covered.
+*/
+function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
+	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the secret reference '${secretName}' in ${origin} in the region its ARN names ('${region}'): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+}
+/**
+* The literal that OPENS a dynamic reference. Used as the CHEAP pre-filter that
+* decides whether a leaf is walked at all — see {@link pinCrossRegionSecrets}.
+*/
+const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
+/**
+* The openings the assembled-reference guard actually COUNTS: `{{resolve:`
+* followed by a service whose VALUE CloudFormation defines as a secret. Counted
+* against the number of WHOLE tokens of the same class the scan matched, which
+* is how an ASSEMBLED reference is detected without parsing intrinsics — see
+* {@link unclassifiableScrubSecretError}.
+*
+* WHY THE SERVICE IS PART OF THE OPENING (issue #2109 review). Counting the bare
+* `{{resolve:` made the guard fire on any leaf that merely MENTIONS the syntax
+* — measured: `Use the {{resolve: prefix for dynamic references` and
+* `{{resolve:}}` both count one opening and zero tokens. A description, an IAM
+* policy document, a UserData script or an environment variable saying that is
+* ordinary, and the refusal is permanent for the whole stack (exit 2, no bypass
+* flag) with a remedy — "spell the reference as one complete literal" — that is
+* unactionable for prose. Requiring the service makes the count a count of
+* SECRET references rather than of the characters `{{resolve:`.
+*
+* `secretsmanager` / `ssm` mirror `REPLAY_SECRET_SERVICES` in
+* `rollback-executor.ts`, whose {@link classifyReplaySecretRegion} is what
+* classifies the tokens below — the same set on both sides, so the count and
+* the classification never disagree about what is in scope. `ssm-secure` is
+* added on top: it IS a CloudFormation secret spelling, and although cdkd does
+* not resolve it today (the resolver's unsupported-service arm leaves it
+* verbatim, so it can never become a wrong-region needle), counting it costs
+* only an assembled `ssm-secure` reference in a cross-region stack and keeps
+* the guard correct the day that arm changes.
+*
+* THE TRADE, stated rather than hidden: an `Fn::Join` that splits BEFORE the
+* service name (`['{{resolve:', 'secretsmanager:db:SecretString:pw}}']`) has no
+* counted opening in either part and stops being caught by this guard. The part
+* carrying the service has no `{{resolve:` at all, so `pinCrossRegionSecrets`
+* returns it by identity too. That shape falls to the same resolver-side
+* classification issue [#2134](https://github.com/go-to-k/cdkd/issues/2134)
+* tracks.
+*/
+const SECRET_REFERENCE_OPENINGS = [
+	`${DYNAMIC_REFERENCE_OPENING}secretsmanager:`,
+	`${DYNAMIC_REFERENCE_OPENING}ssm:`,
+	`${DYNAMIC_REFERENCE_OPENING}ssm-secure:`
+];
+/**
+* What an `Fn::Sub` placeholder opens with. A whole token that CONTAINS one is
+* the third assembled shape — see {@link unclassifiableScrubSecretError}.
+*/
+const SUB_PLACEHOLDER_OPENING = "${";
+/** How many SECRET references {@link SECRET_REFERENCE_OPENINGS} `leaf` opens. */
+function countSecretReferenceOpenings(leaf) {
+	let count = 0;
+	for (const opening of SECRET_REFERENCE_OPENINGS) count += leaf.split(opening).length - 1;
+	return count;
+}
+/** Whether a WHOLE token the scan matched is one of the secret spellings. */
+function isSecretReferenceToken(token) {
+	return SECRET_REFERENCE_OPENINGS.some((opening) => token.startsWith(opening));
+}
+/**
+* The refusal an ASSEMBLED reference raises (issue #2109 review): a leaf that
+* OPENS more SECRET references than the scan found COMPLETE tokens of that
+* class in it, or a whole token that still carries an `Fn::Sub` placeholder.
+*
+* WHY THIS EXISTS, and it is the load-bearing half of this pre-pass rather than
+* an edge case. The region split runs on the RAW template leaf, BEFORE intrinsic
+* resolution, and the shared token scan is `\{\{resolve:[^}]+\}\}` — a class
+* that cannot cross a `}`. So none of the three shapes that assemble a
+* reference out of parts yields the ONE WHOLE token a literal reference does,
+* and the third one is why this guard needs two tests rather than one
+* (all four rows MEASURED):
+*
+* ```text
+*   "{{resolve:secretsmanager:my-secret:SecretString:pw}}"        1 opening, 1 token   literal
+*   "{{resolve:secretsmanager:${Env}-db:SecretString:password}}"  1 opening, 0 tokens  Fn::Sub, MID-string
+*   "{{resolve:secretsmanager:"  (one Fn::Join part)              1 opening, 0 tokens  Fn::Join split
+*   "{{resolve:secretsmanager:x:SecretString:${Field}}}"          1 opening, 1 token   Fn::Sub, TRAILING
+* ```
+*
+* The first two assembled rows are caught by the COUNT. The fourth is not, and
+* the count can never catch it: `[^}]+` stops at the `}` of `${Field}` and the
+* `}}` that follows closes the match one brace short, so the scan returns
+* `"{{resolve:secretsmanager:x:SecretString:${Field}"` + `}` — a token, of the
+* right class, exactly one per opening. It is caught instead by the second
+* test: a WHOLE token that still contains `${` has not been assembled yet.
+* Neither a Secrets Manager secret name nor an SSM parameter name may contain
+* `$` or `{`, so the only false positive that test can produce is a JSON key
+* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and
+* this guard is the fail-closed side of a command whose subject is a leaked
+* plaintext.
+*
+* With no token there is nothing to classify: {@link pinCrossRegionSecrets}
+* returns the leaf BY IDENTITY, and `resolveJoin` / `resolveSub` then call
+* `resolveDynamicReferences` on the PRIMARY resolver once they have joined the
+* parts — issue #2109 verbatim, with the `ambiguous` refusal never firing. The
+* trailing-placeholder row got there a different way before this guard's second
+* test: the token WAS classified, and only downstream luck kept it safe (the
+* name form then classifies `ambiguous`, the ARN form fails into
+* `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it looks up still has a
+* literal `${Field}` in it). Both are pinned by the suite rather than assumed.
+* Fixing all of this inside the resolver (classify AFTER assembly) is the
+* structurally right answer and is NOT what this does: the resolver's
+* dynamic-reference path is shared with deploy and is out of this change's
+* scope. This guard buys the same SAFETY property — a reference whose region
+* cannot be established is never resolved in the stack's own region — by
+* refusing instead.
+*
+* GATED ON A FOREIGN PRODUCER REGION BEING ON RECORD, which is what keeps it
+* from refusing the world. With no foreign region on record there is no
+* cross-region question to get wrong: every reference in the stack resolves
+* locally, which is what an assembled one would have done anyway, so proceeding
+* is exactly today's behavior. Two residuals, stated rather than hidden:
+* an assembled reference that names a FOREIGN ARN inside an `Fn::Sub` in a
+* stack with NO cross-stack read on record is still resolved locally; and an
+* `Fn::Join` that splits BEFORE the service name is not counted at all (see
+* {@link SECRET_REFERENCE_OPENINGS}). Closing either needs the resolver-side
+* classification above — issue
+* [#2134](https://github.com/go-to-k/cdkd/issues/2134).
+*/
+function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProducerRegions, stackRegion) {
+	return new ScrubRefusalError(`Scrub of ${stackName} cannot classify a secret reference in ${origin}${leafPath ? ` at '${leafPath}'` : ""}: the value opens a '{{resolve:...}}' reference that is ASSEMBLED by an intrinsic (an Fn::Sub placeholder inside it, or an Fn::Join that splits it across parts), so the reference does not exist as a complete expression until AFTER it is resolved — and its region therefore cannot be determined before resolution. This stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so resolving it in '${stackRegion}' may look for a different region's secret: scrub would then miss the plaintext it exists to remove and report the stack clean. Refusing instead. Spell the reference as one complete literal '{{resolve:secretsmanager:<full ARN>:SecretString:...}}' — an ARN names its own region — then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE");
+}
+/**
+* Resolve every FOREIGN-region `{{resolve:...}}` reference in one leaf through
+* a resolver pinned to the region the expression NAMES, and refuse the ones
+* whose region cannot be established (issue #2109).
+*
+* The returned string is what the primary resolver is handed, so a foreign
+* reference is already a value by the time the stack's own region sees the
+* leaf — the local endpoint is never asked about it at all. A leaf with no
+* foreign reference is returned BY IDENTITY and takes exactly the pre-#2109
+* path: `resolveDynamicReferences` has well-tested substitution semantics (it
+* collects matches from the ORIGINAL string, so a resolved plaintext that is
+* itself token-shaped is never re-resolved — issue #1917) and this change does
+* not relitigate any of it.
+*
+* That #1917 guarantee does NOT cross this seam — the primary receives a string
+* this function already substituted into — so the result is re-scanned and a
+* token the substitution INTRODUCED is refused rather than passed on. Fail
+* closed: a stopped scrub is recoverable, a lookup for a secret id spliced
+* together out of a plaintext is not.
+*/
+async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
+	const tokens = dynamicReferenceTokens(leaf);
+	const secretTokens = tokens.filter(isSecretReferenceToken);
+	if ((countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING))) && ctx.foreignProducerRegions.length > 0) throw unclassifiableScrubSecretError(ctx.origin, leafPath, stackName, ctx.foreignProducerRegions, ctx.stackRegion);
+	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
+	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
+	const localTokens = [];
+	let out = "";
+	let cursor = 0;
+	for (const [token, verdict] of verdicts) {
+		const at = leaf.indexOf(token, cursor);
+		if (at < 0) throw new ScrubRefusalError(`Scrub of ${stackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in '${ctx.stackRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
+		out += leaf.slice(cursor, at);
+		if (verdict.kind === "named-region") {
+			const resolver = ctx.resolvers.forRegion(verdict.region);
+			try {
+				out += await resolver.resolveDynamicReferences(token, {
+					template: { Resources: {} },
+					resources: {},
+					recordedSecretValues: ctx.recordedSecretValues
+				});
+			} catch (err) {
+				throw unresolvableForeignScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.region, err, ctx.recordedSecretValues);
+			}
+		} else {
+			out += token;
+			localTokens.push(token);
+		}
+		cursor = at + token.length;
+	}
+	out += leaf.slice(cursor);
+	const surviving = dynamicReferenceTokens(out);
+	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${stackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
+	return out;
+}
+/**
+* Rewrite one template bag so every FOREIGN-region secret reference in it is
+* already resolved — in the region the expression NAMES — before the stack's
+* own resolver walks it (issue
+* [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
+*
+* WHY SCRUB NEEDS THIS AT ALL. `scrubStack` learns which plaintexts to look for
+* by RE-RESOLVING the template through one resolver built from the stack's own
+* region, and `resolveSecretsManagerReference` builds its client from that
+* region and passes the SECRET_ID through as an opaque string — the AWS SDK's
+* endpoint ruleset has no ARN-derived endpoint rule, so a reference naming
+* another region's ARN is sent to this stack's regional endpoint. Both halves
+* of that go wrong at once, and the second is the one that is easy to miss: the
+* plaintext scrub exists to remove is never found (the needle is the wrong
+* region's value), so the command reports the stack CLEAN over state that still
+* holds the secret; and the foreign value is a real string, so scanning for it
+* can rewrite an unrelated stored literal that happens to coincide.
+*
+* The split is `classifyReplaySecretRegion`'s, imported from
+* `rollback-executor.ts` rather than re-spelled — one answer to "which region
+* must answer for this expression", shared by the rollback replay (#2057) and
+* by scrub. Its known OVER-refusal is inherited with it: a name-form reference
+* in a stack with ANY foreign producer region on record is refused even when it
+* is the stack's own purely-local secret, because the evidence
+* (`state.imports` / `state.outputReads`) is per-STACK and not per-reference.
+* That is the fail-closed side of a trade whose other side is a silently
+* unscrubbed state file.
+*
+* Returns the bag BY IDENTITY when nothing was foreign, which is every bag on
+* every existing code path. The caller keeps the ORIGINAL bag as its position
+* source either way — a substituted copy must never reach
+* `redactSecretsForState`, whose whole job is to read UNRESOLVED expressions
+* off it.
+*/
+async function pinCrossRegionSecrets(bag, stackName, ctx) {
+	const walk = async (v, path) => {
+		if (typeof v === "string") {
+			if (!v.includes(DYNAMIC_REFERENCE_OPENING)) return v;
+			return await resolveForeignRegionTokens(v, stackName, ctx, path);
+		}
+		if (Array.isArray(v)) {
+			const out = new Array(v.length);
+			let changed = false;
+			for (let i = 0; i < v.length; i++) {
+				out[i] = await walk(v[i], `${path}[${i}]`);
+				if (out[i] !== v[i]) changed = true;
+			}
+			return changed ? out : v;
+		}
+		if (v !== null && typeof v === "object") {
+			const out = Object.create(null);
+			let changed = false;
+			for (const [k, val] of Object.entries(v)) {
+				out[k] = await walk(val, path ? `${path}.${k}` : k);
+				if (out[k] !== val) changed = true;
+			}
+			return changed ? out : v;
+		}
+		return v;
+	};
+	return await walk(bag, "");
+}
+/**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
 * learn the resolved secret VALUES, then replaces those values in the state
 * record with their `{{resolve:...}}` expressions. Returns counts; performs no
@@ -62570,6 +62988,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const { logger } = opts;
 	const acquired = !opts.dryRun;
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
+	const perResourceSecrets = /* @__PURE__ */ new Map();
+	const outputSecrets = /* @__PURE__ */ new Map();
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -62581,11 +63001,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		}
 		const state = loaded.state;
-		const perResourceSecrets = /* @__PURE__ */ new Map();
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
-		const outputSecrets = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
-		const resolver = new IntrinsicFunctionResolver(region);
+		const resolvers = new ScrubResolvers(region);
+		const resolver = resolvers.primary;
+		const producerRegions = producerRegionsFromState(state);
+		const foreignProducerRegions = foreignRegionsOf(producerRegions, region);
 		let parameters = {};
 		let conditions = {};
 		try {
@@ -62608,8 +63029,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const templateResource = templateResources[logicalId];
 			if (!templateResource?.Properties) continue;
 			const recordedSecretValues = /* @__PURE__ */ new Map();
+			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
+				stackRegion: region,
+				producerRegions,
+				foreignProducerRegions,
+				resolvers,
+				recordedSecretValues,
+				origin: `resource '${logicalId}'`
+			});
 			try {
-				await resolver.resolve(templateResource.Properties, {
+				await resolver.resolve(resolveInput, {
 					template: stack.template,
 					resources: state.resources,
 					...Object.keys(parameters).length > 0 && { parameters },
@@ -62619,7 +63048,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					bestEffort: true
 				});
 			} catch (err) {
-				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 			}
 			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -62633,19 +63062,29 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		for (const [name, output] of Object.entries(templateOutputs)) {
 			const declaredExportName = output.Export?.Name;
 			let exportName = declaredExportName;
-			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") try {
-				exportName = await resolver.resolve(declaredExportName, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
+			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") {
+				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
+					stackRegion: region,
+					producerRegions,
+					foreignProducerRegions,
+					resolvers,
 					recordedSecretValues: outputSecrets,
-					bestEffort: true
+					origin: `Export.Name of output '${name}'`
 				});
-			} catch (err) {
-				outputsSourceUntrusted = true;
-				logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${err instanceof Error ? err.message : String(err)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+				try {
+					exportName = await resolver.resolve(nameSource, {
+						template: stack.template,
+						resources: state.resources,
+						...Object.keys(parameters).length > 0 && { parameters },
+						...Object.keys(conditions).length > 0 && { conditions },
+						stackName: stack.stackName,
+						recordedSecretValues: outputSecrets,
+						bestEffort: true
+					});
+				} catch (err) {
+					outputsSourceUntrusted = true;
+					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+				}
 			}
 			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
 			const exportNameUnresolved = declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName));
@@ -62664,8 +63103,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (!ambiguousKeys.has(name)) outputsTemplateSource[name] = value;
 			const exportName = output.Export?.Name;
 			if (typeof exportName === "string" && !ambiguousKeys.has(exportName)) outputsTemplateSource[exportName] = value;
+			const valueSource = await pinCrossRegionSecrets(value, stack.stackName, {
+				stackRegion: region,
+				producerRegions,
+				foreignProducerRegions,
+				resolvers,
+				recordedSecretValues: outputSecrets,
+				origin: `output '${name}'`
+			});
 			try {
-				await resolver.resolve(value, {
+				await resolver.resolve(valueSource, {
 					template: stack.template,
 					resources: state.resources,
 					...Object.keys(parameters).length > 0 && { parameters },
@@ -62675,7 +63122,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					bestEffort: true
 				});
 			} catch (err) {
-				logger.debug(`Resolution of output ${name} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 			}
 		}
 		for (const [name, exportName] of collisions) logger.warn(exportAliasCollisionScrubWarning(name, exportName, outputSecrets));
@@ -62706,7 +63153,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
+		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const nextState = {
@@ -62722,6 +63169,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length
 		};
+	} catch (err) {
+		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
 			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
@@ -63632,6 +64081,30 @@ function stripWalk(value) {
 //#endregion
 //#region src/cli/commands/drift.ts
 /**
+* Route one outcome to the handler for its variant.
+*
+* The mechanism issue [#2135](https://github.com/go-to-k/cdkd/issues/2135) asks
+* for, and the reason every consumer in this file goes through it rather than
+* filtering on `o.kind === '...'`: `handlers` is a MAPPED TYPE over
+* `DriftOutcome['kind']`, so it must name EVERY variant. Adding a member to the
+* union turns every call site that has not been updated into a compile error
+* ("property '<kind>' is missing"), instead of leaving it to fall through to
+* whatever it happened to do before. A `.filter()` predicate cannot do that —
+* it keeps compiling and silently stops matching the new state.
+*
+* A handler that deliberately does nothing with a variant still has to be
+* written out, which is the point: the author of the next variant has to decide,
+* per consumer, what it means there.
+*
+* Exported, with {@link DriftOutcome} and {@link NotComparedCause}, so
+* `tests/unit/cli/drift-outcome.test-d.ts` can fence the mapped type itself:
+* relaxing it to a `Partial` record would silently un-fence every consumer in
+* this file while changing no runtime behaviour, so no runtime test can see it.
+*/
+function matchOutcome(outcome, handlers) {
+	return handlers[outcome.kind](outcome);
+}
+/**
 * Distinguish "drift detected" (exit 1) from "command crashed" (exit 1
 * via the default handler) so the drift command can fail fast and the
 * top-level handler doesn't add a stack trace for the expected case.
@@ -63656,18 +64129,19 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * `{{resolve:ssm-secure:...}}` token — a pre-existing population cdkd resolves
 * for nobody, which can never clear on a re-run, and which this change did not
 * create. Exiting non-zero for them would break `cdkd drift` in CI forever over
-* an unrelated defect, so the exit reads `comparisonRefused` and the report
-* reads `referencesUnresolved`. See that field's note.
+* an unrelated defect, so the exit reads the `refused` cause alone while the
+* report covers both. See `NotComparedCause` and `outcomeExitSignal`.
 *
 * WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
 * Pre-#2108 that population resolved the reference in the WRONG region, the
 * baseline could never equal what AWS held, and the resource was reported
 * `drifted` -- so `cdkd drift` exited 1 and every CI gate keyed on the exit code
 * fired. #2108 correctly stopped comparing against a foreign region's plaintext,
-* which made the same population report `clean`; without this the command would
-* exit 0 and print `no drift detected` for a stack whose secret-bearing
-* properties were never looked at. Round 1 of that change surfaced the refusal
-* in `--json` (`notCompared`) and in the human report, but the exit code -- the
+* which made the same population report `notCompared`; without this the
+* command would exit 0 and print `no drift detected` for a stack whose
+* secret-bearing properties were never looked at. Round 1 of that change
+* surfaced the refusal in `--json` (`notCompared`) and in the human report,
+* but the exit code -- the
 * signal most CI gates actually read -- still said "pass".
 *
 * WHY EXIT 2 RATHER THAN 1. `2` is this repo's established "work completed but
@@ -63704,32 +64178,56 @@ var DriftComparisonRefusedError = class DriftComparisonRefusedError extends Cdkd
 	}
 };
 /**
-* Every outcome on one report that was only PARTIALLY compared -- `drifted` or
-* `clean`, carrying `referencesUnresolved` (issue #2108).
+* Every outcome on one report that was only PARTIALLY compared -- the
+* `notCompared` variant, plus a `drifted` one whose `notComparedCause` is set
+* (issues #2108 / #2135).
 *
-* ONE spelling, because there are now THREE readers that must agree: the
-* `--json` `notCompared` roll-up, the human report's `PARTIALLY compared` block,
-* and the EXIT CODE. A predicate spelled per reader is how the payload and the
-* exit code come to disagree about the same run.
+* ONE spelling, because TWO renderings must agree about the same run: the
+* `--json` `notCompared` roll-up and the human report's `PARTIALLY compared`
+* block (whose count is also what the `N of M fully checked` line subtracts).
+* A roll-up spelled per reader is how the payload and the human summary come to
+* disagree.
+*
+* The EXIT CODE deliberately does NOT read this — see {@link outcomeExitSignal}
+* and {@link NotComparedCause} for why it is scoped to refusals alone.
 */
 function notComparedOutcomes(report) {
-	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.referencesUnresolved);
+	return report.outcomes.flatMap((o) => matchOutcome(o, {
+		drifted: (d) => d.notComparedCause === void 0 ? [] : [d],
+		notCompared: (n) => [n],
+		clean: () => [],
+		unsupported: () => [],
+		skipped: () => []
+	}));
 }
 /**
-* Every outcome whose comparison cdkd DELIBERATELY REFUSED (issue #2108) — the
-* strict subset of {@link notComparedOutcomes} that drives the EXIT CODE.
-*
-* Deliberately NOT the same predicate, and the asymmetry is the point: the
-* REPORT covers everything that was not compared, because as information both
-* populations matter equally, while the exit code covers only the population
-* this change created. Driving it off `referencesUnresolved` would exit
-* non-zero forever for every stack holding an `{{resolve:ssm-secure:...}}`
-* reference — permanent, unclearable, and unrelated to this issue. See the
-* `comparisonRefused` field note, and issue
-* [#2135](https://github.com/go-to-k/cdkd/issues/2135) for the structural fix.
-*/
-function refusedComparisonOutcomes(report) {
-	return report.outcomes.filter((o) => (o.kind === "drifted" || o.kind === "clean") && o.comparisonRefused);
+* What one outcome contributes to the run's EXIT CODE (issues #2108 / #2135).
+*
+* The exit-code CONSUMER, kept as an exhaustive `matchOutcome` so a new outcome
+* variant cannot inherit `none` by omission — reporting a resource cdkd never
+* compared as a pass is precisely the round-2 defect #2135 exists to make
+* impossible.
+*
+* `refused` is a STRICT SUBSET of what {@link notComparedOutcomes} rolls up, and
+* the asymmetry is the point: the REPORT covers everything that was not
+* compared, because as information both causes matter equally, while the exit
+* code covers only the population #2108 created. Exiting non-zero on
+* `unresolvedToken` would break `cdkd drift` in CI forever for every stack
+* holding an `{{resolve:ssm-secure:...}}` reference — permanent, unclearable,
+* and unrelated. See {@link NotComparedCause}.
+*
+* A `drifted` outcome reports `drifted` even when its own comparison was
+* refused: drift is the stronger, actionable signal and the caller ranks it
+* first, so a consumer gating on `1` loses nothing it gets today.
+*/
+function outcomeExitSignal(outcome) {
+	return matchOutcome(outcome, {
+		drifted: () => "drifted",
+		notCompared: (n) => n.notComparedCause === "refused" ? "refused" : "none",
+		clean: () => "none",
+		unsupported: () => "none",
+		skipped: () => "none"
+	});
 }
 /**
 * `cdkd drift [<stack>...]` command implementation.
@@ -63799,8 +64297,9 @@ async function driftCommand(stacks, options) {
 		}
 		if (options.json) writeJsonReport(reports);
 		else writeHumanReport(reports);
-		const drifted = reports.some((r) => r.outcomes.some((o) => o.kind === "drifted"));
-		const anyRefused = reports.some((r) => refusedComparisonOutcomes(r).length > 0);
+		const signals = reports.flatMap((r) => r.outcomes.map(outcomeExitSignal));
+		const drifted = signals.includes("drifted");
+		const anyRefused = signals.includes("refused");
 		if (!options.accept && !options.revert) {
 			if (drifted) throw new DriftDetectedError();
 			if (anyRefused) throw new DriftComparisonRefusedError();
@@ -64504,14 +65003,17 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				unionWalkObjects: useObserved,
 				unorderedPaths
 			}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths);
-			const referencesUnresolved = secretResolutionFailed || unresolvedTokens.size > 0;
-			const comparisonRefused = secretResolutionFailed;
-			if (reported.changes.length === 0) outcomes.push({
-				kind: "clean",
+			const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
+			if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
+				kind: "notCompared",
 				logicalId,
 				resourceType: resource.resourceType,
-				referencesUnresolved,
-				comparisonRefused
+				notComparedCause
+			});
+			else outcomes.push({
+				kind: "clean",
+				logicalId,
+				resourceType: resource.resourceType
 			});
 			else outcomes.push({
 				kind: "drifted",
@@ -64520,8 +65022,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				...reported,
 				awsProperties: aws,
 				secrets,
-				referencesUnresolved,
-				comparisonRefused
+				notComparedCause
 			});
 		}
 		return {
@@ -64618,7 +65119,13 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 	const lockManager = new LockManager(awsClients.s3, stateConfig);
 	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 	for (const report of reports) {
-		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
+		const driftedOutcomes = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept");
 		try {
@@ -65236,7 +65743,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	let totalSucceeded = 0;
 	let totalUnresolvable = 0;
 	for (const report of reports) {
-		const driftedOutcomes = report.outcomes.filter((o) => o.kind === "drifted");
+		const driftedOutcomes = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (driftedOutcomes.length === 0) continue;
 		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
@@ -65387,7 +65900,13 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 */
 function printAcceptPlan(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
+		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (drifted.length === 0) continue;
 		process.stdout.write(`\nPlan (--accept): update cdkd state for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
@@ -65410,7 +65929,13 @@ function printAcceptPlan(reports) {
 */
 function printRevertPlan(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
+		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
+			drifted: (d) => [d],
+			clean: () => [],
+			notCompared: () => [],
+			unsupported: () => [],
+			skipped: () => []
+		}));
 		if (drifted.length === 0) continue;
 		process.stdout.write(`\nPlan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
@@ -65420,7 +65945,7 @@ function printRevertPlan(reports) {
 			const stateResource = report.state.resources[o.logicalId];
 			if (stateResource) {
 				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
-				const cannotMaskKeys = o.referencesUnresolved;
+				const cannotMaskKeys = o.notComparedCause !== void 0;
 				if (cannotMaskKeys && preserved.length > 0) process.stdout.write(`    ! ${preserved.length} AWS-authored tag(s) will be preserved, but cdkd could not resolve this resource's dynamic reference(s), so their names are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				if (!cannotMaskKeys && preserved.length > 0) {
 					const tagWord = preserved.length === 1 ? "tag" : "tags";
@@ -65432,7 +65957,7 @@ function printRevertPlan(reports) {
 			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const unbaselined = findRevertUnbaselinedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
-				if (o.referencesUnresolved && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
+				if (o.notComparedCause !== void 0 && unbaselined.length > 0) process.stdout.write(`    ! ${unbaselined.length} AWS-authored value(s) will be left untouched, but cdkd could not resolve this resource's dynamic reference(s), so their paths are withheld — they come from the live readback and cannot be checked for secrets without them.\n`);
 				else if (unbaselined.length > 0) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					process.stdout.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
@@ -65474,28 +65999,44 @@ async function confirmPrompt$5(prompt) {
 }
 function writeJsonReport(reports) {
 	const payload = reports.map((r) => {
-		const drifted = r.outcomes.filter((o) => o.kind === "drifted").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType,
-			changes: o.changes,
-			referencesUnresolved: o.referencesUnresolved
-		}));
-		const clean = r.outcomes.filter((o) => o.kind === "clean").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType,
-			referencesUnresolved: o.referencesUnresolved
-		}));
+		const drifted = [];
+		const clean = [];
+		const notSupported = [];
+		const skipped = [];
+		for (const o of r.outcomes) matchOutcome(o, {
+			drifted: (d) => {
+				drifted.push({
+					logicalId: d.logicalId,
+					type: d.resourceType,
+					changes: d.changes,
+					referencesUnresolved: d.notComparedCause !== void 0
+				});
+			},
+			clean: (c) => {
+				clean.push({
+					logicalId: c.logicalId,
+					type: c.resourceType,
+					referencesUnresolved: false
+				});
+			},
+			notCompared: () => {},
+			unsupported: (u) => {
+				notSupported.push({
+					logicalId: u.logicalId,
+					type: u.resourceType
+				});
+			},
+			skipped: (sk) => {
+				skipped.push({
+					logicalId: sk.logicalId,
+					type: sk.resourceType
+				});
+			}
+		});
 		const notCompared = notComparedOutcomes(r).map((o) => ({
 			logicalId: o.logicalId,
-			type: o.resourceType
-		}));
-		const notSupported = r.outcomes.filter((o) => o.kind === "unsupported").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType
-		}));
-		const skipped = r.outcomes.filter((o) => o.kind === "skipped").map((o) => ({
-			logicalId: o.logicalId,
-			type: o.resourceType
+			type: o.resourceType,
+			referencesUnresolved: true
 		}));
 		return {
 			stack: r.stackName,
@@ -65511,10 +66052,27 @@ function writeJsonReport(reports) {
 }
 function writeHumanReport(reports) {
 	for (const report of reports) {
-		const drifted = report.outcomes.filter((o) => o.kind === "drifted");
-		const unsupported = report.outcomes.filter((o) => o.kind === "unsupported");
-		const skippedCount = report.outcomes.filter((o) => o.kind === "skipped").length;
-		const inspected = report.outcomes.length - skippedCount;
+		const drifted = [];
+		const unsupported = [];
+		let inspectedCount = 0;
+		for (const o of report.outcomes) matchOutcome(o, {
+			drifted: (d) => {
+				drifted.push(d);
+				inspectedCount += 1;
+			},
+			unsupported: (u) => {
+				unsupported.push(u);
+				inspectedCount += 1;
+			},
+			skipped: () => {},
+			clean: () => {
+				inspectedCount += 1;
+			},
+			notCompared: () => {
+				inspectedCount += 1;
+			}
+		});
+		const inspected = inspectedCount;
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
 		if (drifted.length === 0) if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked (${notCompared.length} only partially compared, ${unsupported.length} unsupported)\n`);
@@ -71197,8 +71755,8 @@ async function rollbackCommand(stackArg, options) {
 		try {
 			await setup.lockManager.acquireLockWithRetry(stackName, region, void 0, "rollback");
 		} catch (error) {
-			unforwardSigterm();
 			process.removeListener("SIGINT", sigintHandler);
+			unforwardSigterm();
 			throw error;
 		}
 		try {
@@ -71343,11 +71901,14 @@ async function rollbackCommand(stackArg, options) {
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${stackName}' (${region}) complete.`);
 		} finally {
-			unforwardSigterm();
-			process.removeListener("SIGINT", sigintHandler);
-			await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-				logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
-			});
+			try {
+				await setup.lockManager.releaseLock(stackName, region).catch((err) => {
+					logger.warn(`Failed to release lock for '${stackName}' (${region}): ${err instanceof Error ? err.message : String(err)}`);
+				});
+			} finally {
+				process.removeListener("SIGINT", sigintHandler);
+				unforwardSigterm();
+			}
 		}
 	} finally {
 		if (stackAwsClients) {
@@ -84546,7 +85107,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.30");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;