@go-to-k/cdkd 0.284.30 → 0.284.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-BFgi0RJr.js";
+import { $ as endCommandInterruptScope, $t as buildAssetRedirectMap, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveStateBucketWithDefaultAndSource, At as maskSecretsInError, B as collectDeclaredOutputNames, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as ccRoutedFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isThrottlingError, Ct as STATE_SOURCED_CROSS_GENERATION_RULES, D as unsupportedFinalSnapshotError, Dn as resolveCaptureObservedState, Dt as dynamicReferenceTokens, E as refusesFinalSnapshot, En as resolveAutoAssetStorage, Et as createSecretMasker, F as cyan, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as stateKeySecretExposure, Gt as TemplateParser, H as exportAliasCollisionScrubWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as gray, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as clearOnUpdateRemoval, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as IAMRoleProvider, Kn as resolveBucketRegion, Kt as LockManager, L as green, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as renderStatefulReason, Mn as stateBucketExistenceConfirmed, Mt as redactSecretsForState, N as formatResourceLine, Nn as warnDeprecatedNoPrefixCliFlag, Nt as scrubResourceRecord, O as makeCanonicalizePropertiesFn, On as resolveSkipPrefix, Ot as errorCauseChain, P as bold, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as beginCommandInterruptScope, Qn as CdkdError, Qt as WorkGraph, R as red, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as buildFinalSnapshotIdentifier, Sn as synthesisStatusMessage, Sr as isRetryableTransientError, St as requireConfigString, T as isFinalSnapshotError, Tn as resolveApp, Tt as TEMPLATE_SOURCED_RULES, U as isExportAliasCollision, Un as AssemblyReader, Ut as withRetry, V as collectPublishedOutputNames, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as secretBearingStateKeyWarning, Wn as processStackMessages, Wt as DagBuilder, X as findActionableSilentDrops, Xn as setAwsClients, Xt as AssetPublisher, Y as ProviderRegistry, Yn as resetAwsClients, Yt as shouldRetainResource, Z as findSilentDropProperties, Zt as stringifyValue, _ as maskingRetryLogger, _n as runDockerForeground, _t as configStringRefusal, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalStartServiceError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as getDockerImageBySourceHash, br as withErrorHandling, bt as requireConfigArray, c as planRollback, cn as getBootstrapMarkerKey, cr as NestedStackChildDirectDestroyError, ct as cfnRefValueFromPhysicalId, d as replayRollback, dn as validateAssetBucketName, dr as ResourceTimeoutError, dt as WAFv2WebACLProvider, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as isInterruptedWaitError, f as updatePartialMessage, fn as validateContainerRepoName, fr as ResourceUpdateNotSupportedError, ft as normalizeAwsTagsToCfn, g as withResourceDeadline, gn as getDockerCmd, gt as configBooleanRefusal, h as deleteSkipReason, hn as formatDockerLoginError, ht as coerceCfnBoolean, i as DeploymentEventsReader, in as stripControlChars, ir as LocalMigrateError, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as resolveUseCdkBootstrapAssets, jt as maskSecretsInText, k as extractDeploymentEventError, kn as resolveStateBucketWithDefault, kt as isSingleDynamicReferenceToken, l as producerRegionsFromState, ln as parseBootstrapMarker, lr as PartialFailureError, lt as getAccountInfo, m as UNSPECIFIED_SKIP_REASON, mn as buildDockerImage, mr as StackTerminationProtectionError, mt as assertRegionMatch, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as BOOTSTRAP_MARKER_PREFIX, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDenyExternalAccessPolicy, pr as StackHasActiveImportsError, pt as resolveExplicitPhysicalId, q as collectInlinePolicyNamesManagedBySiblings, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as LocalInvokeBuildError$1, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as ensureAssetStorage, sr as MissingCdkCliError, st as carriesDynamicReference, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as startInterruptWatch, u as replayFailedOperations, un as readBootstrapMarkerBody, ur as ProvisioningError, ut as refStateLookupFromResource, v as IMPLICIT_DELETE_DEPENDENCIES, vn as runDockerStreaming, vt as readConfigString, w as createPreDeleteFinalSnapshot, wn as getLegacyStateBucketName, wr as markNonRetryable, wt as STATE_SOURCED_READBACK_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as Synthesizer, xr as isMarkedNonRetryable, xt as requireConfigObject, y as computeImplicitDeleteEdges, yn as AssetManifestLoader, yr as normalizeAwsError, yt as replayWarn, z as yellow, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-DsUQ4GxO.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-qMgJEhCM.js";
+import { t as ASGProvider } from "./asg-provider-BVzQ7mQX.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -77,6 +77,162 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { WebSocketServer } from "ws";
 
+//#region src/cli/commands/state-file-keys.ts
+/**
+* Shared helpers for enumerating and describing cdkd state-bucket keys.
+*
+* Extracted from `bootstrap-destroy.ts` (issue #1010) so that `cdkd gc`
+* (issue #1012) reuses the exact same whole-bucket state-file discovery
+* instead of duplicating it — the "scan the WHOLE bucket, not just the
+* default `cdkd/` prefix" rule was a review blocker once already (PR #1018)
+* and must not drift between the two commands.
+*/
+/**
+* Every cdkd state file ends with this suffix, regardless of the
+* `--state-prefix` it was deployed under (`{prefix}/{stack}/{region}/state.json`,
+* or legacy `{prefix}/{stack}/state.json`).
+*/
+const STATE_FILE_SUFFIX = "/state.json";
+/**
+* The prefix `cdkd bootstrap` writes under, and the one `gc` /
+* `bootstrap --destroy` configure their own state backend with.
+*
+* Shared here rather than spelled per command for the same reason this module
+* exists at all: `bootstrap-destroy.ts` and `gc.ts` each held their own copy,
+* and it is now also the `knownPrefix` argument to {@link describeStateKey},
+* where a copy that drifted from the backend's actual prefix would silently
+* send every key back to the shape heuristic instead of the exact depth rule.
+*
+* Note this is only the DEFAULT. Other commands accept `--state-prefix`, so
+* the whole-bucket listings deliberately do not scope to it.
+*/
+const DEFAULT_STATE_PREFIX = "cdkd";
+/**
+* Segments left under a known prefix for the legacy `{prefix}/{stack}` layout.
+*
+* The twin of `S3StateBackend`'s `LEGACY_KEY_DEPTH`, which counts the
+* `state.json` segment as well; this one counts what remains after the prefix
+* and the suffix are stripped, so it is that value minus one. Fenced against it
+* by a unit test rather than imported, because a value import from
+* `s3-state-backend.js` breaks the suites that mock that module.
+*/
+const LEGACY_SEGMENTS_UNDER_PREFIX = 1;
+/**
+* Every cdkd stack lock ends with this suffix — the lock lives next to the
+* state file (`{prefix}/{stack}/{region}/lock.json`, or the legacy region-less
+* `{prefix}/{stack}/lock.json` that `lock-manager.ts` still writes for a
+* pre-v2 stack).
+*/
+const LOCK_FILE_SUFFIX = "/lock.json";
+/**
+* `us-east-1` / `ap-northeast-1` / `us-gov-west-1` — a region-shaped segment.
+*
+* The first token is `[a-z]{2}` OR the literal `eusc` (issue #2001). Every
+* region AWS ships has a two-letter first token except the European Sovereign
+* Cloud partition's, which is four — `eusc-de-east-1` — and the old
+* `^[a-z]{2}` rejected that whole partition. Enumerated from
+* `aws-cdk-lib/region-info` and `@aws-sdk/util-endpoints`: 46 REAL regions,
+* first tokens all two letters or `eusc`, none three. (A count of 53 includes
+* the `aws-global` / `aws-iso-*-global` PSEUDO-regions, whose first token is
+* `aws`; they carry no trailing `-<digits>`, so this pattern rejects them and
+* so did the old one — no behavioural difference, but at 53 the "two letters
+* or eusc" claim is false as stated.)
+*
+* **The exception is enumerated rather than widened, and that is the whole
+* design.** The obvious fix — relaxing the bound to `{2,4}` — was written
+* first and review measured what it cost: `api-prod-1`, `demo-app-1`,
+* `dev-api-1`, `core-api-1`, `test-stack-2` all become region-shaped under it.
+* Those are idiomatic STACK names, and in the legacy region-less layout a
+* stack name sits exactly where a region would, so the pattern would report
+* the key's PREFIX as the stack for each of them — the same wrong answer this
+* issue is about, arriving from the other side and at a far higher rate. A
+* length class cannot separate `eusc` from `demo`; only naming the partition
+* can.
+*
+* The cost of enumerating is that a future partition with a new non-two-letter
+* token needs this line updated. That is the same failure this issue fixed, it
+* is a one-token change, and it fails in the recoverable direction (a region
+* read as a stack name) rather than corrupting ordinary stack names.
+*
+* It stays SHAPE-based and deliberately does not reuse `isClientSafeRegion`
+* from `intrinsic-function-resolver.ts`: that predicate is charset-based (its
+* job is to keep a value inside a hostname label, so it accepts anything
+* lowercase-alphanumeric) and would classify almost every stack name as a
+* region. This one has the opposite job — telling a region segment apart from
+* a stack name in the same position — so it must constrain the shape.
+*
+* A two-letter STACK name like `db-prod-1` is still misread in the legacy
+* layout; that is pre-existing (`main` does the same) and is what the
+* `knownPrefix` depth rule below repairs for callers that can supply one.
+*/
+const REGION_SEGMENT = /^(?:[a-z]{2}|eusc)(-[a-z]+)+-\d+$/;
+/**
+* List every state file in the bucket — the WHOLE bucket, not just the
+* default `cdkd/` prefix. Other commands accept `--state-prefix`, so live
+* stack state may exist under ANY prefix in this bucket; scoping this
+* listing to the default prefix would let reference scans and teardown
+* guards silently miss those stacks and delete live data.
+*/
+async function listAllStateKeys(stateBackend) {
+	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(STATE_FILE_SUFFIX));
+}
+/**
+* List every stack lock file in the bucket — same whole-bucket rule as
+* {@link listAllStateKeys}. A lock under ANY prefix means a deploy /
+* destroy may be in flight for that stack.
+*/
+async function listAllLockKeys(stateBackend) {
+	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(LOCK_FILE_SUFFIX));
+}
+/**
+* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
+* `{prefix}/{stack}/state.json` → `stack`. Pass {@link LOCK_FILE_SUFFIX} to
+* describe lock keys.
+*
+* The shape heuristic below cannot be made exact, and it errs in BOTH
+* directions -- a region it fails to recognise is reported AS the stack name,
+* while a region-shaped STACK name in the legacy layout makes it report the
+* key's PREFIX as the stack. Neither is safe: `cdkd gc`'s corrupt-state abort
+* turns whichever answer it gets into a `cdkd state show ...` recovery
+* command, so a wrong one is handed to the user as a command to run.
+*
+* `knownPrefix` narrows it where a caller can: a key with exactly one segment
+* under a prefix we know is the legacy `{stack}` layout by construction,
+* whatever the stack is named, so no shape test is needed there at all. That
+* repairs the pre-existing two-letter case (`cdkd/db-prod-1/state.json`, which
+* `main` describes as `cdkd (db-prod-1)`).
+*
+* **It is a narrowing, not a safety net for the pattern above.** A first cut
+* treated it as one — widening `REGION_SEGMENT` to `{2,4}` and relying on this
+* rule to undo the damage — and review measured that the damage is repo-wide
+* while this rule reaches only keys under the ONE prefix a caller names. The
+* listing deliberately spans the whole bucket, so foreign and nested prefixes
+* are in scope and unreachable from here; six shapes regressed against `main`
+* that way. The pattern must be right on its own.
+*
+* **It deliberately does NOT claim the two-segment case.** A first cut did, on
+* the reasoning that at that depth the last segment must be the region -- and
+* review found `--state-prefix cdkd/team-a`, which nests inside the default
+* prefix, so `cdkd/team-a/MyStack/state.json` is a LEGACY key two segments
+* deep and would have been mis-split as `team-a (MyStack)` where `main` said
+* `MyStack`. Depth cannot tell that apart from a real `{stack}/{region}`; only
+* the shape of the tail can, so the heuristic keeps that case.
+*/
+function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
+	const body = key.slice(0, -suffix.length);
+	const prefix = knownPrefix?.replace(/\/+$/, "");
+	if (prefix !== void 0 && prefix !== "" && key.startsWith(`${prefix}/`)) {
+		const rest = body.slice(prefix.length + 1).split("/");
+		if (rest.length === LEGACY_SEGMENTS_UNDER_PREFIX && rest[0]) return rest[0];
+	}
+	const segments = body.split("/");
+	const last = segments[segments.length - 1] ?? key;
+	const secondLast = segments[segments.length - 2];
+	if (secondLast !== void 0 && secondLast !== "" && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
+	return last;
+}
+
+//#endregion
 //#region src/cli/options.ts
 /**
 * Parse context key=value pairs from CLI arguments into a Record
@@ -152,7 +308,7 @@ const appOptions = [new Option("-a, --app <command>", "CDK app command (e.g., \"
 * --state-bucket is optional: falls back to CDKD_STATE_BUCKET env var,
 * then cdk.json context.cdkd.stateBucket
 */
-const stateOptions = [new Option("--state-bucket <bucket>", "S3 bucket for state storage. Falls back to CDKD_STATE_BUCKET env or cdk.json"), new Option("--state-prefix <prefix>", "S3 key prefix for state files").default("cdkd")];
+const stateOptions = [new Option("--state-bucket <bucket>", "S3 bucket for state storage. Falls back to CDKD_STATE_BUCKET env or cdk.json"), new Option("--state-prefix <prefix>", "S3 key prefix for state files").default(DEFAULT_STATE_PREFIX)];
 /**
 * Stack options
 */
@@ -1025,91 +1181,9 @@ function regionNeedsReconciliation(effective) {
 	return effective.region !== LEGACY_DEFAULT_REGION;
 }
 
-//#endregion
-//#region src/cli/commands/state-file-keys.ts
-/**
-* Shared helpers for enumerating and describing cdkd state-bucket keys.
-*
-* Extracted from `bootstrap-destroy.ts` (issue #1010) so that `cdkd gc`
-* (issue #1012) reuses the exact same whole-bucket state-file discovery
-* instead of duplicating it — the "scan the WHOLE bucket, not just the
-* default `cdkd/` prefix" rule was a review blocker once already (PR #1018)
-* and must not drift between the two commands.
-*/
-/**
-* Every cdkd state file ends with this suffix, regardless of the
-* `--state-prefix` it was deployed under (`{prefix}/{stack}/{region}/state.json`,
-* or legacy `{prefix}/{stack}/state.json`).
-*/
-const STATE_FILE_SUFFIX = "/state.json";
-/**
-* Every cdkd stack lock ends with this suffix — the lock lives next to the
-* state file (`{prefix}/{stack}/{region}/lock.json`).
-*/
-const LOCK_FILE_SUFFIX = "/lock.json";
-/** `us-east-1` / `ap-northeast-1` / `us-gov-west-1` — a region-shaped segment. */
-const REGION_SEGMENT = /^[a-z]{2}(-[a-z]+)+-\d+$/;
-/**
-* List every state file in the bucket — the WHOLE bucket, not just the
-* default `cdkd/` prefix. Other commands accept `--state-prefix`, so live
-* stack state may exist under ANY prefix in this bucket; scoping this
-* listing to the default prefix would let reference scans and teardown
-* guards silently miss those stacks and delete live data.
-*/
-async function listAllStateKeys(stateBackend) {
-	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(STATE_FILE_SUFFIX));
-}
-/**
-* List every stack lock file in the bucket — same whole-bucket rule as
-* {@link listAllStateKeys}. A lock under ANY prefix means a deploy /
-* destroy may be in flight for that stack.
-*/
-async function listAllLockKeys(stateBackend) {
-	return (await stateBackend.listRawKeys("")).filter((k) => k.endsWith(LOCK_FILE_SUFFIX));
-}
-/**
-* `{prefix}/{stack}/{region}/state.json` → `stack (region)`; legacy
-* `{prefix}/{stack}/state.json` → `stack`. The prefix is arbitrary (custom
-* `--state-prefix` values included), so the stack/region pair is derived
-* from the key's TAIL: the last segment is treated as a region only when
-* it is region-shaped. Pass {@link LOCK_FILE_SUFFIX} to describe lock keys.
-*/
-function describeStateKey(key, suffix = STATE_FILE_SUFFIX) {
-	const segments = key.slice(0, -suffix.length).split("/");
-	const last = segments[segments.length - 1] ?? key;
-	const secondLast = segments[segments.length - 2];
-	if (secondLast !== void 0 && REGION_SEGMENT.test(last)) return `${secondLast} (${last})`;
-	return last;
-}
-
 //#endregion
 //#region src/cli/commands/bootstrap-destroy.ts
 /**
-* `cdkd bootstrap --destroy` — teardown of cdkd-created account resources
-* (issue #1010, the reverse of `cdkd bootstrap` / `ensureAssetStorage`).
-*
-* Scope per invocation is ONE region's asset storage (`--region`, same
-* option the create side uses): empty + delete the asset bucket, force-
-* delete the container-asset ECR repo, then delete the region's bootstrap
-* marker LAST — the mirror image of the create side's marker-written-last
-* ordering, so a crash mid-teardown leaves the region still consistently
-* opted in (marker present → deploys keep hard-erroring at the missing
-* resources with a re-bootstrap hint, never a silent legacy fallback).
-*
-* The asset bucket / repo NAMES are read from the region's bootstrap
-* marker, NOT recomputed from the naming convention — the marker is the
-* source of truth for names (design §4.1), which keeps this teardown
-* compatible with custom asset-storage names (issue #1011).
-*
-* The state bucket is NOT deleted by default: it is the account's source
-* of truth. `--include-state-bucket` opts in, and even then the deletion
-* is refused while ANY stack state exists in the bucket or any OTHER
-* region is still opted in to asset storage (deleting their markers would
-* silently flip those regions back to legacy mode).
-*/
-/** S3 key prefix for state files — same fixed value the create side uses. */
-const STATE_PREFIX = "cdkd";
-/**
 * Interactive confirmation for the teardown. Follows the repo's
 * destructive-prompt convention (see `recreate-confirm-prompt.ts`, the
 * same pattern family as `confirm-prompt.ts`): print the deletion plan as
@@ -1157,7 +1231,7 @@ async function scanStateReferences(stateBackend, names) {
 	for (const key of stateKeys) {
 		const body = await stateBackend.getRawObject(key);
 		if (body === null) continue;
-		if (names.some((name) => body.includes(name))) referencing.push(describeStateKey(key));
+		if (names.some((name) => body.includes(name))) referencing.push(describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX));
 	}
 	return referencing;
 }
@@ -1332,7 +1406,7 @@ async function bootstrapDestroyCommand(options) {
 			...options.profile && { profile: options.profile }
 		}), {
 			bucket: bucketName,
-			prefix: STATE_PREFIX
+			prefix: DEFAULT_STATE_PREFIX
 		}, {
 			region: effective.region,
 			...options.profile && { profile: options.profile }
@@ -1361,7 +1435,7 @@ async function bootstrapDestroyCommand(options) {
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
-		prefix: STATE_PREFIX
+		prefix: DEFAULT_STATE_PREFIX
 	}, {
 		region,
 		...options.profile && { profile: options.profile }
@@ -1413,7 +1487,7 @@ async function bootstrapDestroyCommand(options) {
 		if (options.includeStateBucket) {
 			const stateKeys = await listAllStateKeys(stateBackend);
 			if (stateKeys.length > 0) {
-				const listing = stateKeys.map((k) => `  - ${describeStateKey(k)}  [${k}]`).join("\n");
+				const listing = stateKeys.map((k) => `  - ${describeStateKey(k, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
 				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': ${stateKeys.length} stack(s) still have state in it:\n${listing}\nDestroy every stack ('cdkd destroy' / 'cdkd state destroy') before deleting the state bucket.`, "STATE_BUCKET_NOT_EMPTY");
 			}
 			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
@@ -1509,7 +1583,7 @@ async function bootstrapCommand(options) {
 			...options.profile && { profile: options.profile }
 		}), {
 			bucket: bucketName,
-			prefix: "cdkd"
+			prefix: DEFAULT_STATE_PREFIX
 		}, {
 			region: effective.region,
 			...options.profile && { profile: options.profile }
@@ -1610,7 +1684,7 @@ async function bootstrapCommand(options) {
 			});
 			const stateBackend = new S3StateBackend(markerS3Client, {
 				bucket: bucketName,
-				prefix: "cdkd"
+				prefix: DEFAULT_STATE_PREFIX
 			}, {
 				region,
 				...options.profile && { profile: options.profile }
@@ -62373,6 +62447,7 @@ async function scrubCommand(stacks, options) {
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 	if (targetStacks.length === 0) throw new Error("No stacks matched.");
 	await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
+	targetStacks = orderScrubTargets(targetStacks);
 	const stateConfig = {
 		bucket: stateBucket,
 		prefix: options.statePrefix
@@ -62388,6 +62463,7 @@ async function scrubCommand(stacks, options) {
 	const lockManager = new LockManager(stateS3.s3, stateConfig);
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
+	let totalStacksWithUnverifiableReads = 0;
 	const failures = [];
 	for (const stack of targetStacks) {
 		const stackRegion = stack.region || region;
@@ -62396,7 +62472,8 @@ async function scrubCommand(stacks, options) {
 			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
 				dryRun: options.dryRun ?? false,
 				roleArn: options.roleArn,
-				logger
+				logger,
+				appStacks: allStacks
 			});
 		} catch (err) {
 			failures.push({ stackName: stack.stackName });
@@ -62407,13 +62484,17 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.unverifiableReads > 0) {
+			totalStacksWithUnverifiableReads++;
+			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
+		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -62423,17 +62504,18 @@ async function scrubCommand(stacks, options) {
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
+	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${failureNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${unverifiableNote}${failureNote}`);
+	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
-	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
+	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
 * Every secret plaintext this run recorded, from ANY position in the template
@@ -62972,6 +63054,571 @@ async function pinCrossRegionSecrets(bag, stackName, ctx) {
 	return await walk(bag, "");
 }
 /**
+* Order scrub targets PRODUCER-BEFORE-CONSUMER (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133) review).
+*
+* `cdkd scrub --all` used to walk the assembly's artifact order, which is not
+* topological — `getAllStacks` iterates the manifest, and only `cdkd deploy`
+* sorts. That ordering decides whether a legacy multi-stack app can be scrubbed
+* in ONE run: a consumer importing a secret learns its expression only by
+* reading the producer's state, and that state holds the expression only once
+* the PRODUCER has been scrubbed. Reached in the other order the consumer gets
+* a plaintext, has no needle, and is refused
+* ({@link plaintextProducerCrossStackReadError}) until the user re-runs. Both
+* orders are SAFE — the refusal is what makes them safe — but only one of them
+* finishes the job in a single command.
+*
+* Edges come from BOTH sources `cdkd deploy` uses: CDK's own manifest
+* dependencies (`dependencyNames`, emitted for a strong reference through
+* `exportValue`) and {@link inferCrossStackStackDeps}, which scans the
+* synthesized templates for a RAW `cdk.Fn.importValue` / `Fn::GetStackOutput`
+* that CDK records no dependency for. Edges to stacks outside the target set
+* are ignored: a producer that is not being scrubbed cannot be ordered.
+*
+* Cycles cannot happen through `Fn::ImportValue` on a deployable app, but a
+* cycle in the INFERRED graph is possible (two stacks reading each other's
+* outputs weakly), so the sort degrades to input order for whatever it cannot
+* place rather than dropping or duplicating a stack. Ties keep input order, so
+* a single-stack or dependency-free `--all` run is byte-identical to before.
+*/
+function orderScrubTargets(targets) {
+	if (targets.length < 2) return [...targets];
+	const inSet = new Set(targets.map((t) => t.stackName));
+	const inferred = inferCrossStackStackDeps(targets);
+	const producersOf = /* @__PURE__ */ new Map();
+	for (const target of targets) {
+		const producers = /* @__PURE__ */ new Set();
+		for (const dep of target.dependencyNames ?? []) if (inSet.has(dep) && dep !== target.stackName) producers.add(dep);
+		for (const dep of inferred.get(target.stackName) ?? []) if (inSet.has(dep) && dep !== target.stackName) producers.add(dep);
+		producersOf.set(target.stackName, producers);
+	}
+	const ordered = [];
+	const emitted = /* @__PURE__ */ new Set();
+	const pending = [...targets];
+	while (pending.length > 0) {
+		let index = pending.findIndex((t) => [...producersOf.get(t.stackName) ?? []].every((p) => emitted.has(p)));
+		if (index === -1) index = 0;
+		const [next] = pending.splice(index, 1);
+		if (!next) break;
+		ordered.push(next);
+		emitted.add(next.stackName);
+	}
+	return ordered;
+}
+/**
+* A memoizing READ view over the state backend, for the resolutions ONE
+* `scrubStack` call performs (issue #2133 review).
+*
+* `resolveImportValue` has no lookup cache of its own: each reference costs a
+* `listStacks()` plus up to N `getState()` calls, and scrub resolves every
+* cross-stack reference TWICE — once in the pre-pass (which must run before the
+* best-effort catch can swallow a failure) and once in the main resolution
+* (which must run because the pre-pass deliberately does not rewrite the bag).
+* The view collapses both into one scan and one `getState` per (stack, region).
+*
+* `Object.create` rather than a hand-written wrapper object: the resolver also
+* reads `stateBackend.prefix` and could reach for more, and a literal cast to
+* `S3StateBackend` would turn the next such call into `undefined is not a
+* function`. Prototype delegation keeps every other member — and
+* `instanceof S3StateBackend` — intact.
+*
+* Deliberately NOT used for this stack's own `getState` / `saveState`: those go
+* through the real backend, so the read-modify-write still sees S3 rather than
+* a cache, and its ETag precondition still means what it says.
+*/
+function memoizeCrossStackStateReads(backend) {
+	const view = Object.create(backend);
+	let listed;
+	const states = /* @__PURE__ */ new Map();
+	view.listStacks = () => {
+		listed ??= backend.listStacks();
+		return listed;
+	};
+	view.getState = (stackName, stateRegion) => {
+		const key = `${stackName}\u0000${stateRegion}`;
+		let pending = states.get(key);
+		if (!pending) {
+			pending = backend.getState(stackName, stateRegion);
+			states.set(key, pending);
+		}
+		return pending;
+	};
+	return view;
+}
+/**
+* Is this template output one the deploy would NOT have written (issue #2133
+* review)?
+*
+* The outputs passes deliberately run over EVERY declared output regardless of
+* its `Condition`, so a secret carried by a (possibly spuriously) suppressed
+* output still becomes a needle for the resource records that share it. That
+* argument justifies RESOLVING a suppressed output, and nothing more — it does
+* not justify REFUSING the whole stack when such a resolution fails, because a
+* suppressed output produced no `state.outputs` key and so has nothing at risk.
+* A dev-environment scrub would otherwise be refused outright by a prod-only
+* `Value: {Fn::ImportValue: ProdOnlyExport}` whose producer does not exist in
+* dev. So: resolve it best-effort, but disarm the refusal.
+*
+* An UNKNOWN condition counts as suppressed, matching `resolveIf`'s
+* unknown-selects-FALSE rule and erring toward not refusing.
+*
+* STATE OVERRULES THE CONDITION (issue #2133 review). `conditions` degrades to
+* `{}` whenever `evaluateConditions` throws, and even when it succeeds it is
+* evaluated from TEMPLATE PARAMETER DEFAULTS — scrub takes no `--parameters` —
+* so an output the deploy really did write reads as suppressed on any stack
+* deployed with non-default parameters, which silently disarms the refusal for
+* that position. `state.outputs` is the record of what the deploy ACTUALLY
+* wrote (keyed by output NAME, plus the export-name alias), so a key present
+* there is proof the output was not suppressed, whatever this run's
+* best-effort condition evaluation concluded.
+*/
+function isOutputSuppressed(name, output, conditions, stateOutputs) {
+	const condition = output.Condition;
+	if (typeof condition !== "string") return false;
+	if (conditions[condition] === true) return false;
+	return !(name in stateOutputs);
+}
+/**
+* The intrinsics that read ANOTHER stack's state (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* Both require `context.stateBackend` — `resolveImportValue` throws without it,
+* and `Fn::GetStackOutput` reaches the same requirement through
+* `getSameAccountStackState` — which is exactly what scrub's three resolve
+* contexts did not supply, so neither could ever resolve here.
+*/
+const CROSS_STACK_INTRINSIC_KEYS = ["Fn::ImportValue", "Fn::GetStackOutput"];
+/**
+* The intrinsic keys {@link IntrinsicFunctionResolver}'s `resolveValue`
+* dispatches on, IN ITS ORDER (issue #2133 review).
+*
+* The pre-pass below must decide which key of a multi-key node the RESOLVER
+* would act on, because a node carrying a higher-precedence sibling never
+* reaches its `Fn::ImportValue` at all. Testing the cross-stack keys first — as
+* the first cut did — makes the pre-pass perform a READ the main resolution
+* never performs, and a read that fails is a refusal over a reference the
+* deploy never made. Isolation (`{ [key]: node[key] }`) does not answer this:
+* it stops the pre-pass resolving something ELSE, it does not stop it resolving
+* something EXTRA.
+*
+* `Condition` is deliberately absent. The resolver's `{Condition: <name>}` arm
+* is gated on `context.conditionResolver`, which only `evaluateConditions`
+* threads; in every context this pre-pass runs under, such a node is an
+* ordinary object property literally named `Condition`.
+*
+* Fenced against the resolver's own dispatch order by
+* `tests/unit/cli/commands/scrub-import-value-secret.test.ts`, so a new
+* intrinsic added there cannot silently leave this copy behind.
+*/
+const RESOLVER_INTRINSIC_PRECEDENCE = [
+	"Ref",
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+];
+/** The key `resolveValue` would dispatch on for `node`, or `undefined`. */
+function effectiveIntrinsicKey(node) {
+	return RESOLVER_INTRINSIC_PRECEDENCE.find((key) => key in node);
+}
+/**
+* The refusal a cross-stack read raises when scrub cannot PERFORM it (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* The value behind such a reference MAY be a secret — a producer stack exporting
+* a `{{resolve:...}}` expression is exactly the shape issue #1934 persists — and
+* scrub learns its plaintext ONLY by performing the read. A read that fails
+* therefore leaves the command with no needle for that value, so a stored
+* plaintext survives and the stack is reported clean. Refusing is the same bar
+* issue #2109 sets for the cross-region case: reporting success over a document
+* scrub could not examine is the one outcome that must not survive.
+*
+* MASKED for the reason `unresolvableForeignScrubSecretError` states — the bag
+* this resolved through is one `pinCrossRegionSecrets` may already have
+* substituted a foreign plaintext into, so a resolver error echoing its input
+* can carry one, and the map is the same one this pass records into.
+*/
+function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cause, secrets) {
+	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
+}
+/**
+* The refusal a cross-stack read raises when it SUCCEEDED but the PRODUCER's
+* own state record still stores the PLAINTEXT (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133) review).
+*
+* That producer state is precisely the population `cdkd scrub` exists for:
+* state an older binary wrote. Reading it hands the consumer a bare string,
+* nothing lands in `recordedSecretValues`, `totalSecrets` stays 0 and the
+* consumer is reported "No plaintext secrets found" while its record still
+* holds that plaintext. That is the same silent success the issue exists to
+* kill, reached one step later.
+*
+* There is no correct value to write here instead. What scrub must persist for
+* an imported secret is the PRODUCER's `{{resolve:...}}` expression, and that
+* expression exists only in the producer's state — the consumer's template
+* carries `{"Fn::ImportValue": ...}`, which is a REFERENCE, not an expression.
+* Writing the reference into a state leaf would fabricate an expression that
+* `Fn::ImportValue` and the exports index re-apply verbatim to further
+* consumers, the #1934 BREAK class this file already refuses one class over.
+* So: refuse, and name the fix that actually works — scrub the producer first,
+* which turns its stored plaintext into the expression this read then resolves.
+*/
+function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path, producerStack, exportKey, verdict, secrets) {
+	const loggedExportKey = maskSecretsInText(exportKey, secrets);
+	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
+	const templateClaim = verdict === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
+	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. Scrub the producer first ('cdkd scrub ${loggedProducerStack}'), then re-run 'cdkd scrub ${stackName}' — the read will then return the expression and this stack is scrubbed normally.`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
+}
+/**
+* Can the producer's STORED value be a legacy plaintext secret at all (issue
+* #2133 review)?
+*
+* `false` for a value that carries no text: `null` / `undefined`, the empty
+* string, and every non-string scalar. A resolved `{{resolve:...}}` reference
+* is always a STRING — `resolveDynamicReferences` substitutes text — so a
+* number or a boolean cannot be one, and an empty string holds nothing to
+* redact. Without this, `carriesDynamicReference` being false for those shapes
+* made a `widened` verdict refuse the consumer over a value with nothing behind
+* it, in a refusal that no re-run could clear (scrubbing the producer cannot
+* turn an empty value into an expression).
+*
+* Containers are NOT included: an array or object can nest a plaintext string,
+* and `carriesDynamicReference` already walks them, so the classification for
+* those is left exactly as it was.
+*/
+function storedValueCarriesNoPlaintext(stored) {
+	if (stored === null || stored === void 0) return true;
+	if (typeof stored === "string") return stored === "";
+	return typeof stored !== "object";
+}
+/**
+* Is `key` an export the producer's TEMPLATE declares from a `{{resolve:...}}`
+* expression (issue #2133 review)?
+*
+* This is HALF the discriminator, and the half the direct state read below
+* cannot supply. From the consumer's side, "the producer stored a plaintext
+* SECRET" and "the producer stored an ordinary non-secret value" are
+* indistinguishable — a bucket name and a leaked password are both bare
+* strings — so a refusal keyed on the producer's STORED value alone would fire
+* on every multi-stack app that imports anything at all. An export whose
+* declared `Value` contains no `{{resolve:` anywhere cannot be secret-bearing,
+* so its plaintext is nothing to redact.
+*
+* What it deliberately does NOT answer is whether the producer's own STATE has
+* been scrubbed down to that expression yet, which is the other half and the
+* one the three earlier cuts of this file each got wrong. See the discriminator
+* in {@link makeCrossStackPrePass}.
+*
+* `key` is the state.outputs KEY the read matched, which the deploy engine
+* writes under BOTH the output name and the literal `Export.Name` — hence both
+* are matched. When no output matches (an INTRINSIC `Export.Name`, which scrub
+* cannot reproduce from here) the test widens to every output of the producer,
+* which over-approximates in the SAFE direction: it can refuse a stack that
+* imports a non-secret export from a producer that has some other secret
+* output, and it never lets a secret-bearing one through. The widening is
+* REPORTED rather than folded into a boolean, because the refusal message
+* asserts what the producer declares and only the `declared` verdict has
+* checked that for THIS key.
+*
+* Residual, stated rather than hidden: a producer that publishes a secret
+* WITHOUT a literal `{{resolve:` in its template — one re-exporting a value it
+* imported from a third stack, or reading one through `Ref` to a parameter —
+* is not detected, and neither is a producer outside this app (whose template
+* scrub never sees). Those keep the pre-#2133 outcome for that one reference.
+*/
+function producerPublishesSecretExpression(template, key) {
+	const outputs = template.Outputs ?? {};
+	const matched = [];
+	for (const [name, output] of Object.entries(outputs)) {
+		const exportName = output?.Export?.Name;
+		if (name === key || typeof exportName === "string" && exportName === key) matched.push(output?.Value);
+	}
+	const widened = matched.length === 0;
+	if (!(widened ? Object.values(outputs).map((o) => o?.Value) : matched).some((value) => JSON.stringify(value ?? null).includes("{{resolve:"))) return "no";
+	return widened ? "widened" : "declared";
+}
+/**
+* Build the CROSS-STACK pre-pass for ONE stack's scrub (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* WHY THIS RUNS AT ALL, given the wiring in `scrubStack` already lets the main
+* resolution perform these reads. The wiring is what makes an
+* `Fn::ImportValue`-sourced secret RESOLVE; this pass is what makes a FAILED
+* one LOUD, and what catches a SUCCEEDING one that produced no needle. A
+* cross-stack read that throws inside `resolver.resolve` lands in the caller's
+* best-effort `catch { logger.debug(...) }`, and that catch cannot tell "a
+* `Ref` to a resource that is not in state" — which it exists for — from "the
+* producer's state could not be read", which silently costs the command its
+* needle. Lifting the second class OUT of the catch is the same placement issue
+* #2109 uses for its own refusals, and it keeps the catch doing its job:
+* everything it still swallows is now provably NOT a cross-stack read.
+*
+* THREE OUTCOMES per reference, and the split is the whole design:
+* - the read FAILS for a reason a user can fix (producer not deployed, wrong
+*   reference, an `AccessDenied` on the producer's state or on
+*   `cloudformation:ListExports`, an unassumable `RoleArn`) — REFUSE the stack.
+*   A re-run after the fix scrubs it, so refusing costs reachability only until
+*   the cause is addressed.
+* - the read is DECLINED BY DESIGN (`CrossAccountSecretRefusalError`) — record
+*   an UNVERIFIABLE finding, scrub the rest of the stack, and let the run exit
+*   non-zero. No user action can make that read succeed, so refusing the whole
+*   stack would strand every OTHER secret in it forever — a reachability
+*   regression against the pre-#2133 best-effort behaviour, in the command that
+*   exists to remediate. This is the `secretBearingKeys` treatment (issue
+*   #1919), applied to the same shape of finding: real, reported, unremediable.
+*   The match is on that SUBCLASS, never on `IntrinsicResolutionRefusalError`:
+*   five of its six throw sites are USER-FIXABLE and are reachable from here
+*   whenever a cross-stack node's ARGUMENT is an `Fn::Sub` / `Fn::GetAtt` /
+*   `Fn::Split` (`resolveSub` re-raises the class), so matching the base class
+*   downgraded a fixable refusal to a finding and let scrub print
+*   `No plaintext secrets found` and exit 0 over surviving plaintext.
+* - the read SUCCEEDS but the PRODUCER's own state record still holds the
+*   plaintext, for an export the producer's template declares from a
+*   `{{resolve:...}}` expression — REFUSE, see
+*   {@link plaintextProducerCrossStackReadError}.
+*
+* Each node is resolved on its OWN — `{ [key]: node[key] }` rather than the
+* enclosing object — so a bag carrying an unrelated sibling key cannot make
+* this pass resolve something else, and so a failure names the cross-stack read
+* rather than whatever the whole node resolves to. Which key of a multi-key
+* node is even eligible is decided by {@link RESOLVER_INTRINSIC_PRECEDENCE},
+* mirroring the resolver — so for the CHOICE OF KEY the pass never reads
+* through an intrinsic the main resolution would ignore.
+*
+* That is the whole of the invariant, and it is deliberately narrower than
+* "this pass performs no read the main resolution would not" (issue #2133
+* review — the earlier, overstated wording). `resolveValue` walks a plain
+* object's properties SEQUENTIALLY and aborts the whole bag at the first one
+* that throws, and it THROWS on an unknown intrinsic (`Fn::ToJsonString`,
+* `Fn::ForEach`) before descending into its argument at all; this pass resolves
+* each node on its own and keeps walking in both cases. So it can read a
+* reference the main resolution never reaches — after a sibling `Ref` to a
+* resource absent from state, which is the routine case, or beneath an
+* intrinsic cdkd cannot resolve. The DIRECTION is safe (the deploy made those
+* reads, so refusing over one names a real unscrubbed producer rather than a
+* fabricated one) but the sentence is load-bearing for the refusal, so it is
+* stated as what it is rather than as the stronger claim.
+*
+* The bag is NOT rewritten. The main resolution re-resolves these references
+* itself, and the S3 reads behind them are shared with this pass by the
+* memoizing backend view `scrubStack` builds (issue #2133 review — before that
+* every reference cost `listStacks()` plus up to N `getState()` TWICE). What
+* not rewriting buys back is the whole class of hazard a substituted value
+* carries: a resolved cross-stack value that is itself intrinsic- or
+* reference-shaped would be re-interpreted by the stack's own resolver, which
+* is the shape `SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN` guards against one
+* class over. The needles this records survive the main resolution failing for
+* an unrelated reason, since `recordedSecretValues` is filled in place.
+*
+* `Fn::If` is walked the way {@link IntrinsicFunctionResolver} walks it — the
+* SELECTED branch only, with an unknown condition selecting the FALSE branch,
+* mirroring `resolveIf`. Reading a reference the main resolution would never
+* touch would refuse a stack over a conditional import the deploy never made.
+* A MALFORMED `Fn::If` (args not a 3-tuple) is walked with refusals DISARMED
+* rather than skipped: which branch is live is unknowable, so a read inside it
+* may be one the deploy never made — the exact hazard the selected-branch
+* mirror exists to prevent — but any needle it does yield is still worth having.
+*/
+function makeCrossStackPrePass(deps) {
+	const { stackName, resolver, producerTemplates, findings, logger } = deps;
+	/**
+	* Is this a refusal NO RE-RUN can clear (issue #2133 review)?
+	*
+	* The predicate is the SUBCLASS, not `IntrinsicResolutionRefusalError`. That
+	* class has six throw sites and only ONE — `resolveGetStackOutput`'s
+	* cross-account arm — is permanent; the other five (a stale placeholder ARN,
+	* a fabricated account id, an unenriched `Fn::GetAtt`, `--strict-getatt`, a
+	* malformed `Fn::Split`) are all fixed by editing the template or deploying
+	* the producer. They are REACHABLE here, because `resolveSub` re-raises the
+	* class, so any cross-stack node whose ARGUMENT is an `Fn::Sub` /
+	* `Fn::GetAtt` / `Fn::Split` can carry one up to this catch. Matching the
+	* base class downgraded every one of them to a finding logged as "cdkd
+	* declines this read by design, so no re-run can change it" — false — and
+	* scrub then printed `No plaintext secrets found` and exited 0 without
+	* `--fail` while the consumer's state.json still held the imported plaintext.
+	*
+	* The CAUSE CHAIN rather than a bare `instanceof`: the refusal reaches this
+	* catch through `resolver.resolve`, which wraps in several places, and a
+	* top-link-only test silently reclassifies a wrapped permanent refusal as
+	* user-fixable — i.e. refuses the whole stack over something no user can fix.
+	*/
+	const isByDesignRefusal = (err) => err instanceof Error && errorCauseChain(err).some((link) => link instanceof CrossAccountSecretRefusalError);
+	return async function resolveCrossStackReads(bag, context, origin, opts) {
+		const canRefuse = opts?.canRefuse ?? true;
+		const secrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+		/**
+		* The producer this reference actually resolved through, and the KEY it
+		* matched — read back out of the resolver's own recording bags.
+		*
+		* Keyed on the intrinsic UNDER TEST rather than "imports first, then output
+		* reads": `resolveImportValue` / `resolveGetStackOutput` each resolve their
+		* ARGUMENTS before recording their own read, so a nested cross-stack read
+		* inside the argument lands in the OTHER family's bag (or earlier in the
+		* same one). Preferring imports unconditionally made an
+		* `Fn::GetStackOutput` whose `StackName` contains an `Fn::ImportValue`
+		* report the INNER producer.
+		*
+		* `.at(-1)` for the same reason within one family: the outer read is
+		* recorded LAST, after its argument has resolved.
+		*
+		* An empty bag means the value did NOT come from a cdkd state record, and
+		* the two arms that produce one are NOT unreadable for the same reason
+		* (issue #2133 review — one rationale used to cover both, and it was false
+		* of the second):
+		*
+		* - the CloudFormation `ListExports` / `DescribeStacks` FALLBACKS record
+		*   nothing deliberately, a CFn-managed producer being a weak reference.
+		*   Here "no expression to restore" is literally true: the value came from
+		*   CloudFormation, which cdkd never redacted, so no `{{resolve:...}}`
+		*   expression exists anywhere for scrub to write in its place.
+		* - the CROSS-ACCOUNT `Fn::GetStackOutput` arm records nothing for a
+		*   different reason, and a post-#1934 producer in the other account DOES
+		*   store the expression — which is precisely why
+		*   `CrossAccountSecretRefusalError` exists, and why it fires BEFORE this
+		*   point whenever the stored value carries one. What can reach here is a
+		*   value that carried none, and scrub cannot classify it any further: the
+		*   producer's `state.json` lives in another account and the only
+		*   credentials in hand are the consumer's, so reading it is the
+		*   wrong-account lookup that refusal exists to prevent.
+		*
+		* The OUTCOME is the same today either way — a cross-account producer is
+		* never in `appStacks`, so the `!producerTemplate` return below fires first
+		* regardless — but a future change that widened `producerTemplates` would
+		* be relying on this sentence, so it must not claim the second arm has no
+		* expression behind it.
+		*
+		* Residual: an OUTER read that fell through to a CloudFormation fallback
+		* while its ARGUMENT performed a same-family cdkd read leaves the inner
+		* entry last, so the check below consults the wrong producer. Bounded by
+		* the key test — the inner key must also exist in the inner producer's
+		* outputs, which it does — and it can only produce a false REFUSAL naming a
+		* real unscrubbed producer, never a false clean.
+		*/
+		const recordedProducer = (key, probe) => {
+			if (key === "Fn::GetStackOutput") {
+				const read = probe.recordedOutputReads?.at(-1);
+				return read ? {
+					stack: read.sourceStack,
+					region: read.sourceRegion,
+					key: read.outputName
+				} : void 0;
+			}
+			const imported = probe.recordedImports?.at(-1);
+			return imported ? {
+				stack: imported.sourceStack,
+				region: imported.sourceRegion,
+				key: imported.exportName
+			} : void 0;
+		};
+		/**
+		* The producer's STORED value for `key` — what its `state.json` actually
+		* holds, as opposed to what the read RETURNED.
+		*
+		* `undefined` when the producer's record cannot be read or does not carry
+		* the key, which is treated as "cannot classify" by the caller rather than
+		* as evidence of anything. Both are near-unreachable on the arms that get
+		* here (the read just succeeded against that record, through the SAME
+		* memoized `getState` promise this call resolves), so the read costs no
+		* extra AWS call.
+		*/
+		const storedProducerValue = async (producer, backend) => {
+			if (!backend) return void 0;
+			let loaded;
+			try {
+				loaded = await backend.getState(producer.stack, producer.region);
+			} catch (err) {
+				logger.debug(`Scrub of ${stackName}: could not re-read producer '${producer.stack}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				return;
+			}
+			const outputs = loaded?.state?.outputs;
+			if (!outputs || !(producer.key in outputs)) return void 0;
+			return { stored: outputs[producer.key] };
+		};
+		const readOne = async (key, node, path, nodeCanRefuse) => {
+			const probe = {
+				...context,
+				recordedImports: [],
+				recordedOutputReads: []
+			};
+			try {
+				await resolver.resolve({ [key]: node[key] }, probe);
+			} catch (err) {
+				if (!nodeCanRefuse) {
+					logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
+				if (isByDesignRefusal(err)) {
+					const detail = `${key} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					findings.unverifiable.push(detail);
+					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
+					return;
+				}
+				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
+			}
+			const producer = recordedProducer(key, probe);
+			if (!producer) return;
+			const producerTemplate = producerTemplates.get(producer.stack);
+			if (!producerTemplate) return;
+			const verdict = producerPublishesSecretExpression(producerTemplate, producer.key);
+			if (verdict === "no") return;
+			const stored = await storedProducerValue(producer, context.stateBackend);
+			if (!stored) return;
+			if (carriesDynamicReference(stored.stored)) return;
+			if (storedValueCarriesNoPlaintext(stored.stored)) {
+				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved through producer '${producer.stack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				return;
+			}
+			if (!nodeCanRefuse) {
+				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved to a plaintext from unscrubbed producer '${producer.stack}', and this position cannot refuse.`);
+				return;
+			}
+			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
+		};
+		const walk = async (v, path, nodeCanRefuse) => {
+			if (Array.isArray(v)) {
+				for (let i = 0; i < v.length; i++) await walk(v[i], `${path}[${i}]`, nodeCanRefuse);
+				return;
+			}
+			if (v === null || typeof v !== "object") return;
+			const node = v;
+			const key = effectiveIntrinsicKey(node);
+			if (key === void 0) {
+				for (const [k, val] of Object.entries(node)) await walk(val, path ? `${path}.${k}` : k, nodeCanRefuse);
+				return;
+			}
+			if (key === "Fn::If") {
+				const args = node["Fn::If"];
+				if (Array.isArray(args) && args.length === 3) {
+					const [conditionName, ifTrue, ifFalse] = args;
+					const selected = typeof conditionName === "string" && context.conditions?.[conditionName] === true ? ifTrue : ifFalse;
+					await walk(selected, `${path}['Fn::If']`, nodeCanRefuse);
+					return;
+				}
+				await walk(args, `${path}['Fn::If']`, false);
+				return;
+			}
+			if (CROSS_STACK_INTRINSIC_KEYS.includes(key)) {
+				await readOne(key, node, path, nodeCanRefuse);
+				return;
+			}
+			await walk(node[key], `${path}['${key}']`, nodeCanRefuse);
+		};
+		await walk(bag, "", canRefuse);
+	};
+}
+/**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
 * learn the resolved secret VALUES, then replaces those values in the state
 * record with their `{{resolve:...}}` expressions. Returns counts; performs no
@@ -62990,6 +63637,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
 	const perResourceSecrets = /* @__PURE__ */ new Map();
 	const outputSecrets = /* @__PURE__ */ new Map();
+	const prePassFindings = { unverifiable: [] };
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -62997,7 +63645,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			return {
 				recordsChanged: 0,
 				secretsFound: 0,
-				secretBearingKeys: 0
+				secretBearingKeys: 0,
+				unverifiableReads: 0
 			};
 		}
 		const state = loaded.state;
@@ -63014,13 +63663,26 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		} catch (err) {
 			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
+		const resolverContext = (recordedSecretValues) => ({
+			template: stack.template,
+			resources: state.resources,
+			...Object.keys(parameters).length > 0 && { parameters },
+			...Object.keys(conditions).length > 0 && { conditions },
+			stackName: stack.stackName,
+			stateBackend: resolverStateBackend,
+			...recordedSecretValues && { recordedSecretValues },
+			bestEffort: true
+		});
+		const resolveCrossStackReads = makeCrossStackPrePass({
+			stackName: stack.stackName,
+			resolver,
+			producerTemplates: new Map((opts.appStacks ?? []).map((s) => [s.stackName, s.template])),
+			findings: prePassFindings,
+			logger
+		});
 		try {
-			conditions = await resolver.evaluateConditions({
-				template: stack.template,
-				resources: state.resources,
-				...Object.keys(parameters).length > 0 && { parameters },
-				bestEffort: true
-			});
+			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
 			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -63029,6 +63691,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const templateResource = templateResources[logicalId];
 			if (!templateResource?.Properties) continue;
 			const recordedSecretValues = /* @__PURE__ */ new Map();
+			perResourceSecrets.set(logicalId, recordedSecretValues);
 			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
@@ -63037,20 +63700,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordedSecretValues,
 				origin: `resource '${logicalId}'`
 			});
+			const resourceContext = resolverContext(recordedSecretValues);
+			await resolveCrossStackReads(resolveInput, resourceContext, `resource '${logicalId}'`);
 			try {
-				await resolver.resolve(resolveInput, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
-					recordedSecretValues,
-					bestEffort: true
-				});
+				await resolver.resolve(resolveInput, resourceContext);
 			} catch (err) {
 				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 			}
-			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
 		}
 		const templateOutputs = stack.template.Outputs ?? {};
@@ -63071,16 +63727,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					recordedSecretValues: outputSecrets,
 					origin: `Export.Name of output '${name}'`
 				});
+				const nameContext = resolverContext(outputSecrets);
+				await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				try {
-					exportName = await resolver.resolve(nameSource, {
-						template: stack.template,
-						resources: state.resources,
-						...Object.keys(parameters).length > 0 && { parameters },
-						...Object.keys(conditions).length > 0 && { conditions },
-						stackName: stack.stackName,
-						recordedSecretValues: outputSecrets,
-						bestEffort: true
-					});
+					exportName = await resolver.resolve(nameSource, nameContext);
 				} catch (err) {
 					outputsSourceUntrusted = true;
 					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
@@ -63111,16 +63761,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordedSecretValues: outputSecrets,
 				origin: `output '${name}'`
 			});
+			const valueContext = resolverContext(outputSecrets);
+			await resolveCrossStackReads(valueSource, valueContext, `output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 			try {
-				await resolver.resolve(valueSource, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
-					recordedSecretValues: outputSecrets,
-					bestEffort: true
-				});
+				await resolver.resolve(valueSource, valueContext);
 			} catch (err) {
 				logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 			}
@@ -63137,7 +63781,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (totalSecrets === 0) return {
 			recordsChanged: 0,
 			secretsFound: 0,
-			secretBearingKeys: 0
+			secretBearingKeys: secretBearingKeys.length,
+			unverifiableReads: prePassFindings.unverifiable.length
 		};
 		let recordsChanged = 0;
 		const newResources = {};
@@ -63167,7 +63812,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		return {
 			recordsChanged,
 			secretsFound: totalSecrets,
-			secretBearingKeys: secretBearingKeys.length
+			secretBearingKeys: secretBearingKeys.length,
+			unverifiableReads: prePassFindings.unverifiable.length
 		};
 	} catch (err) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
@@ -73031,7 +73677,7 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 		try {
 			parsed = JSON.parse(body);
 		} catch (error) {
-			const described = describeStateKey(key);
+			const described = describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
 			const regionMatch = /^(\S+) \((\S+)\)$/.exec(described);
 			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
 		}
@@ -73236,7 +73882,7 @@ async function gcCommand(options) {
 	});
 	const stateBackend = new S3StateBackend(markerS3Client, {
 		bucket: bucketName,
-		prefix: "cdkd"
+		prefix: DEFAULT_STATE_PREFIX
 	}, {
 		region: effective.region,
 		...options.profile && { profile: options.profile }
@@ -73282,7 +73928,7 @@ async function gcCommand(options) {
 		const marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
 		const lockKeys = await listAllLockKeys(stateBackend);
 		if (lockKeys.length > 0) {
-			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX)}  [${k}]`).join("\n");
+			const listing = lockKeys.map((k) => `  - ${describeStateKey(k, LOCK_FILE_SUFFIX, DEFAULT_STATE_PREFIX)}  [${k}]`).join("\n");
 			throw new CdkdError(`Refusing to gc while ${lockKeys.length} stack(s) hold an active lock (a deploy in flight may have published assets whose state write has not landed yet):\n${listing}\nWait for the operation(s) to finish — or clear a stale lock with 'cdkd force-unlock <stack>' — then re-run 'cdkd gc'.`, "GC_LOCKED");
 		}
 		const refs = await scanReferencedAssets(stateBackend, marker, logger);
@@ -85084,7 +85730,7 @@ async function promptConfirm(message) {
 * callers get the standard exit-code-2 routing.
 */
 function createMigrateCommand() {
-	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default("cdkd")).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
+	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default(DEFAULT_STATE_PREFIX)).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
 }
 
 //#endregion
@@ -85107,7 +85753,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.30");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.32");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;