@go-to-k/cdkd 0.284.31 → 0.284.32

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as endCommandInterruptScope, $t as createAssetRedirectResolver, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveUseCdkBootstrapAssets, At as maskSecretsInText, B as collectDeclaredOutputNames, Bn as canonicalizeRegion, Bt as INTRINSIC_KEYS, C as ccRoutedFinalSnapshotError, Cn as getLegacyStateBucketName, Ct as STATE_SOURCED_READBACK_RULES, D as unsupportedFinalSnapshotError, Dn as resolveSkipPrefix, Dt as errorCauseChain, E as refusesFinalSnapshot, En as resolveCaptureObservedState, Et as dynamicReferenceTokens, F as cyan, Fn as MIGRATE_TMP_PREFIX, Ft as s3BucketDualStackDomainName, G as stateKeySecretExposure, Gn as resolveBucketRegion, Gt as LockManager, H as exportAliasCollisionScrubWarning, Hn as AssemblyReader, Ht as withRetry, I as gray, In as findLargeInlineResources, It as s3BucketRegionalDomainName, J as clearOnUpdateRemoval, Jn as resetAwsClients, Jt as shouldRetainResource, K as IAMRoleProvider, Kn as AwsClients, Kt as S3StateBackend, L as green, Ln as uploadCfnTemplate, Lt as s3BucketWebsiteUrl, M as renderStatefulReason, Mn as warnDeprecatedNoPrefixCliFlag, Mt as scrubResourceRecord, N as formatResourceLine, Nn as CFN_TEMPLATE_BODY_LIMIT, Nt as s3BucketArn, O as makeCanonicalizePropertiesFn, On as resolveStateBucketWithDefault, Ot as isSingleDynamicReferenceToken, P as bold, Pn as CFN_TEMPLATE_URL_LIMIT, Pt as s3BucketDomainName, Q as beginCommandInterruptScope, Qt as buildAssetRedirectMap, R as red, Rn as expectedOwnerParam, Rt as applyRoleArnIfSet, S as buildFinalSnapshotIdentifier, Sn as getDefaultStateBucketName, Sr as markNonRetryable, St as STATE_SOURCED_CROSS_GENERATION_RULES, T as isFinalSnapshotError, Tn as resolveAutoAssetStorage, Tt as createSecretMasker, U as isExportAliasCollision, Un as processStackMessages, Ut as DagBuilder, V as collectPublishedOutputNames, Vn as derivePartitionAndUrlSuffix, Vt as describeTypeWithThrottleRetry, W as secretBearingStateKeyWarning, Wt as TemplateParser, X as findActionableSilentDrops, Xt as stringifyValue, Y as ProviderRegistry, Yn as setAwsClients, Yt as AssetPublisher, Z as findSilentDropProperties, Zn as CdkdError, Zt as WorkGraph, _ as maskingRetryLogger, _n as runDockerStreaming, _r as normalizeAwsError, _t as readConfigString, a as DeploymentEventsStore, an as BOOTSTRAP_MARKER_PREFIX, ar as MissingCdkCliError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as Synthesizer, br as isRetryableTransientError, bt as requireConfigObject, c as planRollback, cn as parseBootstrapMarker, cr as ProvisioningError, ct as getAccountInfo, d as replayRollback, dn as validateContainerRepoName, dr as StackHasActiveImportsError, dt as normalizeAwsTagsToCfn, en as loadPublishableAssetManifest, er as DeployCancelledError, et as isInterruptedWaitError, f as updatePartialMessage, fn as buildDenyExternalAccessPolicy, fr as StackTerminationProtectionError, ft as resolveExplicitPhysicalId, g as withResourceDeadline, gn as runDockerForeground, gt as configStringRefusal, h as deleteSkipReason, hn as getDockerCmd, ht as configBooleanRefusal, i as DeploymentEventsReader, in as AssetModeResolver, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as stateBucketExistenceConfirmed, jt as redactSecretsForState, k as extractDeploymentEventError, kn as resolveStateBucketWithDefaultAndSource, kt as maskSecretsInError, l as producerRegionsFromState, ln as readBootstrapMarkerBody, lr as ResourceTimeoutError, lt as refStateLookupFromResource, m as UNSPECIFIED_SKIP_REASON, mn as formatDockerLoginError, mt as coerceCfnBoolean, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as escapeRegExp, nr as LocalMigrateError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as ensureAssetStorage, or as NestedStackChildDirectDestroyError, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDockerImage, pt as assertRegionMatch, q as collectInlinePolicyNamesManagedBySiblings, qn as getAwsClients, qt as rebuildClientForBucketRegion, r as DeployEngine, rn as stripControlChars, rr as LocalStartServiceError, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as getBootstrapMarkerKey, sr as PartialFailureError, st as cfnRefValueFromPhysicalId, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as rewriteTemplateAssetReferences, tr as LocalInvokeBuildError$1, tt as startInterruptWatch, u as replayFailedOperations, un as validateAssetBucketName, ur as ResourceUpdateNotSupportedError, ut as WAFv2WebACLProvider, v as IMPLICIT_DELETE_DEPENDENCIES, vn as AssetManifestLoader, vr as withErrorHandling, vt as replayWarn, w as createPreDeleteFinalSnapshot, wn as resolveApp, wt as TEMPLATE_SOURCED_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as synthesisStatusMessage, xr as isThrottlingError, xt as requireConfigString, y as computeImplicitDeleteEdges, yn as getDockerImageBySourceHash, yr as isMarkedNonRetryable, yt as requireConfigArray, z as yellow, zn as PARTITION_TABLE, zt as DiffCalculator } from "./deploy-engine-DYdEWX-s.js";
+import { $ as endCommandInterruptScope, $t as buildAssetRedirectMap, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveStateBucketWithDefaultAndSource, At as maskSecretsInError, B as collectDeclaredOutputNames, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as ccRoutedFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isThrottlingError, Ct as STATE_SOURCED_CROSS_GENERATION_RULES, D as unsupportedFinalSnapshotError, Dn as resolveCaptureObservedState, Dt as dynamicReferenceTokens, E as refusesFinalSnapshot, En as resolveAutoAssetStorage, Et as createSecretMasker, F as cyan, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as stateKeySecretExposure, Gt as TemplateParser, H as exportAliasCollisionScrubWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as gray, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as clearOnUpdateRemoval, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as IAMRoleProvider, Kn as resolveBucketRegion, Kt as LockManager, L as green, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as renderStatefulReason, Mn as stateBucketExistenceConfirmed, Mt as redactSecretsForState, N as formatResourceLine, Nn as warnDeprecatedNoPrefixCliFlag, Nt as scrubResourceRecord, O as makeCanonicalizePropertiesFn, On as resolveSkipPrefix, Ot as errorCauseChain, P as bold, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as beginCommandInterruptScope, Qn as CdkdError, Qt as WorkGraph, R as red, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as buildFinalSnapshotIdentifier, Sn as synthesisStatusMessage, Sr as isRetryableTransientError, St as requireConfigString, T as isFinalSnapshotError, Tn as resolveApp, Tt as TEMPLATE_SOURCED_RULES, U as isExportAliasCollision, Un as AssemblyReader, Ut as withRetry, V as collectPublishedOutputNames, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as secretBearingStateKeyWarning, Wn as processStackMessages, Wt as DagBuilder, X as findActionableSilentDrops, Xn as setAwsClients, Xt as AssetPublisher, Y as ProviderRegistry, Yn as resetAwsClients, Yt as shouldRetainResource, Z as findSilentDropProperties, Zt as stringifyValue, _ as maskingRetryLogger, _n as runDockerForeground, _t as configStringRefusal, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalStartServiceError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as getDockerImageBySourceHash, br as withErrorHandling, bt as requireConfigArray, c as planRollback, cn as getBootstrapMarkerKey, cr as NestedStackChildDirectDestroyError, ct as cfnRefValueFromPhysicalId, d as replayRollback, dn as validateAssetBucketName, dr as ResourceTimeoutError, dt as WAFv2WebACLProvider, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as isInterruptedWaitError, f as updatePartialMessage, fn as validateContainerRepoName, fr as ResourceUpdateNotSupportedError, ft as normalizeAwsTagsToCfn, g as withResourceDeadline, gn as getDockerCmd, gt as configBooleanRefusal, h as deleteSkipReason, hn as formatDockerLoginError, ht as coerceCfnBoolean, i as DeploymentEventsReader, in as stripControlChars, ir as LocalMigrateError, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as resolveUseCdkBootstrapAssets, jt as maskSecretsInText, k as extractDeploymentEventError, kn as resolveStateBucketWithDefault, kt as isSingleDynamicReferenceToken, l as producerRegionsFromState, ln as parseBootstrapMarker, lr as PartialFailureError, lt as getAccountInfo, m as UNSPECIFIED_SKIP_REASON, mn as buildDockerImage, mr as StackTerminationProtectionError, mt as assertRegionMatch, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as BOOTSTRAP_MARKER_PREFIX, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDenyExternalAccessPolicy, pr as StackHasActiveImportsError, pt as resolveExplicitPhysicalId, q as collectInlinePolicyNamesManagedBySiblings, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as LocalInvokeBuildError$1, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as ensureAssetStorage, sr as MissingCdkCliError, st as carriesDynamicReference, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as startInterruptWatch, u as replayFailedOperations, un as readBootstrapMarkerBody, ur as ProvisioningError, ut as refStateLookupFromResource, v as IMPLICIT_DELETE_DEPENDENCIES, vn as runDockerStreaming, vt as readConfigString, w as createPreDeleteFinalSnapshot, wn as getLegacyStateBucketName, wr as markNonRetryable, wt as STATE_SOURCED_READBACK_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as Synthesizer, xr as isMarkedNonRetryable, xt as requireConfigObject, y as computeImplicitDeleteEdges, yn as AssetManifestLoader, yr as normalizeAwsError, yt as replayWarn, z as yellow, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-DsUQ4GxO.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DJvcY8lj.js";
+import { t as ASGProvider } from "./asg-provider-BVzQ7mQX.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -62447,6 +62447,7 @@ async function scrubCommand(stacks, options) {
 	else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 	if (targetStacks.length === 0) throw new Error("No stacks matched.");
 	await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
+	targetStacks = orderScrubTargets(targetStacks);
 	const stateConfig = {
 		bucket: stateBucket,
 		prefix: options.statePrefix
@@ -62462,6 +62463,7 @@ async function scrubCommand(stacks, options) {
 	const lockManager = new LockManager(stateS3.s3, stateConfig);
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
+	let totalStacksWithUnverifiableReads = 0;
 	const failures = [];
 	for (const stack of targetStacks) {
 		const stackRegion = stack.region || region;
@@ -62470,7 +62472,8 @@ async function scrubCommand(stacks, options) {
 			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
 				dryRun: options.dryRun ?? false,
 				roleArn: options.roleArn,
-				logger
+				logger,
+				appStacks: allStacks
 			});
 		} catch (err) {
 			failures.push({ stackName: stack.stackName });
@@ -62481,13 +62484,17 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		if (scrubbed.unverifiableReads > 0) {
+			totalStacksWithUnverifiableReads++;
+			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
+		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -62497,17 +62504,18 @@ async function scrubCommand(stacks, options) {
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
+	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${failureNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${unverifiableNote}${failureNote}`);
+	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
-	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
+	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
 * Every secret plaintext this run recorded, from ANY position in the template
@@ -63046,6 +63054,571 @@ async function pinCrossRegionSecrets(bag, stackName, ctx) {
 	return await walk(bag, "");
 }
 /**
+* Order scrub targets PRODUCER-BEFORE-CONSUMER (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133) review).
+*
+* `cdkd scrub --all` used to walk the assembly's artifact order, which is not
+* topological — `getAllStacks` iterates the manifest, and only `cdkd deploy`
+* sorts. That ordering decides whether a legacy multi-stack app can be scrubbed
+* in ONE run: a consumer importing a secret learns its expression only by
+* reading the producer's state, and that state holds the expression only once
+* the PRODUCER has been scrubbed. Reached in the other order the consumer gets
+* a plaintext, has no needle, and is refused
+* ({@link plaintextProducerCrossStackReadError}) until the user re-runs. Both
+* orders are SAFE — the refusal is what makes them safe — but only one of them
+* finishes the job in a single command.
+*
+* Edges come from BOTH sources `cdkd deploy` uses: CDK's own manifest
+* dependencies (`dependencyNames`, emitted for a strong reference through
+* `exportValue`) and {@link inferCrossStackStackDeps}, which scans the
+* synthesized templates for a RAW `cdk.Fn.importValue` / `Fn::GetStackOutput`
+* that CDK records no dependency for. Edges to stacks outside the target set
+* are ignored: a producer that is not being scrubbed cannot be ordered.
+*
+* Cycles cannot happen through `Fn::ImportValue` on a deployable app, but a
+* cycle in the INFERRED graph is possible (two stacks reading each other's
+* outputs weakly), so the sort degrades to input order for whatever it cannot
+* place rather than dropping or duplicating a stack. Ties keep input order, so
+* a single-stack or dependency-free `--all` run is byte-identical to before.
+*/
+function orderScrubTargets(targets) {
+	if (targets.length < 2) return [...targets];
+	const inSet = new Set(targets.map((t) => t.stackName));
+	const inferred = inferCrossStackStackDeps(targets);
+	const producersOf = /* @__PURE__ */ new Map();
+	for (const target of targets) {
+		const producers = /* @__PURE__ */ new Set();
+		for (const dep of target.dependencyNames ?? []) if (inSet.has(dep) && dep !== target.stackName) producers.add(dep);
+		for (const dep of inferred.get(target.stackName) ?? []) if (inSet.has(dep) && dep !== target.stackName) producers.add(dep);
+		producersOf.set(target.stackName, producers);
+	}
+	const ordered = [];
+	const emitted = /* @__PURE__ */ new Set();
+	const pending = [...targets];
+	while (pending.length > 0) {
+		let index = pending.findIndex((t) => [...producersOf.get(t.stackName) ?? []].every((p) => emitted.has(p)));
+		if (index === -1) index = 0;
+		const [next] = pending.splice(index, 1);
+		if (!next) break;
+		ordered.push(next);
+		emitted.add(next.stackName);
+	}
+	return ordered;
+}
+/**
+* A memoizing READ view over the state backend, for the resolutions ONE
+* `scrubStack` call performs (issue #2133 review).
+*
+* `resolveImportValue` has no lookup cache of its own: each reference costs a
+* `listStacks()` plus up to N `getState()` calls, and scrub resolves every
+* cross-stack reference TWICE — once in the pre-pass (which must run before the
+* best-effort catch can swallow a failure) and once in the main resolution
+* (which must run because the pre-pass deliberately does not rewrite the bag).
+* The view collapses both into one scan and one `getState` per (stack, region).
+*
+* `Object.create` rather than a hand-written wrapper object: the resolver also
+* reads `stateBackend.prefix` and could reach for more, and a literal cast to
+* `S3StateBackend` would turn the next such call into `undefined is not a
+* function`. Prototype delegation keeps every other member — and
+* `instanceof S3StateBackend` — intact.
+*
+* Deliberately NOT used for this stack's own `getState` / `saveState`: those go
+* through the real backend, so the read-modify-write still sees S3 rather than
+* a cache, and its ETag precondition still means what it says.
+*/
+function memoizeCrossStackStateReads(backend) {
+	const view = Object.create(backend);
+	let listed;
+	const states = /* @__PURE__ */ new Map();
+	view.listStacks = () => {
+		listed ??= backend.listStacks();
+		return listed;
+	};
+	view.getState = (stackName, stateRegion) => {
+		const key = `${stackName}\u0000${stateRegion}`;
+		let pending = states.get(key);
+		if (!pending) {
+			pending = backend.getState(stackName, stateRegion);
+			states.set(key, pending);
+		}
+		return pending;
+	};
+	return view;
+}
+/**
+* Is this template output one the deploy would NOT have written (issue #2133
+* review)?
+*
+* The outputs passes deliberately run over EVERY declared output regardless of
+* its `Condition`, so a secret carried by a (possibly spuriously) suppressed
+* output still becomes a needle for the resource records that share it. That
+* argument justifies RESOLVING a suppressed output, and nothing more — it does
+* not justify REFUSING the whole stack when such a resolution fails, because a
+* suppressed output produced no `state.outputs` key and so has nothing at risk.
+* A dev-environment scrub would otherwise be refused outright by a prod-only
+* `Value: {Fn::ImportValue: ProdOnlyExport}` whose producer does not exist in
+* dev. So: resolve it best-effort, but disarm the refusal.
+*
+* An UNKNOWN condition counts as suppressed, matching `resolveIf`'s
+* unknown-selects-FALSE rule and erring toward not refusing.
+*
+* STATE OVERRULES THE CONDITION (issue #2133 review). `conditions` degrades to
+* `{}` whenever `evaluateConditions` throws, and even when it succeeds it is
+* evaluated from TEMPLATE PARAMETER DEFAULTS — scrub takes no `--parameters` —
+* so an output the deploy really did write reads as suppressed on any stack
+* deployed with non-default parameters, which silently disarms the refusal for
+* that position. `state.outputs` is the record of what the deploy ACTUALLY
+* wrote (keyed by output NAME, plus the export-name alias), so a key present
+* there is proof the output was not suppressed, whatever this run's
+* best-effort condition evaluation concluded.
+*/
+function isOutputSuppressed(name, output, conditions, stateOutputs) {
+	const condition = output.Condition;
+	if (typeof condition !== "string") return false;
+	if (conditions[condition] === true) return false;
+	return !(name in stateOutputs);
+}
+/**
+* The intrinsics that read ANOTHER stack's state (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* Both require `context.stateBackend` — `resolveImportValue` throws without it,
+* and `Fn::GetStackOutput` reaches the same requirement through
+* `getSameAccountStackState` — which is exactly what scrub's three resolve
+* contexts did not supply, so neither could ever resolve here.
+*/
+const CROSS_STACK_INTRINSIC_KEYS = ["Fn::ImportValue", "Fn::GetStackOutput"];
+/**
+* The intrinsic keys {@link IntrinsicFunctionResolver}'s `resolveValue`
+* dispatches on, IN ITS ORDER (issue #2133 review).
+*
+* The pre-pass below must decide which key of a multi-key node the RESOLVER
+* would act on, because a node carrying a higher-precedence sibling never
+* reaches its `Fn::ImportValue` at all. Testing the cross-stack keys first — as
+* the first cut did — makes the pre-pass perform a READ the main resolution
+* never performs, and a read that fails is a refusal over a reference the
+* deploy never made. Isolation (`{ [key]: node[key] }`) does not answer this:
+* it stops the pre-pass resolving something ELSE, it does not stop it resolving
+* something EXTRA.
+*
+* `Condition` is deliberately absent. The resolver's `{Condition: <name>}` arm
+* is gated on `context.conditionResolver`, which only `evaluateConditions`
+* threads; in every context this pre-pass runs under, such a node is an
+* ordinary object property literally named `Condition`.
+*
+* Fenced against the resolver's own dispatch order by
+* `tests/unit/cli/commands/scrub-import-value-secret.test.ts`, so a new
+* intrinsic added there cannot silently leave this copy behind.
+*/
+const RESOLVER_INTRINSIC_PRECEDENCE = [
+	"Ref",
+	"Fn::GetAtt",
+	"Fn::Join",
+	"Fn::Sub",
+	"Fn::Select",
+	"Fn::Split",
+	"Fn::If",
+	"Fn::Equals",
+	"Fn::And",
+	"Fn::Or",
+	"Fn::Not",
+	"Fn::ImportValue",
+	"Fn::GetStackOutput",
+	"Fn::FindInMap",
+	"Fn::Base64",
+	"Fn::GetAZs",
+	"Fn::Cidr"
+];
+/** The key `resolveValue` would dispatch on for `node`, or `undefined`. */
+function effectiveIntrinsicKey(node) {
+	return RESOLVER_INTRINSIC_PRECEDENCE.find((key) => key in node);
+}
+/**
+* The refusal a cross-stack read raises when scrub cannot PERFORM it (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* The value behind such a reference MAY be a secret — a producer stack exporting
+* a `{{resolve:...}}` expression is exactly the shape issue #1934 persists — and
+* scrub learns its plaintext ONLY by performing the read. A read that fails
+* therefore leaves the command with no needle for that value, so a stored
+* plaintext survives and the stack is reported clean. Refusing is the same bar
+* issue #2109 sets for the cross-region case: reporting success over a document
+* scrub could not examine is the one outcome that must not survive.
+*
+* MASKED for the reason `unresolvableForeignScrubSecretError` states — the bag
+* this resolved through is one `pinCrossRegionSecrets` may already have
+* substituted a foreign plaintext into, so a resolver error echoing its input
+* can carry one, and the map is the same one this pass records into.
+*/
+function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cause, secrets) {
+	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
+}
+/**
+* The refusal a cross-stack read raises when it SUCCEEDED but the PRODUCER's
+* own state record still stores the PLAINTEXT (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133) review).
+*
+* That producer state is precisely the population `cdkd scrub` exists for:
+* state an older binary wrote. Reading it hands the consumer a bare string,
+* nothing lands in `recordedSecretValues`, `totalSecrets` stays 0 and the
+* consumer is reported "No plaintext secrets found" while its record still
+* holds that plaintext. That is the same silent success the issue exists to
+* kill, reached one step later.
+*
+* There is no correct value to write here instead. What scrub must persist for
+* an imported secret is the PRODUCER's `{{resolve:...}}` expression, and that
+* expression exists only in the producer's state — the consumer's template
+* carries `{"Fn::ImportValue": ...}`, which is a REFERENCE, not an expression.
+* Writing the reference into a state leaf would fabricate an expression that
+* `Fn::ImportValue` and the exports index re-apply verbatim to further
+* consumers, the #1934 BREAK class this file already refuses one class over.
+* So: refuse, and name the fix that actually works — scrub the producer first,
+* which turns its stored plaintext into the expression this read then resolves.
+*/
+function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path, producerStack, exportKey, verdict, secrets) {
+	const loggedExportKey = maskSecretsInText(exportKey, secrets);
+	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
+	const templateClaim = verdict === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
+	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. Scrub the producer first ('cdkd scrub ${loggedProducerStack}'), then re-run 'cdkd scrub ${stackName}' — the read will then return the expression and this stack is scrubbed normally.`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
+}
+/**
+* Can the producer's STORED value be a legacy plaintext secret at all (issue
+* #2133 review)?
+*
+* `false` for a value that carries no text: `null` / `undefined`, the empty
+* string, and every non-string scalar. A resolved `{{resolve:...}}` reference
+* is always a STRING — `resolveDynamicReferences` substitutes text — so a
+* number or a boolean cannot be one, and an empty string holds nothing to
+* redact. Without this, `carriesDynamicReference` being false for those shapes
+* made a `widened` verdict refuse the consumer over a value with nothing behind
+* it, in a refusal that no re-run could clear (scrubbing the producer cannot
+* turn an empty value into an expression).
+*
+* Containers are NOT included: an array or object can nest a plaintext string,
+* and `carriesDynamicReference` already walks them, so the classification for
+* those is left exactly as it was.
+*/
+function storedValueCarriesNoPlaintext(stored) {
+	if (stored === null || stored === void 0) return true;
+	if (typeof stored === "string") return stored === "";
+	return typeof stored !== "object";
+}
+/**
+* Is `key` an export the producer's TEMPLATE declares from a `{{resolve:...}}`
+* expression (issue #2133 review)?
+*
+* This is HALF the discriminator, and the half the direct state read below
+* cannot supply. From the consumer's side, "the producer stored a plaintext
+* SECRET" and "the producer stored an ordinary non-secret value" are
+* indistinguishable — a bucket name and a leaked password are both bare
+* strings — so a refusal keyed on the producer's STORED value alone would fire
+* on every multi-stack app that imports anything at all. An export whose
+* declared `Value` contains no `{{resolve:` anywhere cannot be secret-bearing,
+* so its plaintext is nothing to redact.
+*
+* What it deliberately does NOT answer is whether the producer's own STATE has
+* been scrubbed down to that expression yet, which is the other half and the
+* one the three earlier cuts of this file each got wrong. See the discriminator
+* in {@link makeCrossStackPrePass}.
+*
+* `key` is the state.outputs KEY the read matched, which the deploy engine
+* writes under BOTH the output name and the literal `Export.Name` — hence both
+* are matched. When no output matches (an INTRINSIC `Export.Name`, which scrub
+* cannot reproduce from here) the test widens to every output of the producer,
+* which over-approximates in the SAFE direction: it can refuse a stack that
+* imports a non-secret export from a producer that has some other secret
+* output, and it never lets a secret-bearing one through. The widening is
+* REPORTED rather than folded into a boolean, because the refusal message
+* asserts what the producer declares and only the `declared` verdict has
+* checked that for THIS key.
+*
+* Residual, stated rather than hidden: a producer that publishes a secret
+* WITHOUT a literal `{{resolve:` in its template — one re-exporting a value it
+* imported from a third stack, or reading one through `Ref` to a parameter —
+* is not detected, and neither is a producer outside this app (whose template
+* scrub never sees). Those keep the pre-#2133 outcome for that one reference.
+*/
+function producerPublishesSecretExpression(template, key) {
+	const outputs = template.Outputs ?? {};
+	const matched = [];
+	for (const [name, output] of Object.entries(outputs)) {
+		const exportName = output?.Export?.Name;
+		if (name === key || typeof exportName === "string" && exportName === key) matched.push(output?.Value);
+	}
+	const widened = matched.length === 0;
+	if (!(widened ? Object.values(outputs).map((o) => o?.Value) : matched).some((value) => JSON.stringify(value ?? null).includes("{{resolve:"))) return "no";
+	return widened ? "widened" : "declared";
+}
+/**
+* Build the CROSS-STACK pre-pass for ONE stack's scrub (issue
+* [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
+*
+* WHY THIS RUNS AT ALL, given the wiring in `scrubStack` already lets the main
+* resolution perform these reads. The wiring is what makes an
+* `Fn::ImportValue`-sourced secret RESOLVE; this pass is what makes a FAILED
+* one LOUD, and what catches a SUCCEEDING one that produced no needle. A
+* cross-stack read that throws inside `resolver.resolve` lands in the caller's
+* best-effort `catch { logger.debug(...) }`, and that catch cannot tell "a
+* `Ref` to a resource that is not in state" — which it exists for — from "the
+* producer's state could not be read", which silently costs the command its
+* needle. Lifting the second class OUT of the catch is the same placement issue
+* #2109 uses for its own refusals, and it keeps the catch doing its job:
+* everything it still swallows is now provably NOT a cross-stack read.
+*
+* THREE OUTCOMES per reference, and the split is the whole design:
+* - the read FAILS for a reason a user can fix (producer not deployed, wrong
+*   reference, an `AccessDenied` on the producer's state or on
+*   `cloudformation:ListExports`, an unassumable `RoleArn`) — REFUSE the stack.
+*   A re-run after the fix scrubs it, so refusing costs reachability only until
+*   the cause is addressed.
+* - the read is DECLINED BY DESIGN (`CrossAccountSecretRefusalError`) — record
+*   an UNVERIFIABLE finding, scrub the rest of the stack, and let the run exit
+*   non-zero. No user action can make that read succeed, so refusing the whole
+*   stack would strand every OTHER secret in it forever — a reachability
+*   regression against the pre-#2133 best-effort behaviour, in the command that
+*   exists to remediate. This is the `secretBearingKeys` treatment (issue
+*   #1919), applied to the same shape of finding: real, reported, unremediable.
+*   The match is on that SUBCLASS, never on `IntrinsicResolutionRefusalError`:
+*   five of its six throw sites are USER-FIXABLE and are reachable from here
+*   whenever a cross-stack node's ARGUMENT is an `Fn::Sub` / `Fn::GetAtt` /
+*   `Fn::Split` (`resolveSub` re-raises the class), so matching the base class
+*   downgraded a fixable refusal to a finding and let scrub print
+*   `No plaintext secrets found` and exit 0 over surviving plaintext.
+* - the read SUCCEEDS but the PRODUCER's own state record still holds the
+*   plaintext, for an export the producer's template declares from a
+*   `{{resolve:...}}` expression — REFUSE, see
+*   {@link plaintextProducerCrossStackReadError}.
+*
+* Each node is resolved on its OWN — `{ [key]: node[key] }` rather than the
+* enclosing object — so a bag carrying an unrelated sibling key cannot make
+* this pass resolve something else, and so a failure names the cross-stack read
+* rather than whatever the whole node resolves to. Which key of a multi-key
+* node is even eligible is decided by {@link RESOLVER_INTRINSIC_PRECEDENCE},
+* mirroring the resolver — so for the CHOICE OF KEY the pass never reads
+* through an intrinsic the main resolution would ignore.
+*
+* That is the whole of the invariant, and it is deliberately narrower than
+* "this pass performs no read the main resolution would not" (issue #2133
+* review — the earlier, overstated wording). `resolveValue` walks a plain
+* object's properties SEQUENTIALLY and aborts the whole bag at the first one
+* that throws, and it THROWS on an unknown intrinsic (`Fn::ToJsonString`,
+* `Fn::ForEach`) before descending into its argument at all; this pass resolves
+* each node on its own and keeps walking in both cases. So it can read a
+* reference the main resolution never reaches — after a sibling `Ref` to a
+* resource absent from state, which is the routine case, or beneath an
+* intrinsic cdkd cannot resolve. The DIRECTION is safe (the deploy made those
+* reads, so refusing over one names a real unscrubbed producer rather than a
+* fabricated one) but the sentence is load-bearing for the refusal, so it is
+* stated as what it is rather than as the stronger claim.
+*
+* The bag is NOT rewritten. The main resolution re-resolves these references
+* itself, and the S3 reads behind them are shared with this pass by the
+* memoizing backend view `scrubStack` builds (issue #2133 review — before that
+* every reference cost `listStacks()` plus up to N `getState()` TWICE). What
+* not rewriting buys back is the whole class of hazard a substituted value
+* carries: a resolved cross-stack value that is itself intrinsic- or
+* reference-shaped would be re-interpreted by the stack's own resolver, which
+* is the shape `SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN` guards against one
+* class over. The needles this records survive the main resolution failing for
+* an unrelated reason, since `recordedSecretValues` is filled in place.
+*
+* `Fn::If` is walked the way {@link IntrinsicFunctionResolver} walks it — the
+* SELECTED branch only, with an unknown condition selecting the FALSE branch,
+* mirroring `resolveIf`. Reading a reference the main resolution would never
+* touch would refuse a stack over a conditional import the deploy never made.
+* A MALFORMED `Fn::If` (args not a 3-tuple) is walked with refusals DISARMED
+* rather than skipped: which branch is live is unknowable, so a read inside it
+* may be one the deploy never made — the exact hazard the selected-branch
+* mirror exists to prevent — but any needle it does yield is still worth having.
+*/
+function makeCrossStackPrePass(deps) {
+	const { stackName, resolver, producerTemplates, findings, logger } = deps;
+	/**
+	* Is this a refusal NO RE-RUN can clear (issue #2133 review)?
+	*
+	* The predicate is the SUBCLASS, not `IntrinsicResolutionRefusalError`. That
+	* class has six throw sites and only ONE — `resolveGetStackOutput`'s
+	* cross-account arm — is permanent; the other five (a stale placeholder ARN,
+	* a fabricated account id, an unenriched `Fn::GetAtt`, `--strict-getatt`, a
+	* malformed `Fn::Split`) are all fixed by editing the template or deploying
+	* the producer. They are REACHABLE here, because `resolveSub` re-raises the
+	* class, so any cross-stack node whose ARGUMENT is an `Fn::Sub` /
+	* `Fn::GetAtt` / `Fn::Split` can carry one up to this catch. Matching the
+	* base class downgraded every one of them to a finding logged as "cdkd
+	* declines this read by design, so no re-run can change it" — false — and
+	* scrub then printed `No plaintext secrets found` and exited 0 without
+	* `--fail` while the consumer's state.json still held the imported plaintext.
+	*
+	* The CAUSE CHAIN rather than a bare `instanceof`: the refusal reaches this
+	* catch through `resolver.resolve`, which wraps in several places, and a
+	* top-link-only test silently reclassifies a wrapped permanent refusal as
+	* user-fixable — i.e. refuses the whole stack over something no user can fix.
+	*/
+	const isByDesignRefusal = (err) => err instanceof Error && errorCauseChain(err).some((link) => link instanceof CrossAccountSecretRefusalError);
+	return async function resolveCrossStackReads(bag, context, origin, opts) {
+		const canRefuse = opts?.canRefuse ?? true;
+		const secrets = context.recordedSecretValues ?? /* @__PURE__ */ new Map();
+		/**
+		* The producer this reference actually resolved through, and the KEY it
+		* matched — read back out of the resolver's own recording bags.
+		*
+		* Keyed on the intrinsic UNDER TEST rather than "imports first, then output
+		* reads": `resolveImportValue` / `resolveGetStackOutput` each resolve their
+		* ARGUMENTS before recording their own read, so a nested cross-stack read
+		* inside the argument lands in the OTHER family's bag (or earlier in the
+		* same one). Preferring imports unconditionally made an
+		* `Fn::GetStackOutput` whose `StackName` contains an `Fn::ImportValue`
+		* report the INNER producer.
+		*
+		* `.at(-1)` for the same reason within one family: the outer read is
+		* recorded LAST, after its argument has resolved.
+		*
+		* An empty bag means the value did NOT come from a cdkd state record, and
+		* the two arms that produce one are NOT unreadable for the same reason
+		* (issue #2133 review — one rationale used to cover both, and it was false
+		* of the second):
+		*
+		* - the CloudFormation `ListExports` / `DescribeStacks` FALLBACKS record
+		*   nothing deliberately, a CFn-managed producer being a weak reference.
+		*   Here "no expression to restore" is literally true: the value came from
+		*   CloudFormation, which cdkd never redacted, so no `{{resolve:...}}`
+		*   expression exists anywhere for scrub to write in its place.
+		* - the CROSS-ACCOUNT `Fn::GetStackOutput` arm records nothing for a
+		*   different reason, and a post-#1934 producer in the other account DOES
+		*   store the expression — which is precisely why
+		*   `CrossAccountSecretRefusalError` exists, and why it fires BEFORE this
+		*   point whenever the stored value carries one. What can reach here is a
+		*   value that carried none, and scrub cannot classify it any further: the
+		*   producer's `state.json` lives in another account and the only
+		*   credentials in hand are the consumer's, so reading it is the
+		*   wrong-account lookup that refusal exists to prevent.
+		*
+		* The OUTCOME is the same today either way — a cross-account producer is
+		* never in `appStacks`, so the `!producerTemplate` return below fires first
+		* regardless — but a future change that widened `producerTemplates` would
+		* be relying on this sentence, so it must not claim the second arm has no
+		* expression behind it.
+		*
+		* Residual: an OUTER read that fell through to a CloudFormation fallback
+		* while its ARGUMENT performed a same-family cdkd read leaves the inner
+		* entry last, so the check below consults the wrong producer. Bounded by
+		* the key test — the inner key must also exist in the inner producer's
+		* outputs, which it does — and it can only produce a false REFUSAL naming a
+		* real unscrubbed producer, never a false clean.
+		*/
+		const recordedProducer = (key, probe) => {
+			if (key === "Fn::GetStackOutput") {
+				const read = probe.recordedOutputReads?.at(-1);
+				return read ? {
+					stack: read.sourceStack,
+					region: read.sourceRegion,
+					key: read.outputName
+				} : void 0;
+			}
+			const imported = probe.recordedImports?.at(-1);
+			return imported ? {
+				stack: imported.sourceStack,
+				region: imported.sourceRegion,
+				key: imported.exportName
+			} : void 0;
+		};
+		/**
+		* The producer's STORED value for `key` — what its `state.json` actually
+		* holds, as opposed to what the read RETURNED.
+		*
+		* `undefined` when the producer's record cannot be read or does not carry
+		* the key, which is treated as "cannot classify" by the caller rather than
+		* as evidence of anything. Both are near-unreachable on the arms that get
+		* here (the read just succeeded against that record, through the SAME
+		* memoized `getState` promise this call resolves), so the read costs no
+		* extra AWS call.
+		*/
+		const storedProducerValue = async (producer, backend) => {
+			if (!backend) return void 0;
+			let loaded;
+			try {
+				loaded = await backend.getState(producer.stack, producer.region);
+			} catch (err) {
+				logger.debug(`Scrub of ${stackName}: could not re-read producer '${producer.stack}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				return;
+			}
+			const outputs = loaded?.state?.outputs;
+			if (!outputs || !(producer.key in outputs)) return void 0;
+			return { stored: outputs[producer.key] };
+		};
+		const readOne = async (key, node, path, nodeCanRefuse) => {
+			const probe = {
+				...context,
+				recordedImports: [],
+				recordedOutputReads: []
+			};
+			try {
+				await resolver.resolve({ [key]: node[key] }, probe);
+			} catch (err) {
+				if (!nodeCanRefuse) {
+					logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					return;
+				}
+				if (isByDesignRefusal(err)) {
+					const detail = `${key} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					findings.unverifiable.push(detail);
+					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
+					return;
+				}
+				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
+			}
+			const producer = recordedProducer(key, probe);
+			if (!producer) return;
+			const producerTemplate = producerTemplates.get(producer.stack);
+			if (!producerTemplate) return;
+			const verdict = producerPublishesSecretExpression(producerTemplate, producer.key);
+			if (verdict === "no") return;
+			const stored = await storedProducerValue(producer, context.stateBackend);
+			if (!stored) return;
+			if (carriesDynamicReference(stored.stored)) return;
+			if (storedValueCarriesNoPlaintext(stored.stored)) {
+				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved through producer '${producer.stack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				return;
+			}
+			if (!nodeCanRefuse) {
+				logger.debug(`Scrub of ${stackName}: ${key} in ${origin}${path ? ` at ${path}` : ""} resolved to a plaintext from unscrubbed producer '${producer.stack}', and this position cannot refuse.`);
+				return;
+			}
+			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
+		};
+		const walk = async (v, path, nodeCanRefuse) => {
+			if (Array.isArray(v)) {
+				for (let i = 0; i < v.length; i++) await walk(v[i], `${path}[${i}]`, nodeCanRefuse);
+				return;
+			}
+			if (v === null || typeof v !== "object") return;
+			const node = v;
+			const key = effectiveIntrinsicKey(node);
+			if (key === void 0) {
+				for (const [k, val] of Object.entries(node)) await walk(val, path ? `${path}.${k}` : k, nodeCanRefuse);
+				return;
+			}
+			if (key === "Fn::If") {
+				const args = node["Fn::If"];
+				if (Array.isArray(args) && args.length === 3) {
+					const [conditionName, ifTrue, ifFalse] = args;
+					const selected = typeof conditionName === "string" && context.conditions?.[conditionName] === true ? ifTrue : ifFalse;
+					await walk(selected, `${path}['Fn::If']`, nodeCanRefuse);
+					return;
+				}
+				await walk(args, `${path}['Fn::If']`, false);
+				return;
+			}
+			if (CROSS_STACK_INTRINSIC_KEYS.includes(key)) {
+				await readOne(key, node, path, nodeCanRefuse);
+				return;
+			}
+			await walk(node[key], `${path}['${key}']`, nodeCanRefuse);
+		};
+		await walk(bag, "", canRefuse);
+	};
+}
+/**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
 * learn the resolved secret VALUES, then replaces those values in the state
 * record with their `{{resolve:...}}` expressions. Returns counts; performs no
@@ -63064,6 +63637,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
 	const perResourceSecrets = /* @__PURE__ */ new Map();
 	const outputSecrets = /* @__PURE__ */ new Map();
+	const prePassFindings = { unverifiable: [] };
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -63071,7 +63645,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			return {
 				recordsChanged: 0,
 				secretsFound: 0,
-				secretBearingKeys: 0
+				secretBearingKeys: 0,
+				unverifiableReads: 0
 			};
 		}
 		const state = loaded.state;
@@ -63088,13 +63663,26 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		} catch (err) {
 			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
+		const resolverContext = (recordedSecretValues) => ({
+			template: stack.template,
+			resources: state.resources,
+			...Object.keys(parameters).length > 0 && { parameters },
+			...Object.keys(conditions).length > 0 && { conditions },
+			stackName: stack.stackName,
+			stateBackend: resolverStateBackend,
+			...recordedSecretValues && { recordedSecretValues },
+			bestEffort: true
+		});
+		const resolveCrossStackReads = makeCrossStackPrePass({
+			stackName: stack.stackName,
+			resolver,
+			producerTemplates: new Map((opts.appStacks ?? []).map((s) => [s.stackName, s.template])),
+			findings: prePassFindings,
+			logger
+		});
 		try {
-			conditions = await resolver.evaluateConditions({
-				template: stack.template,
-				resources: state.resources,
-				...Object.keys(parameters).length > 0 && { parameters },
-				bestEffort: true
-			});
+			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
 			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -63103,6 +63691,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const templateResource = templateResources[logicalId];
 			if (!templateResource?.Properties) continue;
 			const recordedSecretValues = /* @__PURE__ */ new Map();
+			perResourceSecrets.set(logicalId, recordedSecretValues);
 			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
@@ -63111,20 +63700,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordedSecretValues,
 				origin: `resource '${logicalId}'`
 			});
+			const resourceContext = resolverContext(recordedSecretValues);
+			await resolveCrossStackReads(resolveInput, resourceContext, `resource '${logicalId}'`);
 			try {
-				await resolver.resolve(resolveInput, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
-					recordedSecretValues,
-					bestEffort: true
-				});
+				await resolver.resolve(resolveInput, resourceContext);
 			} catch (err) {
 				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 			}
-			if (recordedSecretValues.size > 0) perResourceSecrets.set(logicalId, recordedSecretValues);
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
 		}
 		const templateOutputs = stack.template.Outputs ?? {};
@@ -63145,16 +63727,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					recordedSecretValues: outputSecrets,
 					origin: `Export.Name of output '${name}'`
 				});
+				const nameContext = resolverContext(outputSecrets);
+				await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				try {
-					exportName = await resolver.resolve(nameSource, {
-						template: stack.template,
-						resources: state.resources,
-						...Object.keys(parameters).length > 0 && { parameters },
-						...Object.keys(conditions).length > 0 && { conditions },
-						stackName: stack.stackName,
-						recordedSecretValues: outputSecrets,
-						bestEffort: true
-					});
+					exportName = await resolver.resolve(nameSource, nameContext);
 				} catch (err) {
 					outputsSourceUntrusted = true;
 					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
@@ -63185,16 +63761,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordedSecretValues: outputSecrets,
 				origin: `output '${name}'`
 			});
+			const valueContext = resolverContext(outputSecrets);
+			await resolveCrossStackReads(valueSource, valueContext, `output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 			try {
-				await resolver.resolve(valueSource, {
-					template: stack.template,
-					resources: state.resources,
-					...Object.keys(parameters).length > 0 && { parameters },
-					...Object.keys(conditions).length > 0 && { conditions },
-					stackName: stack.stackName,
-					recordedSecretValues: outputSecrets,
-					bestEffort: true
-				});
+				await resolver.resolve(valueSource, valueContext);
 			} catch (err) {
 				logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 			}
@@ -63211,7 +63781,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (totalSecrets === 0) return {
 			recordsChanged: 0,
 			secretsFound: 0,
-			secretBearingKeys: 0
+			secretBearingKeys: secretBearingKeys.length,
+			unverifiableReads: prePassFindings.unverifiable.length
 		};
 		let recordsChanged = 0;
 		const newResources = {};
@@ -63241,7 +63812,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		return {
 			recordsChanged,
 			secretsFound: totalSecrets,
-			secretBearingKeys: secretBearingKeys.length
+			secretBearingKeys: secretBearingKeys.length,
+			unverifiableReads: prePassFindings.unverifiable.length
 		};
 	} catch (err) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
@@ -85181,7 +85753,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.31");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.32");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;