@go-to-k/cdkd 0.284.35 → 0.284.37

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as endCommandInterruptScope, $t as buildAssetRedirectMap, A as MULTI_REGION_RECREATE_BLOCKED_TYPES, An as resolveStateBucketWithDefaultAndSource, At as maskSecretsInError, B as collectDeclaredOutputNames, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as ccRoutedFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isThrottlingError, Ct as STATE_SOURCED_CROSS_GENERATION_RULES, D as unsupportedFinalSnapshotError, Dn as resolveCaptureObservedState, Dt as dynamicReferenceTokens, E as refusesFinalSnapshot, En as resolveAutoAssetStorage, Et as createSecretMasker, F as cyan, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as stateKeySecretExposure, Gt as TemplateParser, H as exportAliasCollisionScrubWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as gray, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as clearOnUpdateRemoval, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as IAMRoleProvider, Kn as resolveBucketRegion, Kt as LockManager, L as green, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as renderStatefulReason, Mn as stateBucketExistenceConfirmed, Mt as redactSecretsForState, N as formatResourceLine, Nn as warnDeprecatedNoPrefixCliFlag, Nt as scrubResourceRecord, O as makeCanonicalizePropertiesFn, On as resolveSkipPrefix, Ot as errorCauseChain, P as bold, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as beginCommandInterruptScope, Qn as CdkdError, Qt as WorkGraph, R as red, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as buildFinalSnapshotIdentifier, Sn as synthesisStatusMessage, Sr as isRetryableTransientError, St as requireConfigString, T as isFinalSnapshotError, Tn as resolveApp, Tt as TEMPLATE_SOURCED_RULES, U as isExportAliasCollision, Un as AssemblyReader, Ut as withRetry, V as collectPublishedOutputNames, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as secretBearingStateKeyWarning, Wn as processStackMessages, Wt as DagBuilder, X as findActionableSilentDrops, Xn as setAwsClients, Xt as AssetPublisher, Y as ProviderRegistry, Yn as resetAwsClients, Yt as shouldRetainResource, Z as findSilentDropProperties, Zt as stringifyValue, _ as maskingRetryLogger, _n as runDockerForeground, _t as configStringRefusal, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalStartServiceError, at as isTerminationProtectionPropagationError, b as ATOMIC_FINAL_SNAPSHOT_TYPES, bn as getDockerImageBySourceHash, br as withErrorHandling, bt as requireConfigArray, c as planRollback, cn as getBootstrapMarkerKey, cr as NestedStackChildDirectDestroyError, ct as cfnRefValueFromPhysicalId, d as replayRollback, dn as validateAssetBucketName, dr as ResourceTimeoutError, dt as WAFv2WebACLProvider, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as isInterruptedWaitError, f as updatePartialMessage, fn as validateContainerRepoName, fr as ResourceUpdateNotSupportedError, ft as normalizeAwsTagsToCfn, g as withResourceDeadline, gn as getDockerCmd, gt as configBooleanRefusal, h as deleteSkipReason, hn as formatDockerLoginError, ht as coerceCfnBoolean, i as DeploymentEventsReader, in as stripControlChars, ir as LocalMigrateError, it as disableInstanceApiTermination, j as isStatefulRecreateTargetSync, jn as resolveUseCdkBootstrapAssets, jt as maskSecretsInText, k as extractDeploymentEventError, kn as resolveStateBucketWithDefault, kt as isSingleDynamicReferenceToken, l as producerRegionsFromState, ln as parseBootstrapMarker, lr as PartialFailureError, lt as getAccountInfo, m as UNSPECIFIED_SKIP_REASON, mn as buildDockerImage, mr as StackTerminationProtectionError, mt as assertRegionMatch, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as CloudControlProvider, o as classifyReplaySecretRegion, on as BOOTSTRAP_MARKER_PREFIX, ot as IntrinsicFunctionResolver, p as updatePartialReason, pn as buildDenyExternalAccessPolicy, pr as StackHasActiveImportsError, pt as resolveExplicitPhysicalId, q as collectInlinePolicyNamesManagedBySiblings, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as LocalInvokeBuildError$1, rt as slowCcOperationTimeoutMs, s as planFailedOps, sn as ensureAssetStorage, sr as MissingCdkCliError, st as carriesDynamicReference, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as startInterruptWatch, u as replayFailedOperations, un as readBootstrapMarkerBody, ur as ProvisioningError, ut as refStateLookupFromResource, v as IMPLICIT_DELETE_DEPENDENCIES, vn as runDockerStreaming, vt as readConfigString, w as createPreDeleteFinalSnapshot, wn as getLegacyStateBucketName, wr as markNonRetryable, wt as STATE_SOURCED_READBACK_RULES, x as PRE_DELETE_SNAPSHOT_TYPES, xn as Synthesizer, xr as isMarkedNonRetryable, xt as requireConfigObject, y as computeImplicitDeleteEdges, yn as AssetManifestLoader, yr as normalizeAwsError, yt as replayWarn, z as yellow, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-Wei5Yw-_.js";
+import { $ as startInterruptWatch, $t as buildAssetRedirectMap, A as renderStatefulReason, An as resolveStateBucketWithDefaultAndSource, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isRetryableTransientError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveCaptureObservedState, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveAutoAssetStorage, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as red, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as clearOnUpdateRemoval, Kn as resolveBucketRegion, Kt as LockManager, L as yellow, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as bold, Mn as stateBucketExistenceConfirmed, Mt as classifyReplaySecretRegion, N as cyan, Nn as warnDeprecatedNoPrefixCliFlag, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveSkipPrefix, Ot as maskSecretsInError, P as gray, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as CdkdError, Qt as WorkGraph, R as collectDeclaredOutputNames, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as synthesisStatusMessage, Sr as isMarkedNonRetryable, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as resolveApp, Tr as markNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as AssemblyReader, Ut as withRetry, V as isExportAliasCollision, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as processStackMessages, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as setAwsClients, Xt as AssetPublisher, Y as findSilentDropProperties, Yn as resetAwsClients, Yt as shouldRetainResource, Z as endCommandInterruptScope, Zt as stringifyValue, _ as computeImplicitDeleteEdges, _n as runDockerForeground, _t as replayWarn, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalMigrateError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as getDockerImageBySourceHash, br as normalizeAwsError, bt as requireConfigString, c as replayFailedOperations, cn as getBootstrapMarkerKey, cr as MissingCdkCliError, ct as refStateLookupFromResource, d as updatePartialReason, dn as validateAssetBucketName, dr as ProvisioningError, dt as resolveExplicitPhysicalId, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateContainerRepoName, fr as ResourceTimeoutError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getDockerCmd, gt as readConfigString, h as maskingRetryLogger, hn as formatDockerLoginError, hr as StackTerminationProtectionError, ht as configStringRefusal, i as DeploymentEventsReader, in as stripControlChars, ir as LocalInvokeBuildError$1, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveUseCdkBootstrapAssets, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveStateBucketWithDefault, kt as maskSecretsInText, l as replayRollback, ln as parseBootstrapMarker, lr as NestedStackChildDirectDestroyError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDockerImage, mr as StackHasActiveImportsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as disableInstanceApiTermination, o as planFailedOps, on as BOOTSTRAP_MARKER_PREFIX, or as LocalStartServiceError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as buildDenyExternalAccessPolicy, pr as ResourceUpdateNotSupportedError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as DynamicReferenceRegionAmbiguousError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as ensureAssetStorage, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as readBootstrapMarkerBody, ur as PartialFailureError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerStreaming, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getLegacyStateBucketName, wr as isThrottlingError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as Synthesizer, xr as withErrorHandling, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetManifestLoader, yt as requireConfigObject, z as collectPublishedOutputNames, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-C62UGXid.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-bJ8nim2C.js";
+import { t as ASGProvider } from "./asg-provider-BbWubpjP.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -62709,28 +62709,6 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	return repaired ?? positioned;
 }
 /**
-* The producer regions that are genuinely FOREIGN to this stack, canonicalized
-* and de-duplicated (issue #2109 review).
-*
-* The same filter {@link classifyReplaySecretRegion} applies to its own
-* `importedProducerRegions` argument, spelled here because the
-* unclassifiable-reference guard needs the answer WITHOUT an expression to hand
-* to the classifier. A same-region cross-stack read is the common case and
-* raises no cross-region question, so it must not arm a refusal.
-*/
-function foreignRegionsOf(producerRegions, stackRegion) {
-	const seen = /* @__PURE__ */ new Set();
-	const foreign = [];
-	for (const candidate of producerRegions) {
-		const canonical = canonicalizeRegion(candidate);
-		if (!canonical || canonical === canonicalizeRegion(stackRegion)) continue;
-		if (seen.has(canonical)) continue;
-		seen.add(canonical);
-		foreign.push(candidate);
-	}
-	return foreign;
-}
-/**
 * The `cdkd scrub` resolvers: the stack's own, plus one pinned sibling per
 * FOREIGN region an ARN-named secret reference asks for (issue
 * [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
@@ -62822,7 +62800,7 @@ const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 * followed by a service whose VALUE CloudFormation defines as a secret. Counted
 * against the number of WHOLE tokens of the same class the scan matched, which
 * is how an ASSEMBLED reference is detected without parsing intrinsics — see
-* {@link unclassifiableScrubSecretError}.
+* {@link isAssembledSecretReference}.
 *
 * WHY THE SERVICE IS PART OF THE OPENING (issue #2109 review). Counting the bare
 * `{{resolve:` made the guard fire on any leaf that merely MENTIONS the syntax
@@ -62859,7 +62837,7 @@ const SECRET_REFERENCE_OPENINGS = [
 ];
 /**
 * What an `Fn::Sub` placeholder opens with. A whole token that CONTAINS one is
-* the third assembled shape — see {@link unclassifiableScrubSecretError}.
+* the third assembled shape — see {@link isAssembledSecretReference}.
 */
 const SUB_PLACEHOLDER_OPENING = "${";
 /** How many SECRET references {@link SECRET_REFERENCE_OPENINGS} `leaf` opens. */
@@ -62873,16 +62851,17 @@ function isSecretReferenceToken(token) {
 	return SECRET_REFERENCE_OPENINGS.some((opening) => token.startsWith(opening));
 }
 /**
-* The refusal an ASSEMBLED reference raises (issue #2109 review): a leaf that
-* OPENS more SECRET references than the scan found COMPLETE tokens of that
-* class in it, or a whole token that still carries an `Fn::Sub` placeholder.
+* Does this leaf ASSEMBLE a secret reference out of parts (issue #2109 review)
+* — i.e. does it OPEN more SECRET references than the scan found COMPLETE
+* tokens of that class in it, or carry a whole token that still holds an
+* `Fn::Sub` placeholder?
 *
 * WHY THIS EXISTS, and it is the load-bearing half of this pre-pass rather than
 * an edge case. The region split runs on the RAW template leaf, BEFORE intrinsic
 * resolution, and the shared token scan is `\{\{resolve:[^}]+\}\}` — a class
 * that cannot cross a `}`. So none of the three shapes that assemble a
 * reference out of parts yields the ONE WHOLE token a literal reference does,
-* and the third one is why this guard needs two tests rather than one
+* and the third one is why this predicate needs two tests rather than one
 * (all four rows MEASURED):
 *
 * ```text
@@ -62900,40 +62879,42 @@ function isSecretReferenceToken(token) {
 * test: a WHOLE token that still contains `${` has not been assembled yet.
 * Neither a Secrets Manager secret name nor an SSM parameter name may contain
 * `$` or `{`, so the only false positive that test can produce is a JSON key
-* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and
-* this guard is the fail-closed side of a command whose subject is a leaked
-* plaintext.
-*
-* With no token there is nothing to classify: {@link pinCrossRegionSecrets}
-* returns the leaf BY IDENTITY, and `resolveJoin` / `resolveSub` then call
-* `resolveDynamicReferences` on the PRIMARY resolver once they have joined the
-* parts — issue #2109 verbatim, with the `ambiguous` refusal never firing. The
-* trailing-placeholder row got there a different way before this guard's second
-* test: the token WAS classified, and only downstream luck kept it safe (the
-* name form then classifies `ambiguous`, the ARN form fails into
-* `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it looks up still has a
-* literal `${Field}` in it). Both are pinned by the suite rather than assumed.
-* Fixing all of this inside the resolver (classify AFTER assembly) is the
-* structurally right answer and is NOT what this does: the resolver's
-* dynamic-reference path is shared with deploy and is out of this change's
-* scope. This guard buys the same SAFETY property — a reference whose region
-* cannot be established is never resolved in the stack's own region — by
-* refusing instead.
-*
-* GATED ON A FOREIGN PRODUCER REGION BEING ON RECORD, which is what keeps it
-* from refusing the world. With no foreign region on record there is no
-* cross-region question to get wrong: every reference in the stack resolves
-* locally, which is what an assembled one would have done anyway, so proceeding
-* is exactly today's behavior. Two residuals, stated rather than hidden:
-* an assembled reference that names a FOREIGN ARN inside an `Fn::Sub` in a
-* stack with NO cross-stack read on record is still resolved locally; and an
-* `Fn::Join` that splits BEFORE the service name is not counted at all (see
-* {@link SECRET_REFERENCE_OPENINGS}). Closing either needs the resolver-side
-* classification above — issue
-* [#2134](https://github.com/go-to-k/cdkd/issues/2134).
-*/
-function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProducerRegions, stackRegion) {
-	return new ScrubRefusalError(`Scrub of ${stackName} cannot classify a secret reference in ${origin}${leafPath ? ` at '${leafPath}'` : ""}: the value opens a '{{resolve:...}}' reference that is ASSEMBLED by an intrinsic (an Fn::Sub placeholder inside it, or an Fn::Join that splits it across parts), so the reference does not exist as a complete expression until AFTER it is resolved — and its region therefore cannot be determined before resolution. This stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so resolving it in '${stackRegion}' may look for a different region's secret: scrub would then miss the plaintext it exists to remove and report the stack clean. Refusing instead. Spell the reference as one complete literal '{{resolve:secretsmanager:<full ARN>:SecretString:...}}' — an ARN names its own region — then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE");
+* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and a
+* false positive here now costs a DEFERRAL rather than a refusal, so it is
+* cheaper than it was when this predicate raised
+* `SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE`.
+*
+* WHAT A `true` MEANS FOR THE CALLER, and it changed with issue
+* [#2157](https://github.com/go-to-k/cdkd/issues/2157): the leaf is handed on
+* BY IDENTITY, so the PRIMARY resolver classifies the reference once
+* `resolveSub` / `resolveJoin` have assembled it. Before issue
+* [#2134](https://github.com/go-to-k/cdkd/issues/2134) that was issue #2109
+* verbatim — the resolver had no region question at all, so an identity return
+* meant a foreign secret fetched against the stack's own endpoint, and this
+* predicate therefore had to REFUSE (gated on a foreign producer region being
+* on record, to keep it from refusing the world). #2134 put the classification
+* in `resolveDynamicReferences`, which sees the COMPLETE expression, so the
+* safety property the refusal bought — a reference whose region cannot be
+* established is never resolved in the stack's own region — is now bought
+* downstream over strictly more information.
+*
+* The trailing-placeholder row reached the resolver a different way before that
+* second test existed: the truncated token WAS classified here, and only
+* downstream luck kept it safe (the name form classifies `ambiguous`, the ARN
+* form fails into `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it
+* looks up still has a literal `${Field}` in it). Post-#2157 it is deferred
+* like the other three, and the resolver answers it on the assembled
+* expression instead of on a token one brace short. Every row is pinned by the
+* suite rather than assumed.
+*
+* Residual, unchanged and stated rather than hidden: an `Fn::Join` that splits
+* BEFORE the service name opens no counted reference at all (see
+* {@link SECRET_REFERENCE_OPENINGS}), so this predicate returns `false` for it
+* and the leaf is returned by identity anyway — the same destination, reached
+* without being noticed.
+*/
+function isAssembledSecretReference(leaf, secretTokens) {
+	return countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING));
 }
 /**
 * Resolve every FOREIGN-region `{{resolve:...}}` reference in one leaf through
@@ -62955,10 +62936,9 @@ function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProd
 * closed: a stopped scrub is recoverable, a lookup for a secret id spliced
 * together out of a plaintext is not.
 */
-async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
+async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	const tokens = dynamicReferenceTokens(leaf);
-	const secretTokens = tokens.filter(isSecretReferenceToken);
-	if ((countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING))) && ctx.foreignProducerRegions.length > 0) throw unclassifiableScrubSecretError(ctx.origin, leafPath, stackName, ctx.foreignProducerRegions, ctx.stackRegion);
+	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
 	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
@@ -63026,16 +63006,16 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
 * off it.
 */
 async function pinCrossRegionSecrets(bag, stackName, ctx) {
-	const walk = async (v, path) => {
+	const walk = async (v) => {
 		if (typeof v === "string") {
 			if (!v.includes(DYNAMIC_REFERENCE_OPENING)) return v;
-			return await resolveForeignRegionTokens(v, stackName, ctx, path);
+			return await resolveForeignRegionTokens(v, stackName, ctx);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
 			let changed = false;
 			for (let i = 0; i < v.length; i++) {
-				out[i] = await walk(v[i], `${path}[${i}]`);
+				out[i] = await walk(v[i]);
 				if (out[i] !== v[i]) changed = true;
 			}
 			return changed ? out : v;
@@ -63044,14 +63024,14 @@ async function pinCrossRegionSecrets(bag, stackName, ctx) {
 			const out = Object.create(null);
 			let changed = false;
 			for (const [k, val] of Object.entries(v)) {
-				out[k] = await walk(val, path ? `${path}.${k}` : k);
+				out[k] = await walk(val);
 				if (out[k] !== val) changed = true;
 			}
 			return changed ? out : v;
 		}
 		return v;
 	};
-	return await walk(bag, "");
+	return await walk(bag);
 }
 /**
 * Order scrub targets PRODUCER-BEFORE-CONSUMER (issue
@@ -63460,8 +63440,11 @@ function storedValueCarriesNoPlaintext(stored) {
 *   {@link buildExportOwnerIndex} and `producerTemplates` are keyed by stack
 *   NAME alone, so the walk reads that name's template regardless of `Region`;
 * - a secret reachable only through the TRUE branch of an `Fn::If` in a
-*   producer's output: see {@link collectReExportHops}, which takes the FALSE
-*   branch for a condition it cannot evaluate.
+*   producer's output: see {@link selectTakenConditionalBranches}, which takes
+*   the FALSE branch for a condition it cannot evaluate -- and which, since
+*   issue [#2150](https://github.com/go-to-k/cdkd/issues/2150), feeds BOTH the
+*   literal scan below and {@link collectReExportHops} from that one
+*   selection.
 */
 function producerPublishesSecretExpression(templates, exportOwners, producerStack, key) {
 	const seen = /* @__PURE__ */ new Set([`${producerStack}\u0000${key}`]);
@@ -63489,7 +63472,8 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 			widened = true;
 			subjects = Object.values(outputs).map((o) => o?.Value);
 		} else continue;
-		for (const subject of subjects) {
+		for (const rawSubject of subjects) {
+			const subject = selectTakenConditionalBranches(rawSubject);
 			if (JSON.stringify(subject ?? null).includes("{{resolve:")) {
 				if (widened) return {
 					kind: "widened",
@@ -63518,6 +63502,64 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 	return NO_SECRET_EXPRESSION;
 }
 /**
+* One node with every `Fn::If` collapsed to the branch scrub would TAKE
+* (issues #2146 and [#2150](https://github.com/go-to-k/cdkd/issues/2150)).
+*
+* ONE SPELLING, consumed verbatim by both halves of "does this producer publish
+* a secret expression?" — {@link collectReExportHops}, which follows the value
+* onward, and {@link producerPublishesSecretExpression}'s literal
+* `{{resolve:` scan, which tests the value itself. Those two are one question
+* asked twice, and they DISAGREED between #2146 and #2150: the hop walk took
+* the false branch while the scan `JSON.stringify`d the whole node and saw
+* both. A producer whose output is
+* `{"Fn::If": ["IsProd", "{{resolve:...}}", "plain"]}` deployed with `IsProd`
+* false therefore verdicted `declared`, the discriminator read the deployed
+* value `plain`, and scrub refused with `SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT`
+* — an UNCLEARABLE refusal, because no `cdkd scrub` of the producer can turn
+* `plain` into an expression and there is no bypass flag, so every other secret
+* in the consumer stack was stranded. A second spelling of the selection would
+* only move where the two can drift apart again, so there is exactly one.
+*
+* WHICH BRANCH: the FALSE one, unconditionally, mirroring `resolveIf`'s
+* unknown-condition arm. Every condition met on this path belongs to ANOTHER
+* stack, and scrub evaluates conditions only for the stack it is scrubbing,
+* from that template's parameter DEFAULTS (it takes no `--parameters`), so a
+* producer's condition is not evaluable here.
+*
+* TWO SHAPES COLLAPSE MORE THAN THE SELECTED BRANCH, both fail-OPEN, both
+* stated rather than implied because the old whole-node `JSON.stringify` saw
+* them and this does not. Neither is CloudFormation-emittable, which is why
+* they are accepted rather than fixed:
+*
+* - a MALFORMED `Fn::If` (args not a 3-tuple) collapses to `null` -- NO branch.
+*   Which branch is live is unknowable, so neither a hop nor a `{{resolve:`
+*   sighting may be claimed from it. CloudFormation refuses such a template, so
+*   a producer that reads this way cannot have been deployed carrying one.
+* - an object carrying `Fn::If` ALONGSIDE sibling keys keeps only the selected
+*   branch, so a `{{resolve:` under a sibling is not seen. An intrinsic node has
+*   exactly one key in any template CloudFormation accepts, and the hop walk
+*   dropped those siblings before this function existed (its `Fn::If` arm
+*   `return`ed rather than falling through), so this preserves that behaviour
+*   rather than introducing it.
+*
+* Residual, and it is the direction this file accepts elsewhere: a secret
+* reachable only through the TRUE branch is not detected, so that reference
+* keeps its pre-#2133 outcome. The hop walk already took this trade for the
+* chain it follows; #2150 extends it to the scan so that the two agree.
+*/
+function selectTakenConditionalBranches(node) {
+	if (Array.isArray(node)) return node.map(selectTakenConditionalBranches);
+	if (node === null || typeof node !== "object") return node;
+	const obj = node;
+	if ("Fn::If" in obj) {
+		const args = obj["Fn::If"];
+		return Array.isArray(args) && args.length === 3 ? selectTakenConditionalBranches(args[2]) : null;
+	}
+	const out = Object.create(null);
+	for (const [key, child] of Object.entries(obj)) out[key] = selectTakenConditionalBranches(child);
+	return out;
+}
+/**
 * The re-export hops one output VALUE carries (issue #2146).
 *
 * Only STATICALLY resolvable references produce a hop, mirroring
@@ -63536,8 +63578,9 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 * routinely wrapped — `Fn::Join`ing an imported password into a URL is the
 * shape the live fixture uses.
 *
-* `Fn::If` IS NOT WALKED ON BOTH ARMS, and this is load-bearing rather than
-* tidy (issue #2146 review). `makeCrossStackPrePass` deliberately mirrors
+* `Fn::If` NEVER REACHES THIS WALK, and the selection that used to live here
+* is load-bearing rather than tidy (issue #2146 review). `makeCrossStackPrePass`
+* deliberately mirrors
 * `resolveIf` — selected branch only — so that a conditional import of a
 * not-yet-deployed producer cannot refuse a whole stack, unbypassably, over a
 * reference the deploy never read. A hop walk that descended into both arms
@@ -63549,24 +63592,24 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 * flag. On main the same input answered `no`, so it would have been a
 * regression this change introduced.
 *
-* WHICH branch: the FALSE one, unconditionally. `resolveIf` selects FALSE for a
-* condition it cannot evaluate, and every condition here belongs to ANOTHER
-* stack — scrub evaluates conditions for the stack it is scrubbing, from that
-* template's parameter DEFAULTS, and has neither the parameters nor the
-* evaluation for a producer's. A MALFORMED `Fn::If` (args not a 3-tuple) yields
-* NO hop at all: which branch is live is unknowable, and the pre-pass's answer
-* there (walk it with refusals DISARMED) has no counterpart in a function whose
-* only output is "refuse or not".
-*
-* Residual, and it is the direction this file accepts elsewhere: a secret
-* reachable only through the TRUE branch is not detected, so that reference
-* keeps its pre-#2133 outcome. The asymmetry with the `{{resolve:` scan in
-* {@link producerPublishesSecretExpression} — which `JSON.stringify`s the whole
-* subject and therefore sees BOTH arms — is #2133's behaviour, unchanged here
-* on purpose: narrowing it would change which stacks that older refusal fires
-* on, which is not this change's subject.
-*/
-function collectReExportHops(value, templates, exportOwners) {
+* `selectedValue` IS THE CONTRACT, and it is why this function carries no
+* `Fn::If` handling of its own: the only caller,
+* {@link producerPublishesSecretExpression}, applies
+* {@link selectTakenConditionalBranches} ONCE and hands the result to BOTH the
+* literal `{{resolve:` scan and this walk, so a node reaching here holds no
+* `Fn::If` at all. Issue [#2150](https://github.com/go-to-k/cdkd/issues/2150)
+* collapsed the two to one site deliberately: the scan used to `JSON.stringify`
+* the whole subject and therefore see BOTH arms while this walk took only the
+* false one, and two spellings of one question are exactly how they came to
+* disagree. A second selection HERE would restore that, and be worse than
+* useless — measured on the #2150 lane, a per-site copy was invisible to every
+* test in the suite, because the caller had already pruned, so deleting it
+* changed nothing and no probe could fence it.
+* {@link selectTakenConditionalBranches}'s own doc carries which branch is
+* selected, what a malformed `Fn::If` yields, and the TRUE-branch residual both
+* halves accept.
+*/
+function collectReExportHops(selectedValue, templates, exportOwners) {
 	const hops = [];
 	const walk = (node) => {
 		if (Array.isArray(node)) {
@@ -63575,11 +63618,6 @@ function collectReExportHops(value, templates, exportOwners) {
 		}
 		if (node === null || typeof node !== "object") return;
 		const obj = node;
-		if ("Fn::If" in obj) {
-			const args = obj["Fn::If"];
-			if (Array.isArray(args) && args.length === 3) walk(args[2]);
-			return;
-		}
 		const imported = obj["Fn::ImportValue"];
 		if (typeof imported === "string") for (const owner of exportOwners.get(imported) ?? []) hops.push({
 			stack: owner,
@@ -63597,7 +63635,7 @@ function collectReExportHops(value, templates, exportOwners) {
 		}
 		for (const child of Object.values(obj)) walk(child);
 	};
-	walk(value);
+	walk(selectedValue);
 	return hops;
 }
 /**
@@ -63637,6 +63675,44 @@ function buildExportOwnerIndex(templates) {
 	return owners;
 }
 /**
+* Is this the issue #2134 refusal -- a `{{resolve:...}}` reference whose region
+* cdkd cannot establish?
+*
+* WHY IT IS NOT BEST-EFFORT, which is the whole reason this predicate exists.
+* `scrubStack` wraps each resolution pass in a `catch { logger.debug }` so one
+* unresolvable resource does not abandon the rest of the scrub. Every other
+* error reaching those catches means "this resource resolved partially, carry
+* on". This one means cdkd could not tell which region owns a secret reference,
+* so NO NEEDLE was recorded for it and the plaintext is still in `state.json` --
+* and swallowed, the command then reports `No plaintext secrets found` and
+* exits 0 over exactly the state it exists to clean. That is why the pre-pass
+* refusals are placed OUTSIDE those catches; this one is raised from inside
+* `resolveDynamicReferences`, so it cannot be placed and has to be re-raised.
+*
+* By CAUSE CHAIN rather than a bare `instanceof`, for the reason
+* {@link isByDesignRefusal} states: the refusal reaches those catches through
+* `resolver.resolve`, which wraps in several places, so a top-link-only test
+* silently swallows a wrapped one.
+*
+* TWO SITES IN THIS CALL GRAPH STILL SWALLOW IT, named rather than left to be
+* rediscovered (issue #2134 review round 2):
+*
+* - `evaluateConditions` (`intrinsic-function-resolver.ts`) warns and degrades
+*   the condition to `false`. Accepted for now: a condition evaluates to a
+*   boolean and carries no secret INTO state, and this file's own note above
+*   `resolveCrossStackReads` records why the conditions pass is deliberately
+*   not refusal-armed -- it runs BEFORE scrub knows which branch the deploy
+*   took, so refusing there can reject a whole stack over a branch never taken.
+*   The residual is that the FALSE branch is then selected, which that note
+*   already states.
+* - the `!nodeCanRefuse` arm of the cross-stack pre-pass, which debugs and
+*   returns. Defensible: a SUPPRESSED output writes no state key, so there is
+*   no persisted plaintext for a missing needle to leave behind.
+*/
+function isRegionAmbiguousRefusal(err) {
+	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
+}
+/**
 * Build the CROSS-STACK pre-pass for ONE stack's scrub (issue
 * [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
 *
@@ -63952,7 +64028,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const resolvers = new ScrubResolvers(region);
 		const resolver = resolvers.primary;
 		const producerRegions = producerRegionsFromState(state);
-		const foreignProducerRegions = foreignRegionsOf(producerRegions, region);
 		let parameters = {};
 		let conditions = {};
 		try {
@@ -63969,6 +64044,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			stackName: stack.stackName,
 			stateBackend: resolverStateBackend,
 			...recordedSecretValues && { recordedSecretValues },
+			producerRegions,
 			bestEffort: true
 		});
 		const resolveCrossStackReads = makeCrossStackPrePass({
@@ -63992,7 +64068,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
-				foreignProducerRegions,
 				resolvers,
 				recordedSecretValues,
 				origin: `resource '${logicalId}'`
@@ -64002,6 +64077,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			try {
 				await resolver.resolve(resolveInput, resourceContext);
 			} catch (err) {
+				if (isRegionAmbiguousRefusal(err)) throw err;
 				logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 			}
 			perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -64019,7 +64095,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
 					stackRegion: region,
 					producerRegions,
-					foreignProducerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
 					origin: `Export.Name of output '${name}'`
@@ -64029,6 +64104,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				try {
 					exportName = await resolver.resolve(nameSource, nameContext);
 				} catch (err) {
+					if (isRegionAmbiguousRefusal(err)) throw err;
 					outputsSourceUntrusted = true;
 					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 				}
@@ -64053,7 +64129,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const valueSource = await pinCrossRegionSecrets(value, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
-				foreignProducerRegions,
 				resolvers,
 				recordedSecretValues: outputSecrets,
 				origin: `output '${name}'`
@@ -64063,6 +64138,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			try {
 				await resolver.resolve(valueSource, valueContext);
 			} catch (err) {
+				if (isRegionAmbiguousRefusal(err)) throw err;
 				logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 			}
 		}
@@ -86049,7 +86125,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.35");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.37");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;