@go-to-k/cdkd 0.284.35 → 0.284.37

package/dist/{deploy-engine-Wei5Yw-_.js → deploy-engine-C62UGXid.js}

@@ -875,6 +875,42 @@ var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extend
 	}
 };
 /**
+* A `{{resolve:...}}` reference whose REGION cannot be established (issue
+* [#2134](https://github.com/go-to-k/cdkd/issues/2134)): it names no region,
+* and the stack it sits in is on record as reading across a region boundary.
+*
+* A SUBCLASS rather than a bare code, because the consumers that must not
+* swallow it identify it by CLASS. `cdkd scrub` wraps its resolution passes in
+* best-effort `catch { logger.debug }` blocks so that one unresolvable resource
+* does not abandon the rest of the scrub -- and a refusal swallowed there is
+* the exact outcome the refusal exists to prevent: no needle is recorded for
+* the reference, the plaintext survives in `state.json`, and the command
+* reports `No plaintext secrets found` and exits 0. The pre-pass refusals in
+* `scrub.ts` are placed OUTSIDE those catches for the same reason; this one
+* fires from inside `resolveDynamicReferences`, so it cannot be placed --
+* it has to be re-raised.
+*
+* USER-FIXABLE, so it deliberately does NOT extend
+* {@link CrossAccountSecretRefusalError}, whose subclass identity marks the one
+* PERMANENT refusal `scrub.ts`'s `isByDesignRefusal` reports as unclearable.
+* Spelling the reference as a full ARN names its region and clears this.
+*
+* The CODE names the domain (`DYNAMIC_REFERENCE_REGION_AMBIGUOUS`) rather than
+* carrying the base class's `INTRINSIC_RESOLUTION_REFUSAL_` prefix its one
+* sibling uses. Deliberate: no consumer keys on that prefix, so it is not a
+* contract, and the prefixed spelling would read
+* `INTRINSIC_RESOLUTION_REFUSAL_DYNAMIC_REFERENCE_REGION_AMBIGUOUS`. Consumers
+* that must act on this identify it by CLASS, which is what the subclass is
+* for.
+*/
+var DynamicReferenceRegionAmbiguousError = class DynamicReferenceRegionAmbiguousError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "DYNAMIC_REFERENCE_REGION_AMBIGUOUS");
+		this.name = "DynamicReferenceRegionAmbiguousError";
+		Object.setPrototypeOf(this, DynamicReferenceRegionAmbiguousError.prototype);
+	}
+};
+/**
 * Dependency resolution errors
 */
 var DependencyError = class DependencyError extends CdkdError {
@@ -10325,6 +10361,226 @@ function s3BucketWebsiteUrl(bucketName, region) {
 	return `http://${bucketName}.s3-website${S3_WEBSITE_ENDPOINT_LEGACY_DASH_REGIONS.has(folded) ? "-" : "."}${folded}.${urlSuffix}`;
 }
 
+//#endregion
+//#region src/deployment/secret-region-classification.ts
+/**
+* The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
+* therefore the only ones the region question below is asked about: every
+* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
+* exactly when its parameter is a `SecureString` (issue #1901).
+*
+* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
+* because it is public. `ssm-secure` is the live example and is emphatically
+* not public: `resolveDynamicReferences` has no arm for it, so the literal
+* token is passed through to AWS and CloudFormation resolves it SERVER-side.
+* cdkd never holds its value, so there is no region for cdkd to get wrong —
+* which is the only reason it can be waved through here.
+*/
+const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
+/**
+* Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
+*
+* Mirrors `IntrinsicFunctionResolver.resolveSecretsManagerReference`'s own
+* split — including the END-ANCHORED whole-secret form — because a secret ID
+* may legitimately contain colons (an ARN always does), so `split(':')[1]` is
+* wrong for exactly the shape this file cares about most.
+*/
+function secretsManagerSecretId(inner) {
+	const afterService = inner.substring(15);
+	let stringIdx = afterService.indexOf(":SecretString:");
+	let binaryIdx = afterService.indexOf(":SecretBinary:");
+	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
+	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
+	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
+	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
+}
+/**
+* The parameter name an `{{resolve:ssm:...}}` reference asks for — byte-for-byte
+* what `IntrinsicFunctionResolver.resolveSSMReference` passes as `GetParameter`'s
+* `Name`, which is `parts.slice(1).join(':')` on the colon-split inner body.
+*
+* The whole remainder, deliberately, with NOTHING stripped:
+*
+*  - An SSM dynamic reference CAN name a full ARN. The resolver joins the tail
+*    back together, so `{{resolve:ssm:arn:aws:ssm:us-west-2:111122223333:parameter/db/pw}}`
+*    reaches AWS as that ARN. A `split(':')[1]` here would yield the literal
+*    `'arn'` — a parameter that does not exist — and then report the reference
+*    as region-LESS and refuse it, which is the guess-in-the-other-direction the
+*    `named-region` arm exists to prevent.
+*  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
+*    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
+*    a different thing in the refusal message than the one that would be read.
+*/
+function ssmParameterName(inner) {
+	return inner.substring(4);
+}
+/**
+* The region an ARN names, or `undefined` for anything that is not an ARN with
+* a populated region field (`arn:<partition>:<service>:<region>:...`).
+*/
+function arnRegion(secretId) {
+	if (!secretId.startsWith("arn:")) return void 0;
+	const region = secretId.split(":")[3];
+	return region ? region : void 0;
+}
+/**
+* The producer regions a stack's persisted cross-stack reads name, for
+* the replay's `RollbackExecutorContext.importedProducerRegions` (issue #2057).
+*
+* Both record kinds count, and for the same reason: each one is a value this
+* stack read out of ANOTHER region's state, so each one is a way a
+* foreign-region `{{resolve:...}}` expression can have reached this stack's own
+* record. `imports` is the strong `Fn::ImportValue` edge; `outputReads` is the
+* weak `Fn::GetStackOutput` one (schema v8), which is the EASIER of the two to
+* point across a region boundary because the reference carries its own
+* `Region` argument.
+*
+* Deduplicated case-insensitively, keeping each region's first-recorded
+* spelling so the refusal message echoes what the user will see in
+* `state.json`. The consumer's own region is deliberately NOT filtered here —
+* {@link classifyReplaySecretRegion} does that, because it is the one that
+* knows which region is asking.
+*
+* Exported so the two `RollbackExecutorContext` construction sites derive the
+* list identically — `cdkd rollback` from the state it loaded, and
+* `DeployEngine.rollbackExecutorContext` from `crossStackReadsForPartialSave`,
+* which unions that snapshot with the reads the failing deploy itself made.
+*/
+function producerRegionsFromState(state) {
+	const seen = /* @__PURE__ */ new Set();
+	const regions = [];
+	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
+		const canonical = canonicalizeRegion(entry.sourceRegion);
+		if (!canonical || seen.has(canonical)) continue;
+		seen.add(canonical);
+		regions.push(entry.sourceRegion);
+	}
+	return regions;
+}
+/**
+* Decide which region must answer for a single `{{resolve:...}}` expression a
+* rollback replay is about to re-resolve — issue
+* [#2057](https://github.com/go-to-k/cdkd/issues/2057).
+*
+* WHY A REPLAY CAN BE HOLDING A FOREIGN REGION'S EXPRESSION AT ALL. Since
+* issue #1934 a cross-stack consumer re-resolves a redacted producer value in
+* the PRODUCER's region (`reresolveCrossStackValue` /
+* `resolverForProducerRegion`) — correct, because a Secrets Manager secret or
+* an SSM `SecureString` of the same NAME in two regions is two independent
+* values. The plaintext is then recorded into the CONSUMER's
+* `recordedSecretValues`, so the consumer's `state.json` (and from there the
+* rollback journal) persists the PRODUCER's spelling of the expression. That is
+* the right thing to persist, and it is region-less: the reader cannot tell
+* from the string which region produced it.
+*
+* The replay rebuilds its resolver from the CONSUMER's region alone, so
+* re-resolving that expression locally answers from a same-named secret in the
+* wrong region and writes it to a LIVE resource. Silent, and on the recovery
+* path. The rule applied here is the family's, from issue #1957: A NAMED REGION
+* BINDS; NEVER SUBSTITUTE A GUESS. The three verdicts are that one sentence:
+*
+*  - **`named-region`** — the expression's SECRET_ID is an ARN, which names its
+*    own region. The region is ESTABLISHED, so it binds: the caller resolves
+*    through a resolver pinned to it (each command's own `*Resolvers.forRegion`) rather
+*    than refusing. Refusing here would be the guess in the other direction.
+*
+*    cdkd would otherwise get this wrong, which is why the arm exists at all:
+*    `resolveSecretsManagerReference` builds its client from
+*    `this.explicitRegion` and passes the ARN through as an opaque `SecretId`,
+*    and `@aws-sdk/client-secrets-manager`'s endpoint ruleset has NO
+*    ARN-derived endpoint rule (unlike, say, S3 access points), so a
+*    foreign-region ARN is sent to the stack's own regional endpoint. What the
+*    SERVICE then does with it is not something this repo can settle offline —
+*    see the fixture note in
+*    `tests/integration/rollback-cross-region-secret/README.md`. Pinning the
+*    client to the ARN's region is correct either way: if Secrets Manager would
+*    have refused the foreign ARN, this turns a hard failure into a correct
+*    resolution; if it would have honoured it, this reaches the same value by
+*    the documented route. Neither outcome is a regression.
+*
+*  - **`ambiguous`** — the expression names no region (the plain name form) AND
+*    this stack has a foreign producer region on record
+*    (the replay's `RollbackExecutorContext.importedProducerRegions`). Nothing on hand
+*    can establish the origin, so the replay refuses instead of guessing.
+*
+*    KNOWN OVER-REFUSAL, accepted deliberately, and WIDER THAN THE SSM CASE
+*    ALONE — state both, because the second one is the common shape:
+*
+*    (a) Any NAME-FORM `secretsmanager` reference in a stack that has ANY
+*    foreign producer region on record is refused, even when that secret is
+*    the stack's own purely-local one and has nothing to do with the
+*    cross-region read. The evidence is per-STACK, not per-reference, so one
+*    cross-region export plus one ordinary
+*    `{{resolve:secretsmanager:mysecret:SecretString:pw}}` is enough — and CDK's
+*    `secretValueFromJson` emits exactly that name form, so this is the shape
+*    most people will meet. It also persists: with the union the producer
+*    region stays on record until the next SUCCESSFUL deploy. Per-reference
+*    evidence is what would narrow it, and that needs the region recorded
+*    ALONGSIDE the expression — the persisted-shape change issue #2057
+*    deliberately deferred (its options 1 and 2). Until then the refusal is
+*    loud, names the ARN spelling as the remedy, and is the fail-closed side
+*    of a trade whose other side is a silent wrong-secret write.
+*
+*    (b) An `ssm` reference is secret only when its parameter is a
+*    `SecureString`, and this arm cannot tell. So a `{{resolve:ssm:/app/env}}`
+*    naming a PUBLIC `String` that reached a persisted bag (issue #2036's
+*    acknowledged over-redaction) is refused too. Narrowing it by
+*    `isRecordedSecretExpression` was considered and REJECTED, and not because
+*    the store is unreachable — it is imported by this very file. It is
+*    unusable: `recordedSecretExpressions` is populated BY resolution, and in
+*    the standalone `cdkd rollback` process nothing has resolved anything when
+*    the first op is classified, so the store is empty and every `ssm` verdict
+*    would come back "not secret" — turning the protection off for exactly the
+*    SecureString case it exists for. Worse, once one op DID resolve a
+*    reference the store would be warm for the next, so the verdict would
+*    depend on OP ORDER. A resolve-the-type-first probe is unsound for the
+*    same reason the whole issue exists: the TYPE is region-dependent (#1957),
+*    so probing locally can report `String` for a name that is `SecureString`
+*    in the producer's region and wave through the very write this refuses.
+*    The residual is therefore a loud, actionable error on a narrow
+*    intersection (an over-redacted public ssm reference AND a cross-region
+*    read on record), which is the fail-closed side of the trade.
+*
+*  - **`local`** — everything else, which is the overwhelmingly common case:
+*    every non-secret service, every same-region ARN (the ordinary CDK
+*    `secretValueFromJson` shape), and every name-form expression in a stack
+*    with no foreign producer region recorded. Resolved exactly as before this
+*    change.
+*
+* A same-region ARN answers `local` even when a foreign producer region IS on
+* record: the expression settles the question itself, so the weaker evidence
+* never gets consulted.
+*/
+function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
+	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
+	if (inner === void 0) return { kind: "local" };
+	const service = inner.split(":")[0];
+	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return { kind: "local" };
+	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
+	if (!secretName) return { kind: "local" };
+	const named = arnRegion(secretName);
+	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
+		kind: "named-region",
+		secretName,
+		region: named
+	};
+	const seen = /* @__PURE__ */ new Set();
+	const foreignProducerRegions = [];
+	for (const candidate of importedProducerRegions ?? []) {
+		const canonical = canonicalizeRegion(candidate);
+		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
+		if (seen.has(canonical)) continue;
+		seen.add(canonical);
+		foreignProducerRegions.push(candidate);
+	}
+	if (foreignProducerRegions.length === 0) return { kind: "local" };
+	return {
+		kind: "ambiguous",
+		secretName,
+		foreignProducerRegions
+	};
+}
+
 //#endregion
 //#region src/deployment/secret-redaction.ts
 /** Fixed marker substituted for a secret value in log / error output. */
@@ -13566,6 +13822,33 @@ function buildUnknownIntrinsicError(key) {
 	return /* @__PURE__ */ new Error(`Unsupported CloudFormation intrinsic function "${key}": cdkd does not support resolving it yet. Deploying this template would produce a broken value. Please request support by opening an issue: ${issueUrl}`);
 }
 /**
+* The same context with the `producerRegions` EVIDENCE removed (issue #2134
+* review rounds 1 and 2).
+*
+* That field means "the CONSUMER stack reads from these regions", and it is
+* only meaningful where the origin of a reference is genuinely UNKNOWN. Hand it
+* to a resolution whose origin is already established and it re-judges a
+* reference cdkd has just proven, verdicting `ambiguous`.
+*
+* ROUND 1 stripped it by RESOLVER IDENTITY -- "is this a different instance?"
+* -- and round 2 measured that that is the wrong question. When the producer
+* lives in the CONSUMER's own region `resolverForProducerRegion` returns `this`,
+* so the identity test passed the evidence straight through and a name-form
+* reference read out of that producer was refused. The LOCAL producer failed
+* while the CROSS-REGION one succeeded, which is backwards, and after the
+* round-1 re-raise it aborted the whole stack's scrub rather than logging a
+* debug line.
+*
+* The right question is whether the ORIGIN IS KNOWN, so each caller answers it
+* for itself and this helper only performs the strip. Returned BY IDENTITY when
+* there is no evidence to remove, so the ordinary path allocates nothing.
+*/
+function withoutProducerRegions(context) {
+	if (context?.producerRegions === void 0) return context;
+	const { producerRegions: _stripped, ...rest } = context;
+	return rest;
+}
+/**
 * Does `value` carry a CloudFormation dynamic reference anywhere inside it?
 *
 * Used as the identity fast path of {@link
@@ -15467,8 +15750,9 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	async reresolveCrossStackValue(value, producerRegion, context, origin, sourceKey) {
 		if (!carriesDynamicReference(value)) return value;
 		const resolver = this.resolverForProducerRegion(producerRegion);
+		const pinnedContext = producerRegion ? withoutProducerRegions(context) : context;
 		const walk = async (v) => {
-			if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, context) : v;
+			if (typeof v === "string") return v.includes("{{resolve:") ? await resolver.resolveDynamicReferences(v, pinnedContext) : v;
 			if (Array.isArray(v)) {
 				const out = new Array(v.length);
 				for (let i = 0; i < v.length; i++) out[i] = await walk(v[i]);
@@ -16132,6 +16416,13 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const service = inner.split(":")[0];
 			const isKnownSecret = service === "secretsmanager" || recordedSecretExpressions.has(fullMatch);
 			if (isKnownSecret && context?.skipDynamicReferences) continue;
+			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
+			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${fullMatch}: it names '${regionVerdict.secretName}' without a region, and this stack reads from ${regionVerdict.foreignProducerRegions.join(", ")} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+			if (regionVerdict.kind === "named-region") {
+				const foreign = await this.resolverForProducerRegion(regionVerdict.region).resolveDynamicReferences(fullMatch, withoutProducerRegions(context));
+				result = result.replace(fullMatch, () => foreign);
+				continue;
+			}
 			const cached = this.cachedDynamicReferences.get(fullMatch);
 			if (cached) {
 				if (cached.secret && cached.value) context?.recordedSecretValues?.set(cached.value, fullMatch);
@@ -17273,7 +17564,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-bJ8nim2C.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BbWubpjP.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25148,223 +25439,6 @@ async function resolveReplayProps(props, resolvers, secrets, execCtx, logicalId)
 	return await walk(props, "");
 }
 /**
-* The `{{resolve:<service>:...}}` families whose value can be a SECRET, and
-* therefore the only ones the region question below is asked about: every
-* `secretsmanager` reference by spelling, and every `ssm` one, which is secret
-* exactly when its parameter is a `SecureString` (issue #1901).
-*
-* Every OTHER service is `local` because cdkd cannot resolve it at all, NOT
-* because it is public. `ssm-secure` is the live example and is emphatically
-* not public: `resolveDynamicReferences` has no arm for it, so the literal
-* token is passed through to AWS and CloudFormation resolves it SERVER-side.
-* cdkd never holds its value, so there is no region for cdkd to get wrong —
-* which is the only reason it can be waved through here.
-*/
-const REPLAY_SECRET_SERVICES = /* @__PURE__ */ new Set(["secretsmanager", "ssm"]);
-/**
-* Split a `{{resolve:secretsmanager:...}}` inner body into its SECRET_ID.
-*
-* Mirrors `IntrinsicFunctionResolver.resolveSecretsManagerReference`'s own
-* split — including the END-ANCHORED whole-secret form — because a secret ID
-* may legitimately contain colons (an ARN always does), so `split(':')[1]` is
-* wrong for exactly the shape this file cares about most.
-*/
-function secretsManagerSecretId(inner) {
-	const afterService = inner.substring(15);
-	let stringIdx = afterService.indexOf(":SecretString:");
-	let binaryIdx = afterService.indexOf(":SecretBinary:");
-	if (stringIdx < 0 && afterService.endsWith(":SecretString")) stringIdx = afterService.length - 13;
-	if (binaryIdx < 0 && afterService.endsWith(":SecretBinary")) binaryIdx = afterService.length - 13;
-	const delimiterIdx = stringIdx >= 0 && binaryIdx >= 0 ? Math.min(stringIdx, binaryIdx) : stringIdx >= 0 ? stringIdx : binaryIdx;
-	return delimiterIdx >= 0 ? afterService.substring(0, delimiterIdx) : afterService;
-}
-/**
-* The parameter name an `{{resolve:ssm:...}}` reference asks for — byte-for-byte
-* what `IntrinsicFunctionResolver.resolveSSMReference` passes as `GetParameter`'s
-* `Name`, which is `parts.slice(1).join(':')` on the colon-split inner body.
-*
-* The whole remainder, deliberately, with NOTHING stripped:
-*
-*  - An SSM dynamic reference CAN name a full ARN. The resolver joins the tail
-*    back together, so `{{resolve:ssm:arn:aws:ssm:us-west-2:111122223333:parameter/db/pw}}`
-*    reaches AWS as that ARN. A `split(':')[1]` here would yield the literal
-*    `'arn'` — a parameter that does not exist — and then report the reference
-*    as region-LESS and refuse it, which is the guess-in-the-other-direction the
-*    `named-region` arm exists to prevent.
-*  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
-*    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
-*    a different thing in the refusal message than the one that would be read.
-*/
-function ssmParameterName(inner) {
-	return inner.substring(4);
-}
-/**
-* The region an ARN names, or `undefined` for anything that is not an ARN with
-* a populated region field (`arn:<partition>:<service>:<region>:...`).
-*/
-function arnRegion(secretId) {
-	if (!secretId.startsWith("arn:")) return void 0;
-	const region = secretId.split(":")[3];
-	return region ? region : void 0;
-}
-/**
-* The producer regions a stack's persisted cross-stack reads name, for
-* {@link RollbackExecutorContext.importedProducerRegions} (issue #2057).
-*
-* Both record kinds count, and for the same reason: each one is a value this
-* stack read out of ANOTHER region's state, so each one is a way a
-* foreign-region `{{resolve:...}}` expression can have reached this stack's own
-* record. `imports` is the strong `Fn::ImportValue` edge; `outputReads` is the
-* weak `Fn::GetStackOutput` one (schema v8), which is the EASIER of the two to
-* point across a region boundary because the reference carries its own
-* `Region` argument.
-*
-* Deduplicated case-insensitively, keeping each region's first-recorded
-* spelling so the refusal message echoes what the user will see in
-* `state.json`. The consumer's own region is deliberately NOT filtered here —
-* {@link classifyReplaySecretRegion} does that, because it is the one that
-* knows which region is asking.
-*
-* Exported so the two `RollbackExecutorContext` construction sites derive the
-* list identically — `cdkd rollback` from the state it loaded, and
-* `DeployEngine.rollbackExecutorContext` from `crossStackReadsForPartialSave`,
-* which unions that snapshot with the reads the failing deploy itself made.
-*/
-function producerRegionsFromState(state) {
-	const seen = /* @__PURE__ */ new Set();
-	const regions = [];
-	for (const entry of [...state.imports ?? [], ...state.outputReads ?? []]) {
-		const canonical = canonicalizeRegion(entry.sourceRegion);
-		if (!canonical || seen.has(canonical)) continue;
-		seen.add(canonical);
-		regions.push(entry.sourceRegion);
-	}
-	return regions;
-}
-/**
-* Decide which region must answer for a single `{{resolve:...}}` expression a
-* rollback replay is about to re-resolve — issue
-* [#2057](https://github.com/go-to-k/cdkd/issues/2057).
-*
-* WHY A REPLAY CAN BE HOLDING A FOREIGN REGION'S EXPRESSION AT ALL. Since
-* issue #1934 a cross-stack consumer re-resolves a redacted producer value in
-* the PRODUCER's region (`reresolveCrossStackValue` /
-* `resolverForProducerRegion`) — correct, because a Secrets Manager secret or
-* an SSM `SecureString` of the same NAME in two regions is two independent
-* values. The plaintext is then recorded into the CONSUMER's
-* `recordedSecretValues`, so the consumer's `state.json` (and from there the
-* rollback journal) persists the PRODUCER's spelling of the expression. That is
-* the right thing to persist, and it is region-less: the reader cannot tell
-* from the string which region produced it.
-*
-* The replay rebuilds its resolver from the CONSUMER's region alone, so
-* re-resolving that expression locally answers from a same-named secret in the
-* wrong region and writes it to a LIVE resource. Silent, and on the recovery
-* path. The rule applied here is the family's, from issue #1957: A NAMED REGION
-* BINDS; NEVER SUBSTITUTE A GUESS. The three verdicts are that one sentence:
-*
-*  - **`named-region`** — the expression's SECRET_ID is an ARN, which names its
-*    own region. The region is ESTABLISHED, so it binds: the caller resolves
-*    through a resolver pinned to it ({@link ReplayResolvers.forRegion}) rather
-*    than refusing. Refusing here would be the guess in the other direction.
-*
-*    cdkd would otherwise get this wrong, which is why the arm exists at all:
-*    `resolveSecretsManagerReference` builds its client from
-*    `this.explicitRegion` and passes the ARN through as an opaque `SecretId`,
-*    and `@aws-sdk/client-secrets-manager`'s endpoint ruleset has NO
-*    ARN-derived endpoint rule (unlike, say, S3 access points), so a
-*    foreign-region ARN is sent to the stack's own regional endpoint. What the
-*    SERVICE then does with it is not something this repo can settle offline —
-*    see the fixture note in
-*    `tests/integration/rollback-cross-region-secret/README.md`. Pinning the
-*    client to the ARN's region is correct either way: if Secrets Manager would
-*    have refused the foreign ARN, this turns a hard failure into a correct
-*    resolution; if it would have honoured it, this reaches the same value by
-*    the documented route. Neither outcome is a regression.
-*
-*  - **`ambiguous`** — the expression names no region (the plain name form) AND
-*    this stack has a foreign producer region on record
-*    ({@link RollbackExecutorContext.importedProducerRegions}). Nothing on hand
-*    can establish the origin, so the replay refuses instead of guessing.
-*
-*    KNOWN OVER-REFUSAL, accepted deliberately, and WIDER THAN THE SSM CASE
-*    ALONE — state both, because the second one is the common shape:
-*
-*    (a) Any NAME-FORM `secretsmanager` reference in a stack that has ANY
-*    foreign producer region on record is refused, even when that secret is
-*    the stack's own purely-local one and has nothing to do with the
-*    cross-region read. The evidence is per-STACK, not per-reference, so one
-*    cross-region export plus one ordinary
-*    `{{resolve:secretsmanager:mysecret:SecretString:pw}}` is enough — and CDK's
-*    `secretValueFromJson` emits exactly that name form, so this is the shape
-*    most people will meet. It also persists: with the union the producer
-*    region stays on record until the next SUCCESSFUL deploy. Per-reference
-*    evidence is what would narrow it, and that needs the region recorded
-*    ALONGSIDE the expression — the persisted-shape change issue #2057
-*    deliberately deferred (its options 1 and 2). Until then the refusal is
-*    loud, names the ARN spelling as the remedy, and is the fail-closed side
-*    of a trade whose other side is a silent wrong-secret write.
-*
-*    (b) An `ssm` reference is secret only when its parameter is a
-*    `SecureString`, and this arm cannot tell. So a `{{resolve:ssm:/app/env}}`
-*    naming a PUBLIC `String` that reached a persisted bag (issue #2036's
-*    acknowledged over-redaction) is refused too. Narrowing it by
-*    `isRecordedSecretExpression` was considered and REJECTED, and not because
-*    the store is unreachable — it is imported by this very file. It is
-*    unusable: `recordedSecretExpressions` is populated BY resolution, and in
-*    the standalone `cdkd rollback` process nothing has resolved anything when
-*    the first op is classified, so the store is empty and every `ssm` verdict
-*    would come back "not secret" — turning the protection off for exactly the
-*    SecureString case it exists for. Worse, once one op DID resolve a
-*    reference the store would be warm for the next, so the verdict would
-*    depend on OP ORDER. A resolve-the-type-first probe is unsound for the
-*    same reason the whole issue exists: the TYPE is region-dependent (#1957),
-*    so probing locally can report `String` for a name that is `SecureString`
-*    in the producer's region and wave through the very write this refuses.
-*    The residual is therefore a loud, actionable error on a narrow
-*    intersection (an over-redacted public ssm reference AND a cross-region
-*    read on record), which is the fail-closed side of the trade.
-*
-*  - **`local`** — everything else, which is the overwhelmingly common case:
-*    every non-secret service, every same-region ARN (the ordinary CDK
-*    `secretValueFromJson` shape), and every name-form expression in a stack
-*    with no foreign producer region recorded. Resolved exactly as before this
-*    change.
-*
-* A same-region ARN answers `local` even when a foreign producer region IS on
-* record: the expression settles the question itself, so the weaker evidence
-* never gets consulted.
-*/
-function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
-	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
-	if (inner === void 0) return { kind: "local" };
-	const service = inner.split(":")[0];
-	if (service === void 0 || !REPLAY_SECRET_SERVICES.has(service)) return { kind: "local" };
-	const secretName = service === "secretsmanager" ? secretsManagerSecretId(inner) : ssmParameterName(inner);
-	if (!secretName) return { kind: "local" };
-	const named = arnRegion(secretName);
-	if (named !== void 0) return canonicalizeRegion(named) === canonicalizeRegion(consumerRegion) ? { kind: "local" } : {
-		kind: "named-region",
-		secretName,
-		region: named
-	};
-	const seen = /* @__PURE__ */ new Set();
-	const foreignProducerRegions = [];
-	for (const candidate of importedProducerRegions ?? []) {
-		const canonical = canonicalizeRegion(candidate);
-		if (!canonical || canonical === canonicalizeRegion(consumerRegion)) continue;
-		if (seen.has(canonical)) continue;
-		seen.add(canonical);
-		foreignProducerRegions.push(candidate);
-	}
-	if (foreignProducerRegions.length === 0) return { kind: "local" };
-	return {
-		kind: "ambiguous",
-		secretName,
-		foreignProducerRegions
-	};
-}
-/**
 * The replay's resolvers: the stack's own, plus one pinned sibling per FOREIGN
 * region an ARN-named reference asks for (issue #2057).
 *
@@ -26186,7 +26260,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.35";
+	return "0.284.37";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28806,5 +28880,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { endCommandInterruptScope as $, ConfigError as $n, buildAssetRedirectMap as $t, MULTI_REGION_RECREATE_BLOCKED_TYPES as A, resolveStateBucketWithDefaultAndSource as An, maskSecretsInError as At, collectDeclaredOutputNames as B, PARTITION_TABLE as Bn, DiffCalculator as Bt, ccRoutedFinalSnapshotError as C, getDefaultStateBucketName as Cn, isThrottlingError as Cr, STATE_SOURCED_CROSS_GENERATION_RULES as Ct, unsupportedFinalSnapshotError as D, resolveCaptureObservedState as Dn, dynamicReferenceTokens as Dt, refusesFinalSnapshot as E, resolveAutoAssetStorage as En, createSecretMasker as Et, cyan as F, CFN_TEMPLATE_URL_LIMIT as Fn, s3BucketDomainName as Ft, stateKeySecretExposure as G, clearBucketRegionCache as Gn, TemplateParser as Gt, exportAliasCollisionScrubWarning as H, derivePartitionAndUrlSuffix as Hn, describeTypeWithThrottleRetry as Ht, gray as I, MIGRATE_TMP_PREFIX as In, s3BucketDualStackDomainName as It, clearOnUpdateRemoval as J, getAwsClients as Jn, rebuildClientForBucketRegion as Jt, IAMRoleProvider as K, resolveBucketRegion as Kn, LockManager as Kt, green as L, findLargeInlineResources as Ln, s3BucketRegionalDomainName as Lt, renderStatefulReason as M, stateBucketExistenceConfirmed as Mn, redactSecretsForState as Mt, formatResourceLine as N, warnDeprecatedNoPrefixCliFlag as Nn, scrubResourceRecord as Nt, makeCanonicalizePropertiesFn as O, resolveSkipPrefix as On, errorCauseChain as Ot, bold as P, CFN_TEMPLATE_BODY_LIMIT as Pn, s3BucketArn as Pt, beginCommandInterruptScope as Q, CdkdError as Qn, WorkGraph as Qt, red as R, uploadCfnTemplate as Rn, s3BucketWebsiteUrl as Rt, buildFinalSnapshotIdentifier as S, synthesisStatusMessage as Sn, isRetryableTransientError as Sr, requireConfigString as St, isFinalSnapshotError as T, resolveApp as Tn, __exportAll as Tr, TEMPLATE_SOURCED_RULES as Tt, isExportAliasCollision as U, AssemblyReader as Un, withRetry as Ut, collectPublishedOutputNames as V, canonicalizeRegion as Vn, INTRINSIC_KEYS as Vt, secretBearingStateKeyWarning as W, processStackMessages as Wn, DagBuilder as Wt, findActionableSilentDrops as X, setAwsClients as Xn, AssetPublisher as Xt, ProviderRegistry as Y, resetAwsClients as Yn, shouldRetainResource as Yt, findSilentDropProperties as Z, AssetError as Zn, stringifyValue as Zt, maskingRetryLogger as _, runDockerForeground as _n, formatError as _r, configStringRefusal as _t, DeploymentEventsStore as a, AssetModeResolver as an, LocalStartServiceError as ar, isTerminationProtectionPropagationError as at, ATOMIC_FINAL_SNAPSHOT_TYPES as b, getDockerImageBySourceHash as bn, withErrorHandling as br, requireConfigArray as bt, planRollback as c, getBootstrapMarkerKey as cn, NestedStackChildDirectDestroyError as cr, cfnRefValueFromPhysicalId as ct, replayRollback as d, validateAssetBucketName as dn, ResourceTimeoutError as dr, WAFv2WebACLProvider as dt, createAssetRedirectResolver as en, CrossAccountSecretRefusalError as er, isInterruptedWaitError as et, updatePartialMessage as f, validateContainerRepoName as fn, ResourceUpdateNotSupportedError as fr, normalizeAwsTagsToCfn as ft, withResourceDeadline as g, getDockerCmd as gn, SynthesisError as gr, configBooleanRefusal as gt, deleteSkipReason as h, formatDockerLoginError as hn, StateError as hr, coerceCfnBoolean as ht, DeploymentEventsReader as i, stripControlChars as in, LocalMigrateError as ir, disableInstanceApiTermination as it, isStatefulRecreateTargetSync as j, resolveUseCdkBootstrapAssets as jn, maskSecretsInText as jt, extractDeploymentEventError as k, resolveStateBucketWithDefault as kn, isSingleDynamicReferenceToken as kt, producerRegionsFromState as l, parseBootstrapMarker as ln, PartialFailureError as lr, getAccountInfo as lt, UNSPECIFIED_SKIP_REASON as m, buildDockerImage as mn, StackTerminationProtectionError as mr, assertRegionMatch as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, rewriteTemplateAssetReferences as nn, DeployCancelledError as nr, CloudControlProvider as nt, classifyReplaySecretRegion as o, BOOTSTRAP_MARKER_PREFIX as on, LockError as or, IntrinsicFunctionResolver as ot, updatePartialReason as p, buildDenyExternalAccessPolicy as pn, StackHasActiveImportsError as pr, resolveExplicitPhysicalId as pt, collectInlinePolicyNamesManagedBySiblings as q, AwsClients as qn, S3StateBackend as qt, DeployEngine as r, escapeRegExp$1 as rn, LocalInvokeBuildError as rr, slowCcOperationTimeoutMs as rt, planFailedOps as s, ensureAssetStorage as sn, MissingCdkCliError as sr, carriesDynamicReference as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, loadPublishableAssetManifest as tn, DependencyError as tr, startInterruptWatch as tt, replayFailedOperations as u, readBootstrapMarkerBody as un, ProvisioningError as ur, refStateLookupFromResource as ut, IMPLICIT_DELETE_DEPENDENCIES as v, runDockerStreaming as vn, isCdkdError as vr, readConfigString as vt, createPreDeleteFinalSnapshot as w, getLegacyStateBucketName as wn, markNonRetryable as wr, STATE_SOURCED_READBACK_RULES as wt, PRE_DELETE_SNAPSHOT_TYPES as x, Synthesizer as xn, isMarkedNonRetryable as xr, requireConfigObject as xt, computeImplicitDeleteEdges as y, AssetManifestLoader as yn, normalizeAwsError as yr, replayWarn as yt, yellow as z, expectedOwnerParam as zn, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-Wei5Yw-_.js.map
+export { startInterruptWatch as $, ConfigError as $n, buildAssetRedirectMap as $t, renderStatefulReason as A, resolveStateBucketWithDefaultAndSource as An, redactSecretsForState as At, exportAliasCollisionScrubWarning as B, PARTITION_TABLE as Bn, DiffCalculator as Bt, isFinalSnapshotError as C, getDefaultStateBucketName as Cn, isRetryableTransientError as Cr, TEMPLATE_SOURCED_RULES as Ct, extractDeploymentEventError as D, resolveCaptureObservedState as Dn, isSingleDynamicReferenceToken as Dt, makeCanonicalizePropertiesFn as E, resolveAutoAssetStorage as En, __exportAll as Er, errorCauseChain as Et, green as F, CFN_TEMPLATE_URL_LIMIT as Fn, s3BucketDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, clearBucketRegionCache as Gn, TemplateParser as Gt, secretBearingStateKeyWarning as H, derivePartitionAndUrlSuffix as Hn, describeTypeWithThrottleRetry as Ht, red as I, MIGRATE_TMP_PREFIX as In, s3BucketDualStackDomainName as It, findActionableSilentDrops as J, getAwsClients as Jn, rebuildClientForBucketRegion as Jt, clearOnUpdateRemoval as K, resolveBucketRegion as Kn, LockManager as Kt, yellow as L, findLargeInlineResources as Ln, s3BucketRegionalDomainName as Lt, bold as M, stateBucketExistenceConfirmed as Mn, classifyReplaySecretRegion as Mt, cyan as N, warnDeprecatedNoPrefixCliFlag as Nn, producerRegionsFromState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, resolveSkipPrefix as On, maskSecretsInError as Ot, gray as P, CFN_TEMPLATE_BODY_LIMIT as Pn, s3BucketArn as Pt, isInterruptedWaitError as Q, CdkdError as Qn, WorkGraph as Qt, collectDeclaredOutputNames as R, uploadCfnTemplate as Rn, s3BucketWebsiteUrl as Rt, createPreDeleteFinalSnapshot as S, synthesisStatusMessage as Sn, isMarkedNonRetryable as Sr, STATE_SOURCED_READBACK_RULES as St, unsupportedFinalSnapshotError as T, resolveApp as Tn, markNonRetryable as Tr, dynamicReferenceTokens as Tt, stateKeySecretExposure as U, AssemblyReader as Un, withRetry as Ut, isExportAliasCollision as V, canonicalizeRegion as Vn, INTRINSIC_KEYS as Vt, IAMRoleProvider as W, processStackMessages as Wn, DagBuilder as Wt, beginCommandInterruptScope as X, setAwsClients as Xn, AssetPublisher as Xt, findSilentDropProperties as Y, resetAwsClients as Yn, shouldRetainResource as Yt, endCommandInterruptScope as Z, AssetError as Zn, stringifyValue as Zt, computeImplicitDeleteEdges as _, runDockerForeground as _n, SynthesisError as _r, replayWarn as _t, DeploymentEventsStore as a, AssetModeResolver as an, LocalMigrateError as ar, carriesDynamicReference as at, buildFinalSnapshotIdentifier as b, getDockerImageBySourceHash as bn, normalizeAwsError as br, requireConfigString as bt, replayFailedOperations as c, getBootstrapMarkerKey as cn, MissingCdkCliError as cr, refStateLookupFromResource as ct, updatePartialReason as d, validateAssetBucketName as dn, ProvisioningError as dr, resolveExplicitPhysicalId as dt, createAssetRedirectResolver as en, CrossAccountSecretRefusalError as er, CloudControlProvider as et, UNSPECIFIED_SKIP_REASON as f, validateContainerRepoName as fn, ResourceTimeoutError as fr, assertRegionMatch as ft, IMPLICIT_DELETE_DEPENDENCIES as g, getDockerCmd as gn, StateError as gr, readConfigString as gt, maskingRetryLogger as h, formatDockerLoginError as hn, StackTerminationProtectionError as hr, configStringRefusal as ht, DeploymentEventsReader as i, stripControlChars as in, LocalInvokeBuildError as ir, IntrinsicFunctionResolver as it, formatResourceLine as j, resolveUseCdkBootstrapAssets as jn, scrubResourceRecord as jt, isStatefulRecreateTargetSync as k, resolveStateBucketWithDefault as kn, maskSecretsInText as kt, replayRollback as l, parseBootstrapMarker as ln, NestedStackChildDirectDestroyError as lr, WAFv2WebACLProvider as lt, withResourceDeadline as m, buildDockerImage as mn, StackHasActiveImportsError as mr, configBooleanRefusal as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, rewriteTemplateAssetReferences as nn, DeployCancelledError as nr, disableInstanceApiTermination as nt, planFailedOps as o, BOOTSTRAP_MARKER_PREFIX as on, LocalStartServiceError as or, cfnRefValueFromPhysicalId as ot, deleteSkipReason as p, buildDenyExternalAccessPolicy as pn, ResourceUpdateNotSupportedError as pr, coerceCfnBoolean as pt, ProviderRegistry as q, AwsClients as qn, S3StateBackend as qt, DeployEngine as r, escapeRegExp$1 as rn, DynamicReferenceRegionAmbiguousError as rr, isTerminationProtectionPropagationError as rt, planRollback as s, ensureAssetStorage as sn, LockError as sr, getAccountInfo as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, loadPublishableAssetManifest as tn, DependencyError as tr, slowCcOperationTimeoutMs as tt, updatePartialMessage as u, readBootstrapMarkerBody as un, PartialFailureError as ur, normalizeAwsTagsToCfn as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, runDockerStreaming as vn, formatError as vr, requireConfigArray as vt, refusesFinalSnapshot as w, getLegacyStateBucketName as wn, isThrottlingError as wr, createSecretMasker as wt, ccRoutedFinalSnapshotError as x, Synthesizer as xn, withErrorHandling as xr, STATE_SOURCED_CROSS_GENERATION_RULES as xt, PRE_DELETE_SNAPSHOT_TYPES as y, AssetManifestLoader as yn, isCdkdError as yr, requireConfigObject as yt, collectPublishedOutputNames as z, expectedOwnerParam as zn, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-C62UGXid.js.map