@go-to-k/cdkd 0.284.36 → 0.284.38

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as startInterruptWatch, $t as buildAssetRedirectMap, A as renderStatefulReason, An as resolveStateBucketWithDefaultAndSource, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isRetryableTransientError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveCaptureObservedState, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveAutoAssetStorage, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as red, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as clearOnUpdateRemoval, Kn as resolveBucketRegion, Kt as LockManager, L as yellow, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as bold, Mn as stateBucketExistenceConfirmed, Mt as classifyReplaySecretRegion, N as cyan, Nn as warnDeprecatedNoPrefixCliFlag, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveSkipPrefix, Ot as maskSecretsInError, P as gray, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as CdkdError, Qt as WorkGraph, R as collectDeclaredOutputNames, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as synthesisStatusMessage, Sr as isMarkedNonRetryable, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as resolveApp, Tr as markNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as AssemblyReader, Ut as withRetry, V as isExportAliasCollision, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as processStackMessages, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as setAwsClients, Xt as AssetPublisher, Y as findSilentDropProperties, Yn as resetAwsClients, Yt as shouldRetainResource, Z as endCommandInterruptScope, Zt as stringifyValue, _ as computeImplicitDeleteEdges, _n as runDockerForeground, _t as replayWarn, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalMigrateError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as getDockerImageBySourceHash, br as normalizeAwsError, bt as requireConfigString, c as replayFailedOperations, cn as getBootstrapMarkerKey, cr as MissingCdkCliError, ct as refStateLookupFromResource, d as updatePartialReason, dn as validateAssetBucketName, dr as ProvisioningError, dt as resolveExplicitPhysicalId, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateContainerRepoName, fr as ResourceTimeoutError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getDockerCmd, gt as readConfigString, h as maskingRetryLogger, hn as formatDockerLoginError, hr as StackTerminationProtectionError, ht as configStringRefusal, i as DeploymentEventsReader, in as stripControlChars, ir as LocalInvokeBuildError$1, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveUseCdkBootstrapAssets, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveStateBucketWithDefault, kt as maskSecretsInText, l as replayRollback, ln as parseBootstrapMarker, lr as NestedStackChildDirectDestroyError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDockerImage, mr as StackHasActiveImportsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as disableInstanceApiTermination, o as planFailedOps, on as BOOTSTRAP_MARKER_PREFIX, or as LocalStartServiceError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as buildDenyExternalAccessPolicy, pr as ResourceUpdateNotSupportedError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as DynamicReferenceRegionAmbiguousError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as ensureAssetStorage, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as readBootstrapMarkerBody, ur as PartialFailureError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerStreaming, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getLegacyStateBucketName, wr as isThrottlingError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as Synthesizer, xr as withErrorHandling, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetManifestLoader, yt as requireConfigObject, z as collectPublishedOutputNames, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-Csb2eS97.js";
+import { $ as startInterruptWatch, $t as buildAssetRedirectMap, A as renderStatefulReason, An as resolveStateBucketWithDefaultAndSource, At as redactSecretsForState, B as exportAliasCollisionScrubWarning, Bn as PARTITION_TABLE, Bt as DiffCalculator, C as isFinalSnapshotError, Cn as getDefaultStateBucketName, Cr as isRetryableTransientError, Ct as TEMPLATE_SOURCED_RULES, D as extractDeploymentEventError, Dn as resolveCaptureObservedState, Dt as isSingleDynamicReferenceToken, E as makeCanonicalizePropertiesFn, En as resolveAutoAssetStorage, Et as errorCauseChain, F as green, Fn as CFN_TEMPLATE_URL_LIMIT, Ft as s3BucketDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gt as TemplateParser, H as secretBearingStateKeyWarning, Hn as derivePartitionAndUrlSuffix, Ht as describeTypeWithThrottleRetry, I as red, In as MIGRATE_TMP_PREFIX, It as s3BucketDualStackDomainName, J as findActionableSilentDrops, Jn as getAwsClients, Jt as rebuildClientForBucketRegion, K as clearOnUpdateRemoval, Kn as resolveBucketRegion, Kt as LockManager, L as yellow, Ln as findLargeInlineResources, Lt as s3BucketRegionalDomainName, M as bold, Mn as stateBucketExistenceConfirmed, Mt as classifyReplaySecretRegion, N as cyan, Nn as warnDeprecatedNoPrefixCliFlag, Nt as producerRegionsFromState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as resolveSkipPrefix, Ot as maskSecretsInError, P as gray, Pn as CFN_TEMPLATE_BODY_LIMIT, Pt as s3BucketArn, Q as isInterruptedWaitError, Qn as CdkdError, Qt as WorkGraph, R as collectDeclaredOutputNames, Rn as uploadCfnTemplate, Rt as s3BucketWebsiteUrl, S as createPreDeleteFinalSnapshot, Sn as synthesisStatusMessage, Sr as isMarkedNonRetryable, St as STATE_SOURCED_READBACK_RULES, T as unsupportedFinalSnapshotError, Tn as resolveApp, Tr as markNonRetryable, Tt as dynamicReferenceTokens, U as stateKeySecretExposure, Un as AssemblyReader, Ut as withRetry, V as isExportAliasCollision, Vn as canonicalizeRegion, Vt as INTRINSIC_KEYS, W as IAMRoleProvider, Wn as processStackMessages, Wt as DagBuilder, X as beginCommandInterruptScope, Xn as setAwsClients, Xt as AssetPublisher, Y as findSilentDropProperties, Yn as resetAwsClients, Yt as shouldRetainResource, Z as endCommandInterruptScope, Zt as stringifyValue, _ as computeImplicitDeleteEdges, _n as runDockerForeground, _t as replayWarn, a as DeploymentEventsStore, an as AssetModeResolver, ar as LocalMigrateError, at as carriesDynamicReference, b as buildFinalSnapshotIdentifier, bn as getDockerImageBySourceHash, br as normalizeAwsError, bt as requireConfigString, c as replayFailedOperations, cn as getBootstrapMarkerKey, cr as MissingCdkCliError, ct as refStateLookupFromResource, d as updatePartialReason, dn as validateAssetBucketName, dr as ProvisioningError, dt as resolveExplicitPhysicalId, en as createAssetRedirectResolver, er as CrossAccountSecretRefusalError, et as CloudControlProvider, f as UNSPECIFIED_SKIP_REASON, fn as validateContainerRepoName, fr as ResourceTimeoutError, ft as assertRegionMatch, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getDockerCmd, gt as readConfigString, h as maskingRetryLogger, hn as formatDockerLoginError, hr as StackTerminationProtectionError, ht as configStringRefusal, i as DeploymentEventsReader, in as stripControlChars, ir as LocalInvokeBuildError$1, it as IntrinsicFunctionResolver, j as formatResourceLine, jn as resolveUseCdkBootstrapAssets, jt as scrubResourceRecord, k as isStatefulRecreateTargetSync, kn as resolveStateBucketWithDefault, kt as maskSecretsInText, l as replayRollback, ln as parseBootstrapMarker, lr as NestedStackChildDirectDestroyError, lt as WAFv2WebACLProvider, m as withResourceDeadline, mn as buildDockerImage, mr as StackHasActiveImportsError, mt as configBooleanRefusal, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as rewriteTemplateAssetReferences, nr as DeployCancelledError, nt as disableInstanceApiTermination, o as planFailedOps, on as BOOTSTRAP_MARKER_PREFIX, or as LocalStartServiceError, ot as cfnRefValueFromPhysicalId, p as deleteSkipReason, pn as buildDenyExternalAccessPolicy, pr as ResourceUpdateNotSupportedError, pt as coerceCfnBoolean, q as ProviderRegistry, qn as AwsClients, qt as S3StateBackend, r as DeployEngine, rn as escapeRegExp, rr as DynamicReferenceRegionAmbiguousError, rt as isTerminationProtectionPropagationError, s as planRollback, sn as ensureAssetStorage, st as getAccountInfo, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as loadPublishableAssetManifest, tt as slowCcOperationTimeoutMs, u as updatePartialMessage, un as readBootstrapMarkerBody, ur as PartialFailureError, ut as normalizeAwsTagsToCfn, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as runDockerStreaming, vt as requireConfigArray, w as refusesFinalSnapshot, wn as getLegacyStateBucketName, wr as isThrottlingError, wt as createSecretMasker, x as ccRoutedFinalSnapshotError, xn as Synthesizer, xr as withErrorHandling, xt as STATE_SOURCED_CROSS_GENERATION_RULES, y as PRE_DELETE_SNAPSHOT_TYPES, yn as AssetManifestLoader, yt as requireConfigObject, z as collectPublishedOutputNames, zn as expectedOwnerParam, zt as applyRoleArnIfSet } from "./deploy-engine-DyxASW-O.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-2wQUtu7f.js";
+import { t as ASGProvider } from "./asg-provider-kqBWElNc.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -58335,19 +58335,40 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stackRegion = state.region;
 	let destroyProviderRegistry = ctx.providerRegistry;
 	let destroyAwsClients;
+	let regionSwitched = false;
+	const restoreBaseRegionAndClients = () => {
+		if (!regionSwitched) return;
+		regionSwitched = false;
+		const switchedClients = destroyAwsClients;
+		destroyAwsClients = void 0;
+		process.env["AWS_REGION"] = ctx.baseRegion;
+		process.env["AWS_DEFAULT_REGION"] = ctx.baseRegion;
+		setAwsClients(ctx.baseAwsClients);
+		try {
+			switchedClients?.destroy();
+		} catch (destroyError) {
+			logger.debug(`Failed to destroy region-scoped AWS clients: ${destroyError instanceof Error ? destroyError.message : String(destroyError)}`);
+		}
+	};
 	if (stackRegion && stackRegion !== ctx.baseRegion) {
 		logger.info(`Stack region: ${stackRegion}`);
 		process.env["AWS_REGION"] = stackRegion;
 		process.env["AWS_DEFAULT_REGION"] = stackRegion;
-		destroyAwsClients = new AwsClients({
-			region: stackRegion,
-			...ctx.profile && { profile: ctx.profile }
-		});
-		setAwsClients(destroyAwsClients);
-		destroyProviderRegistry = new ProviderRegistry();
-		registerAllProviders(destroyProviderRegistry);
-		destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
-		if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
+		regionSwitched = true;
+		try {
+			destroyAwsClients = new AwsClients({
+				region: stackRegion,
+				...ctx.profile && { profile: ctx.profile }
+			});
+			setAwsClients(destroyAwsClients);
+			destroyProviderRegistry = new ProviderRegistry();
+			registerAllProviders(destroyProviderRegistry);
+			destroyProviderRegistry.setCustomResourceResponseBucket(ctx.stateBucket);
+			if (ctx.allowUnsupportedTypes?.length) destroyProviderRegistry.allowUnsupportedTypes(ctx.allowUnsupportedTypes);
+		} catch (setupError) {
+			restoreBaseRegionAndClients();
+			throw setupError;
+		}
 	}
 	const renderer = getLiveRenderer();
 	let draining = false;
@@ -58367,10 +58388,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 	};
 	process.setMaxListeners(Math.max(process.getMaxListeners(), 100));
 	process.on("SIGINT", sigintHandler);
-	logger.info(`\nAcquiring lock for stack ${stackName}...`);
 	try {
-		await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy");
+		logger.info(`\nAcquiring lock for stack ${stackName}...`);
+		if (!await ctx.lockManager.acquireLock(stackName, regionForState, void 0, "destroy")) throw new Error(`Could not acquire lock for stack '${stackName}' (${regionForState}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${stackName} --stack-region ${regionForState}' if you are certain no other process is active.`);
 	} catch (error) {
+		restoreBaseRegionAndClients();
 		process.removeListener("SIGINT", sigintHandler);
 		throw error;
 	}
@@ -58382,6 +58404,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			} catch (releaseErr) {
 				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
 			}
+			restoreBaseRegionAndClients();
 			process.removeListener("SIGINT", sigintHandler);
 		};
 		let consumers;
@@ -58422,8 +58445,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 		});
 	};
-	renderer.start();
 	try {
+		renderer.start();
 		logger.info("Building dependency graph...");
 		const template = {
 			AWSTemplateFormatVersion: "2010-09-09",
@@ -58693,14 +58716,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 			await ctx.lockManager.releaseLock(stackName, regionForState);
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
+			restoreBaseRegionAndClients();
 		}
 		result.interrupted ||= draining;
-		if (destroyAwsClients) {
-			destroyAwsClients.destroy();
-			process.env["AWS_REGION"] = ctx.baseRegion;
-			process.env["AWS_DEFAULT_REGION"] = ctx.baseRegion;
-			setAwsClients(ctx.baseAwsClients);
-		}
 	}
 	return result;
 }
@@ -62709,28 +62727,6 @@ function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
 	return repaired ?? positioned;
 }
 /**
-* The producer regions that are genuinely FOREIGN to this stack, canonicalized
-* and de-duplicated (issue #2109 review).
-*
-* The same filter {@link classifyReplaySecretRegion} applies to its own
-* `importedProducerRegions` argument, spelled here because the
-* unclassifiable-reference guard needs the answer WITHOUT an expression to hand
-* to the classifier. A same-region cross-stack read is the common case and
-* raises no cross-region question, so it must not arm a refusal.
-*/
-function foreignRegionsOf(producerRegions, stackRegion) {
-	const seen = /* @__PURE__ */ new Set();
-	const foreign = [];
-	for (const candidate of producerRegions) {
-		const canonical = canonicalizeRegion(candidate);
-		if (!canonical || canonical === canonicalizeRegion(stackRegion)) continue;
-		if (seen.has(canonical)) continue;
-		seen.add(canonical);
-		foreign.push(candidate);
-	}
-	return foreign;
-}
-/**
 * The `cdkd scrub` resolvers: the stack's own, plus one pinned sibling per
 * FOREIGN region an ARN-named secret reference asks for (issue
 * [#2109](https://github.com/go-to-k/cdkd/issues/2109)).
@@ -62822,7 +62818,7 @@ const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 * followed by a service whose VALUE CloudFormation defines as a secret. Counted
 * against the number of WHOLE tokens of the same class the scan matched, which
 * is how an ASSEMBLED reference is detected without parsing intrinsics — see
-* {@link unclassifiableScrubSecretError}.
+* {@link isAssembledSecretReference}.
 *
 * WHY THE SERVICE IS PART OF THE OPENING (issue #2109 review). Counting the bare
 * `{{resolve:` made the guard fire on any leaf that merely MENTIONS the syntax
@@ -62859,7 +62855,7 @@ const SECRET_REFERENCE_OPENINGS = [
 ];
 /**
 * What an `Fn::Sub` placeholder opens with. A whole token that CONTAINS one is
-* the third assembled shape — see {@link unclassifiableScrubSecretError}.
+* the third assembled shape — see {@link isAssembledSecretReference}.
 */
 const SUB_PLACEHOLDER_OPENING = "${";
 /** How many SECRET references {@link SECRET_REFERENCE_OPENINGS} `leaf` opens. */
@@ -62873,16 +62869,17 @@ function isSecretReferenceToken(token) {
 	return SECRET_REFERENCE_OPENINGS.some((opening) => token.startsWith(opening));
 }
 /**
-* The refusal an ASSEMBLED reference raises (issue #2109 review): a leaf that
-* OPENS more SECRET references than the scan found COMPLETE tokens of that
-* class in it, or a whole token that still carries an `Fn::Sub` placeholder.
+* Does this leaf ASSEMBLE a secret reference out of parts (issue #2109 review)
+* — i.e. does it OPEN more SECRET references than the scan found COMPLETE
+* tokens of that class in it, or carry a whole token that still holds an
+* `Fn::Sub` placeholder?
 *
 * WHY THIS EXISTS, and it is the load-bearing half of this pre-pass rather than
 * an edge case. The region split runs on the RAW template leaf, BEFORE intrinsic
 * resolution, and the shared token scan is `\{\{resolve:[^}]+\}\}` — a class
 * that cannot cross a `}`. So none of the three shapes that assemble a
 * reference out of parts yields the ONE WHOLE token a literal reference does,
-* and the third one is why this guard needs two tests rather than one
+* and the third one is why this predicate needs two tests rather than one
 * (all four rows MEASURED):
 *
 * ```text
@@ -62900,40 +62897,42 @@ function isSecretReferenceToken(token) {
 * test: a WHOLE token that still contains `${` has not been assembled yet.
 * Neither a Secrets Manager secret name nor an SSM parameter name may contain
 * `$` or `{`, so the only false positive that test can produce is a JSON key
-* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and
-* this guard is the fail-closed side of a command whose subject is a leaked
-* plaintext.
-*
-* With no token there is nothing to classify: {@link pinCrossRegionSecrets}
-* returns the leaf BY IDENTITY, and `resolveJoin` / `resolveSub` then call
-* `resolveDynamicReferences` on the PRIMARY resolver once they have joined the
-* parts — issue #2109 verbatim, with the `ambiguous` refusal never firing. The
-* trailing-placeholder row got there a different way before this guard's second
-* test: the token WAS classified, and only downstream luck kept it safe (the
-* name form then classifies `ambiguous`, the ARN form fails into
-* `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it looks up still has a
-* literal `${Field}` in it). Both are pinned by the suite rather than assumed.
-* Fixing all of this inside the resolver (classify AFTER assembly) is the
-* structurally right answer and is NOT what this does: the resolver's
-* dynamic-reference path is shared with deploy and is out of this change's
-* scope. This guard buys the same SAFETY property — a reference whose region
-* cannot be established is never resolved in the stack's own region — by
-* refusing instead.
-*
-* GATED ON A FOREIGN PRODUCER REGION BEING ON RECORD, which is what keeps it
-* from refusing the world. With no foreign region on record there is no
-* cross-region question to get wrong: every reference in the stack resolves
-* locally, which is what an assembled one would have done anyway, so proceeding
-* is exactly today's behavior. Two residuals, stated rather than hidden:
-* an assembled reference that names a FOREIGN ARN inside an `Fn::Sub` in a
-* stack with NO cross-stack read on record is still resolved locally; and an
-* `Fn::Join` that splits BEFORE the service name is not counted at all (see
-* {@link SECRET_REFERENCE_OPENINGS}). Closing either needs the resolver-side
-* classification above — issue
-* [#2134](https://github.com/go-to-k/cdkd/issues/2134).
-*/
-function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProducerRegions, stackRegion) {
-	return new ScrubRefusalError(`Scrub of ${stackName} cannot classify a secret reference in ${origin}${leafPath ? ` at '${leafPath}'` : ""}: the value opens a '{{resolve:...}}' reference that is ASSEMBLED by an intrinsic (an Fn::Sub placeholder inside it, or an Fn::Join that splits it across parts), so the reference does not exist as a complete expression until AFTER it is resolved — and its region therefore cannot be determined before resolution. This stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so resolving it in '${stackRegion}' may look for a different region's secret: scrub would then miss the plaintext it exists to remove and report the stack clean. Refusing instead. Spell the reference as one complete literal '{{resolve:secretsmanager:<full ARN>:SecretString:...}}' — an ARN names its own region — then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE");
+* literally spelled `${...}` in a leaf that is NOT under an `Fn::Sub` — and a
+* false positive here now costs a DEFERRAL rather than a refusal, so it is
+* cheaper than it was when this predicate raised
+* `SCRUB_SECRET_REFERENCE_UNCLASSIFIABLE`.
+*
+* WHAT A `true` MEANS FOR THE CALLER, and it changed with issue
+* [#2157](https://github.com/go-to-k/cdkd/issues/2157): the leaf is handed on
+* BY IDENTITY, so the PRIMARY resolver classifies the reference once
+* `resolveSub` / `resolveJoin` have assembled it. Before issue
+* [#2134](https://github.com/go-to-k/cdkd/issues/2134) that was issue #2109
+* verbatim — the resolver had no region question at all, so an identity return
+* meant a foreign secret fetched against the stack's own endpoint, and this
+* predicate therefore had to REFUSE (gated on a foreign producer region being
+* on record, to keep it from refusing the world). #2134 put the classification
+* in `resolveDynamicReferences`, which sees the COMPLETE expression, so the
+* safety property the refusal bought — a reference whose region cannot be
+* established is never resolved in the stack's own region — is now bought
+* downstream over strictly more information.
+*
+* The trailing-placeholder row reached the resolver a different way before that
+* second test existed: the truncated token WAS classified here, and only
+* downstream luck kept it safe (the name form classifies `ambiguous`, the ARN
+* form fails into `SCRUB_CROSS_REGION_SECRET_UNRESOLVED` because the id it
+* looks up still has a literal `${Field}` in it). Post-#2157 it is deferred
+* like the other three, and the resolver answers it on the assembled
+* expression instead of on a token one brace short. Every row is pinned by the
+* suite rather than assumed.
+*
+* Residual, unchanged and stated rather than hidden: an `Fn::Join` that splits
+* BEFORE the service name opens no counted reference at all (see
+* {@link SECRET_REFERENCE_OPENINGS}), so this predicate returns `false` for it
+* and the leaf is returned by identity anyway — the same destination, reached
+* without being noticed.
+*/
+function isAssembledSecretReference(leaf, secretTokens) {
+	return countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING));
 }
 /**
 * Resolve every FOREIGN-region `{{resolve:...}}` reference in one leaf through
@@ -62955,10 +62954,9 @@ function unclassifiableScrubSecretError(origin, leafPath, stackName, foreignProd
 * closed: a stopped scrub is recoverable, a lookup for a secret id spliced
 * together out of a plaintext is not.
 */
-async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
+async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	const tokens = dynamicReferenceTokens(leaf);
-	const secretTokens = tokens.filter(isSecretReferenceToken);
-	if ((countSecretReferenceOpenings(leaf) !== secretTokens.length || secretTokens.some((token) => token.includes(SUB_PLACEHOLDER_OPENING))) && ctx.foreignProducerRegions.length > 0) throw unclassifiableScrubSecretError(ctx.origin, leafPath, stackName, ctx.foreignProducerRegions, ctx.stackRegion);
+	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
 	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
 	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
@@ -63026,16 +63024,16 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx, leafPath) {
 * off it.
 */
 async function pinCrossRegionSecrets(bag, stackName, ctx) {
-	const walk = async (v, path) => {
+	const walk = async (v) => {
 		if (typeof v === "string") {
 			if (!v.includes(DYNAMIC_REFERENCE_OPENING)) return v;
-			return await resolveForeignRegionTokens(v, stackName, ctx, path);
+			return await resolveForeignRegionTokens(v, stackName, ctx);
 		}
 		if (Array.isArray(v)) {
 			const out = new Array(v.length);
 			let changed = false;
 			for (let i = 0; i < v.length; i++) {
-				out[i] = await walk(v[i], `${path}[${i}]`);
+				out[i] = await walk(v[i]);
 				if (out[i] !== v[i]) changed = true;
 			}
 			return changed ? out : v;
@@ -63044,14 +63042,14 @@ async function pinCrossRegionSecrets(bag, stackName, ctx) {
 			const out = Object.create(null);
 			let changed = false;
 			for (const [k, val] of Object.entries(v)) {
-				out[k] = await walk(val, path ? `${path}.${k}` : k);
+				out[k] = await walk(val);
 				if (out[k] !== val) changed = true;
 			}
 			return changed ? out : v;
 		}
 		return v;
 	};
-	return await walk(bag, "");
+	return await walk(bag);
 }
 /**
 * Order scrub targets PRODUCER-BEFORE-CONSUMER (issue
@@ -63460,8 +63458,11 @@ function storedValueCarriesNoPlaintext(stored) {
 *   {@link buildExportOwnerIndex} and `producerTemplates` are keyed by stack
 *   NAME alone, so the walk reads that name's template regardless of `Region`;
 * - a secret reachable only through the TRUE branch of an `Fn::If` in a
-*   producer's output: see {@link collectReExportHops}, which takes the FALSE
-*   branch for a condition it cannot evaluate.
+*   producer's output: see {@link selectTakenConditionalBranches}, which takes
+*   the FALSE branch for a condition it cannot evaluate -- and which, since
+*   issue [#2150](https://github.com/go-to-k/cdkd/issues/2150), feeds BOTH the
+*   literal scan below and {@link collectReExportHops} from that one
+*   selection.
 */
 function producerPublishesSecretExpression(templates, exportOwners, producerStack, key) {
 	const seen = /* @__PURE__ */ new Set([`${producerStack}\u0000${key}`]);
@@ -63489,7 +63490,8 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 			widened = true;
 			subjects = Object.values(outputs).map((o) => o?.Value);
 		} else continue;
-		for (const subject of subjects) {
+		for (const rawSubject of subjects) {
+			const subject = selectTakenConditionalBranches(rawSubject);
 			if (JSON.stringify(subject ?? null).includes("{{resolve:")) {
 				if (widened) return {
 					kind: "widened",
@@ -63518,6 +63520,64 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 	return NO_SECRET_EXPRESSION;
 }
 /**
+* One node with every `Fn::If` collapsed to the branch scrub would TAKE
+* (issues #2146 and [#2150](https://github.com/go-to-k/cdkd/issues/2150)).
+*
+* ONE SPELLING, consumed verbatim by both halves of "does this producer publish
+* a secret expression?" — {@link collectReExportHops}, which follows the value
+* onward, and {@link producerPublishesSecretExpression}'s literal
+* `{{resolve:` scan, which tests the value itself. Those two are one question
+* asked twice, and they DISAGREED between #2146 and #2150: the hop walk took
+* the false branch while the scan `JSON.stringify`d the whole node and saw
+* both. A producer whose output is
+* `{"Fn::If": ["IsProd", "{{resolve:...}}", "plain"]}` deployed with `IsProd`
+* false therefore verdicted `declared`, the discriminator read the deployed
+* value `plain`, and scrub refused with `SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT`
+* — an UNCLEARABLE refusal, because no `cdkd scrub` of the producer can turn
+* `plain` into an expression and there is no bypass flag, so every other secret
+* in the consumer stack was stranded. A second spelling of the selection would
+* only move where the two can drift apart again, so there is exactly one.
+*
+* WHICH BRANCH: the FALSE one, unconditionally, mirroring `resolveIf`'s
+* unknown-condition arm. Every condition met on this path belongs to ANOTHER
+* stack, and scrub evaluates conditions only for the stack it is scrubbing,
+* from that template's parameter DEFAULTS (it takes no `--parameters`), so a
+* producer's condition is not evaluable here.
+*
+* TWO SHAPES COLLAPSE MORE THAN THE SELECTED BRANCH, both fail-OPEN, both
+* stated rather than implied because the old whole-node `JSON.stringify` saw
+* them and this does not. Neither is CloudFormation-emittable, which is why
+* they are accepted rather than fixed:
+*
+* - a MALFORMED `Fn::If` (args not a 3-tuple) collapses to `null` -- NO branch.
+*   Which branch is live is unknowable, so neither a hop nor a `{{resolve:`
+*   sighting may be claimed from it. CloudFormation refuses such a template, so
+*   a producer that reads this way cannot have been deployed carrying one.
+* - an object carrying `Fn::If` ALONGSIDE sibling keys keeps only the selected
+*   branch, so a `{{resolve:` under a sibling is not seen. An intrinsic node has
+*   exactly one key in any template CloudFormation accepts, and the hop walk
+*   dropped those siblings before this function existed (its `Fn::If` arm
+*   `return`ed rather than falling through), so this preserves that behaviour
+*   rather than introducing it.
+*
+* Residual, and it is the direction this file accepts elsewhere: a secret
+* reachable only through the TRUE branch is not detected, so that reference
+* keeps its pre-#2133 outcome. The hop walk already took this trade for the
+* chain it follows; #2150 extends it to the scan so that the two agree.
+*/
+function selectTakenConditionalBranches(node) {
+	if (Array.isArray(node)) return node.map(selectTakenConditionalBranches);
+	if (node === null || typeof node !== "object") return node;
+	const obj = node;
+	if ("Fn::If" in obj) {
+		const args = obj["Fn::If"];
+		return Array.isArray(args) && args.length === 3 ? selectTakenConditionalBranches(args[2]) : null;
+	}
+	const out = Object.create(null);
+	for (const [key, child] of Object.entries(obj)) out[key] = selectTakenConditionalBranches(child);
+	return out;
+}
+/**
 * The re-export hops one output VALUE carries (issue #2146).
 *
 * Only STATICALLY resolvable references produce a hop, mirroring
@@ -63536,8 +63596,9 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 * routinely wrapped — `Fn::Join`ing an imported password into a URL is the
 * shape the live fixture uses.
 *
-* `Fn::If` IS NOT WALKED ON BOTH ARMS, and this is load-bearing rather than
-* tidy (issue #2146 review). `makeCrossStackPrePass` deliberately mirrors
+* `Fn::If` NEVER REACHES THIS WALK, and the selection that used to live here
+* is load-bearing rather than tidy (issue #2146 review). `makeCrossStackPrePass`
+* deliberately mirrors
 * `resolveIf` — selected branch only — so that a conditional import of a
 * not-yet-deployed producer cannot refuse a whole stack, unbypassably, over a
 * reference the deploy never read. A hop walk that descended into both arms
@@ -63549,24 +63610,24 @@ function producerPublishesSecretExpression(templates, exportOwners, producerStac
 * flag. On main the same input answered `no`, so it would have been a
 * regression this change introduced.
 *
-* WHICH branch: the FALSE one, unconditionally. `resolveIf` selects FALSE for a
-* condition it cannot evaluate, and every condition here belongs to ANOTHER
-* stack — scrub evaluates conditions for the stack it is scrubbing, from that
-* template's parameter DEFAULTS, and has neither the parameters nor the
-* evaluation for a producer's. A MALFORMED `Fn::If` (args not a 3-tuple) yields
-* NO hop at all: which branch is live is unknowable, and the pre-pass's answer
-* there (walk it with refusals DISARMED) has no counterpart in a function whose
-* only output is "refuse or not".
-*
-* Residual, and it is the direction this file accepts elsewhere: a secret
-* reachable only through the TRUE branch is not detected, so that reference
-* keeps its pre-#2133 outcome. The asymmetry with the `{{resolve:` scan in
-* {@link producerPublishesSecretExpression} — which `JSON.stringify`s the whole
-* subject and therefore sees BOTH arms — is #2133's behaviour, unchanged here
-* on purpose: narrowing it would change which stacks that older refusal fires
-* on, which is not this change's subject.
-*/
-function collectReExportHops(value, templates, exportOwners) {
+* `selectedValue` IS THE CONTRACT, and it is why this function carries no
+* `Fn::If` handling of its own: the only caller,
+* {@link producerPublishesSecretExpression}, applies
+* {@link selectTakenConditionalBranches} ONCE and hands the result to BOTH the
+* literal `{{resolve:` scan and this walk, so a node reaching here holds no
+* `Fn::If` at all. Issue [#2150](https://github.com/go-to-k/cdkd/issues/2150)
+* collapsed the two to one site deliberately: the scan used to `JSON.stringify`
+* the whole subject and therefore see BOTH arms while this walk took only the
+* false one, and two spellings of one question are exactly how they came to
+* disagree. A second selection HERE would restore that, and be worse than
+* useless — measured on the #2150 lane, a per-site copy was invisible to every
+* test in the suite, because the caller had already pruned, so deleting it
+* changed nothing and no probe could fence it.
+* {@link selectTakenConditionalBranches}'s own doc carries which branch is
+* selected, what a malformed `Fn::If` yields, and the TRUE-branch residual both
+* halves accept.
+*/
+function collectReExportHops(selectedValue, templates, exportOwners) {
 	const hops = [];
 	const walk = (node) => {
 		if (Array.isArray(node)) {
@@ -63575,11 +63636,6 @@ function collectReExportHops(value, templates, exportOwners) {
 		}
 		if (node === null || typeof node !== "object") return;
 		const obj = node;
-		if ("Fn::If" in obj) {
-			const args = obj["Fn::If"];
-			if (Array.isArray(args) && args.length === 3) walk(args[2]);
-			return;
-		}
 		const imported = obj["Fn::ImportValue"];
 		if (typeof imported === "string") for (const owner of exportOwners.get(imported) ?? []) hops.push({
 			stack: owner,
@@ -63597,7 +63653,7 @@ function collectReExportHops(value, templates, exportOwners) {
 		}
 		for (const child of Object.values(obj)) walk(child);
 	};
-	walk(value);
+	walk(selectedValue);
 	return hops;
 }
 /**
@@ -63990,7 +64046,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const resolvers = new ScrubResolvers(region);
 		const resolver = resolvers.primary;
 		const producerRegions = producerRegionsFromState(state);
-		const foreignProducerRegions = foreignRegionsOf(producerRegions, region);
 		let parameters = {};
 		let conditions = {};
 		try {
@@ -64031,7 +64086,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const resolveInput = await pinCrossRegionSecrets(templateResource.Properties, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
-				foreignProducerRegions,
 				resolvers,
 				recordedSecretValues,
 				origin: `resource '${logicalId}'`
@@ -64059,7 +64113,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
 					stackRegion: region,
 					producerRegions,
-					foreignProducerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
 					origin: `Export.Name of output '${name}'`
@@ -64094,7 +64147,6 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const valueSource = await pinCrossRegionSecrets(value, stack.stackName, {
 				stackRegion: region,
 				producerRegions,
-				foreignProducerRegions,
 				resolvers,
 				recordedSecretValues: outputSecrets,
 				origin: `output '${name}'`
@@ -66112,7 +66164,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			skipped: () => []
 		}));
 		if (driftedOutcomes.length === 0) continue;
-		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept");
+		if (!await lockManager.acquireLock(report.stackName, report.region, owner, "drift-accept")) throw new Error(`Could not acquire lock for stack '${report.stackName}' (${report.region}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${report.stackName} --stack-region ${report.region}' if you are certain no other process is active.`);
 		try {
 			const resources = { ...report.state.resources };
 			for (const outcome of driftedOutcomes) {
@@ -66736,7 +66788,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 			skipped: () => []
 		}));
 		if (driftedOutcomes.length === 0) continue;
-		await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert");
+		if (!await lockManager.acquireLock(report.stackName, report.region, owner, "drift-revert")) throw new Error(`Could not acquire lock for stack '${report.stackName}' (${report.region}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${report.stackName} --stack-region ${report.region}' if you are certain no other process is active.`);
 		const narrowedByLogicalId = /* @__PURE__ */ new Map();
 		const revertSecretResolvers = new DriftSecretResolvers(report.region);
 		const revertProducerRegions = producerRegionsFromState(report.state);
@@ -69026,7 +69078,7 @@ async function exportCommand(stackArg, options) {
 		}
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		if (!options.dryRun) {
-			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName}' if you are certain no other process is active.`);
+			if (!await lockManager.acquireLock(resolvedStackName, targetRegion, owner, "export")) throw new Error(`Could not acquire lock for stack '${resolvedStackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${resolvedStackName} --stack-region ${targetRegion}' if you are certain no other process is active.`);
 		}
 		try {
 			if (nestedStackRows.length > 0) {
@@ -70942,7 +70994,7 @@ async function runPerStackImportLoop(args) {
 			try {
 				await deps.lockManager.acquireLockWithRetry(node.stackName, node.region, deps.lockOwner, "export", CHILD_LOCK_RETRY_MAX_ATTEMPTS, CHILD_LOCK_RETRY_DELAY_MS);
 			} catch (err) {
-				throw new Error(`Could not acquire lock for nested-stack child '${node.stackName}' (${node.region}) — another cdkd process held it through the retry window. Wait for it to finish, or run 'cdkd force-unlock ${node.stackName}' if you are certain no other process is active. No CloudFormation changeset has been submitted; cdkd state is unchanged.`, { cause: err instanceof Error ? err : void 0 });
+				throw new Error(`Could not acquire lock for nested-stack child '${node.stackName}' (${node.region}) — another cdkd process held it through the retry window. Wait for it to finish, or run 'cdkd force-unlock ${node.stackName} --stack-region ${node.region}' if you are certain no other process is active. No CloudFormation changeset has been submitted; cdkd state is unchanged.`, { cause: err instanceof Error ? err : void 0 });
 			}
 			acquiredChildLocks.push({
 				stackName: node.stackName,
@@ -72483,7 +72535,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		};
 	}
 	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-	await lockManager.acquireLock(stackName, region, owner, "state-refresh-observed");
+	if (!await lockManager.acquireLock(stackName, region, owner, "state-refresh-observed")) throw new Error(`Could not acquire lock for stack '${stackName}' (${region}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${stackName} --stack-region ${region}' if you are certain no other process is active.`);
 	try {
 		let refreshed = 0;
 		let unsupported = 0;
@@ -74862,7 +74914,9 @@ async function orphanCommand(pathArgs, options) {
 		const targetRegion = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
 		logger.info(`Target: ${stackInfo.stackName} (${targetRegion}); orphaning ${orphanLogicalIds.length} resource(s): ${orphanLogicalIds.join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-		if (!options.dryRun) await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "orphan");
+		if (!options.dryRun) {
+			if (!await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "orphan")) throw new Error(`Could not acquire lock for stack '${stackInfo.stackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${stackInfo.stackName} --stack-region ${targetRegion}' if you are certain no other process is active.`);
+		}
 		try {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
 			if (!stateData) throw new Error(`No state found for stack '${stackInfo.stackName}' (${targetRegion}). Nothing to orphan. (Did the stack get deployed?)`);
@@ -75447,7 +75501,7 @@ async function importCommand(stackArg, options) {
 		}
 		for (const overrideId of overrides.keys()) if (!templateLogicalIds.has(overrideId)) throw new Error(`--resource / --resource-mapping references logical ID '${overrideId}' which is not in the synthesized template for stack '${stackInfo.stackName}'. Available IDs: ${[...templateLogicalIds].join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
-		await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "import");
+		if (!await lockManager.acquireLock(stackInfo.stackName, targetRegion, owner, "import")) throw new Error(`Could not acquire lock for stack '${stackInfo.stackName}' (${targetRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${stackInfo.stackName} --stack-region ${targetRegion}' if you are certain no other process is active.`);
 		try {
 			const rows = [];
 			for (const { logicalId, resource } of resources) {
@@ -76176,7 +76230,7 @@ async function importNestedStackChildrenRecursive(args) {
 			const childRewritten = rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 			if (childRewritten > 0) logger.info(`Note: ${childRewritten} asset reference(s) in nested stack ${childStackName} are recorded in state at their pre-rewrite (CDK bootstrap) values, so the next 'cdkd deploy' repoints any resource that still holds them to cdkd asset storage.`);
 		}
-		await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import");
+		if (!await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import")) throw new Error(`Could not acquire lock for nested stack '${childStackName}' (${childRegion}) — another cdkd process holds it. Wait for it to finish, or run 'cdkd force-unlock ${childStackName} --stack-region ${childRegion}' if you are certain no other process is active.`);
 		try {
 			const childResources = collectImportableResources(childTemplate);
 			const childTemplateLogicalIds = new Set(childResources.map((r) => r.logicalId));
@@ -86091,7 +86145,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.36");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.38");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;