@go-to-k/cdkd 0.284.9 → 0.284.11

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-CY2fx4K1.js";
+import { $ as IntrinsicFunctionResolver, $n as StackHasActiveImportsError, $t as validateContainerRepoName, A as formatResourceLine, An as AssemblyReader, At as describeTypeWithThrottleRetry, B as isExportAliasCollision, Bt as WorkGraph, C as refusesFinalSnapshot, Cn as MIGRATE_TMP_PREFIX, Ct as s3BucketDomainName, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as PARTITION_TABLE, Dt as applyRoleArnIfSet, E as extractDeploymentEventError, En as expectedOwnerParam, Et as s3BucketWebsiteUrl, F as red, Fn as getAwsClients, Ft as S3StateBackend, G as clearOnUpdateRemoval, Gn as LocalStartServiceError, Gt as escapeRegExp, H as stateKeySecretExposure, Hn as DeployCancelledError, Ht as createAssetRedirectResolver, I as yellow, In as resetAwsClients, It as rebuildClientForBucketRegion, J as findSilentDropProperties, Jn as NestedStackChildDirectDestroyError, Jt as BOOTSTRAP_MARKER_PREFIX, K as ProviderRegistry, Kt as stripControlChars, L as collectDeclaredOutputNames, Ln as setAwsClients, Lt as shouldRetainResource, M as cyan, Mt as DagBuilder, N as gray, Nn as resolveBucketRegion, Nt as TemplateParser, O as isStatefulRecreateTargetSync, On as canonicalizeRegion, Ot as DiffCalculator, P as green, Pn as AwsClients, Pt as LockManager, Q as isTerminationProtectionPropagationError, Qn as ResourceUpdateNotSupportedError, Qt as validateAssetBucketName, R as collectPublishedOutputNames, Rt as AssetPublisher, S as isFinalSnapshotError, Sn as CFN_TEMPLATE_URL_LIMIT, St as s3BucketArn, T as makeCanonicalizePropertiesFn, Tn as uploadCfnTemplate, Tt as s3BucketRegionalDomainName, U as IAMRoleProvider, Un as LocalInvokeBuildError$1, Ut as loadPublishableAssetManifest, V as secretBearingStateKeyWarning, Vt as buildAssetRedirectMap, W as collectInlinePolicyNamesManagedBySiblings, Wn as LocalMigrateError, Wt as rewriteTemplateAssetReferences, X as slowCcOperationTimeoutMs, Xn as ProvisioningError, Xt as getBootstrapMarkerKey, Y as CloudControlProvider, Yn as PartialFailureError, Yt as ensureAssetStorage, Z as disableInstanceApiTermination, Zn as ResourceTimeoutError, Zt as parseBootstrapMarker, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as resolveStateBucketWithDefaultAndSource, _t as TEMPLATE_SOURCED_RULES, a as DeploymentEventsStore, an as runDockerStreaming, ar as normalizeAwsError, at as resolveExplicitPhysicalId, b as ccRoutedFinalSnapshotError, bn as warnDeprecatedNoPrefixCliFlag, bt as redactSecretsForState, c as replayFailedOperations, cn as Synthesizer, cr as isRetryableTransientError, ct as configBooleanRefusal, d as updatePartialReason, dn as getLegacyStateBucketName, dt as replayWarn, en as buildDenyExternalAccessPolicy, er as StackTerminationProtectionError, et as cfnRefValueFromPhysicalId, f as UNSPECIFIED_SKIP_REASON, fn as resolveApp, ft as requireConfigArray, g as computeImplicitDeleteEdges, gn as resolveStateBucketWithDefault, gt as STATE_SOURCED_READBACK_RULES, h as IMPLICIT_DELETE_DEPENDENCIES, hn as resolveSkipPrefix, ht as STATE_SOURCED_CROSS_GENERATION_RULES, i as DeploymentEventsReader, in as runDockerForeground, it as normalizeAwsTagsToCfn, j as bold, jn as processStackMessages, jt as withRetry, k as renderStatefulReason, kn as derivePartitionAndUrlSuffix, kt as INTRINSIC_KEYS, l as replayRollback, ln as synthesisStatusMessage, lr as isThrottlingError, lt as configStringRefusal, m as withResourceDeadline, mn as resolveCaptureObservedState, mt as requireConfigString, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as formatDockerLoginError, nt as refStateLookupFromResource, o as planFailedOps, on as AssetManifestLoader, or as withErrorHandling, ot as assertRegionMatch, p as deleteSkipReason, pn as resolveAutoAssetStorage, pt as requireConfigObject, q as findActionableSilentDrops, qn as MissingCdkCliError, qt as AssetModeResolver, r as DeployEngine, rn as getDockerCmd, rt as WAFv2WebACLProvider, s as planRollback, sn as getDockerImageBySourceHash, sr as isMarkedNonRetryable, st as coerceCfnBoolean, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as buildDockerImage, tt as getAccountInfo, u as updatePartialMessage, un as getDefaultStateBucketName, ur as markNonRetryable, ut as readConfigString, v as PRE_DELETE_SNAPSHOT_TYPES, vn as resolveUseCdkBootstrapAssets, vt as createSecretMasker, w as unsupportedFinalSnapshotError, wn as findLargeInlineResources, wt as s3BucketDualStackDomainName, x as createPreDeleteFinalSnapshot, xn as CFN_TEMPLATE_BODY_LIMIT, xt as scrubResourceRecord, y as buildFinalSnapshotIdentifier, yn as stateBucketExistenceConfirmed, yt as maskSecretsInText, z as exportAliasCollisionScrubWarning, zn as CdkdError, zt as stringifyValue } from "./deploy-engine-K5kHzsB-.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-B09ceB1r.js";
+import { t as ASGProvider } from "./asg-provider-C9OlqHee.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -60686,6 +60686,36 @@ var ScrubNeededError = class ScrubNeededError extends CdkdError {
 * parameter; scrub only stops it from being re-read out of state going
 * forward.
 *
+* OUTPUTS: `state.outputs` is scrubbed alongside the resource records, and its
+* repair scope is WIDER than today's declared outputs (issue #2005). A stored
+* output key the template can still name is redacted BY POSITION against that
+* template; a key it cannot name is repaired when its stored value MATCHES a
+* secret plaintext recorded anywhere this run, including one only a RESOURCE
+* still references. The motivating member of that population is an output
+* DELETED in an ordinary refactor, but it is not the only one — a key this run
+* cannot COMPUTE is in it too, and a parameterized `Export.Name` (scrub has
+* only template defaults) leaves the deploy's real alias key unaccounted on
+* EVERY run. When nothing recorded the plaintext the value is left exactly as
+* it is: a scrub that cannot identify the needle must not guess, because
+* `state.outputs` is re-applied VERBATIM to consumer stacks — by the exports
+* index (`src/state/export-index-store.ts`) and by `Fn::ImportValue` /
+* `Fn::GetStackOutput` (`src/deployment/intrinsic-function-resolver.ts`) — so a
+* fabricated redaction ships a literal `{{resolve:...}}` token into a
+* consumer's own AWS call. (`cdkd drift` is NOT one of those readers: it reads
+* `state.resources`, never `state.outputs`.) See `redactUnaccountedOutputs`.
+*
+* A FOURTH re-apply reader exists and is recorded here so the next audit does
+* not have to re-derive it: `NestedStackProvider.buildOutputsAttributes`
+* projects a CHILD record's `state.outputs` into the PARENT's
+* `Fn::GetAtt Outputs.X` attributes, i.e. into a parent resource property. It
+* is OUT of this command's reach, not exempt from the hazard — `scrubCommand`
+* targets synth STACK ARTIFACTS, and a nested child is a `nestedTemplates`
+* entry on its parent's `StackInfo` rather than an `aws:cloudformation:stack`
+* artifact of its own (`src/synthesis/assembly-reader.ts`), so the
+* `{parent}~{Child}` record this walk reads is never a stack scrub writes. If
+* scrub ever gains nested-child targets, this reader joins the list above and
+* the fabrication bound has to be re-argued for it.
+*
 * ORDERING: scrub matches the CURRENT resolved secret value against what state
 * holds, so run it BEFORE rotating. Once the secret is rotated, the value in
 * state no longer matches the current one and scrub cannot find it (it reports
@@ -60776,11 +60806,208 @@ async function scrubCommand(stacks, options) {
 	if (options.fail && totalStacksWithUnscrubbableKeys > 0) throw new ScrubNeededError();
 }
 /**
+* Every secret plaintext this run recorded, from ANY position in the template
+* (issue #2005) — the outputs' own map plus every resource's, filtered to the
+* values long enough to be a safe needle.
+*
+* Used ONLY by {@link redactUnaccountedOutputs}, which is why the union is built
+* here rather than kept as the pass's input everywhere: `outputSecrets` and
+* `perResourceSecrets` are deliberately SEPARATE bags so one resource's secret
+* value cannot rewrite another resource's coinciding literal (the collision the
+* deploy engine's `perResourceSecrets` doc describes), and widening the bag the
+* RESOURCE walk uses would re-open exactly that.
+*
+* On a value collision the outputs' expression wins: it is written last, and an
+* output KEY is the closest kin of the bag this map is scanned against. Both
+* expressions resolve to the same plaintext by construction (that is what makes
+* them collide), so the choice costs precision, not correctness — the residual
+* documented for the ambiguous-key fallback one screen up. A resource-vs-
+* resource collision is NOT ordered by anything: `perResourceSecrets` is
+* iterated in map order and the LAST logical id wins, so between two resources
+* resolving one plaintext the surviving expression is whichever the walk
+* reached last. Same trade as above (both resolve to the same value), stated
+* because only the outputs-vs-resource half used to be.
+*
+* **The needle floor is the security half, and it looks like it contradicts
+* repo policy without doing so.** `redactSecretsForState`'s no-source arm
+* matches a WHOLE VALUE at ANY length; only its substring arm honors
+* {@link MIN_NEEDLE_LENGTH}. That is sound for a POSITION-SCOPED bag, where the
+* candidate leaf is already known to belong to the reference. This union has no
+* position source at all, so an unfiltered 1-3 character plaintext recorded by
+* ANY resource would whole-value-match an unrelated stored output and rewrite
+* it onto that resource's expression. Issues #2012 / #2036 do say that with no
+* evidence OVER-redaction is the right failure, because it is "visible,
+* recoverable, and not a disclosure" — but that asymmetry is about a DRIFT
+* BASELINE, and it does not transfer here: `state.outputs` is re-applied
+* VERBATIM to consumer stacks by the exports index
+* (`src/state/export-index-store.ts`) and by `Fn::ImportValue` /
+* `Fn::GetStackOutput` (`src/deployment/intrinsic-function-resolver.ts`), so a
+* false redaction ships a literal `{{resolve:...}}` token into a consumer's own
+* AWS call — the #1934 class, a BREAK rather than a recoverable mismatch. (Two
+* readers, not the whole list: the module doc records a third that is out of
+* this command's reach, with the derivation.)
+*
+* The floor is applied to the WHOLE union, `outputSecrets` included, and that
+* narrows NOTHING that worked before. The positioning pass still runs FIRST
+* over the same bag with the UNFILTERED `outputSecrets`, whole-value-matching
+* at any length, and {@link redactUnaccountedOutputs} scans the STORED value —
+* so a sub-floor output secret it cannot see compares equal, falls through, and
+* the positioned leaf survives into `repaired ?? positioned`. Pinned by the
+* suite's "still repairs a SCALAR unaccounted key holding a sub-floor OUTPUT
+* secret" case (`ab1` -> its expression — the exact shape the false note
+* described) and by its non-scalar sibling "keeps the POSITIONED value". The
+* floor's effect is therefore confined to CROSS-RESOURCE needles: a sub-floor
+* plaintext recorded only by a RESOURCE never becomes a needle for the outputs
+* bag. Stated because an earlier revision claimed a narrowing here, and a false
+* "we gave this up" note is how a capability gets removed for real later.
+*
+* **What the floor does NOT bound, stated plainly because it is the residual a
+* reader will otherwise assume away.** `redactSecretsForState`'s SUBSTRING arm
+* runs over this union too, so a recorded plaintext of {@link
+* MIN_NEEDLE_LENGTH} characters or more occurring ANYWHERE inside an unrelated
+* unaccounted output WILL be rewritten. `secretValueFromJson('username')`
+* resolving `admin` turns a stored `https://admin.example.com` into
+* `https://{{resolve:secretsmanager:...}}.example.com`, which the exports index
+* republishes and a consumer's `Fn::ImportValue` then ships to AWS as a literal
+* token — the #1934 BREAK class, from a value that was never a secret.
+*
+* That arm is kept, and raising the floor for this union alone was considered
+* and REJECTED, on three grounds:
+*
+* - **Substring matching is what makes the repair work at all.** A connection
+*   string embedding a password is #2005's own target shape and this suite's
+*   own `DbUrl` case; gutting the arm would leave the motivating population
+*   unrepairable, which is the disclosure the command exists to remove.
+* - **Length is a weak proxy for the hazard, in both directions.** The values
+*   that collide with unrelated text are common tokens — `admin`, `prod`,
+*   `root` — and raising the bar to 8 admits `password`, `postgres`,
+*   `localhost`, which are longer AND likelier to occur inside a stored URL. A
+*   higher floor would refuse genuine short secrets while still admitting the
+*   colliding ones.
+* - **4 is the repo's ONE answer, and a second number would have no
+*   derivation.** `secret-redaction.ts`'s own needles, `stateKeySecretExposure`
+*   (#1919) and `drift.ts`'s `carriesRecordedSecret` all use it. A union-only 8
+*   would be the only such constant in the tree justified by taste, and a later
+*   reader could not tell which is authoritative.
+*
+* The trade is right for a GHSA repair command because the two failure
+* directions differ on REVERSIBILITY, not on likelihood. A fabricated rewrite
+* is loud and remediable: the consumer's next deploy fails on an unresolvable
+* token, and the operator fixes the template or edits the key out of state. An
+* unrepaired plaintext is silent and permanent — the key is one today's
+* template does not declare, so no redeploy ever rewrites it, and no other
+* command can. Refusing the substring arm here would trade the irreversible
+* failure for the reversible one in the wrong direction.
+*/
+function allRecordedSecrets(outputSecrets, perResourceSecrets) {
+	const union = /* @__PURE__ */ new Map();
+	for (const recorded of perResourceSecrets.values()) for (const [value, expression] of recorded) union.set(value, expression);
+	for (const [value, expression] of outputSecrets) union.set(value, expression);
+	for (const value of union.keys()) if (value.length < 4) union.delete(value);
+	return union;
+}
+/**
+* Repair a stored output key today's template cannot ACCOUNT for (issue
+* [#2005](https://github.com/go-to-k/cdkd/issues/2005)) — the population `cdkd
+* scrub` is documented as the remedy for and could not actually remedy.
+*
+* `outputSecrets` is built from today's DECLARED outputs, and the outputs
+* redaction above is gated on it being non-empty. An output DELETED from the
+* template contributes nothing to that set, so a record whose only
+* secret-bearing output has since been removed was reported CLEAN by the
+* command whose job is to clean it, while the plaintext stayed in
+* `state.outputs` until an unrelated deploy happened to rewrite the bag. That
+* is precisely the record `cdkd diff` withholds from display
+* ([#1948](https://github.com/go-to-k/cdkd/issues/1948)): correctly hidden, and
+* until now not repairable.
+*
+* TWO scope decisions, and both are load-bearing.
+*
+* 1. **WHICH keys.** Only keys today's template cannot name — not in
+*    `accountedKeys` (every declared output name plus every `Export.Name` this
+*    run could compute). A key the template DOES name is left exactly as the
+*    pass above leaves it, deliberately, because that pass POSITIONS it against
+*    the template and this one cannot: scanning an accounted key against the
+*    union bag would let one resource's secret plaintext rewrite a declared
+*    output's coinciding literal onto that resource's expression — a value
+*    state was never meant to hold, in the command that exists to make state
+*    trustworthy. The accepted residual, stated because narrowing is what buys
+*    the safety: a DECLARED output whose template value no longer resolves a
+*    secret, but whose STORED value is still the stale plaintext of one a
+*    resource carries, is not repaired here either. A redeploy rewrites it.
+*
+* 2. **WHAT may be rewritten.** Only a value that genuinely MATCHES a recorded
+*    plaintext — `redactSecretsForState`'s value scan with no source, i.e. a
+*    whole-value match and an embedded one, both bounded at
+*    {@link MIN_NEEDLE_LENGTH} by {@link allRecordedSecrets}. A scrub that
+*    cannot identify the needle must not guess: `state.outputs` is re-applied
+*    VERBATIM to consumer stacks by the exports index and by `Fn::ImportValue`
+*    / `Fn::GetStackOutput` (and by one more reader out of this command's
+*    reach — see the module doc), so a fabricated redaction ships a literal
+*    `{{resolve:...}}` token into a consumer's AWS call. No key is invented and
+*    no key is removed for the same reason. When nothing this run recorded the
+*    plaintext (the secret was deleted, rotated away, or the reference is gone
+*    from the template too) the value is LEFT ALONE — but note that behavior
+*    does NOT live in this function's `secrets.size === 0` guard, which is one
+*    of three redundant reasons and fences none of them; see the guard's own
+*    comment for what actually reaches it.
+*
+* **The scanned VALUE is the STORED one, never the positioned pass's output**
+* (blocker found in review). Scanning an already-positioned leaf means scanning
+* an expression the first pass just INSERTED, and `redactSecretsForState`'s
+* token guard protects only a WHOLE-VALUE token — so a MIXED leaf
+* (`postgres://admin:{{resolve:secretsmanager:prod/db:...}}@app-db`, the
+* `Fn::Join` shape CDK emits) gets re-scanned and any union needle occurring
+* INSIDE the inserted reference is spliced into it, corrupting the expression
+* into one no service can resolve (the corruption `secret-redaction.ts`'s own
+* token guard documents). A single union scan of the STORED value subsumes the
+* first pass for these keys rather than composing with it: the union is a
+* superset of `outputSecrets` with the outputs' expression winning a collision,
+* and an unaccounted key by construction has no position source in
+* `outputsTemplateSource` (every key that bag carries — a declared output name
+* or a literal `Export.Name` — is in `accountedKeys`), so the first pass could
+* only ever have value-scanned it too.
+*
+* **The repaired population is WIDER than "an output you deleted."** Any stored
+* key today's template cannot COMPUTE is in it, and a parameterized
+* `Export.Name` is the standing example: `scrub` has only template defaults, so
+* a name resolving to the literal `prefix-${Foo}` leaves the REAL alias key the
+* deploy wrote unaccounted on EVERY run, and that key gets cross-resource value
+* matching for as long as the parameter stays unresolvable here. That is the
+* accepted cost of not being able to reproduce the key — the alternative is
+* leaving a permanently unrepairable key — but it is a standing exposure to the
+* fabrication risk above rather than a one-off after a refactor.
+*
+* Returns the input by IDENTITY when nothing changed. That is worth doing on
+* its own terms (no churn, no needless clone), but it is NOT what keeps the
+* caller honest: the caller compares with `JSON.stringify` unconditionally, so
+* an identity return cannot make it cheaper and a fresh-but-equal object could
+* not make it report a repair it did not perform.
+*/
+function redactUnaccountedOutputs(positioned, stored, accountedKeys, secrets) {
+	if (secrets.size === 0 || !positioned || !stored) return positioned;
+	let repaired;
+	for (const [key, value] of Object.entries(stored)) {
+		if (accountedKeys.has(key)) continue;
+		const next = redactSecretsForState(value, secrets);
+		if (JSON.stringify(next) === JSON.stringify(value)) continue;
+		repaired ??= { ...positioned };
+		repaired[key] = next;
+	}
+	return repaired ?? positioned;
+}
+/**
 * Scrub one stack's state. Re-resolves the template's per-resource properties to
 * learn the resolved secret VALUES, then replaces those values in the state
 * record with their `{{resolve:...}}` expressions. Returns counts; performs no
 * AWS mutation. Acquires the stack lock for the read-modify-write unless
 * `dryRun`.
+*
+* The stack OUTPUTS bag is scrubbed too, in two passes: today's declared
+* outputs are redacted BY POSITION against the template, and a stored key
+* today's template cannot account for is repaired by VALUE MATCH alone — see
+* {@link redactUnaccountedOutputs} for why the two are separate and what each
+* deliberately declines to do.
 */
 async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const { logger } = opts;
@@ -60842,6 +61069,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		}
 		const templateOutputs = stack.template.Outputs ?? {};
 		const declaredOutputNames = collectDeclaredOutputNames(templateOutputs);
+		const accountedOutputKeys = new Set(declaredOutputNames);
 		const ambiguousKeys = /* @__PURE__ */ new Set();
 		const collisions = [];
 		let outputsSourceUntrusted = false;
@@ -60863,7 +61091,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${err instanceof Error ? err.message : String(err)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 			}
 			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
-			if (declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName))) {
+			const exportNameUnresolved = declaredExportName !== void 0 && typeof exportName === "string" && isUnresolvedValue(exportName, templateUsesSub(declaredExportName));
+			if (typeof exportName === "string" && !exportNameUnresolved) accountedOutputKeys.add(exportName);
+			if (exportNameUnresolved) {
 				outputsSourceUntrusted = true;
 				logger.warn(`Export.Name of output ${name} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 			} else if (typeof exportName === "string" && isExportAliasCollision(exportName, name, declaredOutputNames)) {
@@ -60919,7 +61149,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource) : state.outputs;
+		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const nextState = {
@@ -62060,11 +62290,12 @@ function containsDynamicReference(value) {
 	return false;
 }
 /**
-* Byte-for-byte the threshold `secret-redaction.ts` applies when it builds its
-* substring needles (`MIN_NEEDLE_LENGTH`). Copied rather than imported because
-* that constant is module-private there and this file may not widen its
-* exports; the two must agree or this function would call a leaf secret-bearing
-* that `redactSecretsForState` will not redact.
+* The threshold `secret-redaction.ts` applies when it builds its substring
+* needles. IMPORTED rather than copied since issue #2005 exported it (`cdkd
+* scrub` needed the same constant to bound its cross-resource union), so the
+* two can no longer disagree — and they must not, or this function would call a
+* leaf secret-bearing that `redactSecretsForState` will not redact. The local
+* alias is kept so the call sites below read unchanged.
 */
 const MIN_SECRET_NEEDLE_LENGTH = 4;
 /**
@@ -82481,7 +82712,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.9");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.284.11");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;