@go-to-k/cdkd 0.284.61 → 0.284.63

package/dist/{program-CrJMVg4e.js → program-alOnKpLV.js}

@@ -1,7 +1,7 @@
-import { $ as endCommandInterruptScope, $n as derivePartitionAndUrlSuffix, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as AssetManifestLoader, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveStateBucketWithDefault, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as buildDockerImage, Cr as ResourceTimeoutError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as partitionSensitiveEnv, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as getDockerCmd, Er as StackTerminationProtectionError, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as getLegacyStateBucketName, Fr as isThrottlingError, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as CFN_TEMPLATE_BODY_LIMIT, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as resolveUseCdkBootstrapAssets, Ht as applyRoleArnIfSet, I as red, In as resolveApp, Ir as markNonRetryable, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as findLargeInlineResources, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as CFN_TEMPLATE_URL_LIMIT, Kt as withRetry, L as yellow, Ln as resolveAutoAssetStorage, Lt as s3BucketArn, M as bold, Mn as Synthesizer, Mr as withErrorHandling, Mt as maskSecretsInText, N as cyan, Nn as synthesisStatusMessage, Nr as isMarkedNonRetryable, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as runDockerForeground, Ot as dynamicReferenceTokens, P as gray, Pn as getDefaultStateBucketName, Pr as isRetryableTransientError, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as canonicalizeRegion, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveCaptureObservedState, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as buildDenyExternalAccessPolicy, Sr as ProvisioningError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as formatDockerLoginError, Tr as StackHasActiveImportsError, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as stateBucketExistenceConfirmed, Ut as DiffCalculator, V as isExportAliasCollision, Vn as resolveStateBucketWithDefaultAndSource, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as warnDeprecatedNoPrefixCliFlag, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as expectedOwnerParam, Xt as displaySafe, Y as findSilentDropProperties, Yn as uploadCfnTemplate, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as PARTITION_TABLE, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as isCrossRegionRedirect, _r as LocalStartServiceError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as getAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as validateAssetBucketName, br as NestedStackChildDirectDestroyError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as CrossAccountSecretRefusalError, dt as refStateLookupFromResource, en as importableOutputKeys, er as AssemblyReader, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getBootstrapMarkerKey, gr as LocalMigrateError, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as ensureAssetStorage, hr as LocalInvokeBuildError$1, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as AwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as getDockerImageBySourceHash, jr as normalizeAwsError, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as runDockerStreaming, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CdkdError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as assertAssetBucketRegion, mr as DynamicReferenceRegionAmbiguousError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, or as resetAwsClients, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as DeployCancelledError, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as MIGRATE_TMP_PREFIX, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as resolveBucketRegion, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as setAwsClients, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as processStackMessages, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as parseBootstrapMarker, vt as configStringRefusal, w as refusesFinalSnapshot, wn as dockerSpawnEnvWithSensitive, wr as ResourceUpdateNotSupportedError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as validateContainerRepoName, xr as PartialFailureError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as readBootstrapMarkerBody, yr as MissingCdkCliError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveSkipPrefix, zt as s3BucketDualStackDomainName } from "./deploy-engine-0d-g0TT4.js";
+import { $ as beginCommandInterruptScope, $n as PARTITION_TABLE, $t as S3StateBackend, A as renderStatefulReason, An as runDockerForeground, At as dynamicReferenceTokens, B as exportAliasCollisionScrubWarning, Bn as resolveCaptureObservedState, Bt as s3BucketDomainName, C as isFinalSnapshotError, Cn as validateContainerRepoName, Cr as PartialFailureError, Ct as requireConfigArray, D as extractDeploymentEventError, Dn as formatDockerLoginError, Dr as StackHasActiveImportsError, Dt as STATE_SOURCED_READBACK_RULES, E as makeCanonicalizePropertiesFn, En as dockerSpawnEnvWithSensitive, Er as ResourceUpdateNotSupportedError, Et as STATE_SOURCED_CROSS_GENERATION_RULES, F as green, Fn as synthesisStatusMessage, Fr as isMarkedNonRetryable, Ft as redactSecretsForState, G as IAMRoleProvider, Gn as stateBucketExistenceConfirmed, Gt as DiffCalculator, H as secretBearingStateKeyWarning, Hn as resolveStateBucketWithDefault, Ht as s3BucketRegionalDomainName, I as red, In as getDefaultStateBucketName, Ir as isRetryableTransientError, It as scrubResourceRecord, J as ProviderRegistry, Jn as CFN_TEMPLATE_URL_LIMIT, Jt as withRetry, K as collectInlinePolicyNamesManagedBySiblings, Kn as warnDeprecatedNoPrefixCliFlag, Kt as INTRINSIC_KEYS, L as yellow, Ln as getLegacyStateBucketName, Lr as isThrottlingError, Lt as classifyReplaySecretRegion, M as bold, Mn as AssetManifestLoader, Mt as isSingleDynamicReferenceToken, N as cyan, Nn as getDockerImageBySourceHash, Nr as normalizeAwsError, Nt as maskSecretsInError, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as getDockerCmd, Or as StackTerminationProtectionError, Ot as TEMPLATE_SOURCED_RULES, P as gray, Pn as Synthesizer, Pr as withErrorHandling, Pt as maskSecretsInText, Q as DEFAULT_STATE_PREFIX, Qn as expectedOwnerParam, Qt as displaySafe, R as collectDeclaredOutputNames, Rn as resolveApp, Rr as markNonRetryable, Rt as producerRegionsFromState, S as createPreDeleteFinalSnapshot, Sn as validateAssetBucketName, Sr as NestedStackChildDirectDestroyError, St as replayWarn, T as unsupportedFinalSnapshotError, Tn as buildDockerImage, Tr as ResourceTimeoutError, Tt as requireConfigString, U as stateKeySecretExposure, Un as resolveStateBucketWithDefaultAndSource, Ut as s3BucketWebsiteUrl, V as isExportAliasCollision, Vn as resolveSkipPrefix, Vt as s3BucketDualStackDomainName, W as getCurrentResourceSecrets, Wn as resolveUseCdkBootstrapAssets, Wt as applyRoleArnIfSet, X as findSilentDropProperties, Xn as findLargeInlineResources, Xt as TemplateParser, Y as findActionableSilentDrops, Yn as MIGRATE_TMP_PREFIX, Yt as DagBuilder, Z as CUSTOM_RESOURCE_RESPONSE_PREFIX, Zn as uploadCfnTemplate, Zt as LockManager, _ as computeImplicitDeleteEdges, _n as ensureAssetStorage, _r as LocalInvokeBuildError$1, _t as assertRegionMatch, a as DeploymentEventsStore, an as AssetPublisher, ar as resolveBucketRegion, at as slowCcOperationTimeoutMs, b as buildFinalSnapshotIdentifier, bn as parseBootstrapMarker, bt as configStringRefusal, c as replayFailedOperations, cn as buildAssetRedirectMap, cr as resetAwsClients, ct as IntrinsicFunctionResolver, d as updatePartialReason, dn as rewriteTemplateAssetReferences, dr as CdkdError, dt as getAccountInfo, en as rebuildClientForBucketRegion, er as canonicalizeRegion, et as endCommandInterruptScope, f as UNSPECIFIED_SKIP_REASON, fn as escapeRegExp, ft as parameterTypeMayLoseSecretIdentity, g as IMPLICIT_DELETE_DEPENDENCIES, gn as assertAssetBucketRegion, gr as DynamicReferenceRegionAmbiguousError, gt as resolveExplicitPhysicalId, h as maskingRetryLogger, hn as BOOTSTRAP_MARKER_PREFIX, hr as DeployCancelledError, ht as normalizeAwsTagsToCfn, i as DeploymentEventsReader, in as shouldRetainResource, it as CloudControlProvider, j as formatResourceLine, jn as runDockerStreaming, jt as errorCauseChain, k as isStatefulRecreateTargetSync, kn as partitionSensitiveEnv, kt as createSecretMasker, l as replayRollback, ln as createAssetRedirectResolver, lr as setAwsClients, lt as carriesDynamicReference, m as withResourceDeadline, mn as AssetModeResolver, mt as WAFv2WebACLProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as importableOutputKeys, nr as AssemblyReader, nt as isInterruptedWaitError, o as planFailedOps, on as stringifyValue, or as AwsClients, ot as disableInstanceApiTermination, p as deleteSkipReason, pn as stripControlChars, pr as CrossAccountSecretRefusalError, pt as refStateLookupFromResource, q as clearOnUpdateRemoval, qn as CFN_TEMPLATE_BODY_LIMIT, qt as describeTypeWithThrottleRetry, r as DeployEngine, rn as importableOutputs, rr as processStackMessages, rt as startInterruptWatch, s as planRollback, sn as WorkGraph, sr as getAwsClients, st as isTerminationProtectionPropagationError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as exportNamesCarriedFrom, tr as derivePartitionAndUrlSuffix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as loadPublishableAssetManifest, ut as cfnRefValueFromPhysicalId, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as getBootstrapMarkerKey, vr as LocalMigrateError, vt as coerceCfnBoolean, w as refusesFinalSnapshot, wn as buildDenyExternalAccessPolicy, wr as ProvisioningError, wt as requireConfigObject, x as ccRoutedFinalSnapshotError, xn as readBootstrapMarkerBody, xr as MissingCdkCliError, xt as readConfigString, y as PRE_DELETE_SNAPSHOT_TYPES, yn as isCrossRegionRedirect, yr as LocalStartServiceError, yt as configBooleanRefusal, z as collectPublishedOutputNames, zn as resolveAutoAssetStorage, zt as s3BucketArn } from "./deploy-engine-B-RuozdO.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-iXYxz3AH.js";
-import { t as ASGProvider } from "./asg-provider-DTolzTHQ.js";
+import { t as getCdkdVersion } from "./version-Cmw63bLc.js";
+import { t as ASGProvider } from "./asg-provider-B9V61Fbq.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2032,7 +2032,9 @@ function createListCommand() {
 * cancellation, and GitLab CI / `docker stop` / Kubernetes send SIGTERM
 * directly. cdkd's graceful-interrupt handling (the top-level command
 * handlers, the deploy engine's partial-state save, and the per-provider
-* poll-abort listeners in CustomResource / ACM / CloudFront / Route53) is
+* poll-abort listeners in CustomResource / CloudFront / ACM — `grep -rn
+* "process.on('SIGINT'" src/provisioning/providers/` regenerates that closed
+* set, and Route53 is NOT in it) is
 * registered on SIGINT only, so an unhandled SIGTERM killed the process
 * mid-run, skipped every `finally`, and stranded the stack lock for its
 * full TTL.
@@ -2082,7 +2084,7 @@ function installSigtermForwarder() {
 * `cdkd deploy` has had one of these since issue #1348 (`deploy.ts`'s
 * `topLevelSigintHandler`). The destroy side had none, so the ONLY channel
 * carrying "the user interrupted" from `runDestroyForStack` back to the
-* `--all` loop was `DestroyRunResult.interrupted` — a boolean assigned ONCE,
+* `--all` loop was `DestroyRunnerResult.interrupted` — a boolean assigned ONCE,
 * inside the runner's `try`, after its level loop. Every instant where the
 * runner's `draining` flag flips AFTER that assignment is an instant where
 * `cdkd destroy --all` went on to delete the NEXT stack after the user asked
@@ -2106,10 +2108,38 @@ function installSigtermForwarder() {
 *
 * A handler that lives for the whole command closes both, because it is armed
 * in every window rather than in the ones the runner happens to span. The two
-* flags answer different questions and both are kept: `result.interrupted` is
-* the PER-STACK outcome (it decides that stack's state preservation, its
-* summary line and its `--purge-events` skip), while this one is the
-* COMMAND-level "stop" the loop wants.
+* flags answer different questions and both are kept, one owner each:
+*
+*  - PER-STACK, "did THIS stack finish, or is there work left in it?" —
+*    `DestroyRunnerResult.interrupted`, owned by `destroy-runner.ts`. It has FOUR
+*    consumers: that stack's state preservation, its summary line,
+*    `destroy.ts`'s `--purge-events` skip, and — the one earlier revisions of
+*    this list omitted — `NestedStackProvider.delete`, which reads the CHILD's
+*    result to decide whether the child row is `{ outcome: 'skipped' }` on the
+*    parent and whether its failure is `markNonRetryable`.
+*
+*    That fourth consumer is why the `&& statePreserved` gate below is a
+*    behavior change beyond the exit code: a fully-destroyed child that takes
+*    a tail signal no longer reports `interrupted`, so the parent no longer
+*    marks its row skipped. That is the CORRECT reading — `skipped` means
+*    "cdkd could not address this, the resources may still exist in AWS",
+*    which is false of a child whose every resource was deleted and whose
+*    state record is gone; it would preserve the parent's row for a child that
+*    no longer exists and exit 2 over a completed teardown. Stopping the
+*    surrounding `--all` run is a DIFFERENT question, still answered by this
+*    watch, which the parent command holds for its whole run.
+*  - PER-RUN, "has the user asked this COMMAND to stop?" — this watch. Its
+*    consumers are the loops' `break`s and the terminal exit-code verdict
+*    (which pairs it with `stoppedEarly`, so a signal in a completed run's
+*    tail does not report unfinished work there is none of).
+*
+* `--purge-events` moved onto the per-stack answer when the runner's outer
+* re-sync was gated on `statePreserved`. Before that the per-stack flag could
+* be true over a stack whose state was already DELETED, so the purge had to
+* read the command-level one to stay conservative — at the cost of the
+* opposite error: a tail signal on the LAST stack skipped the purge while the
+* command exited 0, reporting full success with the events left behind. With
+* the per-stack flag accurate, one read serves both directions.
 *
 * Note on the counterpart contract: `deploy-engine.ts` removes its own SIGINT
 * handler before releasing its lock, which is safe only because `deploy.ts`'s
@@ -2123,6 +2153,11 @@ function installSigtermForwarder() {
 */
 function watchCommandInterrupt(opts) {
 	let interrupted = false;
+	const promptAbort = new AbortController();
+	function markInterrupted() {
+		interrupted = true;
+		promptAbort.abort();
+	}
 	let stacksInFlight = 0;
 	/**
 	* Is some OTHER listener going to handle this signal gracefully?
@@ -2145,27 +2180,30 @@ function watchCommandInterrupt(opts) {
 	*  - `interrupt-watch.ts`'s shared handler, which is a LATCH rather than a
 	*    graceful owner — deferring to it is exactly the swallow above.
 	*
-	* A provider's transient wait listener (CustomResource / ACM / CloudFront /
-	* Route53) does count, and that is correct rather than a false positive:
-	* those exist only DURING a provider wait, which is strictly inside the
-	* runner handler's own lifetime, so one cannot be present while the runner's
-	* is absent.
+	* A provider's transient wait listener does count, and that is correct
+	* rather than a false positive: three providers install one — grep
+	* `process.on('SIGINT'` under `src/provisioning/providers/**` for the
+	* closed set, today `acm-certificate-provider.ts`,
+	* `cloudfront-distribution-provider.ts` and `custom-resource-provider.ts`,
+	* NOT Route53, whose provider registers none — and each exists only
+	* DURING a provider wait, which is strictly inside the runner handler's own
+	* lifetime, so one cannot be present while the runner's is absent.
 	*/
 	function gracefulOwnerArmed() {
 		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
 	}
 	const handler = () => {
 		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
-			interrupted = true;
+			markInterrupted();
 			return;
 		}
 		if (interrupted) {
-			process.stderr.write("\nForce-quit.\n");
+			process.stderr.write("\nForce-quit.\nIf the next run reports a stack lock, release it with: cdkd force-unlock <stack-name>\n");
 			process.exit(130);
 		}
-		interrupted = true;
+		markInterrupted();
 		if (stacksInFlight > 0) {
-			process.stderr.write(`\nInterrupted before ${opts.command} armed its per-stack teardown — quitting now. Nothing was deleted and no stack lock is held.\n`);
+			process.stderr.write(`\nInterrupted before ${opts.command} armed its per-stack teardown — quitting now. No delete was issued for this stack; on an --all run, stacks processed earlier are already destroyed.\nIf the next run reports a stack lock, release it with: cdkd force-unlock <stack-name>\n`);
 			process.exit(130);
 		}
 		process.stderr.write(`\nInterrupted — ${opts.command} will stop before starting another stack (press Ctrl-C again to force-quit)...\n`);
@@ -2173,6 +2211,7 @@ function watchCommandInterrupt(opts) {
 	process.on("SIGINT", handler);
 	return {
 		interrupted: () => interrupted,
+		signal: promptAbort.signal,
 		async runStack(fn) {
 			stacksInFlight += 1;
 			try {
@@ -2186,6 +2225,22 @@ function watchCommandInterrupt(opts) {
 		}
 	};
 }
+/**
+* Did this rejection come from a prompt aborted through
+* {@link CommandInterruptWatch.signal}?
+*
+* Deliberately duck-typed rather than `instanceof`: what `readline/promises`
+* rejects with is an internal Node error class in some versions and a
+* `DOMException` in others, and neither is importable. Both spellings carry
+* `name === 'AbortError'` / `code === 'ABORT_ERR'`, and the caller pairs this
+* with its own `watch.interrupted()` check, so a same-named error from an
+* unrelated abort cannot be mistaken for the user's Ctrl-C.
+*/
+function isPromptAbortError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const { name, code } = error;
+	return name === "AbortError" || code === "ABORT_ERR";
+}
 
 //#endregion
 //#region src/deployment/recreate-targets.ts
@@ -59254,7 +59309,6 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 		}
 		result.skippedEmpty = true;
-		result.interrupted ||= emptyInterrupted;
 		return result;
 	}
 	const needsStrongRefCheck = !!(state.outputs && Object.keys(state.outputs).length > 0);
@@ -59327,6 +59381,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const renderer = getLiveRenderer();
 	let draining = false;
 	let lockHeld = false;
+	let statePreserved = false;
 	const sigintHandler = () => {
 		if (draining) {
 			if (lockHeld) {
@@ -59643,6 +59698,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		result.interrupted = draining;
 		await saveChain;
 		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > 0;
+		statePreserved = preserveState;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.debug("State deleted");
@@ -59690,7 +59746,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			process.removeListener("SIGINT", sigintHandler);
 			restoreBaseRegionAndClients();
 		}
-		result.interrupted ||= draining;
+		result.interrupted ||= draining && statePreserved;
 	}
 	return result;
 }
@@ -59907,7 +59963,7 @@ var NestedStackProvider = class {
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const attributes = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
-			physicalId: this.synthesizeArn(ctx.accountId, ctx.parentRegion, ctx.parentStackName, logicalId),
+			physicalId: this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId),
 			attributes
 		};
 	}
@@ -59982,9 +60038,11 @@ var NestedStackProvider = class {
 		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
+		const inheritedSecrets = getCurrentResourceSecrets();
 		const childEngine = new DeployEngine(parentCtx.stateBackend, parentCtx.lockManager, parentCtx.dagBuilder, parentCtx.diffCalculator, parentCtx.providerRegistry, {
 			...parentCtx.options ?? {},
 			parameters: childParameters,
+			...inheritedSecrets && inheritedSecrets.size > 0 && { inheritedSecrets },
 			parentStackInfo: {
 				parentStack: parentCtx.parentStackName,
 				parentLogicalId: logicalId,
@@ -60014,8 +60072,22 @@ var NestedStackProvider = class {
 	deriveChildStackName(parentStackName, nestedLogicalId) {
 		return `${parentStackName}~${nestedLogicalId}`;
 	}
-	synthesizeArn(accountId, region, parentStackName, logicalId) {
-		return `arn:cdkd-local:${region}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
+	/**
+	* The synthesized `physicalId` recorded on the PARENT's
+	* `AWS::CloudFormation::Stack` row.
+	*
+	* `childRegion` is the region the child stack was deployed into (its own
+	* `StackState.region`), and the segment is LOAD-BEARING as of issue
+	* [#2055](https://github.com/go-to-k/cdkd/issues/2055):
+	* `IntrinsicFunctionResolver` reads it back as the producer region when a
+	* parent property consumes `Fn::GetAtt: [<Child>, 'Outputs.<Name>']` and the
+	* child's persisted output is a redacted `{{resolve:...}}` expression. A
+	* secret NAME is regional, so resolving that expression anywhere but the
+	* child's own region can answer with a different secret. Equal to the
+	* parent's region today; do not collapse the two.
+	*/
+	synthesizeArn(accountId, childRegion, parentStackName, logicalId) {
+		return `arn:cdkd-local:${childRegion}:${accountId}:nested-stack/${parentStackName}/${logicalId}`;
 	}
 	extractParameters(properties) {
 		const params = properties["Parameters"];
@@ -60057,6 +60129,42 @@ var NestedStackProvider = class {
 		}
 		return result;
 	}
+	/**
+	* Surface the child's PERSISTED outputs as the parent's `Outputs.<Key>`
+	* attributes, VERBATIM — including a secret-bearing one, which PR #1899
+	* persists as its unresolved `{{resolve:...}}` expression.
+	*
+	* DELIBERATELY NOT the place the expression is re-resolved (issue
+	* [#2055](https://github.com/go-to-k/cdkd/issues/2055)). Re-resolving here
+	* would be easy — `readChildOutputsAsAttributes` is already async — and it
+	* would trade one bug for a worse one: this map becomes the parent's
+	* `ResourceState.attributes`, and every CONSUMER resource then reads the
+	* plaintext through `Fn::GetAtt` with no entry in its OWN
+	* `recordedSecretValues`, so the deploy engine's save choke point has nothing
+	* to redact it back to and the consumer's `state.json` persists the decrypted
+	* secret. Keeping the expression here keeps BOTH the parent's nested-stack row
+	* and every consumer's record redacted.
+	*
+	* The re-resolution therefore lives at the READ site, in
+	* `IntrinsicFunctionResolver.resolveGetAtt`, where the CONSUMER's resolver
+	* context is in hand — the same seam and the same reason as the
+	* `Fn::ImportValue` / `Fn::GetStackOutput` arms of issue #1934.
+	*
+	* "A read site risks missing a caller" is answered for the RESOLUTION path by
+	* there being exactly one: the flat-key attribute lookup, which
+	* `getAttribute()` below exists to prove is the only route (it throws for
+	* anything that falls through it).
+	*
+	* It is NOT answered for every reader of `ResourceState.attributes` in the
+	* codebase, and an earlier revision of this note claimed it was.
+	* `AttributeFetcher.cacheFallback` in `src/analyzer/orphan-rewriter.ts` reads
+	* `orphan.attributes?.[attribute]` directly under `cdkd orphan --force` and
+	* has no resolver context to re-resolve with, so it splices the token
+	* verbatim into the referring resource's state and warns about exactly that.
+	* The seam decision above is unchanged — putting the plaintext here would
+	* make EVERY consumer persist it — but the count is "one resolution path",
+	* not "one reader".
+	*/
 	buildOutputsAttributes(outputs) {
 		const attributes = {};
 		for (const [key, value] of Object.entries(outputs)) attributes[`Outputs.${key}`] = value;
@@ -62641,6 +62749,55 @@ function isStackNotFoundError(err) {
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
 const logger = getLogger().child("DiffRecursive");
+/** Every `Ref` target reachable from a value, collected in one walk. */
+function collectRefTargets(value, refs) {
+	if (Array.isArray(value)) {
+		for (const element of value) collectRefTargets(element, refs);
+		return;
+	}
+	if (!value || typeof value !== "object") return;
+	const obj = value;
+	if (typeof obj["Ref"] === "string") refs.add(obj["Ref"]);
+	for (const nested of Object.values(obj)) collectRefTargets(nested, refs);
+}
+/**
+* Whether ANY condition in `template` references one of `tokenParameterNames`
+* (issue #1903, review round 2).
+*
+* WHY THIS EXISTS AND WHY THE BROAD FORM IS NOT MERELY CONSERVATIVE. The
+* token-parameter guard originally skipped condition evaluation for the WHOLE
+* template as soon as any bound parameter was a redacted token, on the argument
+* that the cost is "a condition-false resource is diffed rather than pruned".
+* That is only half of it: leaving `conditions` UNDEFINED also means `resolveIf`
+* finds no entry, warns, and takes the FALSE branch for every `Fn::If` in every
+* property value — so a condition-TRUE property diffs as a spurious UPDATE
+* (perpetual, and `--fail` exits 1) and condition-gated resources surface as
+* phantom CREATEs. And it fired whenever ANY parameter was token-valued, even
+* when not one condition mentioned it.
+*
+* So the skip is narrowed to what it can actually get wrong: a condition whose
+* verdict DEPENDS on a value this side does not have.
+*
+* NO TRANSITIVE `{Condition: X}` WALK, and its absence is a reachability
+* argument rather than an omission. An `Fn::And` over a NAMED condition (issue
+* #840's shape) does inherit that condition's dependency — but the named
+* condition is itself an entry in this same `Conditions` map, and this scan
+* visits EVERY entry, so the dependency is already found directly on the
+* referenced condition. A chain walk was written first and measured dead: with
+* it removed, a template whose `IsDev` wraps `{Condition: IsProd}` while only
+* `IsProd` names the token parameter still answers `true`.
+*/
+function conditionsDependOnTokenParameters(template, tokenParameterNames) {
+	const templateConditions = template.Conditions;
+	if (!templateConditions || typeof templateConditions !== "object") return false;
+	if (tokenParameterNames.size === 0) return false;
+	for (const definition of Object.values(templateConditions)) {
+		const refs = /* @__PURE__ */ new Set();
+		collectRefTargets(definition, refs);
+		for (const ref of refs) if (tokenParameterNames.has(ref)) return true;
+	}
+	return false;
+}
 /** Empty template used to diff a removed nested child's state → all DELETE. */
 const EMPTY_TEMPLATE = { Resources: {} };
 /**
@@ -62731,6 +62888,11 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
 	let mergedParameters = parameters;
 	let parametersBound = false;
+	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
+	for (const name of tokenParameterNames) {
+		const declaredType = (template.Parameters?.[name])?.Type;
+		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stackName}: parameter '${name}' is declared 'Type: ${declaredType}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this — declare it 'Type: String' — and this diff keeps the unresolved reference rather than coercing it.`);
+	}
 	try {
 		const userParameters = {};
 		for (const [name, value] of Object.entries(parameters ?? {})) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") userParameters[name] = String(value);
@@ -62739,13 +62901,14 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			...parameters,
 			...templateParameters
 		};
+		for (const name of tokenParameterNames) mergedParameters[name] = (parameters ?? {})[name];
 		parametersBound = true;
 	} catch (error) {
 		logger.debug(`Diff parameter binding for stack ${stackName} is partial: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	let effectiveTemplate = template;
 	let conditions;
-	if (parametersBound) try {
+	if (parametersBound && !conditionsDependOnTokenParameters(template, tokenParameterNames)) try {
 		conditions = await intrinsicResolver.evaluateConditions({
 			template,
 			resources: currentState.resources,
@@ -62818,7 +62981,8 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 			stateBackend,
 			stackName: parentStackName,
 			bestEffort: true,
-			...parentParameters && { parameters: parentParameters }
+			...parentParameters && { parameters: parentParameters },
+			skipDynamicReferences: true
 		});
 	} catch {}
 	return resolved;
@@ -68750,6 +68914,7 @@ async function destroyCommand(stackArgs, options) {
 		let totalSkipped = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
+		let stoppedEarly = false;
 		let stackNames;
 		if (options.all) stackNames = candidateStacks.map((s) => s.stackName);
 		else if (stackPatterns.length > 0) stackNames = matchStacks(candidateStacks, stackPatterns).map((s) => s.stackName);
@@ -68790,7 +68955,7 @@ async function destroyCommand(stackArgs, options) {
 			arr.push(ref);
 			stateRefsByName.set(ref.stackName, arr);
 		}
-		for (const stackName of stackNames) {
+		for (const [stackIndex, stackName] of stackNames.entries()) {
 			logger.info(`\nPreparing to destroy stack: ${stackName}`);
 			const refs = stateRefsByName.get(stackName) ?? [];
 			const synthStack = appStacks.find((s) => s.stackName === stackName);
@@ -68826,7 +68991,10 @@ async function destroyCommand(stackArgs, options) {
 				totalErrors++;
 				continue;
 			}
-			if (runInterrupted()) break;
+			if (runInterrupted()) {
+				stoppedEarly = true;
+				break;
+			}
 			const eventRecorder = startRunRecorder({
 				backend: stateBackend,
 				stackName,
@@ -68834,6 +69002,8 @@ async function destroyCommand(stackArgs, options) {
 				command: "destroy"
 			});
 			let destroyRunResult = "SUCCEEDED";
+			let stackInterrupted = false;
+			let stackCancelled = false;
 			try {
 				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend,
@@ -68877,6 +69047,8 @@ async function destroyCommand(stackArgs, options) {
 				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
+				stackInterrupted = result.interrupted;
+				stackCancelled = result.cancelled === true;
 				if (result.interrupted) interrupted = true;
 				destroyRunResult = result.errorCount > 0 || result.skippedCount > 0 ? "FAILED" : "SUCCEEDED";
 				eventRecorder.record({
@@ -68901,12 +69073,15 @@ async function destroyCommand(stackArgs, options) {
 			await purgeEventsAfterDestroy(new DeploymentEventsReader(stateBackend), stackName, stackTargetRegion, {
 				purgeEvents: options.purgeEvents,
 				runResult: destroyRunResult,
-				interrupted: runInterrupted()
+				interrupted: stackInterrupted || stackCancelled
 			}, logger);
-			if (runInterrupted()) break;
+			if (runInterrupted()) {
+				if (stackIndex < stackNames.length - 1) stoppedEarly = true;
+				break;
+			}
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
+		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
@@ -73505,12 +73680,24 @@ async function stateDestroyCommand(stackArgs, options) {
 			process.stdout.write(`\nWARNING: This destroys ${stackNames.length} stack(s) and removes their state records:\n`);
 			for (const name of stackNames) process.stdout.write(`  - ${name}\n`);
 			process.stdout.write("\n");
+			if (process.stdin.isTTY !== true) throw new CdkdError("The state destroy --all confirmation prompt cannot run in a non-interactive environment. Pass --yes / -y to confirm the batch, or run the command from a real terminal.", "NON_INTERACTIVE_CONFIRM");
 			const rl = readline$1.createInterface({
 				input: process.stdin,
 				output: process.stdout
 			});
-			const answer = await rl.question(`Destroy all ${stackNames.length} stack(s)? (y/N): `);
-			rl.close();
+			let answer;
+			try {
+				answer = await rl.question(`Destroy all ${stackNames.length} stack(s)? (y/N): `, { signal: interruptWatch.signal });
+			} catch (error) {
+				if (interruptWatch.interrupted() && isPromptAbortError(error)) {
+					process.stderr.write("\nDestroy cancelled — nothing was destroyed.\n");
+					rl.close();
+					process.exit(130);
+				}
+				throw error;
+			} finally {
+				rl.close();
+			}
 			const trimmed = answer.trim().toLowerCase();
 			if (trimmed !== "y" && trimmed !== "yes") {
 				logger.info("Destroy cancelled");
@@ -73522,7 +73709,31 @@ async function stateDestroyCommand(stackArgs, options) {
 		let totalSkipped = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
-		for (const stackName of stackNames) {
+		let stoppedEarly = false;
+		/**
+		* Would any stack AFTER `stackIndex` actually have been destroyed?
+		*
+		* `stackIndex < stackNames.length - 1` answers "does an INDEX remain",
+		* which is not the same question and over-claims: with
+		* `--stack-region us-east-1`, a later name whose only state record lives in
+		* eu-west-1 is warn-and-skipped by the `targets.length === 0` branch below
+		* — it was never going to be destroyed, so a signal before it leaves
+		* nothing undone and the run must still exit 0. Measured on
+		* `state destroy --all --yes --stack-region us-east-1` with StackA in
+		* us-east-1 and StackB only in eu-west-1: the index form exited 2 having
+		* dispatched StackA, i.e. every target it had.
+		*
+		* The predicate mirrors that branch's own filter over `stateRefs`, the
+		* same list the loop selects from. `destroy.ts` needs no counterpart: its
+		* `candidateStacks` is already pre-filtered by the set of stack names that
+		* have state, so an index there IS a target.
+		*/
+		const targetRemainsAfter = (stackIndex) => stackNames.slice(stackIndex + 1).some((name) => {
+			const laterRefs = stateRefs.filter((r) => r.stackName === name);
+			if (!options.stackRegion) return laterRefs.length > 0;
+			return laterRefs.some((r) => r.region === options.stackRegion || !r.region);
+		});
+		for (const [stackIndex, stackName] of stackNames.entries()) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
 			if (options.stackRegion) {
@@ -73536,14 +73747,17 @@ async function stateDestroyCommand(stackArgs, options) {
 				const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
 				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Use --stack-region <region> to pick one.`);
 			}
-			for (const ref of targets) {
+			for (const [refIndex, ref] of targets.entries()) {
 				logger.info(`\nPreparing to destroy stack: ${stackName}${ref.region ? ` (${ref.region})` : ""}`);
 				const stateResult = await setup.stateBackend.getState(stackName, ref.region ?? setup.region);
 				if (!stateResult) {
 					logger.warn(`No state found for stack ${stackName}${ref.region ? ` in ${ref.region}` : ""}, skipping`);
 					continue;
 				}
-				if (runInterrupted()) break;
+				if (runInterrupted()) {
+					stoppedEarly = true;
+					break;
+				}
 				const result = await interruptWatch.runStack(() => withNestedStackContext({
 					stateBackend: setup.stateBackend,
 					lockManager: setup.lockManager,
@@ -73586,12 +73800,18 @@ async function stateDestroyCommand(stackArgs, options) {
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
 				if (result.interrupted) interrupted = true;
-				if (runInterrupted()) break;
+				if (runInterrupted()) {
+					if (refIndex < targets.length - 1) stoppedEarly = true;
+					break;
+				}
+			}
+			if (runInterrupted()) {
+				if (targetRemainsAfter(stackIndex)) stoppedEarly = true;
+				break;
 			}
-			if (runInterrupted()) break;
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack>' removes the state record without deleting AWS resources.`);
-		if (runInterrupted()) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
+		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} cdkd could not address, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). Repair the physicalId in state.json and re-run 'cdkd state destroy', or delete the resources by hand and drop the records with 'cdkd state orphan <stack>'.`);
 	} finally {
 		unforwardSigterm();
@@ -76213,6 +76433,7 @@ var AttributeFetcher = class {
 			};
 		}
 		this.logger.warn(`--force: live fetch failed for '${orphanLogicalId}.${attribute}' (${reason}); falling back to cached value from state.attributes.`);
+		if (carriesDynamicReference(cached)) this.logger.warn(`--force: the cached value for '${orphanLogicalId}.${attribute}' is an UNRESOLVED dynamic reference (a nested stack's redacted output, issue #2055). It is being written into the referring resource's state VERBATIM — cdkd cannot re-resolve it from here. Re-run without --force once the live attribute is readable, or fix the referring property by hand.`);
 		const cacheKey = `${orphanLogicalId}\0${attribute}`;
 		this.cache.set(cacheKey, cached);
 		return {
@@ -87873,4 +88094,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CrJMVg4e.js.map
+//# sourceMappingURL=program-alOnKpLV.js.map