@go-to-k/cdkd 0.294.13 → 0.295.0

package/dist/{program-DyHae7kQ.js → program-Cbxe8TgI.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-B46YMG0h.js";
-import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
+import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as STATE_SOURCED_READBACK_RULES, $n as explicitRoleArnOrThrow, $o as runDockerForeground, $r as malformedOutputsWarning, $t as noEchoParameterValueSeed, Aa as printingCorpusOf, Ai as repairMalformedOrphanRecordsForReadOnly, An as ccProtectionRegistryTypes, Ao as assertAssetBucketRegion, Ar as STATE_REGION_DIVERGED, As as derivePartitionAndUrlSuffix, At as ccRoutedFinalSnapshotError, Ba as scrubResourceRecord, Bo as resolveDockerContextDirectory, Br as isReadableResourceEntry, Bs as describeFileReadFailure, Bt as updatePartialMessage, C as perType, Ca as inheritNestedStackParameterAssociations, Ci as refuseMalformedResourcePropertiesForDrift, Cn as ProviderRegistry, Co as WorkGraph, Cr as isStalePlaceholderArnAttribute, Cs as findLargeInlineResources, Ct as resolveReplacementOldType, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Do as rewriteTemplateAssetReferences, Dr as parameterInputsFor, Ds as expectedOwnerParam, Dt as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as createUnionSecretMasker, Ei as refuseMalformedResourcesForDeploy, En as isCustomResourceType$1, Eo as loadPublishableAssetManifest, Er as withSharedDrainBudget, Es as decodeListingKey, Et as inheritProducerRegions, Fa as errorCauseChain, Fi as repairMalformedResourcesForReadOnly, Fo as readBootstrapMarkerBody, Fr as displayLogicalId, Fs as hasOwnKey, Ft as unsupportedFinalSnapshotError, G as cyan, Ga as pathCrossesDottedKey, Gi as findReplacedReadersOfRecreateTargets, Gn as INTRINSIC_KEYS, Go as finchSecretArgvRefusal, Gr as malformedLocalResourceEntriesWarning, Gs as resolveBucketRegion, Gt as WITHHELD_NAME_DISPLAY, H as formatResourceLine, Ha as DYNAMIC_REFERENCE_TOKEN_SCAN, Ho as describeDockerExecFailure, Hr as malformedExportNamesWarning, Hs as renderAssemblyPathEscape, Ht as DeploymentEventsReader, Ia as maskSecretsInError, Ii as unpreviewableOrphanRecords, In as isWaitAbandonedError, Io as validateAssetBucketName, Ir as hasReadableOrphans, Is as hasPlainPrototype, J as red, Ja as recordMaskOnlyValue, Ji as isStatefulRecreateTargetForReplace, Jn as producerRegionsFromState, Jo as isDockerClientEnvKey, Jr as malformedOrphanRecordsWarning, Jt as secretBearing, K as gray, Ka as identityKeyFor, Ki as shownType, Kn as IntrinsicFunctionResolver, Ko as formatDockerLoginError, Kr as malformedLocalResourcesWarning, Kt as displayTextOrWithheld, La as maskSecretsInText, Li as unreadableOrphanRecords, Lo as validateContainerRepoName, Lr as hasReadableOutputs, Ls as nullPrototypeRecord, Ma as recordLogOnlyValue, Mi as repairMalformedOutputsForReadOnly, Mn as UNSPECIFIED_SKIP_REASON, Mo as getBootstrapMarkerKey, Mr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ms as StageLoadError, Mt as effectiveDeletionPolicy, Na as shareLogOnlyValues, Ni as repairMalformedResourceEntriesForReadOnly, Nn as deleteIndeterminateGuards, No as isCrossRegionRedirect, Nr as UNREADABLE_RESOURCES_MAP_ROW, Ns as processStackMessages, Nt as isFinalSnapshotError, Oa as literalSplitDelimitersOf, Oi as refuseMalformedResourcesForExport, On as CloudControlProvider, Oo as AssetModeResolver, Os as PARTITION_TABLE, Ot as PRE_DELETE_SNAPSHOT_TYPES, Pa as createSecretMasker, Pi as repairMalformedResourcePropertiesForReadOnly, Pn as deleteSkipReason, Po as parseBootstrapMarker, Pr as deployRefusesOrphanRowsReason, Ps as defineOwnKey, Pt as refusesFinalSnapshot, Q as reachableDivergentParameters, Qa as STATE_SOURCED_CROSS_GENERATION_RULES, Qn as assertSendableRoleArn, Qo as redactedDockerCause, Qr as malformedOutputsRefusalMessage, Qt as isWholeDynamicReferenceValue, Ra as markSameGenerationBag, Ri as unreadableResourceEntries, Ro as buildDenyExternalAccessPolicy, Rr as hasReadableResources, Rs as ownValue, S as isProtectionValueActive, Sa as liveMatchesUnresolvedTokenFrame, Si as refuseMalformedResourceEntriesForOrphan, Sn as CC_BROKEN_REASON, So as stringifyValue, Sr as cfnRefValueFromPhysicalId, Ss as MIGRATE_TMP_PREFIX, St as planRollback, Ta as carryLogOnlyValues, Ti as refuseMalformedResourcePropertiesForOrphan, Tn as wouldReturnToSdkProvider, To as createAssetRedirectResolver, Ts as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, U as createReadOnlyAttributeHealerFactory, Ua as dynamicReferenceTokens, Ui as NO_CC_HANDLERS_REASON, Uo as describeDockerFailure, Ur as malformedExportSourceWarning, Us as resolveAssemblyPath, Ut as DeploymentEventsStore, Vi as unwrittenCreateOnlyReplacement, Vo as describeDockerCapturedOutput, Vr as malformedDriftResourcePropertiesWarning, Vs as displayAssemblyPath, Vt as updatePartialReason, W as bold, Wa as isUncertifiedBaselineMaskPosition, Wi as hasNoCloudControlHandlers, Wn as DiffCalculator, Wo as dockerSpawnEnvWithSensitive, Wr as malformedLocalOutputsWarning, Wt as extractDeploymentEventError, X as computeParameterTaint, Xa as recordNoEchoAttributeValues, Xi as renderStatefulReason, Xn as applyRoleArnIfSet, Xo as partitionSensitiveEnv, Xr as malformedOrphansRefusalMessage, Xt as secretSafeKeyDisplay, Y as yellow, Ya as recordMaskOnlyValuesIn, Yi as isStatefulRecreateTargetSync, Yn as regionLessSecretName, Yo as isMalformedEnvKey, Yr as malformedOrphanRowsKeptWarning, Yt as secretBearingStateKeyWarning, Z as namesAnyDeclaredParameter, Za as STATE_SOURCED_BASELINE_RULES, Zn as assertFlagRoleArn, Zo as redactDockerArgvValues, Zr as malformedOrphansWarning, Zt as exportNameSecretExposure, _ as makeCanonicalizePropertiesFn, _i as refuseMalformedResourceEntries, _o as orphansAfterRollback, _r as carriesDynamicReference, _s as stateBucketExistenceConfirmed, _t as destroyStackRecordsView, a as findNestedTemplateTreeDefect, ai as malformedStateRefusalMessage, an as DEFAULT_RESOURCE_WARN_AFTER_MS, ao as S3StateBackend, ar as envCredentialsAreAssumedRole, as as getDockerImageBySourceHash, at as dropSettledNestedJournals, b as recordedProtectionNote, ba as DagBuilder, bi as refuseMalformedResourceEntriesForImport, bo as AssetPublisher, br as keepsSecretReferenceToken, bs as CFN_TEMPLATE_BODY_LIMIT, bt as recordAfterRollbackUpdate, c as renderNestedTemplateTreeDefect, co as acceptedCreateOnlyDropsOf, cs as getDefaultStateBucketName, ct as recordDisplacedSkips, d as conditionInputsFrom, di as refuseMalformedOrphans, dn as withCreateTokenLedger, do as hasReadableExportSet, ds as resolveAutoAssetStorage, dt as withNestedRevertRun, ei as malformedRenderedContainersWarning, en as collectDeclaredOutputNames, eo as TEMPLATE_SOURCED_RULES, er as isIamRoleArn, es as runDockerStreaming, et as makeSiblingClaimReader, f as parentSuppliedValues, fa as prefetchCreateOnlyPropertyPaths, fi as refuseMalformedOrphansForDestroy, fo as hasReasonlessBaselineRefusal, fr as coerceParameterTypedValue, fs as resolveCaptureObservedState, g as mergeNoChangeOutputs, gi as refuseMalformedResourceAttributesForOrphan, go as isReadableBag, gr as isImpossibleEmptyStoredAttribute, gs as resolveUseCdkBootstrapAssets, h as keptWholeReasonText, ha as withRetry, hi as refuseMalformedOutputsForDestroy, ho as importableOutputs, hr as getAccountInfo, hs as resolveStateBucketWithDefaultAndSource, ht as replayRollback, i as childTemplateLoader, ii as malformedScrubResourceEntriesRefusalMessage, in as DEFAULT_RESOURCE_TIMEOUT_MS, io as isLockInfoExpired, ir as callerEnvCredentials, is as AssetManifestLoader, it as displacedPhysicalIdShown, ja as recordLogOnlyParameterValue, ji as repairMalformedOrphansForReadOnly, jo as ensureAssetStorage, jr as STATE_RESOURCES_MALFORMED, js as AssemblyReader, jt as createPreDeleteFinalSnapshot, ka as logOnlyValueCount, ki as refuseMalformedState, kn as slowCcOperationTimeoutMs, ko as BOOTSTRAP_MARKER_PREFIX, kr as JSON_LISTING_HOLE_VALUE, ks as canonicalizeRegion, kt as buildFinalSnapshotIdentifier, l as templateIdentity, li as refuseMalformedOrphanRecords, ln as ledgerForStack, lo as describeRegionValueKind, ls as getLegacyStateBucketName, m as isSecretBearingReferenceString, ma as describeTypeWithThrottleRetry, mi as refuseMalformedOutputs, mo as importableOutputKeys, mr as parameterTypeMayLoseSecretIdentity, ms as resolveStateBucketWithDefault, mt as replayFailedOperations, n as IMPLICIT_DELETE_DEPENDENCIES, ni as malformedResourcePropertiesWarning, nn as isExportAliasCollision, no as isSingleDynamicReferenceToken, nr as AWS_CREDENTIAL_ENV_KEYS, ns as escapeRegExp, nt as NESTED_PENDING_PARENT_REASON, o as isAbsoluteAssetPath, oi as previewableOrphanRecords, on as maskingRetryLogger, oo as rebuildClientForBucketRegion, os as Synthesizer, p as readRecordedConditionVerdicts, pa as templateResourceTypes, pi as refuseMalformedOrphansForOrphan, po as hasUnverifiableParameterRefusal, pr as isUnboundTemplateParameter, ps as resolveSkipPrefix, pt as withNestedStackContext, q as green, qa as carriesSecretMask, qi as MULTI_REGION_RECREATE_BLOCKED_TYPES, qn as classifyReplaySecretRegion, qo as getDockerCmd, qr as malformedOrphanRecordsRefusalMessage, qt as exportAliasCollisionScrubWarning, r as computeImplicitDeleteEdges, ri as malformedResourcesWarning, rn as bindingSkippedOutputs, ro as LockManager, rr as applyCallerIdentityCredentials, rs as stripControlChars, rt as displacedOpClause, s as listNestedTemplateRows, si as refuseDivergentRecordRegionForDestroy, sn as RollbackInlinePolicyWriters, so as splitImportedOps, ss as synthesisStatusMessage, st as nestedChildStackName$1, t as DeployEngine, ti as malformedResourceEntriesWarning, tn as collectPublishedOutputNames, to as WHOLE_DYNAMIC_REFERENCE_PATTERN, tr as sendableAssumeRoleCommand, ts as warnFinchArgvExposure, tt as planOrphanAdoption, u as conditionFingerprint, ui as refuseMalformedOrphanRecordsForDestroy, uo as exportNamesCarriedFrom, us as resolveApp, ut as revertedNestedRowIds, v as withResourceDeadline, vi as refuseMalformedResourceEntriesForDeploy, vo as orphansCarriedFrom, vr as carriesFetchableDynamicReference, vs as warnDeprecatedNoPrefixCliFlag, w as readProtection, wa as recordNestedStackParameterExpressions, wi as refuseMalformedResourcePropertiesForExport, wn as ccBrokenReason, wo as buildAssetRedirectMap, wr as refStateLookupFromResource, ws as uploadCfnTemplate, wt as findNestedStackTypeChanges, x as PROTECTION_PROPERTY_BY_TYPE, xa as TemplateParser, xi as refuseMalformedResourceEntriesForImportSave, xo as isSensitiveAttributeName, xr as AWS_NO_VALUE, xs as CFN_TEMPLATE_URL_LIMIT, xt as planFailedOps, y as recordedProtectionEvidence, yi as refuseMalformedResourceEntriesForDestroy, yo as shouldRetainResource, yr as isNamelessDynamicReferenceError, ys as ssmResolvedValueType, yt as withStackRecords, za as redactSecretsForState, zi as findActionableSilentDrops, zo as buildDockerImage, zr as isReadableOrphanRecord, zs as absoluteAssemblyPathEscape } from "./deploy-engine-BiA8Ud6-.js";
-import { t as getCdkdVersion } from "./version-CKLiAWMw.js";
+import { $ as resourcesNamingDeclaredParameter, $a as wholeStringLeavesOf, $n as explicitRoleArnOrThrow, $o as partitionSensitiveEnv, $r as malformedOutputsWarning, $t as noEchoParameterValueSeed, Aa as printingCorpusOf, Ai as repairMalformedOrphanRecordsForReadOnly, An as ccProtectionRegistryTypes, Ao as rewriteTemplateAssetReferences, Ar as STATE_REGION_DIVERGED, As as expectedOwnerParam, At as ccRoutedFinalSnapshotError, Ba as scrubResourceRecord, Bo as validateContainerRepoName, Br as isReadableResourceEntry, Bs as nullPrototypeRecord, Bt as updatePartialMessage, C as perType, Ca as inheritNestedStackParameterAssociations, Ci as refuseMalformedResourcePropertiesForDrift, Cn as ProviderRegistry, Co as AssetPublisher, Cr as isStalePlaceholderArnAttribute, Cs as CFN_TEMPLATE_BODY_LIMIT, Ct as resolveReplacementOldType, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Do as buildAssetRedirectMap, Dr as parameterInputsFor, Ds as uploadCfnTemplate, Dt as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as createUnionSecretMasker, Ei as refuseMalformedResourcesForDeploy, En as isCustomResourceType$1, Eo as WorkGraph, Er as withSharedDrainBudget, Es as findLargeInlineResources, Et as inheritProducerRegions, Fa as errorCauseChain, Fi as repairMalformedResourcesForReadOnly, Fo as getBootstrapMarkerKey, Fr as displayLogicalId, Fs as StageLoadError, Ft as unsupportedFinalSnapshotError, G as cyan, Ga as pathCrossesDottedKey, Gi as findReplacedReadersOfRecreateTargets, Gn as INTRINSIC_KEYS, Go as describeDockerExecFailure, Gr as malformedLocalResourceEntriesWarning, Gs as renderAssemblyPathEscape, Gt as WITHHELD_NAME_DISPLAY, H as formatResourceLine, Ha as DYNAMIC_REFERENCE_TOKEN_SCAN, Ho as buildDockerImage, Hr as malformedExportNamesWarning, Hs as absoluteAssemblyPathEscape, Ht as DeploymentEventsReader, Ia as maskSecretsInError, Ii as unpreviewableOrphanRecords, In as isWaitAbandonedError, Io as isCrossRegionRedirect, Ir as hasReadableOrphans, Is as processStackMessages, J as red, Ja as provenPublicValue, Ji as isStatefulRecreateTargetForReplace, Jn as producerRegionsFromState, Jo as finchSecretArgvRefusal, Jr as malformedOrphanRecordsWarning, Js as resolveBucketRegion, Jt as secretBearing, K as gray, Ka as identityKeyFor, Ki as shownType, Kn as IntrinsicFunctionResolver, Ko as describeDockerFailure, Kr as malformedLocalResourcesWarning, Ks as resolveAssemblyPath, Kt as displayTextOrWithheld, La as maskSecretsInText, Li as unreadableOrphanRecords, Lo as parseBootstrapMarker, Lr as hasReadableOutputs, Ls as defineOwnKey, Ma as recordLogOnlyValue, Mi as repairMalformedOutputsForReadOnly, Mn as UNSPECIFIED_SKIP_REASON, Mo as BOOTSTRAP_MARKER_PREFIX, Mr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ms as canonicalizeRegion, Mt as effectiveDeletionPolicy, Na as shareLogOnlyValues, Ni as repairMalformedResourceEntriesForReadOnly, Nn as deleteIndeterminateGuards, No as assertAssetBucketRegion, Nr as UNREADABLE_RESOURCES_MAP_ROW, Ns as derivePartitionAndUrlSuffix, Nt as isFinalSnapshotError, Oa as literalSplitDelimitersOf, Oi as refuseMalformedResourcesForExport, On as CloudControlProvider, Oo as createAssetRedirectResolver, Os as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ot as PRE_DELETE_SNAPSHOT_TYPES, Pa as createSecretMasker, Pi as repairMalformedResourcePropertiesForReadOnly, Pn as deleteSkipReason, Po as ensureAssetStorage, Pr as deployRefusesOrphanRowsReason, Ps as AssemblyReader, Pt as refusesFinalSnapshot, Q as reachableDivergentParameters, Qa as recordProvenPublicExpression, Qn as assertSendableRoleArn, Qo as isMalformedEnvKey, Qr as malformedOutputsRefusalMessage, Qt as isWholeDynamicReferenceValue, Ra as markSameGenerationBag, Ri as unreadableResourceEntries, Ro as readBootstrapMarkerBody, Rr as hasReadableResources, Rs as hasOwnKey, S as isProtectionValueActive, Sa as liveMatchesUnresolvedTokenFrame, Si as refuseMalformedResourceEntriesForOrphan, Sn as CC_BROKEN_REASON, So as shouldRetainResource, Sr as cfnRefValueFromPhysicalId, Ss as ssmResolvedValueType, St as planRollback, Ta as carryLogOnlyValues, Ti as refuseMalformedResourcePropertiesForOrphan, Tn as wouldReturnToSdkProvider, To as stringifyValue, Ts as MIGRATE_TMP_PREFIX, U as createReadOnlyAttributeHealerFactory, Ua as dynamicReferenceTokens, Ui as NO_CC_HANDLERS_REASON, Uo as resolveDockerContextDirectory, Ur as malformedExportSourceWarning, Us as describeFileReadFailure, Ut as DeploymentEventsStore, Vi as unwrittenCreateOnlyReplacement, Vo as buildDenyExternalAccessPolicy, Vr as malformedDriftResourcePropertiesWarning, Vs as ownValue, Vt as updatePartialReason, W as bold, Wa as isUncertifiedBaselineMaskPosition, Wi as hasNoCloudControlHandlers, Wn as DiffCalculator, Wo as describeDockerCapturedOutput, Wr as malformedLocalOutputsWarning, Ws as displayAssemblyPath, Wt as extractDeploymentEventError, X as computeParameterTaint, Xa as recordMaskOnlyValuesIn, Xi as renderStatefulReason, Xn as applyRoleArnIfSet, Xo as getDockerCmd, Xr as malformedOrphansRefusalMessage, Xt as secretSafeKeyDisplay, Y as yellow, Ya as recordMaskOnlyValue, Yi as isStatefulRecreateTargetSync, Yn as regionLessSecretName, Yo as formatDockerLoginError, Yr as malformedOrphanRowsKeptWarning, Yt as secretBearingStateKeyWarning, Z as namesAnyDeclaredParameter, Za as recordNoEchoAttributeValues, Zn as assertFlagRoleArn, Zo as isDockerClientEnvKey, Zr as malformedOrphansWarning, Zt as exportNameSecretExposure, _ as makeCanonicalizePropertiesFn, _i as refuseMalformedResourceEntries, _o as importableOutputKeys, _r as carriesDynamicReference, _s as resolveStateBucketWithDefault, _t as destroyStackRecordsView, a as findNestedTemplateTreeDefect, ai as malformedStateRefusalMessage, an as DEFAULT_RESOURCE_WARN_AFTER_MS, ao as isSingleDynamicReferenceToken, ar as envCredentialsAreAssumedRole, as as escapeRegExp, at as dropSettledNestedJournals, b as recordedProtectionNote, ba as DagBuilder, bi as refuseMalformedResourceEntriesForImport, bo as orphansAfterRollback, br as keepsSecretReferenceToken, bs as stateBucketExistenceConfirmed, bt as recordAfterRollbackUpdate, c as renderNestedTemplateTreeDefect, co as S3StateBackend, cs as getDockerImageBySourceHash, ct as recordDisplacedSkips, d as conditionInputsFrom, di as refuseMalformedOrphans, dn as withCreateTokenLedger, do as acceptedCreateOnlyDropsOf, ds as getDefaultStateBucketName, dt as withNestedRevertRun, ei as malformedRenderedContainersWarning, en as collectDeclaredOutputNames, eo as STATE_SOURCED_BASELINE_RULES, er as isIamRoleArn, es as redactDockerArgvValues, et as makeSiblingClaimReader, f as parentSuppliedValues, fa as prefetchCreateOnlyPropertyPaths, fi as refuseMalformedOrphansForDestroy, fo as describeRegionValueKind, fr as coerceParameterTypedValue, fs as getLegacyStateBucketName, g as mergeNoChangeOutputs, gi as refuseMalformedResourceAttributesForOrphan, go as hasUnverifiableParameterRefusal, gr as isImpossibleEmptyStoredAttribute, gs as resolveSkipPrefix, h as keptWholeReasonText, ha as withRetry, hi as refuseMalformedOutputsForDestroy, ho as hasReasonlessBaselineRefusal, hr as getAccountInfo, hs as resolveCaptureObservedState, ht as replayRollback, i as childTemplateLoader, ii as malformedScrubResourceEntriesRefusalMessage, in as DEFAULT_RESOURCE_TIMEOUT_MS, io as WHOLE_DYNAMIC_REFERENCE_PATTERN, ir as callerEnvCredentials, is as warnFinchArgvExposure, it as displacedPhysicalIdShown, ja as recordLogOnlyParameterValue, ji as repairMalformedOrphansForReadOnly, jo as AssetModeResolver, jr as STATE_RESOURCES_MALFORMED, js as PARTITION_TABLE, jt as createPreDeleteFinalSnapshot, ka as logOnlyValueCount, ki as refuseMalformedState, kn as slowCcOperationTimeoutMs, ko as loadPublishableAssetManifest, kr as JSON_LISTING_HOLE_VALUE, ks as decodeListingKey, kt as buildFinalSnapshotIdentifier, l as templateIdentity, li as refuseMalformedOrphanRecords, ln as ledgerForStack, lo as rebuildClientForBucketRegion, ls as Synthesizer, m as isSecretBearingReferenceString, ma as describeTypeWithThrottleRetry, mi as refuseMalformedOutputs, mo as hasReadableExportSet, mr as parameterTypeMayLoseSecretIdentity, ms as resolveAutoAssetStorage, mt as replayFailedOperations, n as IMPLICIT_DELETE_DEPENDENCIES, ni as malformedResourcePropertiesWarning, nn as isExportAliasCollision, no as STATE_SOURCED_READBACK_RULES, nr as AWS_CREDENTIAL_ENV_KEYS, ns as runDockerForeground, nt as NESTED_PENDING_PARENT_REASON, o as isAbsoluteAssetPath, oi as previewableOrphanRecords, on as maskingRetryLogger, oo as LockManager, os as stripControlChars, p as readRecordedConditionVerdicts, pa as templateResourceTypes, pi as refuseMalformedOrphansForOrphan, po as exportNamesCarriedFrom, pr as isUnboundTemplateParameter, ps as resolveApp, pt as withNestedStackContext, q as green, qa as carriesSecretMask, qi as MULTI_REGION_RECREATE_BLOCKED_TYPES, qn as classifyReplaySecretRegion, qo as dockerSpawnEnvWithSensitive, qr as malformedOrphanRecordsRefusalMessage, qt as exportAliasCollisionScrubWarning, r as computeImplicitDeleteEdges, ri as malformedResourcesWarning, rn as bindingSkippedOutputs, ro as TEMPLATE_SOURCED_RULES, rr as applyCallerIdentityCredentials, rs as runDockerStreaming, rt as displacedOpClause, s as listNestedTemplateRows, si as refuseDivergentRecordRegionForDestroy, sn as RollbackInlinePolicyWriters, so as isLockInfoExpired, ss as AssetManifestLoader, st as nestedChildStackName$1, t as DeployEngine, ti as malformedResourceEntriesWarning, tn as collectPublishedOutputNames, to as STATE_SOURCED_CROSS_GENERATION_RULES, tr as sendableAssumeRoleCommand, ts as redactedDockerCause, tt as planOrphanAdoption, u as conditionFingerprint, ui as refuseMalformedOrphanRecordsForDestroy, uo as splitImportedOps, us as synthesisStatusMessage, ut as revertedNestedRowIds, v as withResourceDeadline, vi as refuseMalformedResourceEntriesForDeploy, vo as importableOutputs, vr as carriesFetchableDynamicReference, vs as resolveStateBucketWithDefaultAndSource, w as readProtection, wa as recordNestedStackParameterExpressions, wi as refuseMalformedResourcePropertiesForExport, wn as ccBrokenReason, wo as isSensitiveAttributeName, wr as refStateLookupFromResource, ws as CFN_TEMPLATE_URL_LIMIT, wt as findNestedStackTypeChanges, x as PROTECTION_PROPERTY_BY_TYPE, xa as TemplateParser, xi as refuseMalformedResourceEntriesForImportSave, xo as orphansCarriedFrom, xr as AWS_NO_VALUE, xs as warnDeprecatedNoPrefixCliFlag, xt as planFailedOps, y as recordedProtectionEvidence, yi as refuseMalformedResourceEntriesForDestroy, yo as isReadableBag, yr as isNamelessDynamicReferenceError, ys as resolveUseCdkBootstrapAssets, yt as withStackRecords, za as redactSecretsForState, zi as findActionableSilentDrops, zo as validateAssetBucketName, zr as isReadableOrphanRecord, zs as hasPlainPrototype } from "./deploy-engine-CuI_h_Ml.js";
+import { t as getCdkdVersion } from "./version-CMMITJVg.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2362,7 +2362,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DBap0t3K.js");
+	providerClasses ??= import("./provider-classes-DiWFkAOH.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -5474,6 +5474,7 @@ async function repairExportIndexForStack(store, stackName, producerRegion, outpu
 		if (finding.kind !== "converge") continue;
 		const entry = entries.get(finding.exportName);
 		if (!entry) throw new ScrubIndexInvariantError("exports index repair: a planned entry is absent from the snapshot it was planned from");
+		opts.onWriteAttempt?.();
 		if (!await store.patchEntry(finding.exportName, {
 			...entry,
 			value: finding.stateValue
@@ -5487,6 +5488,56 @@ async function repairExportIndexForStack(store, stackName, producerRegion, outpu
 		unwritten
 	};
 }
+const SCRUBBED_STATE_OBJECT_DESCRIPTION = "the stack's earlier state.json versions, which may hold a plaintext secret";
+const SCRUBBED_EXPORT_INDEX_OBJECT_DESCRIPTION = "the region's pre-scrub exports index, which may hold the plaintext secret scrub rewrote";
+function scrubbedStateKey(backend, stackName, region) {
+	return `${backend.prefix}/${stackName}/${region}/state.json`;
+}
+function scrubbedLegacyStateKey(backend, stackName) {
+	return `${backend.prefix}/${stackName}/state.json`;
+}
+function stateHistoryKeys(backend, stackName, region, migrationPending) {
+	return [scrubbedStateKey(backend, stackName, region), ...migrationPending ? [scrubbedLegacyStateKey(backend, stackName)] : []];
+}
+function scrubbedExportIndexKey(backend, region) {
+	return `${backend.prefix}/_index/${region}/exports.json`;
+}
+function wasRetriedBySdk(err) {
+	let current = err;
+	for (let depth = 0; depth < 8 && typeof current === "object" && current !== null; depth++) {
+		const attempts = current.$metadata?.attempts;
+		if (typeof attempts === "number" && attempts > 1) return true;
+		current = current.cause;
+	}
+	return false;
+}
+async function saveScrubbedState(stateBackend, stackName, region, state, loaded) {
+	let mayHaveWritten = false;
+	try {
+		try {
+			await stateBackend.saveState(stackName, region, state, {
+				expectedEtag: loaded.etag,
+				...loaded.migrationPending && { migrateLegacy: true }
+			});
+		} catch (err) {
+			mayHaveWritten = isAmbiguousOutcomeError(err) || wasRetriedBySdk(err);
+			throw err;
+		}
+		mayHaveWritten = true;
+		if (loaded.migrationPending) {
+			const legacyKey = scrubbedLegacyStateKey(stateBackend, stackName);
+			let survives;
+			try {
+				survives = await stateBackend.getRawObject(legacyKey) !== null;
+			} catch (err) {
+				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${err instanceof Error ? err.message : String(err)}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
+			}
+			if (survives) throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but its legacy key ${legacyKey} could not be deleted and still holds the ` + "pre-scrub record as its CURRENT object. Delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes.", "SCRUB_LEGACY_STATE_KEY_SURVIVES");
+		}
+	} finally {
+		if (mayHaveWritten) await stateBackend.purgeNoncurrentVersions(stateHistoryKeys(stateBackend, stackName, region, loaded.migrationPending), { objectDescription: SCRUBBED_STATE_OBJECT_DESCRIPTION });
+	}
+}
 const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 function readNestedChildTemplate$1(templatePath) {
 	let template;
@@ -5586,6 +5637,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 		return changed > 0 || unmatched.length > 0 ? {
 			state: loaded.state,
 			etag: loaded.etag,
+			migrationPending: loaded.migrationPending,
 			attributes,
 			changed,
 			unmatched
@@ -5603,7 +5655,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 		if (!locked) return none;
 		if (locked.changed > 0) {
 			const row = locked.state.resources[parentRow.logicalId];
-			await stateBackend.saveState(parentRow.stackName, region, {
+			await saveScrubbedState(stateBackend, parentRow.stackName, region, {
 				...locked.state,
 				resources: {
 					...locked.state.resources,
@@ -5613,7 +5665,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 					}
 				},
 				lastModified: Date.now()
-			}, { expectedEtag: locked.etag });
+			}, locked);
 		}
 		return {
 			changed: locked.changed,
@@ -5770,11 +5822,13 @@ async function scrubCommand(stacks, options) {
 	};
 	const examinedIndexNames = /* @__PURE__ */ new Map();
 	let totalIndexEntriesConverged = 0;
+	const historyPurgedStacks = /* @__PURE__ */ new Set();
 	let totalIndexEntriesAbsent = 0;
 	let totalIndexEntriesAbsentWithSecret = 0;
 	let totalIndexEntriesUnexamined = 0;
 	const indexUnwritten = [];
 	const indexUnreadable = [];
+	const indexRegionsWritten = /* @__PURE__ */ new Set();
 	const work = targetStacks.map((stack) => ({
 		stackName: stack.stackName,
 		region: stack.region || region,
@@ -5796,6 +5850,7 @@ async function scrubCommand(stacks, options) {
 			scrubbedStack = stack;
 			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
 				dryRun: options.dryRun ?? false,
+				purgeHistory: options.purgeHistory ?? false,
 				roleArn: options.roleArn,
 				logger,
 				appStacks: allStacks,
@@ -5829,7 +5884,10 @@ async function scrubCommand(stacks, options) {
 		let indexConverged = 0;
 		let indexAbsentWithSecret = 0;
 		try {
-			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stackName, stackRegion, scrubbed.outputs, { dryRun: options.dryRun ?? false });
+			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stackName, stackRegion, scrubbed.outputs, {
+				dryRun: options.dryRun ?? false,
+				onWriteAttempt: () => indexRegionsWritten.add(stackRegion)
+			});
 			const seen = examinedIndexNames.get(stackRegion) ?? /* @__PURE__ */ new Set();
 			for (const name of repair.examined) seen.add(name);
 			examinedIndexNames.set(stackRegion, seen);
@@ -5886,6 +5944,7 @@ async function scrubCommand(stacks, options) {
 			if (!failures.some((f) => f.stackName === label)) failures.push({ stackName: label });
 			logger.error(safeMsg`Scrub of ${displayStackName(item.parentRow.stackName)}'s nested-stack output attributes for ${shownStack} failed: ${describeFailure(err)}`);
 		}
+		if (scrubbed.historyPurged) historyPurgedStacks.add(stackName);
 		if (scrubbed.recordsChanged > 0) {
 			if (!rewrittenStacks.has(stackName)) totalStacksScrubbed++;
 			rewrittenStacks.add(stackName);
@@ -5915,6 +5974,11 @@ async function scrubCommand(stacks, options) {
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${shownStack} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
+	for (const indexRegion of indexRegionsWritten) await stateBackend.purgeNoncurrentVersions([scrubbedExportIndexKey(stateBackend, indexRegion)], { objectDescription: SCRUBBED_EXPORT_INDEX_OBJECT_DESCRIPTION });
+	const historyNote = () => {
+		const purgedOnly = [...historyPurgedStacks].filter((n) => !rewrittenStacks.has(n)).length;
+		return purgedOnly > 0 ? ` --purge-history: on a VERSIONED state bucket, the earlier state.json versions of ${purgedOnly} examined record(s) scrub did not rewrite were purged too, unless a warning above says otherwise.` : "";
+	};
 	for (const [indexRegion, store] of exportIndexStores) {
 		if (indexUnreadable.some((u) => u.region === indexRegion)) continue;
 		let entries;
@@ -5938,10 +6002,10 @@ async function scrubCommand(stacks, options) {
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalStacksWithUnrepairedReadNames === 0 && totalStacksWithReadOutputKeys === 0 && totalIndexEntriesAbsentWithSecret === 0 && droppedReadersUnverifiedStacks.length === 0 && totalParentAttributesUnmatched === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
-			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+			logger.info(safeMsg`\nNo plaintext secrets found in any target stack state. Nothing to scrub.${historyNote()}`);
 			return;
 		}
-		logger.info(`\nNo plaintext secrets found in the ${work.length - failures.length} stack(s) this run could examine. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.`);
+		logger.info(`\nNo plaintext secrets found in the ${work.length - failures.length} stack(s) this run could examine. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.${historyNote()}`);
 		throw scrubStacksFailedError(failures);
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
@@ -5953,7 +6017,7 @@ async function scrubCommand(stacks, options) {
 	const parentAttributeNote = totalParentAttributesUnmatched > 0 ? ` ${totalParentAttributesUnmatched} nested-stack output attribute(s) in a parent record hold a plaintext scrub could NOT match to its child's output — see the warnings above.` : "";
 	const indexNote = (() => {
 		const parts = [];
-		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
+		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value, and on a VERSIONED bucket the index's earlier versions were purged, unless a warning above says otherwise.`);
 		if (totalIndexEntriesAbsent > 0) parts.push(` ${totalIndexEntriesAbsent} exports index entr${totalIndexEntriesAbsent === 1 ? "y is" : "ies are"} published by a scrubbed stack under a name its state.outputs does not carry; nothing was written for ${totalIndexEntriesAbsent === 1 ? "it" : "them"} — redeploy that producer.`);
 		if (totalIndexEntriesAbsentWithSecret > 0) parts.push(` ${totalIndexEntriesAbsentWithSecret === 1 ? "One such entry still holds" : `${totalIndexEntriesAbsentWithSecret} such entries still hold`} a secret this run recorded — see the warnings above.`);
 		if (totalIndexEntriesUnexamined > 0) parts.push(` ${totalIndexEntriesUnexamined} exports index entr${totalIndexEntriesUnexamined === 1 ? "y" : "ies"} belong to producers outside this run and were NOT examined.`);
@@ -5970,8 +6034,8 @@ async function scrubCommand(stacks, options) {
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which bootstrapping with cdkd enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote}`);
-	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The rewritten state.json no longer holds the plaintext, and on a VERSIONED state bucket its earlier versions were purged, unless a warning above says otherwise. A value that was ever persisted must still be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any copy cdkd cannot reach harmless.${historyNote()}${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${historyNote()}${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
@@ -6947,6 +7011,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (unverifiableLeaves > 0) logger.warn(abandonedScanStackNote("count", unverifiableLeaves));
 		if (ungateableAbandonedScans > 0) logger.warn(abandonedScanStackNote("warn", ungateableAbandonedScans));
 	};
+	const purgeExaminedHistory = async (migrationPending) => {
+		if (opts.dryRun || !opts.purgeHistory) return {};
+		await stateBackend.purgeNoncurrentVersions(stateHistoryKeys(stateBackend, stack.stackName, region, migrationPending), { objectDescription: SCRUBBED_STATE_OBJECT_DESCRIPTION });
+		return { historyPurged: true };
+	};
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -7326,6 +7395,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (totalSecrets === 0) {
 			emitAbandonedScanNotes();
 			return {
+				...await purgeExaminedHistory(loaded.migrationPending),
 				recordsChanged: 0,
 				secretsFound: 0,
 				secretBearingKeys: secretBearingKeys.length,
@@ -7483,9 +7553,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				...newExportNames !== state.exportNames && { exportNames: newExportNames },
 				lastModified: Date.now()
 			};
-			await stateBackend.saveState(stack.stackName, region, nextState, { expectedEtag: loaded.etag });
+			await saveScrubbedState(stateBackend, stack.stackName, region, nextState, loaded);
 		}
 		return {
+			...recordsChanged > 0 ? {} : await purgeExaminedHistory(loaded.migrationPending),
 			recordsChanged,
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
@@ -7520,7 +7591,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	}
 }
 function createScrubCommand() {
-	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path); the nested stacks under each are scrubbed too").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate). Also exits non-zero on a real run when a leak was found that scrub cannot rewrite.");
+	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path); the nested stacks under each are scrubbed too").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").addOption(new Option("--purge-history", "Also purge the earlier S3 versions of every examined stack's state.json, not only the ones scrub rewrites (drops their state-recovery history; a record scrub refuses is never purged)").conflicts("dryRun")).option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate). Also exits non-zero on a real run when a leak was found that scrub cannot rewrite.");
 	[
 		...commonOptions,
 		...appOptions,
@@ -11095,6 +11166,75 @@ function createDestroyCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/deployment/public-ssm-proof.ts
+var PublicSsmProver = class {
+	resolver;
+	verdicts = /* @__PURE__ */ new Map();
+	region;
+	loadEvidence;
+	evidence;
+	logger;
+	constructor(region, loadEvidence, logger) {
+		this.region = region;
+		this.loadEvidence = loadEvidence;
+		this.logger = logger;
+	}
+	async proofBagFor(source) {
+		const bag = /* @__PURE__ */ new Map();
+		for (const token of mixedLeafSsmTokens(source)) {
+			const value = await this.publicValue(token);
+			if (value !== void 0) recordProvenPublicExpression(bag, token, value);
+		}
+		return bag;
+	}
+	publicValue(token) {
+		let verdict = this.verdicts.get(token);
+		if (!verdict) {
+			verdict = this.lookUp(token);
+			this.verdicts.set(token, verdict);
+		}
+		return verdict;
+	}
+	async lookUp(token) {
+		let regions = [];
+		if (regionLessSecretName(token) !== void 0) {
+			this.evidence ??= this.loadEvidence().catch(() => ({
+				regions: [],
+				complete: false
+			}));
+			const evidence = await this.evidence;
+			if (!evidence.complete) return void 0;
+			regions = evidence.regions;
+		}
+		if (classifyReplaySecretRegion(token, this.region, regions).kind !== "local") return;
+		this.resolver ??= new IntrinsicFunctionResolver(this.region);
+		const probe = /* @__PURE__ */ new Map();
+		const context = {
+			template: { Resources: {} },
+			resources: {},
+			recordedSecretValues: probe,
+			skipDynamicReferences: true
+		};
+		try {
+			await this.resolver.resolveDynamicReferences(token, context);
+		} catch (err) {
+			const name = err instanceof Error ? err.name : typeof err;
+			this.logger.debug(safeMsg`Could not prove an ssm dynamic reference public (${name}); a leaf embedding it ` + `keeps its {{resolve:...}} expression in observedProperties.`);
+			return;
+		}
+		return provenPublicValue(probe, token);
+	}
+};
+function mixedLeafSsmTokens(source) {
+	const tokens = /* @__PURE__ */ new Set();
+	for (const leaf of wholeStringLeavesOf(source)) {
+		if (isSingleDynamicReferenceToken(leaf)) continue;
+		for (const token of dynamicReferenceTokens(leaf)) if (token.startsWith("{{resolve:ssm:")) tokens.add(token);
+	}
+	return tokens;
+}
+
 //#endregion
 //#region src/cli/commands/state-migrate.ts
 async function stateMigrateCommand(options) {
@@ -15422,7 +15562,6 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 		setup.dispose();
 	}
 }
-const NO_RECORDED_SECRETS$1 = /* @__PURE__ */ new Map();
 async function warnOnLiveForeignLock(lockManager, stackName, region, logger) {
 	try {
 		const info = await lockManager.getLockInfo(stackName, region);
@@ -15509,6 +15648,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		let notFound = 0;
 		let refusedBaseline = 0;
 		let refusedSticky = 0;
+		const publicSsmProver = new PublicSsmProver(region, () => driftProducerRegionEvidence(state, stackName, region, stateBackend), logger);
 		await withStackName(stackName, async () => {
 			const tasks = entries.map(async ([logicalId, resource]) => {
 				if (resource.observedBaselineRefused === true) {
@@ -15545,7 +15685,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + `not found in AWS — it was deleted outside cdkd; 'cdkd drift' reports it as deleted.`);
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS$1, resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
+					resource.observedProperties = redactSecretsForState(observed, await publicSsmProver.proofBagFor(resource.properties ?? {}), resource.properties ?? {}, STATE_SOURCED_BASELINE_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -26145,4 +26285,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DyHae7kQ.js.map
+//# sourceMappingURL=program-Cbxe8TgI.js.map