@go-to-k/cdkd 0.294.14 → 0.295.1

package/dist/{program-DhvgK2CV.js → program-DfJFegS1.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-B46YMG0h.js";
-import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
+import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as wholeStringLeavesOf, $n as explicitRoleArnOrThrow, $o as partitionSensitiveEnv, $r as malformedOutputsWarning, $t as noEchoParameterValueSeed, Aa as printingCorpusOf, Ai as repairMalformedOrphanRecordsForReadOnly, An as ccProtectionRegistryTypes, Ao as rewriteTemplateAssetReferences, Ar as STATE_REGION_DIVERGED, As as expectedOwnerParam, At as ccRoutedFinalSnapshotError, Ba as scrubResourceRecord, Bo as validateContainerRepoName, Br as isReadableResourceEntry, Bs as nullPrototypeRecord, Bt as updatePartialMessage, C as perType, Ca as inheritNestedStackParameterAssociations, Ci as refuseMalformedResourcePropertiesForDrift, Cn as ProviderRegistry, Co as AssetPublisher, Cr as isStalePlaceholderArnAttribute, Cs as CFN_TEMPLATE_BODY_LIMIT, Ct as resolveReplacementOldType, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Do as buildAssetRedirectMap, Dr as parameterInputsFor, Ds as uploadCfnTemplate, Dt as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as createUnionSecretMasker, Ei as refuseMalformedResourcesForDeploy, En as isCustomResourceType$1, Eo as WorkGraph, Er as withSharedDrainBudget, Es as findLargeInlineResources, Et as inheritProducerRegions, Fa as errorCauseChain, Fi as repairMalformedResourcesForReadOnly, Fo as getBootstrapMarkerKey, Fr as displayLogicalId, Fs as StageLoadError, Ft as unsupportedFinalSnapshotError, G as cyan, Ga as pathCrossesDottedKey, Gi as findReplacedReadersOfRecreateTargets, Gn as INTRINSIC_KEYS, Go as describeDockerExecFailure, Gr as malformedLocalResourceEntriesWarning, Gs as renderAssemblyPathEscape, Gt as WITHHELD_NAME_DISPLAY, H as formatResourceLine, Ha as DYNAMIC_REFERENCE_TOKEN_SCAN, Ho as buildDockerImage, Hr as malformedExportNamesWarning, Hs as absoluteAssemblyPathEscape, Ht as DeploymentEventsReader, Ia as maskSecretsInError, Ii as unpreviewableOrphanRecords, In as isWaitAbandonedError, Io as isCrossRegionRedirect, Ir as hasReadableOrphans, Is as processStackMessages, J as red, Ja as provenPublicValue, Ji as isStatefulRecreateTargetForReplace, Jn as producerRegionsFromState, Jo as finchSecretArgvRefusal, Jr as malformedOrphanRecordsWarning, Js as resolveBucketRegion, Jt as secretBearing, K as gray, Ka as identityKeyFor, Ki as shownType, Kn as IntrinsicFunctionResolver, Ko as describeDockerFailure, Kr as malformedLocalResourcesWarning, Ks as resolveAssemblyPath, Kt as displayTextOrWithheld, La as maskSecretsInText, Li as unreadableOrphanRecords, Lo as parseBootstrapMarker, Lr as hasReadableOutputs, Ls as defineOwnKey, Ma as recordLogOnlyValue, Mi as repairMalformedOutputsForReadOnly, Mn as UNSPECIFIED_SKIP_REASON, Mo as BOOTSTRAP_MARKER_PREFIX, Mr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ms as canonicalizeRegion, Mt as effectiveDeletionPolicy, Na as shareLogOnlyValues, Ni as repairMalformedResourceEntriesForReadOnly, Nn as deleteIndeterminateGuards, No as assertAssetBucketRegion, Nr as UNREADABLE_RESOURCES_MAP_ROW, Ns as derivePartitionAndUrlSuffix, Nt as isFinalSnapshotError, Oa as literalSplitDelimitersOf, Oi as refuseMalformedResourcesForExport, On as CloudControlProvider, Oo as createAssetRedirectResolver, Os as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ot as PRE_DELETE_SNAPSHOT_TYPES, Pa as createSecretMasker, Pi as repairMalformedResourcePropertiesForReadOnly, Pn as deleteSkipReason, Po as ensureAssetStorage, Pr as deployRefusesOrphanRowsReason, Ps as AssemblyReader, Pt as refusesFinalSnapshot, Q as reachableDivergentParameters, Qa as recordProvenPublicExpression, Qn as assertSendableRoleArn, Qo as isMalformedEnvKey, Qr as malformedOutputsRefusalMessage, Qt as isWholeDynamicReferenceValue, Ra as markSameGenerationBag, Ri as unreadableResourceEntries, Ro as readBootstrapMarkerBody, Rr as hasReadableResources, Rs as hasOwnKey, S as isProtectionValueActive, Sa as liveMatchesUnresolvedTokenFrame, Si as refuseMalformedResourceEntriesForOrphan, Sn as CC_BROKEN_REASON, So as shouldRetainResource, Sr as cfnRefValueFromPhysicalId, Ss as ssmResolvedValueType, St as planRollback, Ta as carryLogOnlyValues, Ti as refuseMalformedResourcePropertiesForOrphan, Tn as wouldReturnToSdkProvider, To as stringifyValue, Ts as MIGRATE_TMP_PREFIX, U as createReadOnlyAttributeHealerFactory, Ua as dynamicReferenceTokens, Ui as NO_CC_HANDLERS_REASON, Uo as resolveDockerContextDirectory, Ur as malformedExportSourceWarning, Us as describeFileReadFailure, Ut as DeploymentEventsStore, Vi as unwrittenCreateOnlyReplacement, Vo as buildDenyExternalAccessPolicy, Vr as malformedDriftResourcePropertiesWarning, Vs as ownValue, Vt as updatePartialReason, W as bold, Wa as isUncertifiedBaselineMaskPosition, Wi as hasNoCloudControlHandlers, Wn as DiffCalculator, Wo as describeDockerCapturedOutput, Wr as malformedLocalOutputsWarning, Ws as displayAssemblyPath, Wt as extractDeploymentEventError, X as computeParameterTaint, Xa as recordMaskOnlyValuesIn, Xi as renderStatefulReason, Xn as applyRoleArnIfSet, Xo as getDockerCmd, Xr as malformedOrphansRefusalMessage, Xt as secretSafeKeyDisplay, Y as yellow, Ya as recordMaskOnlyValue, Yi as isStatefulRecreateTargetSync, Yn as regionLessSecretName, Yo as formatDockerLoginError, Yr as malformedOrphanRowsKeptWarning, Yt as secretBearingStateKeyWarning, Z as namesAnyDeclaredParameter, Za as recordNoEchoAttributeValues, Zn as assertFlagRoleArn, Zo as isDockerClientEnvKey, Zr as malformedOrphansWarning, Zt as exportNameSecretExposure, _ as makeCanonicalizePropertiesFn, _i as refuseMalformedResourceEntries, _o as importableOutputKeys, _r as carriesDynamicReference, _s as resolveStateBucketWithDefault, _t as destroyStackRecordsView, a as findNestedTemplateTreeDefect, ai as malformedStateRefusalMessage, an as DEFAULT_RESOURCE_WARN_AFTER_MS, ao as isSingleDynamicReferenceToken, ar as envCredentialsAreAssumedRole, as as escapeRegExp, at as dropSettledNestedJournals, b as recordedProtectionNote, ba as DagBuilder, bi as refuseMalformedResourceEntriesForImport, bo as orphansAfterRollback, br as keepsSecretReferenceToken, bs as stateBucketExistenceConfirmed, bt as recordAfterRollbackUpdate, c as renderNestedTemplateTreeDefect, co as S3StateBackend, cs as getDockerImageBySourceHash, ct as recordDisplacedSkips, d as conditionInputsFrom, di as refuseMalformedOrphans, dn as withCreateTokenLedger, do as acceptedCreateOnlyDropsOf, ds as getDefaultStateBucketName, dt as withNestedRevertRun, ei as malformedRenderedContainersWarning, en as collectDeclaredOutputNames, eo as STATE_SOURCED_BASELINE_RULES, er as isIamRoleArn, es as redactDockerArgvValues, et as makeSiblingClaimReader, f as parentSuppliedValues, fa as prefetchCreateOnlyPropertyPaths, fi as refuseMalformedOrphansForDestroy, fo as describeRegionValueKind, fr as coerceParameterTypedValue, fs as getLegacyStateBucketName, g as mergeNoChangeOutputs, gi as refuseMalformedResourceAttributesForOrphan, go as hasUnverifiableParameterRefusal, gr as isImpossibleEmptyStoredAttribute, gs as resolveSkipPrefix, h as keptWholeReasonText, ha as withRetry, hi as refuseMalformedOutputsForDestroy, ho as hasReasonlessBaselineRefusal, hr as getAccountInfo, hs as resolveCaptureObservedState, ht as replayRollback, i as childTemplateLoader, ii as malformedScrubResourceEntriesRefusalMessage, in as DEFAULT_RESOURCE_TIMEOUT_MS, io as WHOLE_DYNAMIC_REFERENCE_PATTERN, ir as callerEnvCredentials, is as warnFinchArgvExposure, it as displacedPhysicalIdShown, ja as recordLogOnlyParameterValue, ji as repairMalformedOrphansForReadOnly, jo as AssetModeResolver, jr as STATE_RESOURCES_MALFORMED, js as PARTITION_TABLE, jt as createPreDeleteFinalSnapshot, ka as logOnlyValueCount, ki as refuseMalformedState, kn as slowCcOperationTimeoutMs, ko as loadPublishableAssetManifest, kr as JSON_LISTING_HOLE_VALUE, ks as decodeListingKey, kt as buildFinalSnapshotIdentifier, l as templateIdentity, li as refuseMalformedOrphanRecords, ln as ledgerForStack, lo as rebuildClientForBucketRegion, ls as Synthesizer, m as isSecretBearingReferenceString, ma as describeTypeWithThrottleRetry, mi as refuseMalformedOutputs, mo as hasReadableExportSet, mr as parameterTypeMayLoseSecretIdentity, ms as resolveAutoAssetStorage, mt as replayFailedOperations, n as IMPLICIT_DELETE_DEPENDENCIES, ni as malformedResourcePropertiesWarning, nn as isExportAliasCollision, no as STATE_SOURCED_READBACK_RULES, nr as AWS_CREDENTIAL_ENV_KEYS, ns as runDockerForeground, nt as NESTED_PENDING_PARENT_REASON, o as isAbsoluteAssetPath, oi as previewableOrphanRecords, on as maskingRetryLogger, oo as LockManager, os as stripControlChars, p as readRecordedConditionVerdicts, pa as templateResourceTypes, pi as refuseMalformedOrphansForOrphan, po as exportNamesCarriedFrom, pr as isUnboundTemplateParameter, ps as resolveApp, pt as withNestedStackContext, q as green, qa as carriesSecretMask, qi as MULTI_REGION_RECREATE_BLOCKED_TYPES, qn as classifyReplaySecretRegion, qo as dockerSpawnEnvWithSensitive, qr as malformedOrphanRecordsRefusalMessage, qt as exportAliasCollisionScrubWarning, r as computeImplicitDeleteEdges, ri as malformedResourcesWarning, rn as bindingSkippedOutputs, ro as TEMPLATE_SOURCED_RULES, rr as applyCallerIdentityCredentials, rs as runDockerStreaming, rt as displacedOpClause, s as listNestedTemplateRows, si as refuseDivergentRecordRegionForDestroy, sn as RollbackInlinePolicyWriters, so as isLockInfoExpired, ss as AssetManifestLoader, st as nestedChildStackName$1, t as DeployEngine, ti as malformedResourceEntriesWarning, tn as collectPublishedOutputNames, to as STATE_SOURCED_CROSS_GENERATION_RULES, tr as sendableAssumeRoleCommand, ts as redactedDockerCause, tt as planOrphanAdoption, u as conditionFingerprint, ui as refuseMalformedOrphanRecordsForDestroy, uo as splitImportedOps, us as synthesisStatusMessage, ut as revertedNestedRowIds, v as withResourceDeadline, vi as refuseMalformedResourceEntriesForDeploy, vo as importableOutputs, vr as carriesFetchableDynamicReference, vs as resolveStateBucketWithDefaultAndSource, w as readProtection, wa as recordNestedStackParameterExpressions, wi as refuseMalformedResourcePropertiesForExport, wn as ccBrokenReason, wo as isSensitiveAttributeName, wr as refStateLookupFromResource, ws as CFN_TEMPLATE_URL_LIMIT, wt as findNestedStackTypeChanges, x as PROTECTION_PROPERTY_BY_TYPE, xa as TemplateParser, xi as refuseMalformedResourceEntriesForImportSave, xo as orphansCarriedFrom, xr as AWS_NO_VALUE, xs as warnDeprecatedNoPrefixCliFlag, xt as planFailedOps, y as recordedProtectionEvidence, yi as refuseMalformedResourceEntriesForDestroy, yo as isReadableBag, yr as isNamelessDynamicReferenceError, ys as resolveUseCdkBootstrapAssets, yt as withStackRecords, za as redactSecretsForState, zi as findActionableSilentDrops, zo as validateAssetBucketName, zr as isReadableOrphanRecord, zs as hasPlainPrototype } from "./deploy-engine--YvYB0qw.js";
-import { t as getCdkdVersion } from "./version-CLicSzp8.js";
+import { $ as resourcesNamingDeclaredParameter, $a as recordMaskOnlyValuesIn, $n as assertSendableRoleArn, $o as getDockerCmd, $r as malformedOutputsRefusalMessage, $t as isWholeDynamicReferenceValue, Aa as hasMaskableValues, Ai as refuseMalformedResourcesForExport, An as slowCcOperationTimeoutMs, Ao as buildAssetRedirectMap, Ar as JSON_LISTING_HOLE_VALUE, As as uploadCfnTemplate, At as buildFinalSnapshotIdentifier, Ba as maskSecretsInText, Bi as unreadableResourceEntries, Bo as parseBootstrapMarker, Br as isReadableOrphanRecord, Bs as defineOwnKey, C as perType, Ca as DagBuilder, Ci as refuseMalformedResourceEntriesForOrphan, Cn as CC_BROKEN_REASON, Co as orphansAfterRollback, Cr as cfnRefValueFromPhysicalId, Cs as stateBucketExistenceConfirmed, Ct as planRollback, Da as recordNestedStackParameterExpressions, Di as refuseMalformedResourcePropertiesForOrphan, Dn as isCustomResourceType$1, Do as isSensitiveAttributeName, Dr as withSharedDrainBudget, Ds as CFN_TEMPLATE_URL_LIMIT, Dt as inheritProducerRegions, Ea as inheritNestedStackParameterAssociations, Ei as refuseMalformedResourcePropertiesForExport, En as wouldReturnToSdkProvider, Eo as AssetPublisher, Es as CFN_TEMPLATE_BODY_LIMIT, Fa as recordLogOnlyValue, Fi as repairMalformedResourceEntriesForReadOnly, Fn as deleteSkipReason, Fo as BOOTSTRAP_MARKER_PREFIX, Fr as deployRefusesOrphanRowsReason, Fs as canonicalizeRegion, Ft as refusesFinalSnapshot, G as cyan, Ga as DYNAMIC_REFERENCE_TOKEN_SCAN, Gi as NO_CC_HANDLERS_REASON, Gn as DiffCalculator, Go as buildDockerImage, Gr as malformedLocalOutputsWarning, Gs as absoluteAssemblyPathEscape, Gt as extractDeploymentEventError, H as formatResourceLine, Ha as redactSecretsForState, Ho as validateAssetBucketName, Hr as malformedDriftResourcePropertiesWarning, Hs as hasPlainPrototype, Ht as updatePartialReason, Ia as shareLogOnlyValues, Ii as repairMalformedResourcePropertiesForReadOnly, Io as assertAssetBucketRegion, Ir as displayLogicalId, Is as derivePartitionAndUrlSuffix, It as unsupportedFinalSnapshotError, J as red, Ja as pathCrossesDottedKey, Ji as shownType, Jn as classifyReplaySecretRegion, Jo as describeDockerExecFailure, Jr as malformedOrphanRecordsRefusalMessage, Js as renderAssemblyPathEscape, Jt as exportAliasCollisionScrubWarning, K as gray, Ka as dynamicReferenceTokens, Ki as hasNoCloudControlHandlers, Kn as INTRINSIC_KEYS, Ko as resolveDockerContextDirectory, Kr as malformedLocalResourceEntriesWarning, Ks as describeFileReadFailure, Kt as WITHHELD_NAME_DISPLAY, La as createSecretMasker, Li as repairMalformedResourcesForReadOnly, Ln as isWaitAbandonedError, Lo as ensureAssetStorage, Lr as hasReadableOrphans, Ls as AssemblyReader, Ma as logOnlyValueCount, Mi as repairMalformedOrphanRecordsForReadOnly, Mo as loadPublishableAssetManifest, Mr as STATE_RESOURCES_MALFORMED, Ms as decodeListingKey, Mt as createPreDeleteFinalSnapshot, Na as printingCorpusOf, Ni as repairMalformedOrphansForReadOnly, Nn as UNSPECIFIED_SKIP_REASON, No as rewriteTemplateAssetReferences, Nr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ns as expectedOwnerParam, Nt as effectiveDeletionPolicy, Oa as carryLogOnlyValues, Oi as refuseMalformedResourcesForDeploy, Oo as stringifyValue, Or as parameterInputsFor, Os as MIGRATE_TMP_PREFIX, Ot as ATOMIC_FINAL_SNAPSHOT_TYPES, Pa as recordLogOnlyParameterValue, Pi as repairMalformedOutputsForReadOnly, Pn as deleteIndeterminateGuards, Po as AssetModeResolver, Pr as UNREADABLE_RESOURCES_MAP_ROW, Ps as PARTITION_TABLE, Pt as isFinalSnapshotError, Q as reachableDivergentParameters, Qa as recordMaskOnlyValue, Qi as renderStatefulReason, Qn as assertFlagRoleArn, Qo as formatDockerLoginError, Qr as malformedOrphansWarning, Qt as exportNameSecretExposure, Ra as errorCauseChain, Ri as unpreviewableOrphanRecords, Ro as getBootstrapMarkerKey, Rr as hasReadableOutputs, Rs as StageLoadError, S as isProtectionValueActive, Si as refuseMalformedResourceEntriesForImportSave, So as isReadableBag, Sr as AWS_NO_VALUE, Ss as resolveUseCdkBootstrapAssets, St as planFailedOps, Ta as liveMatchesUnresolvedTokenFrame, Ti as refuseMalformedResourcePropertiesForDrift, Tn as ccBrokenReason, To as shouldRetainResource, Tr as refStateLookupFromResource, Ts as ssmResolvedValueType, Tt as findNestedStackTypeChanges, U as createReadOnlyAttributeHealerFactory, Ua as scrubResourceRecord, Ui as unwrittenCreateOnlyReplacement, Uo as validateContainerRepoName, Ur as malformedExportNamesWarning, Us as nullPrototypeRecord, Ut as DeploymentEventsReader, Va as markSameGenerationBag, Vi as findActionableSilentDrops, Vo as readBootstrapMarkerBody, Vr as isReadableResourceEntry, Vs as hasOwnKey, Vt as updatePartialMessage, W as bold, Wo as buildDenyExternalAccessPolicy, Wr as malformedExportSourceWarning, Ws as ownValue, Wt as DeploymentEventsStore, X as computeParameterTaint, Xa as carriesSecretMask, Xi as isStatefulRecreateTargetForReplace, Xn as regionLessSecretName, Xo as dockerSpawnEnvWithSensitive, Xr as malformedOrphanRowsKeptWarning, Xt as secretBearingStateKeyWarning, Y as yellow, Ya as identityKeyFor, Yi as MULTI_REGION_RECREATE_BLOCKED_TYPES, Yn as producerRegionsFromState, Yo as describeDockerFailure, Yr as malformedOrphanRecordsWarning, Ys as resolveAssemblyPath, Yt as secretBearing, Z as namesAnyDeclaredParameter, Za as provenPublicValue, Zi as isStatefulRecreateTargetSync, Zn as applyRoleArnIfSet, Zo as finchSecretArgvRefusal, Zr as malformedOrphansRefusalMessage, Zs as resolveBucketRegion, Zt as secretSafeKeyDisplay, _ as makeCanonicalizePropertiesFn, _a as withRetry, _i as refuseMalformedResourceAttributesForOrphan, _o as hasReadableExportSet, _r as isImpossibleEmptyStoredAttribute, _s as resolveAutoAssetStorage, _t as destroyStackRecordsView, a as findNestedTemplateTreeDefect, ai as malformedScrubResourceEntriesRefusalMessage, an as DEFAULT_RESOURCE_TIMEOUT_MS, ao as STATE_SOURCED_READBACK_RULES, ar as callerEnvCredentials, as as runDockerForeground, at as dropSettledNestedJournals, b as recordedProtectionNote, bi as refuseMalformedResourceEntriesForDestroy, bo as importableOutputKeys, br as isNamelessDynamicReferenceError, bs as resolveStateBucketWithDefault, bt as recordAfterRollbackUpdate, c as renderNestedTemplateTreeDefect, ci as refuseDivergentRecordRegionForDestroy, cn as RollbackInlinePolicyWriters, co as isSingleDynamicReferenceToken, cs as escapeRegExp, ct as recordDisplacedSkips, d as conditionInputsFrom, di as refuseMalformedOrphanRecordsForDestroy, do as S3StateBackend, ds as getDockerImageBySourceHash, dt as withNestedRevertRun, ei as malformedOutputsWarning, en as noEchoParameterValueSeed, eo as recordNoEchoAttributeValues, er as explicitRoleArnOrThrow, es as isDockerClientEnvKey, et as makeSiblingClaimReader, f as parentSuppliedValues, fi as refuseMalformedOrphans, fn as withCreateTokenLedger, fo as rebuildClientForBucketRegion, fs as Synthesizer, g as mergeNoChangeOutputs, ga as describeTypeWithThrottleRetry, gi as refuseMalformedOutputsForDestroy, go as exportNamesCarriedFrom, gr as getAccountInfo, gs as resolveApp, h as keptWholeReasonText, ha as templateResourceTypes, hi as refuseMalformedOutputs, ho as describeRegionValueKind, hr as parameterTypeMayLoseSecretIdentity, hs as getLegacyStateBucketName, ht as replayRollback, i as childTemplateLoader, ii as malformedResourcesWarning, in as bindingSkippedOutputs, io as STATE_SOURCED_CROSS_GENERATION_RULES, ir as applyCallerIdentityCredentials, is as redactedDockerCause, it as displacedPhysicalIdShown, ja as literalSplitDelimitersOf, ji as refuseMalformedState, jn as ccProtectionRegistryTypes, jo as createAssetRedirectResolver, jr as STATE_REGION_DIVERGED, js as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, jt as ccRoutedFinalSnapshotError, ka as createUnionSecretMasker, ki as refuseMalformedResourcesForDestroy, kn as CloudControlProvider, ko as WorkGraph, ks as findLargeInlineResources, kt as PRE_DELETE_SNAPSHOT_TYPES, l as templateIdentity, lo as LockManager, ls as stripControlChars, m as isSecretBearingReferenceString, ma as prefetchCreateOnlyPropertyPaths, mi as refuseMalformedOrphansForOrphan, mo as acceptedCreateOnlyDropsOf, mr as isUnboundTemplateParameter, ms as getDefaultStateBucketName, mt as replayFailedOperations, n as IMPLICIT_DELETE_DEPENDENCIES, ni as malformedResourceEntriesWarning, nn as collectPublishedOutputNames, no as wholeStringLeavesOf, nr as sendableAssumeRoleCommand, ns as partitionSensitiveEnv, nt as NESTED_PENDING_PARENT_REASON, o as isAbsoluteAssetPath, oi as malformedStateRefusalMessage, on as DEFAULT_RESOURCE_WARN_AFTER_MS, oo as TEMPLATE_SOURCED_RULES, or as envCredentialsAreAssumedRole, os as runDockerStreaming, p as readRecordedConditionVerdicts, pi as refuseMalformedOrphansForDestroy, po as splitImportedOps, pr as coerceParameterTypedValue, ps as synthesisStatusMessage, pt as withNestedStackContext, q as green, qa as isUncertifiedBaselineMaskPosition, qi as findReplacedReadersOfRecreateTargets, qn as IntrinsicFunctionResolver, qo as describeDockerCapturedOutput, qr as malformedLocalResourcesWarning, qs as displayAssemblyPath, qt as displayTextOrWithheld, r as computeImplicitDeleteEdges, ri as malformedResourcePropertiesWarning, rn as isExportAliasCollision, ro as STATE_SOURCED_BASELINE_RULES, rr as AWS_CREDENTIAL_ENV_KEYS, rs as redactDockerArgvValues, rt as displacedOpClause, s as listNestedTemplateRows, si as previewableOrphanRecords, sn as maskingRetryLogger, so as WHOLE_DYNAMIC_REFERENCE_PATTERN, ss as warnFinchArgvExposure, st as nestedChildStackName$1, t as DeployEngine, ti as malformedRenderedContainersWarning, tn as collectDeclaredOutputNames, to as recordProvenPublicExpression, tr as isIamRoleArn, ts as isMalformedEnvKey, tt as planOrphanAdoption, u as conditionFingerprint, ui as refuseMalformedOrphanRecords, un as ledgerForStack, uo as isLockInfoExpired, us as AssetManifestLoader, ut as revertedNestedRowIds, v as withResourceDeadline, vi as refuseMalformedResourceEntries, vo as hasReasonlessBaselineRefusal, vr as carriesDynamicReference, vs as resolveCaptureObservedState, w as readProtection, wa as TemplateParser, wi as refuseMalformedResourcePropertiesForDestroy, wn as ProviderRegistry, wo as orphansCarriedFrom, wr as isStalePlaceholderArnAttribute, ws as warnDeprecatedNoPrefixCliFlag, wt as resolveReplacementOldType, x as PROTECTION_PROPERTY_BY_TYPE, xi as refuseMalformedResourceEntriesForImport, xo as importableOutputs, xr as keepsSecretReferenceToken, xs as resolveStateBucketWithDefaultAndSource, xt as demoteSupersededOrphans, y as recordedProtectionEvidence, yi as refuseMalformedResourceEntriesForDeploy, yo as hasUnverifiableParameterRefusal, yr as carriesFetchableDynamicReference, ys as resolveSkipPrefix, yt as withStackRecords, za as maskSecretsInError, zi as unreadableOrphanRecords, zo as isCrossRegionRedirect, zr as hasReadableResources, zs as processStackMessages } from "./deploy-engine-DG-oC9YK.js";
+import { t as getCdkdVersion } from "./version-Bqzsng8Y.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2362,7 +2362,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DmmgFCgs.js");
+	providerClasses ??= import("./provider-classes-DUw5QAWI.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -5474,6 +5474,7 @@ async function repairExportIndexForStack(store, stackName, producerRegion, outpu
 		if (finding.kind !== "converge") continue;
 		const entry = entries.get(finding.exportName);
 		if (!entry) throw new ScrubIndexInvariantError("exports index repair: a planned entry is absent from the snapshot it was planned from");
+		opts.onWriteAttempt?.();
 		if (!await store.patchEntry(finding.exportName, {
 			...entry,
 			value: finding.stateValue
@@ -5487,6 +5488,57 @@ async function repairExportIndexForStack(store, stackName, producerRegion, outpu
 		unwritten
 	};
 }
+const SCRUBBED_STATE_OBJECT_DESCRIPTION = "the stack's earlier state.json versions, which may hold a plaintext secret";
+const SCRUBBED_EXPORT_INDEX_OBJECT_DESCRIPTION = "the region's pre-scrub exports index, which may hold the plaintext secret scrub rewrote";
+function scrubbedStateKey(backend, stackName, region) {
+	return `${backend.prefix}/${stackName}/${region}/state.json`;
+}
+function scrubbedLegacyStateKey(backend, stackName) {
+	return `${backend.prefix}/${stackName}/state.json`;
+}
+function stateHistoryKeys(backend, stackName, region, migrationPending) {
+	return [scrubbedStateKey(backend, stackName, region), ...migrationPending ? [scrubbedLegacyStateKey(backend, stackName)] : []];
+}
+function scrubbedExportIndexKey(backend, region) {
+	return `${backend.prefix}/_index/${region}/exports.json`;
+}
+function wasRetriedBySdk(err) {
+	let current = err;
+	for (let depth = 0; depth < 8 && typeof current === "object" && current !== null; depth++) {
+		const attempts = current.$metadata?.attempts;
+		if (typeof attempts === "number" && attempts > 1) return true;
+		current = current.cause;
+	}
+	return false;
+}
+async function saveScrubbedState(stateBackend, stackName, region, state, loaded) {
+	let mayHaveWritten = false;
+	try {
+		try {
+			await stateBackend.saveState(stackName, region, state, {
+				expectedEtag: loaded.etag,
+				...loaded.migrationPending && { migrateLegacy: true }
+			});
+		} catch (err) {
+			mayHaveWritten = isAmbiguousOutcomeError(err) || wasRetriedBySdk(err);
+			throw err;
+		}
+		mayHaveWritten = true;
+		if (loaded.migrationPending) {
+			const legacyKey = scrubbedLegacyStateKey(stateBackend, stackName);
+			let survives;
+			try {
+				survives = await stateBackend.getRawObject(legacyKey) !== null;
+			} catch (err) {
+				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${err instanceof Error ? err.message : String(err)}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
+			}
+			if (survives) throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but its legacy key ${legacyKey} could not be deleted and still holds the ` + "pre-scrub record as its CURRENT object. Delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes.", "SCRUB_LEGACY_STATE_KEY_SURVIVES");
+		}
+	} finally {
+		if (mayHaveWritten) await stateBackend.purgeNoncurrentVersions(stateHistoryKeys(stateBackend, stackName, region, loaded.migrationPending), { objectDescription: SCRUBBED_STATE_OBJECT_DESCRIPTION });
+	}
+}
+const SCRUB_CLEAN_SCOPE_NOTE = " (scrub checks only values the template names through a {{resolve:...}} reference)";
 const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
 function readNestedChildTemplate$1(templatePath) {
 	let template;
@@ -5586,6 +5638,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 		return changed > 0 || unmatched.length > 0 ? {
 			state: loaded.state,
 			etag: loaded.etag,
+			migrationPending: loaded.migrationPending,
 			attributes,
 			changed,
 			unmatched
@@ -5603,7 +5656,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 		if (!locked) return none;
 		if (locked.changed > 0) {
 			const row = locked.state.resources[parentRow.logicalId];
-			await stateBackend.saveState(parentRow.stackName, region, {
+			await saveScrubbedState(stateBackend, parentRow.stackName, region, {
 				...locked.state,
 				resources: {
 					...locked.state.resources,
@@ -5613,7 +5666,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 					}
 				},
 				lastModified: Date.now()
-			}, { expectedEtag: locked.etag });
+			}, locked);
 		}
 		return {
 			changed: locked.changed,
@@ -5770,11 +5823,13 @@ async function scrubCommand(stacks, options) {
 	};
 	const examinedIndexNames = /* @__PURE__ */ new Map();
 	let totalIndexEntriesConverged = 0;
+	const historyPurgedStacks = /* @__PURE__ */ new Set();
 	let totalIndexEntriesAbsent = 0;
 	let totalIndexEntriesAbsentWithSecret = 0;
 	let totalIndexEntriesUnexamined = 0;
 	const indexUnwritten = [];
 	const indexUnreadable = [];
+	const indexRegionsWritten = /* @__PURE__ */ new Set();
 	const work = targetStacks.map((stack) => ({
 		stackName: stack.stackName,
 		region: stack.region || region,
@@ -5796,6 +5851,7 @@ async function scrubCommand(stacks, options) {
 			scrubbedStack = stack;
 			scrubbed = await scrubStack(stack, stackRegion, stateBackend, lockManager, {
 				dryRun: options.dryRun ?? false,
+				purgeHistory: options.purgeHistory ?? false,
 				roleArn: options.roleArn,
 				logger,
 				appStacks: allStacks,
@@ -5829,7 +5885,10 @@ async function scrubCommand(stacks, options) {
 		let indexConverged = 0;
 		let indexAbsentWithSecret = 0;
 		try {
-			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stackName, stackRegion, scrubbed.outputs, { dryRun: options.dryRun ?? false });
+			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stackName, stackRegion, scrubbed.outputs, {
+				dryRun: options.dryRun ?? false,
+				onWriteAttempt: () => indexRegionsWritten.add(stackRegion)
+			});
 			const seen = examinedIndexNames.get(stackRegion) ?? /* @__PURE__ */ new Set();
 			for (const name of repair.examined) seen.add(name);
 			examinedIndexNames.set(stackRegion, seen);
@@ -5886,11 +5945,12 @@ async function scrubCommand(stacks, options) {
 			if (!failures.some((f) => f.stackName === label)) failures.push({ stackName: label });
 			logger.error(safeMsg`Scrub of ${displayStackName(item.parentRow.stackName)}'s nested-stack output attributes for ${shownStack} failed: ${describeFailure(err)}`);
 		}
+		if (scrubbed.historyPurged) historyPurgedStacks.add(stackName);
 		if (scrubbed.recordsChanged > 0) {
 			if (!rewrittenStacks.has(stackName)) totalStacksScrubbed++;
 			rewrittenStacks.add(stackName);
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${shownStack}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && scrubbed.unrepairedReadNames === 0 && (scrubbed.keptReadOutputKeys ?? 0) === 0 && (scrubbed.keptAliasOutputKeys ?? 0) === 0 && !scrubbed.droppedOutputReadersUnverified && indexAbsentWithSecret === 0 && indexConverged === 0) logger.info(scrubbed.nestedChildren.some((child) => Boolean(child.input)) ? `No plaintext secrets found in ${shownStack}'s own records; its nested-stack output attributes are checked after each nested stack` : `No plaintext secrets found in ${shownStack}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && scrubbed.unrepairedReadNames === 0 && (scrubbed.keptReadOutputKeys ?? 0) === 0 && (scrubbed.keptAliasOutputKeys ?? 0) === 0 && !scrubbed.droppedOutputReadersUnverified && indexAbsentWithSecret === 0 && indexConverged === 0) logger.info(scrubbed.nestedChildren.some((child) => Boolean(child.input)) ? `No plaintext secrets found in ${shownStack}'s own records${SCRUB_CLEAN_SCOPE_NOTE}; its nested-stack output attributes are checked after each nested stack` : `No plaintext secrets found in ${shownStack}${SCRUB_CLEAN_SCOPE_NOTE}`);
 		if (scrubbed.malformedResources || scrubbed.malformedResourceRows) malformedRecords.push(stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stackName);
 		if (scrubbed.malformedOrphans || scrubbed.malformedOrphanRows) malformedOrphanRecords.push(stackName);
@@ -5915,6 +5975,11 @@ async function scrubCommand(stacks, options) {
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${shownStack} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
+	for (const indexRegion of indexRegionsWritten) await stateBackend.purgeNoncurrentVersions([scrubbedExportIndexKey(stateBackend, indexRegion)], { objectDescription: SCRUBBED_EXPORT_INDEX_OBJECT_DESCRIPTION });
+	const historyNote = () => {
+		const purgedOnly = [...historyPurgedStacks].filter((n) => !rewrittenStacks.has(n)).length;
+		return purgedOnly > 0 ? ` --purge-history: on a VERSIONED state bucket, the earlier state.json versions of ${purgedOnly} examined record(s) scrub did not rewrite were purged too, unless a warning above says otherwise.` : "";
+	};
 	for (const [indexRegion, store] of exportIndexStores) {
 		if (indexUnreadable.some((u) => u.region === indexRegion)) continue;
 		let entries;
@@ -5938,10 +6003,10 @@ async function scrubCommand(stacks, options) {
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalStacksWithUnrepairedReadNames === 0 && totalStacksWithReadOutputKeys === 0 && totalIndexEntriesAbsentWithSecret === 0 && droppedReadersUnverifiedStacks.length === 0 && totalParentAttributesUnmatched === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
-			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
+			logger.info(safeMsg`\nNo plaintext secrets found in any target stack state${SCRUB_CLEAN_SCOPE_NOTE}. Nothing to scrub.${historyNote()}`);
 			return;
 		}
-		logger.info(`\nNo plaintext secrets found in the ${work.length - failures.length} stack(s) this run could examine. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.`);
+		logger.info(`\nNo plaintext secrets found in the ${work.length - failures.length} stack(s) this run could examine${SCRUB_CLEAN_SCOPE_NOTE}. ${failures.length} stack(s) could NOT be scrubbed — see the errors above.${historyNote()}`);
 		throw scrubStacksFailedError(failures);
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
@@ -5953,7 +6018,7 @@ async function scrubCommand(stacks, options) {
 	const parentAttributeNote = totalParentAttributesUnmatched > 0 ? ` ${totalParentAttributesUnmatched} nested-stack output attribute(s) in a parent record hold a plaintext scrub could NOT match to its child's output — see the warnings above.` : "";
 	const indexNote = (() => {
 		const parts = [];
-		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
+		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value, and on a VERSIONED bucket the index's earlier versions were purged, unless a warning above says otherwise.`);
 		if (totalIndexEntriesAbsent > 0) parts.push(` ${totalIndexEntriesAbsent} exports index entr${totalIndexEntriesAbsent === 1 ? "y is" : "ies are"} published by a scrubbed stack under a name its state.outputs does not carry; nothing was written for ${totalIndexEntriesAbsent === 1 ? "it" : "them"} — redeploy that producer.`);
 		if (totalIndexEntriesAbsentWithSecret > 0) parts.push(` ${totalIndexEntriesAbsentWithSecret === 1 ? "One such entry still holds" : `${totalIndexEntriesAbsentWithSecret} such entries still hold`} a secret this run recorded — see the warnings above.`);
 		if (totalIndexEntriesUnexamined > 0) parts.push(` ${totalIndexEntriesUnexamined} exports index entr${totalIndexEntriesUnexamined === 1 ? "y" : "ies"} belong to producers outside this run and were NOT examined.`);
@@ -5970,8 +6035,8 @@ async function scrubCommand(stacks, options) {
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which bootstrapping with cdkd enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote}`);
-	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The rewritten state.json no longer holds the plaintext, and on a VERSIONED state bucket its earlier versions were purged, unless a warning above says otherwise. A value that was ever persisted must still be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any copy cdkd cannot reach harmless.${historyNote()}${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${historyNote()}${keyNote}${unverifiableNote}${readNameNote}${outputKeyNote}${parentAttributeNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
@@ -6947,6 +7012,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (unverifiableLeaves > 0) logger.warn(abandonedScanStackNote("count", unverifiableLeaves));
 		if (ungateableAbandonedScans > 0) logger.warn(abandonedScanStackNote("warn", ungateableAbandonedScans));
 	};
+	const purgeExaminedHistory = async (migrationPending) => {
+		if (opts.dryRun || !opts.purgeHistory) return {};
+		await stateBackend.purgeNoncurrentVersions(stateHistoryKeys(stateBackend, stack.stackName, region, migrationPending), { objectDescription: SCRUBBED_STATE_OBJECT_DESCRIPTION });
+		return { historyPurged: true };
+	};
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -7326,6 +7396,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (totalSecrets === 0) {
 			emitAbandonedScanNotes();
 			return {
+				...await purgeExaminedHistory(loaded.migrationPending),
 				recordsChanged: 0,
 				secretsFound: 0,
 				secretBearingKeys: secretBearingKeys.length,
@@ -7483,9 +7554,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				...newExportNames !== state.exportNames && { exportNames: newExportNames },
 				lastModified: Date.now()
 			};
-			await stateBackend.saveState(stack.stackName, region, nextState, { expectedEtag: loaded.etag });
+			await saveScrubbedState(stateBackend, stack.stackName, region, nextState, loaded);
 		}
 		return {
+			...recordsChanged > 0 ? {} : await purgeExaminedHistory(loaded.migrationPending),
 			recordsChanged,
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
@@ -7520,7 +7592,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	}
 }
 function createScrubCommand() {
-	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path); the nested stacks under each are scrubbed too").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").option("--fail", "With --dry-run, exit non-zero if any plaintext secret is found (CI gate). Also exits non-zero on a real run when a leak was found that scrub cannot rewrite.");
+	const cmd = new Command("scrub").description("Rewrite persisted state so resolved secret dynamic references are stored as their {{resolve:...}} expression, not the plaintext value (no deploy).").argument("[stacks...]", "Stack name(s) to scrub (physical name or display path); the nested stacks under each are scrubbed too").option("--all", "Scrub every stack in the synthesized app", false).option("--dry-run", "Report what would be scrubbed without writing state").addOption(new Option("--purge-history", "Also purge the earlier S3 versions of every examined stack's state.json, not only the ones scrub rewrites (drops their state-recovery history; a record scrub refuses is never purged)").conflicts("dryRun")).option("--fail", "With --dry-run, exit non-zero if a value the template names through a {{resolve:...}} reference is found in plaintext (CI gate). Also exits non-zero on a real run when a leak was found that scrub cannot rewrite.");
 	[
 		...commonOptions,
 		...appOptions,
@@ -10192,6 +10264,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	};
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedResourceEntriesForDestroy(state, stackName, regionForState, refusalRecovery);
+	refuseMalformedResourcePropertiesForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphansForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseMalformedOrphanRecordsForDestroy(state, stackName, regionForState, refusalRecovery);
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion, refusalRecovery);
@@ -10454,6 +10527,23 @@ async function runDestroyForStack(stackName, state, ctx) {
 					});
 					return;
 				}
+				if (resource.resourceType !== NESTED_STACK_TYPE && (typeof resource.physicalId !== "string" || resource.physicalId.trim() === "")) {
+					const skipReason = "state record has no physical id";
+					logger.warn(`Resource ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) has no non-empty string 'physicalId' in its state record, so cdkd cannot address it in AWS and did not try to delete it. Repairing the record in state.json and re-running helps; the record is kept.`);
+					logger.info(`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `skipped (${skipReason})`)}`);
+					result.skippedCount++;
+					skippedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
+					ctx.eventRecorder?.record({
+						eventType: "RESOURCE_SKIPPED",
+						stackName,
+						operation: "DELETE",
+						logicalId,
+						resourceType: resource.resourceType,
+						...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+						reason: skipReason
+					});
+					return;
+				}
 				const baseLabel = `Deleting ${logicalId} (${resource.resourceType})`;
 				renderer.addTask(logicalId, baseLabel);
 				const resourceStartedAt = Date.now();
@@ -15731,11 +15821,11 @@ function safeStack(value) {
 function safeRoleArn(value) {
 	return displayIdent(value, { maxCodePoints: 613 });
 }
-function refuseDivergentRecordRegionForRollback(state, stackName, keyRegion, divergentBodyRegion) {
+function refuseDivergentRecordRegionForRollback(state, stackName, keyRegion, divergentBodyRegion, provenOrphans) {
 	if (divergentBodyRegion === void 0) return;
 	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
-	if (resourceCount === 0) return;
-	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	if (resourceCount === 0 && provenOrphans === 0) return;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : resourceCount > 0 ? `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}` : `its journal holds ${provenOrphans} failed create${provenOrphans === 1 ? "" : "s"} whose resource --revert-failed would delete`;
 	throw markNonRetryable(new CdkdError(`cdkd will not roll back ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(keyRegion, "region")}): the state record read from that region's key carries a 'region' of its own (${describeRegionValueKind(divergentBodyRegion)}) that is not the key's, and ${lists} — so cdkd cannot tell which region they are in. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. The replay would issue every delete and revert against the key's region; if the record's own region is the honest half, each delete comes back not-found, which the replay reads as ALREADY DELETED — it would report the resource rolled back, drop it from the record, and leave it standing in the other region. Nothing was changed. Re-run with --verbose to see what the record's region field holds, repair that field to match the key it is stored under, and run the rollback again.`, STATE_REGION_DIVERGED));
 }
 function divergedDuringRollbackMessage(divergentBodyRegion) {
@@ -15776,11 +15866,12 @@ function failedActionLabel(item, skipFinalSnapshot) {
 	const { op, action } = item;
 	switch (action) {
 		case "revert-failed-update": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED update — remote state unknown, force-applying previous properties]`;
-		case "delete-failed-create": return `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create]`;
+		case "delete-failed-create": return op.physicalIdRecoveredFromError === true ? `  - delete   ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) [FAILED create, never recorded in state: ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}]` : `  - delete   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create]`;
 		case "delete-failed-create-with-final-snapshot": return `  - delete   ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) [FAILED create, ${snapshotNote(op.resourceType, item.effectiveProvisionedBy, skipFinalSnapshot)}]`;
 		case "orphan-failed-create-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
 		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
+		case "skip-failed-superseded": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed CREATE created ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"} before failing; a later deploy or rollback may own it now; not deleted, needs manual attention`;
 		case "skip-failed-mismatch": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed CREATE recorded ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}, which is not the resource state tracks under this id; not reverted, needs manual attention`;
 		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
 		case "skip-failed-type-change": return `  - skip     ${safe(op.logicalId)} (from ${safe(op.previousState?.resourceType)} to ${safe(op.resourceType)}) — failed Type change is a replacement, no in-place revert exists`;
@@ -15865,6 +15956,7 @@ async function rollbackCommand(stackArg, options) {
 			};
 			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
 			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
+			demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
 			if (!options.revertFailed) for (const segment of journal.segments) {
 				const failedRows = splitImportedOps(segment.failedOperations ?? [], segment).replay;
 				for (const logicalId of revertedNestedRowIds(failedRows)) {
@@ -15881,7 +15973,7 @@ async function rollbackCommand(stackArg, options) {
 			refuseMalformedState(baseState, stackName, region, refusalRecovery);
 			refuseMalformedOrphans(baseState, stackName, region, refusalRecovery);
 			refuseMalformedOrphanRecords(baseState, stackName, region, refusalRecovery);
-			refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion);
+			refuseDivergentRecordRegionForRollback(baseState, stackName, region, stateData.divergentBodyRegion, options.revertFailed ? journal.segments.flatMap((seg) => seg.failedOperations ?? []).filter((op) => op.physicalIdRecoveredFromError === true).length : 0);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -26214,4 +26306,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-DhvgK2CV.js.map
+//# sourceMappingURL=program-DfJFegS1.js.map