@go-to-k/cdkd 0.294.9 → 0.294.11

package/dist/{program-DMJnrQOG.js → program-dQFaGjL1.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as displaySafe, C as SAFE_MSG_ALTERED_CHAR, D as cutMarker, E as UNRENDERABLE, F as safeMsg, I as stringifyJsonPayload, L as truncateCodePoints, M as isPasteableIdent, O as displayAwsMessage, P as plainIdentOr, T as STACK_REF_MAX_CODE_POINTS, b as withSkipPrefix, c as getLiveRenderer, d as PATTERN_B_RESOURCE_TYPES, h as generateResourceName, i as reserveStdoutForPayload, j as displayStackName, k as displayIdent, l as PATTERN_B_NAME_OPTIONS, m as explicitNamePropertyFor, n as getLogger, o as runStackBuffered, p as derivesPatternBName, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_PROPERTIES, w as SECRET_REF_MAX_CODE_POINTS, x as withStackName } from "./logger-B46YMG0h.js";
 import { At as clientDefaultsFor, Bn as isMarkedNonRetryable, Bt as IntrinsicResolutionRefusalError, Dt as withPasteableAwsProfile, Et as setPasteableAwsProfile, F as runDeleteAttempt, Fn as retryClassificationText, G as beginCommandInterruptScope, Gt as MalformedProducerRecordRefusalError, Hn as markNonRetryable, Ht as LocalStartServiceError, In as describeAwsFailure, It as CrossAccountSecretRefusalError, J as isInterruptedWaitError, Jt as ProvisioningError, K as endCommandInterruptScope, Kt as NestedStackChildDirectDestroyError, Mt as AccountIdUnavailableError, Nn as isRetryableTransientError, Ot as ambientClientDefaults, Pn as isTransientServerError, Pt as CdkdError, Qt as StackTerminationProtectionError, Rn as safeStringify, Rt as DeployCancelledError, St as injectiveKey, Tt as producerRecordKey, V as isAwsCliLiteral, Vn as isThrottlingError, Vt as LocalInvokeBuildError$1, Xt as ResourceUpdateNotSupportedError, Yt as ResourceTimeoutError, Zt as StackHasActiveImportsError, _ as VALUE_NOT_SHOWN, _n as shellQuote, _t as formatLockOperation, an as TIMEOUT_FLAG_RESOURCE_TYPE, bn as setPasteableVerbFlags, bt as CUSTOM_RESOURCE_RESPONSE_PREFIX, dn as isInertUnquoted, en as SynthesisError, fn as pasteableCommand, ft as UNREPRODUCIBLE_LOCK_CLAUSE, g as assertRegionMatch, gn as shellBoundedDisplay, gt as formatLockExpiry, h as RESOURCE_NOT_FOUND, hn as quotedOrDescribed, ht as forceQuitRecoveryClause, in as withErrorHandling, it as resourceTypeShown, jt as credentialFingerprint, kt as ambientCredentialConfig, ln as commandHole, mn as plainOrDescribed, mt as buildLockContentionMessage, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nt as logicalIdShown, pt as buildForceUnlockCommand, q as interruptWatchListenerCount, qt as PartialFailureError, rn as normalizeAwsError, s as readRecordedPrincipals, sn as SHELL_ACTIVE_WHY, t as IAM_PRINCIPAL_NAME, vn as withheldTargetClause, vt as formatLockOwner, w as remedyLogicalId, wt as producerCoordinateKey, xt as DEFAULT_STATE_PREFIX, yn as setPasteableRunFlags, zt as DynamicReferenceRegionAmbiguousError } from "./iam-policy-targets-CMSQGQnm.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as nestedChildStackName, $a as importableOutputs, $i as describeTypeWithThrottleRetry, $n as coerceParameterTypedValue, $o as resolveStateBucketWithDefaultAndSource, $r as refuseMalformedOutputs, Aa as pathCrossesDottedKey, Ai as findReplacedReadersOfRecreateTargets, Ao as formatDockerLoginError, Ar as malformedLocalResourceEntriesWarning, At as DeploymentEventsStore, B as gray, Ba as WHOLE_DYNAMIC_REFERENCE_PATTERN, Bn as explicitRoleArnOrThrow, Bo as escapeRegExp, Br as malformedResourceEntriesWarning, Bt as noEchoParameterValueSeed, Ca as markSameGenerationBag, Ci as unreadableResourceEntries, Cn as isWaitAbandonedError, Co as buildDockerImage, Cr as hasReadableResources, Cs as absoluteAssemblyPathEscape, Ct as effectiveDeletionPolicy, Da as DYNAMIC_REFERENCE_TOKEN_SCAN, Do as describeDockerFailure, Dr as malformedExportNamesWarning, Ds as resolveAssemblyPath, Dt as updatePartialMessage, Ei as unwrittenCreateOnlyReplacement, Eo as describeDockerExecFailure, Er as malformedDriftResourcePropertiesWarning, Es as renderAssemblyPathEscape, Et as unsupportedFinalSnapshotError, Fa as recordNoEchoAttributeValues, Fi as renderStatefulReason, Fn as producerRegionsFromState, Fo as redactDockerArgvValues, Fr as malformedOrphansRefusalMessage, Ft as secretBearing, G as namesAnyDeclaredParameter, Ga as rebuildClientForBucketRegion, Gn as callerEnvCredentials, Go as synthesisStatusMessage, Gr as previewableOrphanRecords, Gt as DEFAULT_RESOURCE_TIMEOUT_MS, H as red, Ha as LockManager, Hn as sendableAssumeRoleCommand, Ho as AssetManifestLoader, Hr as malformedResourcesWarning, Ht as collectPublishedOutputNames, I as formatResourceLine, Ia as STATE_SOURCED_BASELINE_RULES, In as regionLessSecretName, Io as redactedDockerCause, Ir as malformedOrphansWarning, It as secretBearingStateKeyWarning, J as makeSiblingClaimReader, Ja as exportNamesCarriedFrom, Jo as resolveApp, Jr as refuseMalformedOrphanRecords, Jt as RollbackInlinePolicyWriters, K as reachableDivergentParameters, Ka as acceptedCreateOnlyDropsOf, Kn as envCredentialsAreAssumedRole, Ko as getDefaultStateBucketName, Kr as refuseDivergentRecordRegionForDestroy, Kt as DEFAULT_RESOURCE_WARN_AFTER_MS, L as createReadOnlyAttributeHealerFactory, La as STATE_SOURCED_CROSS_GENERATION_RULES, Ln as applyRoleArnIfSet, Lo as runDockerForeground, Lr as malformedOutputsRefusalMessage, Lt as secretSafeKeyDisplay, Ma as carriesSecretMask, Mi as MULTI_REGION_RECREATE_BLOCKED_TYPES, Mn as INTRINSIC_KEYS, Mo as isDockerClientEnvKey, Mr as malformedOrphanRecordsRefusalMessage, Mt as WITHHELD_NAME_DISPLAY, Na as recordMaskOnlyValue, Ni as isStatefulRecreateTargetForReplace, Nn as IntrinsicFunctionResolver, No as isMalformedEnvKey, Nr as malformedOrphanRecordsWarning, Nt as displayTextOrWithheld, Oa as dynamicReferenceTokens, Oi as NO_CC_HANDLERS_REASON, Oo as dockerSpawnEnvWithSensitive, Or as malformedExportSourceWarning, Ot as updatePartialReason, Pa as recordMaskOnlyValuesIn, Pi as isStatefulRecreateTargetSync, Pn as classifyReplaySecretRegion, Po as partitionSensitiveEnv, Pr as malformedOrphanRowsKeptWarning, Pt as exportAliasCollisionScrubWarning, Qa as importableOutputKeys, Qi as templateResourceTypes, Qo as resolveStateBucketWithDefault, Qr as refuseMalformedOrphansForOrphan, Qt as withCreateTokenLedger, R as bold, Ra as STATE_SOURCED_READBACK_RULES, Rn as assertFlagRoleArn, Ro as runDockerStreaming, Rr as malformedOutputsWarning, Rt as exportNameSecretExposure, Sa as maskSecretsInText, Si as unreadableOrphanRecords, So as buildDenyExternalAccessPolicy, Sr as hasReadableOutputs, Ss as ownValue, St as createPreDeleteFinalSnapshot, Ta as scrubResourceRecord, To as describeDockerCapturedOutput, Tr as isReadableResourceEntry, Ts as displayAssemblyPath, Tt as refusesFinalSnapshot, U as yellow, Ua as isLockInfoExpired, Un as AWS_CREDENTIAL_ENV_KEYS, Uo as getDockerImageBySourceHash, Ur as malformedScrubResourceEntriesRefusalMessage, Ut as isExportAliasCollision, V as green, Va as isSingleDynamicReferenceToken, Vn as isIamRoleArn, Vo as stripControlChars, Vr as malformedResourcePropertiesWarning, Vt as collectDeclaredOutputNames, W as computeParameterTaint, Wa as S3StateBackend, Wn as applyCallerIdentityCredentials, Wo as Synthesizer, Wr as malformedStateRefusalMessage, Wt as bindingSkippedOutputs, X as NESTED_PENDING_PARENT_REASON, Xa as hasReasonlessBaselineRefusal, Xo as resolveCaptureObservedState, Xr as refuseMalformedOrphans, Xt as ledgerForStack, Y as planOrphanAdoption, Ya as hasReadableExportSet, Yo as resolveAutoAssetStorage, Yr as refuseMalformedOrphanRecordsForDestroy, Z as dropSettledNestedJournals, Za as hasUnverifiableParameterRefusal, Zi as prefetchCreateOnlyPropertyPaths, Zo as resolveSkipPrefix, Zr as refuseMalformedOrphansForDestroy, _ as perType, _a as recordLogOnlyValue, _i as repairMalformedOutputsForReadOnly, _n as ccProtectionRegistryTypes, _o as isCrossRegionRedirect, _r as UNREADABLE_ORPHANS_CONTAINER_ROW, _s as processStackMessages, _t as inheritProducerRegions, a as conditionInputsFrom, aa as DagBuilder, ai as refuseMalformedResourceEntriesForImport, ao as isSensitiveAttributeName, ar as carriesFetchableDynamicReference, as as CFN_TEMPLATE_URL_LIMIT, at as replayFailedOperations, ba as errorCauseChain, bi as repairMalformedResourcesForReadOnly, bn as deleteIndeterminateGuards, bo as validateAssetBucketName, br as displayLogicalId, bs as hasPlainPrototype, bt as buildFinalSnapshotIdentifier, c as isSecretBearingReferenceString, ca as inheritNestedStackParameterAssociations, ci as refuseMalformedResourcePropertiesForDrift, co as buildAssetRedirectMap, cr as AWS_NO_VALUE, cs as uploadCfnTemplate, ct as destroyStackRecordsView, d as makeCanonicalizePropertiesFn, da as createUnionSecretMasker, di as refuseMalformedResourcesForDeploy, dn as ccBrokenReason, do as rewriteTemplateAssetReferences, dr as refStateLookupFromResource, ds as expectedOwnerParam, dt as recordAfterRollbackUpdate, ea as withRetry, ei as refuseMalformedOutputsForDestroy, eo as isReadableBag, er as isUnboundTemplateParameter, es as resolveUseCdkBootstrapAssets, f as withResourceDeadline, fa as hasMaskableValues, fi as refuseMalformedResourcesForDestroy, fn as wouldReturnToSdkProvider, fo as AssetModeResolver, fs as PARTITION_TABLE, ft as planFailedOps, g as isProtectionValueActive, ga as recordLogOnlyParameterValue, gi as repairMalformedOrphansForReadOnly, gn as slowCcOperationTimeoutMs, go as getBootstrapMarkerKey, gr as STATE_RESOURCES_MALFORMED, gs as StageLoadError, h as PROTECTION_PROPERTY_BY_TYPE, ha as printingCorpusOf, hi as repairMalformedOrphanRecordsForReadOnly, hn as CloudControlProvider, ho as ensureAssetStorage, hr as STATE_REGION_DIVERGED, hs as AssemblyReader, ht as findNestedStackTypeChanges, i as conditionFingerprint, ii as refuseMalformedResourceEntriesForDestroy, io as AssetPublisher, ir as carriesDynamicReference, is as CFN_TEMPLATE_BODY_LIMIT, it as withNestedStackContext, ja as identityKeyFor, ji as shownType, jn as DiffCalculator, jo as getDockerCmd, jr as malformedLocalResourcesWarning, jt as extractDeploymentEventError, ka as isUncertifiedBaselineMaskPosition, ki as hasNoCloudControlHandlers, ko as finchSecretArgvRefusal, kr as malformedLocalOutputsWarning, ks as resolveBucketRegion, kt as DeploymentEventsReader, l as keptWholeReasonText, la as recordNestedStackParameterExpressions, li as refuseMalformedResourcePropertiesForExport, ln as CC_BROKEN_REASON, lo as createAssetRedirectResolver, lr as cfnRefValueFromPhysicalId, ls as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, m as recordedProtectionNote, ma as logOnlyValueCount, mi as refuseMalformedState, mo as assertAssetBucketRegion, mr as JSON_LISTING_HOLE_VALUE, ms as derivePartitionAndUrlSuffix, mt as resolveReplacementOldType, n as IMPLICIT_DELETE_DEPENDENCIES, ni as refuseMalformedResourceEntries, no as orphansCarriedFrom, nr as getAccountInfo, ns as warnDeprecatedNoPrefixCliFlag, nt as withNestedRevertRun, o as parentSuppliedValues, oa as TemplateParser, oi as refuseMalformedResourceEntriesForImportSave, oo as stringifyValue, or as isNamelessDynamicReferenceError, os as MIGRATE_TMP_PREFIX, ot as replayRollback, p as recordedProtectionEvidence, pa as literalSplitDelimitersOf, pi as refuseMalformedResourcesForExport, pn as isCustomResourceType$1, po as BOOTSTRAP_MARKER_PREFIX, pr as withSharedDrainBudget, ps as canonicalizeRegion, pt as planRollback, q as resourcesNamingDeclaredParameter, qa as describeRegionValueKind, qo as getLegacyStateBucketName, qt as maskingRetryLogger, r as computeImplicitDeleteEdges, ri as refuseMalformedResourceEntriesForDeploy, ro as shouldRetainResource, rr as isImpossibleEmptyStoredAttribute, rs as ssmResolvedValueType, s as readRecordedConditionVerdicts, sa as liveMatchesUnresolvedTokenFrame, si as refuseMalformedResourceEntriesForOrphan, so as WorkGraph, sr as keepsSecretReferenceToken, ss as findLargeInlineResources, t as DeployEngine, ti as refuseMalformedResourceAttributesForOrphan, to as orphansAfterRollback, tr as parameterTypeMayLoseSecretIdentity, ts as stateBucketExistenceConfirmed, tt as revertedNestedRowIds, u as mergeNoChangeOutputs, ua as carryLogOnlyValues, ui as refuseMalformedResourcePropertiesForOrphan, un as ProviderRegistry, uo as loadPublishableAssetManifest, ur as isStalePlaceholderArnAttribute, us as decodeListingKey, ut as withStackRecords, v as readProtection, va as shareLogOnlyValues, vi as repairMalformedResourceEntriesForReadOnly, vo as parseBootstrapMarker, vr as UNREADABLE_RESOURCES_MAP_ROW, vs as defineOwnKey, vt as ATOMIC_FINAL_SNAPSHOT_TYPES, wa as redactSecretsForState, wi as findActionableSilentDrops, wo as resolveDockerContextDirectory, wr as isReadableOrphanRecord, ws as describeFileReadFailure, wt as isFinalSnapshotError, xa as maskSecretsInError, xi as unpreviewableOrphanRecords, xn as deleteSkipReason, xo as validateContainerRepoName, xr as hasReadableOrphans, xs as nullPrototypeRecord, xt as ccRoutedFinalSnapshotError, ya as createSecretMasker, yi as repairMalformedResourcePropertiesForReadOnly, yn as UNSPECIFIED_SKIP_REASON, yo as readBootstrapMarkerBody, yr as deployRefusesOrphanRowsReason, ys as hasOwnKey, yt as PRE_DELETE_SNAPSHOT_TYPES, z as cyan, za as TEMPLATE_SOURCED_RULES, zn as assertSendableRoleArn, zo as warnFinchArgvExposure, zr as malformedRenderedContainersWarning, zt as isWholeDynamicReferenceValue } from "./deploy-engine-BTOCDCWf.js";
-import { t as getCdkdVersion } from "./version-QrNvZCe0.js";
+import { $ as resourcesNamingDeclaredParameter, $a as STATE_SOURCED_READBACK_RULES, $n as explicitRoleArnOrThrow, $o as runDockerForeground, $r as malformedOutputsWarning, $t as noEchoParameterValueSeed, Aa as printingCorpusOf, Ai as repairMalformedOrphanRecordsForReadOnly, An as ccProtectionRegistryTypes, Ao as assertAssetBucketRegion, Ar as STATE_REGION_DIVERGED, As as derivePartitionAndUrlSuffix, At as ccRoutedFinalSnapshotError, Ba as scrubResourceRecord, Bo as resolveDockerContextDirectory, Br as isReadableResourceEntry, Bs as describeFileReadFailure, Bt as updatePartialMessage, C as perType, Ca as inheritNestedStackParameterAssociations, Ci as refuseMalformedResourcePropertiesForDrift, Cn as ProviderRegistry, Co as WorkGraph, Cr as isStalePlaceholderArnAttribute, Cs as findLargeInlineResources, Ct as resolveReplacementOldType, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Do as rewriteTemplateAssetReferences, Dr as parameterInputsFor, Ds as expectedOwnerParam, Dt as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as createUnionSecretMasker, Ei as refuseMalformedResourcesForDeploy, En as isCustomResourceType$1, Eo as loadPublishableAssetManifest, Er as withSharedDrainBudget, Es as decodeListingKey, Et as inheritProducerRegions, Fa as errorCauseChain, Fi as repairMalformedResourcesForReadOnly, Fo as readBootstrapMarkerBody, Fr as displayLogicalId, Fs as hasOwnKey, Ft as unsupportedFinalSnapshotError, G as cyan, Ga as pathCrossesDottedKey, Gi as findReplacedReadersOfRecreateTargets, Gn as INTRINSIC_KEYS, Go as finchSecretArgvRefusal, Gr as malformedLocalResourceEntriesWarning, Gs as resolveBucketRegion, Gt as WITHHELD_NAME_DISPLAY, H as formatResourceLine, Ha as DYNAMIC_REFERENCE_TOKEN_SCAN, Ho as describeDockerExecFailure, Hr as malformedExportNamesWarning, Hs as renderAssemblyPathEscape, Ht as DeploymentEventsReader, Ia as maskSecretsInError, Ii as unpreviewableOrphanRecords, In as isWaitAbandonedError, Io as validateAssetBucketName, Ir as hasReadableOrphans, Is as hasPlainPrototype, J as red, Ja as recordMaskOnlyValue, Ji as isStatefulRecreateTargetForReplace, Jn as producerRegionsFromState, Jo as isDockerClientEnvKey, Jr as malformedOrphanRecordsWarning, Jt as secretBearing, K as gray, Ka as identityKeyFor, Ki as shownType, Kn as IntrinsicFunctionResolver, Ko as formatDockerLoginError, Kr as malformedLocalResourcesWarning, Kt as displayTextOrWithheld, La as maskSecretsInText, Li as unreadableOrphanRecords, Lo as validateContainerRepoName, Lr as hasReadableOutputs, Ls as nullPrototypeRecord, Ma as recordLogOnlyValue, Mi as repairMalformedOutputsForReadOnly, Mn as UNSPECIFIED_SKIP_REASON, Mo as getBootstrapMarkerKey, Mr as UNREADABLE_ORPHANS_CONTAINER_ROW, Ms as StageLoadError, Mt as effectiveDeletionPolicy, Na as shareLogOnlyValues, Ni as repairMalformedResourceEntriesForReadOnly, Nn as deleteIndeterminateGuards, No as isCrossRegionRedirect, Nr as UNREADABLE_RESOURCES_MAP_ROW, Ns as processStackMessages, Nt as isFinalSnapshotError, Oa as literalSplitDelimitersOf, Oi as refuseMalformedResourcesForExport, On as CloudControlProvider, Oo as AssetModeResolver, Os as PARTITION_TABLE, Ot as PRE_DELETE_SNAPSHOT_TYPES, Pa as createSecretMasker, Pi as repairMalformedResourcePropertiesForReadOnly, Pn as deleteSkipReason, Po as parseBootstrapMarker, Pr as deployRefusesOrphanRowsReason, Ps as defineOwnKey, Pt as refusesFinalSnapshot, Q as reachableDivergentParameters, Qa as STATE_SOURCED_CROSS_GENERATION_RULES, Qn as assertSendableRoleArn, Qo as redactedDockerCause, Qr as malformedOutputsRefusalMessage, Qt as isWholeDynamicReferenceValue, Ra as markSameGenerationBag, Ri as unreadableResourceEntries, Ro as buildDenyExternalAccessPolicy, Rr as hasReadableResources, Rs as ownValue, S as isProtectionValueActive, Sa as liveMatchesUnresolvedTokenFrame, Si as refuseMalformedResourceEntriesForOrphan, Sn as CC_BROKEN_REASON, So as stringifyValue, Sr as cfnRefValueFromPhysicalId, Ss as MIGRATE_TMP_PREFIX, St as planRollback, Ta as carryLogOnlyValues, Ti as refuseMalformedResourcePropertiesForOrphan, Tn as wouldReturnToSdkProvider, To as createAssetRedirectResolver, Ts as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, U as createReadOnlyAttributeHealerFactory, Ua as dynamicReferenceTokens, Ui as NO_CC_HANDLERS_REASON, Uo as describeDockerFailure, Ur as malformedExportSourceWarning, Us as resolveAssemblyPath, Ut as DeploymentEventsStore, Vi as unwrittenCreateOnlyReplacement, Vo as describeDockerCapturedOutput, Vr as malformedDriftResourcePropertiesWarning, Vs as displayAssemblyPath, Vt as updatePartialReason, W as bold, Wa as isUncertifiedBaselineMaskPosition, Wi as hasNoCloudControlHandlers, Wn as DiffCalculator, Wo as dockerSpawnEnvWithSensitive, Wr as malformedLocalOutputsWarning, Wt as extractDeploymentEventError, X as computeParameterTaint, Xa as recordNoEchoAttributeValues, Xi as renderStatefulReason, Xn as applyRoleArnIfSet, Xo as partitionSensitiveEnv, Xr as malformedOrphansRefusalMessage, Xt as secretSafeKeyDisplay, Y as yellow, Ya as recordMaskOnlyValuesIn, Yi as isStatefulRecreateTargetSync, Yn as regionLessSecretName, Yo as isMalformedEnvKey, Yr as malformedOrphanRowsKeptWarning, Yt as secretBearingStateKeyWarning, Z as namesAnyDeclaredParameter, Za as STATE_SOURCED_BASELINE_RULES, Zn as assertFlagRoleArn, Zo as redactDockerArgvValues, Zr as malformedOrphansWarning, Zt as exportNameSecretExposure, _ as makeCanonicalizePropertiesFn, _i as refuseMalformedResourceEntries, _o as orphansAfterRollback, _r as carriesDynamicReference, _s as stateBucketExistenceConfirmed, _t as destroyStackRecordsView, a as findNestedTemplateTreeDefect, ai as malformedStateRefusalMessage, an as DEFAULT_RESOURCE_WARN_AFTER_MS, ao as S3StateBackend, ar as envCredentialsAreAssumedRole, as as getDockerImageBySourceHash, at as dropSettledNestedJournals, b as recordedProtectionNote, ba as DagBuilder, bi as refuseMalformedResourceEntriesForImport, bo as AssetPublisher, br as keepsSecretReferenceToken, bs as CFN_TEMPLATE_BODY_LIMIT, bt as recordAfterRollbackUpdate, c as renderNestedTemplateTreeDefect, co as acceptedCreateOnlyDropsOf, cs as getDefaultStateBucketName, ct as recordDisplacedSkips, d as conditionInputsFrom, di as refuseMalformedOrphans, dn as withCreateTokenLedger, do as hasReadableExportSet, ds as resolveAutoAssetStorage, dt as withNestedRevertRun, ei as malformedRenderedContainersWarning, en as collectDeclaredOutputNames, eo as TEMPLATE_SOURCED_RULES, er as isIamRoleArn, es as runDockerStreaming, et as makeSiblingClaimReader, f as parentSuppliedValues, fa as prefetchCreateOnlyPropertyPaths, fi as refuseMalformedOrphansForDestroy, fo as hasReasonlessBaselineRefusal, fr as coerceParameterTypedValue, fs as resolveCaptureObservedState, g as mergeNoChangeOutputs, gi as refuseMalformedResourceAttributesForOrphan, go as isReadableBag, gr as isImpossibleEmptyStoredAttribute, gs as resolveUseCdkBootstrapAssets, h as keptWholeReasonText, ha as withRetry, hi as refuseMalformedOutputsForDestroy, ho as importableOutputs, hr as getAccountInfo, hs as resolveStateBucketWithDefaultAndSource, ht as replayRollback, i as childTemplateLoader, ii as malformedScrubResourceEntriesRefusalMessage, in as DEFAULT_RESOURCE_TIMEOUT_MS, io as isLockInfoExpired, ir as callerEnvCredentials, is as AssetManifestLoader, it as displacedPhysicalIdShown, ja as recordLogOnlyParameterValue, ji as repairMalformedOrphansForReadOnly, jo as ensureAssetStorage, jr as STATE_RESOURCES_MALFORMED, js as AssemblyReader, jt as createPreDeleteFinalSnapshot, ka as logOnlyValueCount, ki as refuseMalformedState, kn as slowCcOperationTimeoutMs, ko as BOOTSTRAP_MARKER_PREFIX, kr as JSON_LISTING_HOLE_VALUE, ks as canonicalizeRegion, kt as buildFinalSnapshotIdentifier, l as templateIdentity, li as refuseMalformedOrphanRecords, ln as ledgerForStack, lo as describeRegionValueKind, ls as getLegacyStateBucketName, m as isSecretBearingReferenceString, ma as describeTypeWithThrottleRetry, mi as refuseMalformedOutputs, mo as importableOutputKeys, mr as parameterTypeMayLoseSecretIdentity, ms as resolveStateBucketWithDefault, mt as replayFailedOperations, n as IMPLICIT_DELETE_DEPENDENCIES, ni as malformedResourcePropertiesWarning, nn as isExportAliasCollision, no as isSingleDynamicReferenceToken, nr as AWS_CREDENTIAL_ENV_KEYS, ns as escapeRegExp, nt as NESTED_PENDING_PARENT_REASON, o as isAbsoluteAssetPath, oi as previewableOrphanRecords, on as maskingRetryLogger, oo as rebuildClientForBucketRegion, os as Synthesizer, p as readRecordedConditionVerdicts, pa as templateResourceTypes, pi as refuseMalformedOrphansForOrphan, po as hasUnverifiableParameterRefusal, pr as isUnboundTemplateParameter, ps as resolveSkipPrefix, pt as withNestedStackContext, q as green, qa as carriesSecretMask, qi as MULTI_REGION_RECREATE_BLOCKED_TYPES, qn as classifyReplaySecretRegion, qo as getDockerCmd, qr as malformedOrphanRecordsRefusalMessage, qt as exportAliasCollisionScrubWarning, r as computeImplicitDeleteEdges, ri as malformedResourcesWarning, rn as bindingSkippedOutputs, ro as LockManager, rr as applyCallerIdentityCredentials, rs as stripControlChars, rt as displacedOpClause, s as listNestedTemplateRows, si as refuseDivergentRecordRegionForDestroy, sn as RollbackInlinePolicyWriters, so as splitImportedOps, ss as synthesisStatusMessage, st as nestedChildStackName$1, t as DeployEngine, ti as malformedResourceEntriesWarning, tn as collectPublishedOutputNames, to as WHOLE_DYNAMIC_REFERENCE_PATTERN, tr as sendableAssumeRoleCommand, ts as warnFinchArgvExposure, tt as planOrphanAdoption, u as conditionFingerprint, ui as refuseMalformedOrphanRecordsForDestroy, uo as exportNamesCarriedFrom, us as resolveApp, ut as revertedNestedRowIds, v as withResourceDeadline, vi as refuseMalformedResourceEntriesForDeploy, vo as orphansCarriedFrom, vr as carriesFetchableDynamicReference, vs as warnDeprecatedNoPrefixCliFlag, w as readProtection, wa as recordNestedStackParameterExpressions, wi as refuseMalformedResourcePropertiesForExport, wn as ccBrokenReason, wo as buildAssetRedirectMap, wr as refStateLookupFromResource, ws as uploadCfnTemplate, wt as findNestedStackTypeChanges, x as PROTECTION_PROPERTY_BY_TYPE, xa as TemplateParser, xi as refuseMalformedResourceEntriesForImportSave, xo as isSensitiveAttributeName, xr as AWS_NO_VALUE, xs as CFN_TEMPLATE_URL_LIMIT, xt as planFailedOps, y as recordedProtectionEvidence, yi as refuseMalformedResourceEntriesForDestroy, yo as shouldRetainResource, yr as isNamelessDynamicReferenceError, ys as ssmResolvedValueType, yt as withStackRecords, za as redactSecretsForState, zi as findActionableSilentDrops, zo as buildDockerImage, zr as isReadableOrphanRecord, zs as absoluteAssemblyPathEscape } from "./deploy-engine-CMRU0DTu.js";
+import { t as getCdkdVersion } from "./version-DIQcU8CA.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1880,147 +1880,6 @@ function analyzePinCcApiReachability(pinnedLogicalIds, stacks) {
 	};
 }
 
-//#endregion
-//#region src/utils/nested-template-cycle.ts
-const NESTED_STACK_TYPE$2 = "AWS::CloudFormation::Stack";
-function isAbsoluteAssetPath(p) {
-	return path.isAbsolute(p) || p.startsWith("/");
-}
-function templateIdentity(templatePath) {
-	const dir = path.dirname(templatePath);
-	let realDir;
-	try {
-		realDir = fs.realpathSync.native(dir);
-	} catch {
-		realDir = path.resolve(dir);
-	}
-	return path.join(realDir, path.basename(templatePath));
-}
-function listNestedTemplateRows(template) {
-	if (template === null || typeof template !== "object") return [];
-	const resources = template.Resources;
-	if (resources === null || resources === void 0) return [];
-	const rows = [];
-	for (const [logicalId, resource] of Object.entries(resources)) {
-		const row = resource;
-		if (row?.Type !== NESTED_STACK_TYPE$2) continue;
-		const assetPath = row.Metadata?.["aws:asset:path"];
-		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		rows.push({
-			logicalId,
-			assetPath
-		});
-	}
-	return rows;
-}
-function readNestedRows(templatePath) {
-	let parsed;
-	try {
-		parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
-	} catch {
-		return;
-	}
-	return listNestedTemplateRows(parsed);
-}
-const MAX_NESTING_DEPTH = 512;
-const MAX_ROWS_FOLLOWED = 1e4;
-function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = []) {
-	const onChain = /* @__PURE__ */ new Set();
-	for (const p of ancestorTemplatePaths) onChain.add(templateIdentity(p));
-	const clean = /* @__PURE__ */ new Set();
-	const chain = [];
-	let rowsFollowed = 0;
-	const visit = (logicalId, templatePath) => {
-		if (typeof templatePath !== "string") return void 0;
-		const identity = templateIdentity(templatePath);
-		const lexical = path.resolve(templatePath);
-		chain.push({
-			logicalId,
-			templatePath: identity
-		});
-		try {
-			if (onChain.has(identity)) return {
-				kind: "cycle",
-				chain: [...chain]
-			};
-			if (chain.length > 512) return {
-				kind: "too-deep",
-				chain: [...chain]
-			};
-			if (++rowsFollowed > 1e4) return {
-				kind: "too-large",
-				chain: [...chain]
-			};
-			if (clean.has(lexical)) return void 0;
-			const rows = readNestedRows(templatePath);
-			if (rows === void 0) return void 0;
-			onChain.add(identity);
-			try {
-				const dir = path.dirname(templatePath);
-				for (const row of rows) {
-					if (isAbsoluteAssetPath(row.assetPath)) return {
-						kind: "absolute-path",
-						chain: [...chain],
-						logicalId: row.logicalId,
-						assetPath: row.assetPath
-					};
-					const resolved = resolveAssemblyPath(dir, row.assetPath);
-					if (!resolved.contained) return {
-						kind: "escaping-path",
-						chain: [...chain],
-						logicalId: row.logicalId,
-						assetPath: row.assetPath,
-						escape: resolved,
-						dir
-					};
-					const defect = visit(row.logicalId, resolved.path);
-					if (defect) return defect;
-				}
-			} finally {
-				onChain.delete(identity);
-			}
-			clean.add(lexical);
-			return;
-		} finally {
-			chain.pop();
-		}
-	};
-	for (const [logicalId, templatePath] of Object.entries(nestedTemplates)) {
-		const defect = visit(logicalId, templatePath);
-		if (defect) return defect;
-	}
-}
-const MAX_RENDERED_HOPS = 8;
-function renderChain(chain) {
-	const hop = (h) => `${displayIdent(h.logicalId)} (${displayAssemblyPath(h.templatePath)})`;
-	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" then ");
-	const keep = MAX_RENDERED_HOPS / 2;
-	return [
-		...chain.slice(0, keep).map(hop),
-		`... ${chain.length - 8} more ...`,
-		...chain.slice(-4).map(hop)
-	].join(" then ");
-}
-function renderNestedTemplateTreeDefect(defect, stackName, action) {
-	const provenance = `CDK emits an acyclic nested template tree with relative asset paths, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
-	const owner = (chain) => {
-		const ids = chain.slice(0, -1).map((h) => h.logicalId);
-		const keep = MAX_RENDERED_HOPS / 2;
-		if (ids.length <= MAX_RENDERED_HOPS) return displayStackName([stackName, ...ids].join("~"));
-		const head = displayStackName([stackName, ...ids.slice(0, keep)].join("~"));
-		const tail = displayStackName(ids.slice(-4).join("~"));
-		return `${head}~...${ids.length - 8} more...~${tail}`;
-	};
-	if (defect.kind === "cycle") {
-		const closing = defect.chain[defect.chain.length - 1];
-		return `The nested template tree under stack ${displayStackName(stackName)} contains a cycle: ${renderChain(defect.chain)}. Nested stack ${displayIdent(closing.logicalId)} (declared in stack ${owner(defect.chain)}) resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
-	}
-	if (defect.kind === "too-large") return `The nested template tree under stack ${displayStackName(stackName)} has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
-	if (defect.kind === "too-deep") return `The nested template tree under stack ${displayStackName(stackName)} nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
-	if (defect.kind === "escaping-path") return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
-	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
-}
-
 //#endregion
 //#region src/cli/commands/nested-template-preflight.ts
 function refuseMalformedNestedTemplateTrees(stacks) {
@@ -2503,7 +2362,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-DCbt28RB.js");
+	providerClasses ??= import("./provider-classes-5NUmLSTV.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4632,7 +4491,40 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			deployRefusals.push(deployRefusesOrphanRowsReason(previewedRowsTheDeployRefuses));
 		}
 	}
-	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog);
+	let maskedInputs;
+	if (options.previewMaskedInputs === true) {
+		const classified = parameterInputsFor({
+			template,
+			values: mergedParameters,
+			unbound: unboundParameterNames
+		});
+		const resourcesForInputs = stateForDiff.resources;
+		maskedInputs = { sources: {
+			template: effectiveTemplate,
+			parameterInput: classified.parameterInput,
+			conditions,
+			childTemplate: childTemplateLoader(options.nestedTemplates),
+			resolve: async (node) => {
+				const secrets = /* @__PURE__ */ new Map();
+				return {
+					value: await intrinsicResolver.resolve(structuredClone(node), {
+						recordedSecretValues: secrets,
+						template: effectiveTemplate,
+						resources: resourcesForInputs,
+						stateBackend,
+						stackName,
+						bestEffort: true,
+						...Object.keys(classified.bound).length > 0 && { parameters: classified.bound },
+						...conditions && Object.keys(conditions).length > 0 && { conditions },
+						skipDynamicReferences: true,
+						staleAttributeHeal: { phase: "probe" }
+					}),
+					secrets
+				};
+			}
+		} };
+	}
+	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs);
 	const nestedStackTypeChanges = findNestedStackTypeChanges({
 		changes,
 		stateResources: stateForDiff.resources
@@ -4912,7 +4804,9 @@ async function buildDiffTree(args) {
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
 			...attributeHealer && { attributeHealer },
-			inheritSecretBearingTemplate: false
+			inheritSecretBearingTemplate: false,
+			previewMaskedInputs: !isNestedChild,
+			nestedTemplates
 		});
 	} finally {
 		createOnlyPrefetch.cancel();
@@ -5184,7 +5078,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement && (propChange.inPlacePropagated === true || propChange.replacementPropagated === true) ? " [may require replacement]" : propChange.requiresReplacement ? " [requires replacement]" : "";
-				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.inPlacePropagated ? " [attribute propagated]" : "";
+				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.inPlacePropagated ? " [attribute propagated]" : propChange.maskedExpressionChanged === true ? " [masked input or expression changed]" : "";
 				const indent = "              ";
 				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
 				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
@@ -6726,6 +6620,7 @@ function abandonedScanVerdict(source, err) {
 }
 function abandonedUnitVerdict(entry) {
 	if (!entry.carriedDynamicReference) return "silent";
+	if (entry.unit === "placeholder") return "count";
 	if (isTemplateShapeResolutionFailure(entry.error) || !entry.carriedFetchableReference) return "warn";
 	return "count";
 }
@@ -6962,6 +6857,25 @@ function makeCrossStackPrePass(deps) {
 		await walk(bag, "", canRefuse);
 	};
 }
+async function bindDefaultedParametersOneByOne(resolver, template, shownStack, logger) {
+	const bound = nullPrototypeRecord();
+	const declared = template.Parameters;
+	if (declared === void 0 || declared === null || typeof declared !== "object") return bound;
+	for (const [name, definition] of Object.entries(declared)) {
+		if (definition === null || typeof definition !== "object" || !("Default" in definition)) continue;
+		if (definition.Default === "") continue;
+		try {
+			const one = await resolver.resolveParameters({
+				...template,
+				Parameters: { [name]: definition }
+			});
+			if (Object.hasOwn(one, name)) bound[name] = one[name];
+		} catch (err) {
+			logger.debug(safeMsg`Parameter ${name} of ${shownStack} left unbound: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	}
+	return bound;
+}
 function exportNameDisplayOver(outputSecrets, extra, withheld) {
 	const corpus = new Map([...printingCorpusOf(outputSecrets), ...extra ?? []]);
 	return (exportName, alsoMask) => {
@@ -7110,6 +7024,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				throw new ScrubRefusalError(`Nested stack ${shownStack}: its Parameters could not be resolved against its own template (${reason}), so its secrets cannot be identified. Its record was NOT examined and may still hold plaintext.`, "SCRUB_NESTED_CHILD_UNRESOLVABLE");
 			}
 			logger.debug(`Parameter resolution skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			parameters = await bindDefaultedParametersOneByOne(resolver, stack.template, shownStack, logger);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
 		const resolverContext = (recordedSecretValues) => ({
@@ -8234,7 +8149,18 @@ async function driftCommand(stacks, options) {
 			return scope;
 		};
 		const resolvePrincipalUniqueId = createIamPrincipalUniqueIdResolver(awsClients);
-		const targetRefs = resolveTargetRefs(stacks, await stateBackend.listStacks(), options);
+		const stateRefs = await stateBackend.listStacks();
+		const targetRefs = resolveTargetRefs(stacks, stateRefs, options);
+		const selectedKeys = new Set(targetRefs.map(stackRefKey));
+		const stateKeys = new Set(stateRefs.map(stackRefKey));
+		const nestedChildRecord = (childStackName, region) => {
+			const key = stackRefKey({
+				stackName: childStackName,
+				region
+			});
+			if (selectedKeys.has(key)) return "selected";
+			return stateKeys.has(key) ? "unselected" : "missing";
+		};
 		const reports = [];
 		for (const ref of targetRefs) {
 			if (!ref.region) {
@@ -8252,7 +8178,7 @@ async function driftCommand(stacks, options) {
 			}
 			const stackRegion = ref.region;
 			const scope = stackRegionScope(stackRegion);
-			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair"));
+			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair", nestedChildRecord));
 			reports.push(report);
 		}
 		if (options.json) writeJsonReport(reports);
@@ -8267,6 +8193,7 @@ async function driftCommand(stacks, options) {
 		}
 		const mode = options.accept ? "accept" : "revert";
 		const refusedDeleted = refuseDeletedForRemediation(reports, mode, logger);
+		const anyRefusedDeleted = refusedDeleted.deleted + refusedDeleted.recordMissing > 0;
 		if (!reports.some((r) => r.outcomes.some((o) => matchOutcome(o, {
 			drifted: () => true,
 			clean: () => false,
@@ -8275,7 +8202,7 @@ async function driftCommand(stacks, options) {
 			skipped: () => false,
 			deleted: () => false
 		})))) {
-			if (refusedDeleted > 0) {
+			if (anyRefusedDeleted) {
 				if (anyIncomplete) {
 					for (const line of incompleteRemediationMessage(reports, mode).slice(0, -1)) logger.info(line);
 					logger.info(safeMsg`Re-run 'cdkd drift' without --${mode} to see which resources and why — ` + `with a deleted resource in the stack, that run exits 1.`);
@@ -8295,28 +8222,72 @@ async function driftCommand(stacks, options) {
 		else try {
 			outcome = await runRevert(reports, stackRegionScope, stateBackend, stateConfig, awsClients, options);
 		} catch (err) {
-			if (refusedDeleted > 0 && err instanceof PartialFailureError) throw new PartialFailureError(`${err.message} ${deletedRefusalError(refusedDeleted, mode).message}`, err);
+			if (anyRefusedDeleted && err instanceof PartialFailureError) throw new PartialFailureError(`${err.message} ${deletedRefusalError(refusedDeleted, mode).message}`, err);
 			throw err;
 		}
-		if (refusedDeleted > 0 && !options.dryRun && outcome !== false) throw deletedRefusalError(refusedDeleted, mode);
+		if (anyRefusedDeleted && !options.dryRun && outcome !== false) throw deletedRefusalError(refusedDeleted, mode);
 	} finally {
 		for (const { clients } of stackRegionScopes.values()) clients.destroy();
 		awsClients.destroy();
 	}
 }
 function refuseDeletedForRemediation(reports, mode, logger) {
-	let refused = 0;
+	const refused = {
+		deleted: 0,
+		recordMissing: 0
+	};
 	for (const report of reports) for (const outcome of report.outcomes) {
 		if (outcome.kind !== "deleted") continue;
-		refused += 1;
+		if (outcome.nestedStackRecordMissing === true) {
+			refused.recordMissing += 1;
+			logger.warn(safeMsg`  ! ${reportHeading(report)} ${reportResource(outcome)}: NOT ` + (mode === "revert" ? "reverted" : "accepted") + safeMsg` — ${nestedRecordMissingClause(report, outcome)} ${NESTED_RECORD_MISSING_REMEDY}`);
+			continue;
+		}
 		logger.warn(safeMsg`  ! ${reportHeading(report)} ${reportResource(outcome)}: NOT ` + (mode === "revert" ? "reverted — AWS reports this resource no longer exists (deleted outside cdkd), and --revert updates a resource in place: it cannot recreate one." : "accepted — AWS reports this resource no longer exists (deleted outside cdkd), so there is no AWS-current value to write to state.") + safeMsg` ${DELETED_RESOURCE_REMEDY}`);
+		refused.deleted += 1;
 	}
 	return refused;
 }
-function deletedRefusalError(count, mode) {
-	return new PartialFailureError(`${count} resource(s) deleted outside cdkd were not ${mode === "accept" ? "accepted" : "reverted"}; each is named above.`);
+function deletedRefusalError({ deleted, recordMissing }, mode) {
+	const verb = mode === "accept" ? "accepted" : "reverted";
+	const parts = [...deleted > 0 ? [`${deleted} resource(s) deleted outside cdkd`] : [], ...recordMissing > 0 ? [`${recordMissing} nested stack(s) whose state record is gone`] : []];
+	return new PartialFailureError(`${parts.join(" and ")} were not ${verb}; each is named above.`);
 }
 const DELETED_RESOURCE_REMEDY = "First confirm it is really gone (in the AWS console or with the AWS CLI). A deploy that does not change it will not recreate it: to recreate it, remove it from the CDK app and deploy, then restore it and deploy again; if it is meant to be gone, the first of those deploys is enough. Anything in the app that references it has to come out with it, and that deploy DELETES those resources too.";
+const NESTED_RECORD_MISSING_REMEDY = "If the parent was imported with 'cdkd import --migrate-from-cloudformation' and that import stopped part-way, its nested stacks were not recorded yet: re-run that import with --force, which rebuilds the parent record from the stack and then records them. Otherwise the resources the nested stack held are no longer tracked by cdkd and may still exist in AWS, and recreating it can collide with them. A deploy that does not change the nested stack will not recreate it: to recreate it, remove it from the CDK app and deploy, then restore it and deploy again; if it is meant to be gone, the first of those deploys is enough.";
+function nestedRecordMissingClause(report, outcome) {
+	return safeMsg`its nested stack's own state record ${reportIdent(nestedChildStackName(report.stackName, outcome.logicalId), STACK_REF_MAX_CODE_POINTS)} is not in state.`;
+}
+function nestedChildStackName(parentStackName, logicalId) {
+	return `${parentStackName}~${logicalId}`;
+}
+function stackRefKey(ref) {
+	return producerRecordKey(ref.stackName, ref.region ?? "");
+}
+function isNestedDescendantOf(ref, ancestor) {
+	return ancestor.region !== void 0 && ref.region === ancestor.region && ref.stackName.startsWith(`${ancestor.stackName}~`);
+}
+function compareNestedStackNames(a, b) {
+	const as = a.split("~");
+	const bs = b.split("~");
+	for (let i = 0; i < Math.min(as.length, bs.length); i++) if (as[i] !== bs[i]) return as[i] < bs[i] ? -1 : 1;
+	return as.length - bs.length;
+}
+function withNestedDescendants(selected, stateRefs) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	const add = (ref) => {
+		const key = stackRefKey(ref);
+		if (seen.has(key)) return;
+		seen.add(key);
+		out.push(ref);
+	};
+	for (const ref of selected) {
+		add(ref);
+		stateRefs.filter((r) => isNestedDescendantOf(r, ref)).sort((a, b) => compareNestedStackNames(a.stackName, b.stackName)).forEach(add);
+	}
+	return out;
+}
 function resolveTargetRefs(stacks, stateRefs, options) {
 	if (options.all) {
 		if (stateRefs.length === 0) throw new Error("No stacks found in state bucket.");
@@ -8326,8 +8297,9 @@ function resolveTargetRefs(stacks, stateRefs, options) {
 	if (stacks.length === 0) {
 		const candidates = options.stackRegion ? stateRefs.filter((r) => r.region === options.stackRegion) : stateRefs;
 		if (candidates.length === 0) throw new Error("No stacks found in state bucket. Run `cdkd deploy` first, or pass --all explicitly.");
-		if (candidates.length === 1) return [candidates[0]];
-		const listing = candidates.map((r) => `${r.stackName}${r.region ? ` (${r.region})` : ""}`).join(", ");
+		const roots = candidates.filter((r) => !candidates.some((a) => a !== r && isNestedDescendantOf(r, a)));
+		if (roots.length === 1) return withNestedDescendants([roots[0]], candidates);
+		const listing = roots.map((r) => `${r.stackName}${r.region ? ` (${r.region})` : ""}`).join(", ");
 		throw new Error(`Multiple stacks found in state: ${listing}. Specify stack name(s) or use --all.`);
 	}
 	const out = [];
@@ -8350,7 +8322,7 @@ function resolveTargetRefs(stacks, stateRefs, options) {
 		const regions = matches.map((r) => r.region === void 0 ? "(legacy)" : regionShown(r.region)).join(", ");
 		throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Re-run with --stack-region ${commandHole("region")} to disambiguate.`);
 	}
-	return out;
+	return withNestedDescendants(out, stateRefs);
 }
 function createIamPrincipalUniqueIdResolver(awsClients) {
 	const cache = /* @__PURE__ */ new Map();
@@ -8654,7 +8626,7 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 		maskedPaths
 	};
 }
-async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode) {
+async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	return await withStackName(stackName, async () => {
@@ -8714,6 +8686,26 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 				continue;
 			}
+			if (resource.resourceType === "AWS::CloudFormation::Stack") {
+				const child = nestedChildRecord(nestedChildStackName(stackName, logicalId), region);
+				if (child === "selected") {
+					outcomes.push({
+						kind: "skipped",
+						logicalId,
+						resourceType: resource.resourceType
+					});
+					continue;
+				}
+				if (child === "missing") {
+					outcomes.push({
+						kind: "deleted",
+						logicalId,
+						resourceType: resource.resourceType,
+						nestedStackRecordMissing: true
+					});
+					continue;
+				}
+			}
 			let provider;
 			const secrets = /* @__PURE__ */ new Map();
 			try {
@@ -9870,7 +9862,8 @@ function writeJsonReport(reports) {
 			deleted: (del) => {
 				deleted.push({
 					logicalId: del.logicalId,
-					type: del.resourceType
+					type: del.resourceType,
+					...del.nestedStackRecordMissing === true && { nestedStackRecordMissing: true }
 				});
 			}
 		});
@@ -9935,6 +9928,7 @@ function writeHumanReport(reports) {
 		const unsupported = [];
 		let inspectedCount = 0;
 		let skippedCount = 0;
+		let nestedCoveredCount = 0;
 		for (const o of report.outcomes) matchOutcome(o, {
 			drifted: (d) => {
 				drifted.push(d);
@@ -9943,8 +9937,9 @@ function writeHumanReport(reports) {
 			unsupported: (u) => {
 				unsupported.push(u);
 			},
-			skipped: () => {
+			skipped: (sk) => {
 				skippedCount += 1;
+				if (sk.resourceType === "AWS::CloudFormation::Stack") nestedCoveredCount += 1;
 			},
 			clean: () => {
 				inspectedCount += 1;
@@ -9961,14 +9956,15 @@ function writeHumanReport(reports) {
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
 		if (drifted.length === 0 && deleted.length === 0) {
-			if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${reportHeading(report)}: no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
+			if (notCompared.length === 0 && nestedCoveredCount > 0 && nestedCoveredCount === report.outcomes.length) process.stdout.write(`✓ ${reportHeading(report)}: no drift detected here — ${nestedCoveredCount} nested stack${nestedCoveredCount === 1 ? "" : "s"}, each checked in its own block\n`);
+			else if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${reportHeading(report)}: no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
 			else if (notCompared.length > 0) process.stdout.write(`⚠ ${reportHeading(report)}: no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => !ANY_OF_IT_COMPARED[n.cause]) ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
 			else process.stdout.write(`✓ ${reportHeading(report)}: no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		} else {
 			const driftCount = drifted.length + deleted.length;
 			const word = driftCount === 1 ? "resource" : "resources";
 			process.stdout.write(`\n⚠ ${reportHeading(report)}: drift detected on ${driftCount} ${word}\n\n`);
-			for (const o of deleted) process.stdout.write(`  - ${reportResource(o)} — DELETED outside cdkd: AWS reports it does not exist.\n\n`);
+			for (const o of deleted) process.stdout.write(o.nestedStackRecordMissing === true ? `  - ${reportResource(o)} — RECORD MISSING: ${nestedRecordMissingClause(report, o)}\n\n` : `  - ${reportResource(o)} — DELETED outside cdkd: AWS reports it does not exist.\n\n`);
 			for (const o of drifted) {
 				process.stdout.write(`  ~ ${reportResource(o)}\n`);
 				for (const change of o.changes) {
@@ -10010,7 +10006,7 @@ function stackRegionOption$2() {
 	return new Option("--stack-region <region>", "Region of the stack record to inspect. Required when the same stack name has state in multiple regions.").argParser(parseStackRegion);
 }
 function createDriftCommand() {
-	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when nothing drifted, 1 when drift is detected, and 2 when nothing drifted but cdkd REFUSED to compare a resource, because a dynamic reference its state records could not be attributed to a region. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names)").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
+	const cmd = new Command("drift").description("Detect drift between cdkd state and AWS reality. Exits 0 when nothing drifted, 1 when drift is detected, and 2 when nothing drifted but cdkd REFUSED to compare a resource, because a dynamic reference its state records could not be attributed to a region. Pass --accept to update cdkd state from AWS, or --revert to push cdkd state values back into AWS.").argument("[stacks...]", "Stack name(s) to check (physical CloudFormation names), each with its nested stacks").option("--all", "Check every stack in the state bucket", false).option("--json", "Output as JSON", false).option("--accept", "Update cdkd state with the AWS-current values for every drifted property (state ← AWS). Mutually exclusive with --revert.", false).option("--revert", "Push cdkd state values back into AWS via provider.update for every drifted resource (AWS ← state). Mutually exclusive with --accept.", false).option("--dry-run", "Print the planned mutations without acquiring a lock or hitting AWS / S3. Honored by --accept and --revert.", false).option("--concurrency <number>", "Maximum concurrent provider.update calls during --revert", (value) => parseInt(value, 10), 4).addOption(stackRegionOption$2()).action(withErrorHandling(driftCommand));
 	[...commonOptions, ...stateOptions].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -10744,7 +10740,7 @@ async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger)
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
 		const purge = await reader.pruneRuns(stackName, region, { all: true });
-		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${displaySafe(stackName)} (${displaySafe(region)}). Where the state bucket is versioned — which bootstrapping with cdkd enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId.`);
+		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${displaySafe(stackName)} (${displaySafe(region)}) and the earlier versions of the deleted keys, unless a warning above says otherwise.`);
 		return purge;
 	} catch (purgeError) {
 		logger.warn(`  Failed to purge deployment-event history for ${displaySafe(stackName)}: ${displaySafe(purgeError instanceof Error ? purgeError.message : String(purgeError))}`);
@@ -11083,7 +11079,7 @@ async function destroyCommand(stackArgs, options) {
 	}
 }
 function createDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts CDK display paths (e.g. 'MyStage/Api') with wildcards ('MyStage/*', '**'), or exact physical CloudFormation names (e.g. 'MyStage-Api').").option("--all", "Destroy every top-level stack (top-level only; Stage stacks: '**')", false).option("--purge-events", `After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so an object listing of the state bucket comes back empty. Where the state bucket is versioned — which bootstrapping with cdkd enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: cdkd events prune ${commandHole("stack")} --all.`, false).action(withErrorHandling(destroyCommand));
+	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts CDK display paths (e.g. 'MyStage/Api') with wildcards ('MyStage/*', '**'), or exact physical CloudFormation names (e.g. 'MyStage-Api').").option("--all", "Destroy every top-level stack (top-level only; Stage stacks: '**')", false).option("--purge-events", `After a clean destroy, also delete the stack's deployment-event history (issue #808 store), purging the earlier versions of those keys on a versioned state bucket too unless a warning says otherwise. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: cdkd events prune ${commandHole("stack")} --all.`, false).action(withErrorHandling(destroyCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -15700,6 +15696,12 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "skip-already-done": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — already reverted`;
 	}
 }
+function importedOpLabel(op) {
+	return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — adopted by cdkd import after this deploy, left as it is`;
+}
+function displacedOpLabel(op, segment) {
+	return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — ${displacedOpClause(op, segment.importedResources ?? [], getLogger())}; not reverted, check that resource by hand`;
+}
 function failedActionLabel(item, skipFinalSnapshot) {
 	const { op, action } = item;
 	switch (action) {
@@ -15709,6 +15711,7 @@ function failedActionLabel(item, skipFinalSnapshot) {
 		case "orphan-failed-create-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [FAILED create, DeletionPolicy Retain — left in AWS]`;
 		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
+		case "skip-failed-mismatch": return `  - skip     ${logicalIdShown(op.logicalId)} (${resourceTypeShown(op.resourceType)}) — failed CREATE recorded ${displacedPhysicalIdShown(op, getLogger()) ?? "a physical id"}, which is not the resource state tracks under this id; not reverted, needs manual attention`;
 		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
 		case "skip-failed-type-change": return `  - skip     ${safe(op.logicalId)} (from ${safe(op.previousState?.resourceType)} to ${safe(op.resourceType)}) — failed Type change is a replacement, no in-place revert exists`;
 	}
@@ -15792,9 +15795,12 @@ async function rollbackCommand(stackArg, options) {
 			};
 			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
 			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
-			if (!options.revertFailed) for (const segment of journal.segments) for (const logicalId of revertedNestedRowIds(segment.failedOperations ?? [])) {
-				const child = nestedChildStackName(stackName, logicalId);
-				if (((await setup.stateBackend.loadRollbackJournal(child, region).catch(() => null))?.segments ?? []).some((s) => s.runId === segment.runId && s.reason !== "nested-pending-parent" && s.operations.length > 0)) throw new Error(`Nested stack ${plainOrDescribed(child, "nested stack name")} failed during a deploy this journal records, and its own journal still holds that deploy's completed operations. Re-run with --revert-failed so they are reverted in order with the parent's.`);
+			if (!options.revertFailed) for (const segment of journal.segments) {
+				const failedRows = splitImportedOps(segment.failedOperations ?? [], segment).replay;
+				for (const logicalId of revertedNestedRowIds(failedRows)) {
+					const child = nestedChildStackName$1(stackName, logicalId);
+					if (((await setup.stateBackend.loadRollbackJournal(child, region).catch(() => null))?.segments ?? []).some((s) => s.runId === segment.runId && s.reason !== "nested-pending-parent" && splitImportedOps(s.operations, s).replay.length > 0)) throw new Error(`Nested stack ${plainOrDescribed(child, "nested stack name")} failed during a deploy this journal records, and its own journal still holds that deploy's completed operations. Re-run with --revert-failed so they are reverted in order with the parent's.`);
+				}
 			}
 			const baseState = stateData.state;
 			const refusalRecovery = {
@@ -15827,20 +15833,24 @@ async function rollbackCommand(stackArg, options) {
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
 				const segment = journal.segments[s];
 				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${safe(segment.reason)}${segment.runId ? `, run ${safe(segment.runId)}` : ""}):`);
-				if (segment.failedOperations && segment.failedOperations.length > 0) {
+				const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
+				const completedOps = splitImportedOps(segment.operations, segment, orphanLogicalIds);
+				for (const op of [...failedOps.imported, ...completedOps.imported]) logger.info(importedOpLabel(op));
+				for (const op of [...failedOps.displaced, ...completedOps.displaced]) logger.info(displacedOpLabel(op, segment));
+				if (failedOps.replay.length > 0) {
 					if (options.revertFailed) {
-						const failedPlan = planFailedOps(segment.failedOperations, planStateView);
+						const failedPlan = planFailedOps(failedOps.replay, planStateView);
 						for (const item of failedPlan) {
 							logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-							if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+							if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
 						}
 						applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
-					} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${logicalIdShown(fop.logicalId)} (${resourceTypeShown(fop.resourceType)}) — its ${plainOrDescribed(fop.changeType, "change type")} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+					} else for (const fop of failedOps.replay) logger.info(`  - (left as-is) ${logicalIdShown(fop.logicalId)} (${resourceTypeShown(fop.resourceType)}) — its ${plainOrDescribed(fop.changeType, "change type")} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
 				}
-				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
+				const plan = planRollback(completedOps.replay, planStateView, orphanLogicalIds);
 				for (const item of plan) {
 					logger.info(actionLabel(item, options.skipFinalSnapshot === true));
-					if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
+					if (revertedNestedRowIds([item.op]).length > 0) for (const line of await previewNestedChildRevert(setup.stateBackend, nestedChildStackName$1(stackName, item.op.logicalId), region, segment.runId, options.skipFinalSnapshot === true)) logger.info(line);
 				}
 				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
 			}
@@ -15911,6 +15921,11 @@ async function rollbackCommand(stackArg, options) {
 				while (journal.segments.length > 0) {
 					if (interrupted) break;
 					const segment = journal.segments[journal.segments.length - 1];
+					const completedSplit = splitImportedOps(segment.operations, segment, orphanLogicalIds);
+					const completedOps = completedSplit.replay;
+					const displaced = [...completedSplit.displaced, ...splitImportedOps(segment.failedOperations ?? [], segment).displaced];
+					for (const op of displaced) logger.warn(displacedOpLabel(op, segment).trim());
+					recordDisplacedSkips(ctx.recordEvent, stackName, displaced);
 					let nestedRun;
 					const result = await withNestedStackContext({
 						stateBackend: setup.stateBackend,
@@ -15932,18 +15947,23 @@ async function rollbackCommand(stackArg, options) {
 						return inSegmentScope(segment, async () => {
 							let failedOpFailures = 0;
 							let failedOpWarnings = 0;
-							if (options.revertFailed && segment.failedOperations && segment.failedOperations.length > 0) {
-								const failedResult = await replayFailedOperations(segment.failedOperations, stateResources, stackName, ctx, {
+							const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
+							if (options.revertFailed && failedOps.replay.length > 0) {
+								const failedResult = await replayFailedOperations(failedOps.replay, stateResources, stackName, ctx, {
 									afterOp: saveState,
 									isInterrupted: () => interrupted,
-									emitEnvelope: segment.operations.length === 0,
+									emitEnvelope: completedOps.length === 0,
 									onOrphan: (record) => mintedOrphans.push(record),
 									inlinePolicyWriters
 								});
 								failedOpFailures = failedResult.failures;
 								failedOpWarnings = failedResult.warnings;
-								const remaining = failedResult.remainingFailedOps;
-								if (!declinedDivergentRewrite && remaining.length !== segment.failedOperations.length) try {
+								const remaining = [
+									...failedOps.imported,
+									...failedOps.displaced,
+									...failedResult.remainingFailedOps
+								];
+								if (!declinedDivergentRewrite && remaining.length !== (segment.failedOperations ?? []).length) try {
 									await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
 									if (remaining.length === 0) delete segment.failedOperations;
 									else segment.failedOperations = remaining;
@@ -15956,7 +15976,7 @@ async function rollbackCommand(stackArg, options) {
 									interrupted: true
 								};
 							}
-							const replayResult = await replayRollback(segment.operations, stateResources, stackName, ctx, {
+							const replayResult = await replayRollback(completedOps, stateResources, stackName, ctx, {
 								orphanLogicalIds,
 								afterOp: saveState,
 								isInterrupted: () => interrupted,
@@ -15971,7 +15991,7 @@ async function rollbackCommand(stackArg, options) {
 						});
 					}));
 					totalFailures += result.failures;
-					totalWarnings += result.warnings + (nestedRun?.warnings ?? 0);
+					totalWarnings += result.warnings + (nestedRun?.warnings ?? 0) + displaced.length;
 					if (declinedDivergentRewrite) break;
 					if (result.interrupted) {
 						interrupted = true;
@@ -16060,7 +16080,10 @@ async function previewNestedChildRevert(backend, childStackName, region, runId,
 		const view = { ...childState.state.resources };
 		const lines = [`      ${shown} replays its own journal:`];
 		for (let s = segments.length - 1; s >= 0; s--) {
-			const childPlan = planRollback(segments[s].operations, view, /* @__PURE__ */ new Set());
+			const childOps = splitImportedOps(segments[s].operations, segments[s]);
+			for (const op of childOps.imported) lines.push(`    ${importedOpLabel(op)}`);
+			for (const op of childOps.displaced) lines.push(`    ${displacedOpLabel(op, segments[s])}`);
+			const childPlan = planRollback(childOps.replay, view, /* @__PURE__ */ new Set());
 			for (const item of childPlan) lines.push(`    ${actionLabel(item, skipFinalSnapshot)}`);
 			applyPlanToPreview(childPlan, view, skipFinalSnapshot);
 		}
@@ -16138,7 +16161,7 @@ const runListToken = (value, fallback) => {
 };
 const safeText = (value) => displaySafe(value);
 const safeCount = (value) => typeof value === "number" ? String(value) : "?";
-const NONCURRENT_VERSIONS_SURVIVE_NOTE = " Where the state bucket is versioned — which bootstrapping with cdkd enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.";
+const EARLIER_VERSIONS_PURGED_NOTE = " Earlier versions of the deleted keys were purged as well, unless a warning above says otherwise.";
 async function eventsCommand(stackName, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -16253,10 +16276,10 @@ async function eventsPruneCommand(stackName, options) {
 			...olderThanMs !== void 0 && { olderThanMs }
 		});
 		if (result.deletedRunIds.length === 0) {
-			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${safeStack} (${safeRegion}); no run streams to delete. Where the state bucket is versioned — which bootstrapping with cdkd enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.` : `No runs matched the prune criteria for ${safeStack} (${safeRegion}).`));
+			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${safeStack} (${safeRegion}); no run streams to delete. Earlier versions of the deleted keys were purged as well, unless a warning above says otherwise.` : `No runs matched the prune criteria for ${safeStack} (${safeRegion}).`));
 			return;
 		}
-		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + "." + gray(NONCURRENT_VERSIONS_SURVIVE_NOTE));
+		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + "." + gray(EARLIER_VERSIONS_PURGED_NOTE));
 	} finally {
 		awsClients.destroy();
 	}
@@ -16353,7 +16376,7 @@ function createEventsCommand() {
 	return cmd;
 }
 function createEventsPruneCommand() {
-	return new Command("prune").description("Delete old per-run deployment-event streams. On a versioned state bucket this clears the object listing; earlier versions of the deleted keys survive and are not purged.").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
+	return new Command("prune").description("Delete old per-run deployment-event streams. On a versioned state bucket the earlier versions of the deleted keys are purged too, unless a warning says otherwise.").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
 		const n = parseInt(v, 10);
 		if (!Number.isInteger(n) || n < 0) throw new Error(`Invalid --keep value ${v === "" ? "\"\"" : displayIdent(v)}: expected a non-negative integer.`);
 		return n;
@@ -18114,6 +18137,7 @@ async function importCommand(stackArg, options) {
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
+			await recordImportOnRollbackJournal(stateBackend, stackInfo.stackName, targetRegion, importedRows.map((r) => r.logicalId), stackState.resources, logger);
 			await stateBackend.saveState(stackInfo.stackName, targetRegion, stackState, saveOptions);
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
 			logger.info(`  ${importedRows.length} resource(s) imported. Run 'cdkd diff' to see how the imported state lines up with the template.`);
@@ -18157,6 +18181,25 @@ async function importCommand(stackArg, options) {
 function stackShown(stackName) {
 	return isPasteableIdent(stackName) ? `stack '${stackName}'` : "a stack whose name is not a plain identifier";
 }
+async function recordImportOnRollbackJournal(stateBackend, stackName, region, logicalIds, resources, logger) {
+	const marks = logicalIds.flatMap((logicalId) => {
+		const record = hasOwnKey(resources, logicalId) ? resources[logicalId] : void 0;
+		const physicalId = record?.physicalId;
+		const resourceType = record?.resourceType;
+		return typeof physicalId === "string" && physicalId !== "" && typeof resourceType === "string" && resourceType !== "" ? [{
+			logicalId,
+			physicalId,
+			resourceType
+		}] : [];
+	});
+	let marked;
+	try {
+		marked = await stateBackend.markRollbackJournalImported(stackName, region, marks);
+	} catch (error) {
+		throw new Error(`Could not record this import on the rollback journal of ${stackShown(stackName)}, so state was NOT written: a later cdkd rollback could otherwise delete what was imported. Cause: ${displaySafe(error instanceof Error ? error.message : String(error))}`);
+	}
+	if (marked.length > 0) logger.info(safeMsg`  The rollback journal of ${stackShown(stackName)} records ` + safeMsg`${marked.map((id) => logicalIdShown(id)).join(", ")} as imported: ` + "cdkd rollback leaves those resources as they are.");
+}
 function mergeCfnDerivedOverrides(params) {
 	const { cfnMapping, template, templateLogicalIds, overrides } = params;
 	const stats = {
@@ -18837,6 +18880,7 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentRegion = parentRegion;
 			const childDeployedParameters = namesAnyDeclaredParameter(childStateTemplate) ? await readDeployedParameters(childTreeNode.stackName, args.cfnClient, logger, displaySafe(childStackName)) : void 0;
 			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger, childDeployedParameters)), rebuiltLogicalIdsFrom(rows, childTemplate));
+			await recordImportOnRollbackJournal(stateBackend, childStackName, childRegion, rows.filter((r) => r.outcome === "imported").map((r) => r.logicalId), childStackState.resources, logger);
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -26092,5 +26136,5 @@ function collectVerbFlags(program) {
 }
 
 //#endregion
-export { canonicalizeIpProtocolValue as a, buildProgram, isAbsoluteAssetPath as c, resolveSecretDerivedPrincipals as i, listNestedTemplateRows as l, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, findNestedTemplateTreeDefect as s, canonicalizeIpv4Cidr as t, renderNestedTemplateTreeDefect as u };
-//# sourceMappingURL=program-DMJnrQOG.js.map
+export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
+//# sourceMappingURL=program-dQFaGjL1.js.map