@go-to-k/cdkd 0.296.27 → 0.296.29

package/dist/{program-BwNb3_Ot.js → program-CN7Dqb3j.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as gray, $a as templateResourceTypes, $i as refuseMalformedOutputsForDestroy, $o as STATE_SOURCED_BASELINE_RULES, $r as isImpossibleEmptyStoredAttribute, $s as redactDockerArgvValues, $t as updatePartialMessage, A as perType, Aa as hasNoCloudControlHandlers, Ac as expectedOwnerParam, Ai as malformedLocalResourcesWarning, An as collectDeclaredOutputNames, Ao as createSecretMasker, Ar as classifyReplaySecretRegion, As as AssetModeResolver, Bc as nullPrototypeRecord, Bi as malformedResourcePropertiesWarning, Bn as RollbackInlinePolicyWriters, Bo as pathCrossesDottedKey, Br as applyCallerIdentityCredentials, Bs as buildDenyExternalAccessPolicy, Bt as planRollback, C as noEchoComparisonForTemplate, Ca as unreadableResourceEntries, Cc as CFN_TEMPLATE_BODY_LIMIT, Ci as isReadableOrphanRecord, Cn as secretBearingStateKeyWarning, Co as hasMaskableValues, Cs as isSensitiveAttributeName, Ct as isHandledOrphan, D as recordedProtectionNote, Da as unwrittenCreateOnlyReplacement, Dc as uploadCfnTemplate, Di as malformedExportSourceWarning, Dn as exportNameSecretExposure, Do as recordLogOnlyParameterValue, Dr as INTRINSIC_KEYS, Ds as createAssetRedirectResolver, Dt as sameJournaledOrphans, E as recordedProtectionEvidence, Ec as findLargeInlineResources, Ei as malformedExportNamesWarning, En as exportNameNoEchoParameters, Eo as printingCorpusOf, Er as DiffCalculator, Es as buildAssetRedirectMap, Et as makeForeignHolderScan, Fa as isStatefulRecreateTargetSync, Fc as StageLoadError, Fi as malformedOrphansWarning, Fn as DEFAULT_RESOURCE_WARN_AFTER_MS, Fo as redactSecretsForState, Fr as assertSendableRoleArn, Fs as isCrossRegionRedirect, Ft as recordAfterRollbackUpdate, Gc as renderAssemblyPathEscape, Gi as refuseDivergentRecordRegionForDestroy, Go as carriesSecretMask, Gs as describeDockerFailure, Gt as orphanDeleteNeedsIdentity, Hc as absoluteAssemblyPathEscape, Hi as malformedScrubResourceEntriesRefusalMessage, Hn as ledgerForStack, Ho as inheritNestedStackParameterAssociations, Hr as envCredentialsAreAssumedRole, Hs as resolveDockerContextDirectory, Ht as recordUnderIdIsNotOwn, Ia as renderStatefulReason, Ic as processStackMessages, Ii as malformedOutputsRefusalMessage, In as maskingRetryLogger, Io as scrubResourceRecord, Ir as explicitRoleArnOrThrow, Is as parseBootstrapMarker, It as demoteSupersededOrphans, Jc as resolveBucketRegion, Ji as refuseMalformedOrphanRecordsForDestroy, Jo as recordMaskOnlyValuesIn, Js as formatDockerLoginError, Jt as inheritProducerRegions, Kc as resolveAssemblyPath, Ko as provenPublicValue, Ks as dockerSpawnEnvWithSensitive, Kt as findNestedStackTypeChanges, Lc as defineOwnKey, Li as malformedOutputsWarning, Ln as constructPathOf, Lo as DYNAMIC_REFERENCE_TOKEN_SCAN, Lr as isIamRoleArn, Ls as readBootstrapMarkerBody, Lt as isJournaledOrphan, Ma as shownType, Mc as canonicalizeRegion, Mi as malformedOrphanRecordsWarning, Mn as isExportAliasCollision, Mo as maskSecretsInError, Mr as regionLessSecretName, Ms as assertAssetBucketRegion, Na as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nc as derivePartitionAndUrlSuffix, Ni as malformedOrphanRowsKeptWarning, Nn as bindingSkippedOutputs, No as maskSecretsInText, Nr as applyRoleArnIfSet, Ns as ensureAssetStorage, Nt as withStackRecords, O as PROTECTION_PROPERTY_BY_TYPE, Oc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Oi as malformedLocalOutputsWarning, On as isWholeDynamicReferenceValue, Oo as recordLogOnlyValue, Or as IntrinsicFunctionResolver, Os as loadPublishableAssetManifest, Ot as replayFailedOperations, Pa as isStatefulRecreateTargetForReplace, Pc as AssemblyReader, Pi as malformedOrphansRefusalMessage, Pn as DEFAULT_RESOURCE_TIMEOUT_MS, Po as markSameGenerationBag, Pr as assertFlagRoleArn, Ps as getBootstrapMarkerKey, Pt as removeProtectionTypeList, Q as cyan, Qa as prefetchCreateOnlyPropertyPaths, Qi as refuseMalformedOutputs, Qo as wholeStringLeavesOf, Qr as getAccountInfo, Qs as partitionSensitiveEnv, Rc as hasOwnKey, Ri as malformedRenderedContainersWarning, Rn as findDestructiveChanges, Ro as dynamicReferenceTokens, Rr as sendableAssumeRoleCommand, Rs as validateAssetBucketName, Rt as isReplacementOrphan, S as noEchoAttributeNamesOf, Sa as unreadableOrphanRecords, Sc as ssmResolvedValueType, Si as hasReadableResources, Sn as secretBearing, So as createUnionSecretMasker, Ss as AssetPublisher, St as dropFailedHint, T as noEchoParameterNamesOf, Ta as findActionableSilentDrops, Tc as MIGRATE_TMP_PREFIX, Ti as malformedDriftResourcePropertiesWarning, Tn as carriedExportAliasExposure, To as logOnlyValueCount, Ts as WorkGraph, Tt as loadJournaledOrphans, Uc as describeFileReadFailure, Ui as malformedStateRefusalMessage, Uo as recordNestedStackParameterExpressions, Us as describeDockerCapturedOutput, Ut as replacementNeverSwapped, Vc as ownValue, Vi as malformedResourcesWarning, Vo as identityKeyFor, Vr as callerEnvCredentials, Vs as buildDockerImage, Vt as recheckFailedPlan, Wc as displayAssemblyPath, Wi as previewableOrphanRecords, Wn as withCreateTokenLedger, Ws as describeDockerExecFailure, Wt as resolveReplacementOldType, X as createReadOnlyAttributeHealerFactory, Xi as refuseMalformedOrphansForDestroy, Xo as recordNoEchoParameterFreshValue, Xr as isUnboundTemplateParameter, Xs as isDockerClientEnvKey, Y as formatResourceLine, Yi as refuseMalformedOrphans, Yo as recordNoEchoAttributeValues, Yr as coerceParameterTypedValue, Ys as getDockerCmd, Z as bold, Zi as refuseMalformedOrphansForOrphan, Zo as recordProvenPublicExpression, Zr as parameterTypeMayLoseSecretIdentity, Zs as isMalformedEnvKey, _ as makeCanonicalizePropertiesFn, _a as repairMalformedOutputsForReadOnly, _c as resolveStateBucketWithDefault, _i as accountArgs, _n as DeploymentEventsStore, _o as readbackPathFor, _s as importableOutputs, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForImportSave, ac as stripControlChars, ai as cfnRefValueFromPhysicalId, an as secretNamePrintingBag, ao as DagBuilder, ar as wouldReturnToSdkProvider, as as LockManager, at as reachableDivergentParameters, b as serviceTokenBlockingReason, ba as repairMalformedResourcesForReadOnly, bc as stateBucketExistenceConfirmed, bi as hasReadableOrphans, bn as displayTextOrWithheld, bo as liveMatchesUnresolvedTokenFrame, bs as orphansCarriedFrom, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForDrift, cc as Synthesizer, cn as PRE_DELETE_SNAPSHOT_TYPES, co as isMarkedCoordinate, cr as isCustomResourceType$1, cs as rebuildClientForBucketRegion, ct as planOrphanAdoption, d as conditionInputsFrom, da as refuseMalformedResourcesForDeploy, dc as getLegacyStateBucketName, dn as createPreDeleteFinalSnapshot, do as maskWholeValue, dr as CloudControlProvider, ds as describeRegionValueKind, dt as displacedPhysicalIdShown, ea as refuseMalformedResourceAttributesForOrphan, ec as redactedDockerCause, ei as carriesDynamicReference, en as updatePartialReason, eo as describeTypeWithThrottleRetry, es as STATE_SOURCED_CROSS_GENERATION_RULES, et as green, f as parentSuppliedValues, fa as refuseMalformedResourcesForDestroy, fc as loadCdkJson, fi as JSON_LISTING_HOLE_VALUE, fn as effectiveDeletionPolicy, fo as maskedLeafCoordinatesOf, fr as slowCcOperationTimeoutMs, fs as exportNamesCarriedFrom, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, ga as repairMalformedOrphansForReadOnly, gc as resolveSkipPrefix, gi as UNREADABLE_RESOURCES_MAP_ROW, gn as DeploymentEventsReader, gr as deleteSkipReason, gs as importableOutputKeys, h as keptWholeReasonText, ha as repairMalformedOrphanRecordsForReadOnly, hc as resolveCaptureObservedState, hi as UNREADABLE_ORPHANS_CONTAINER_ROW, hn as unsupportedFinalSnapshotError, ho as noEchoOutputsComparison, hr as deleteIndeterminateGuards, hs as hasUnverifiableParameterRefusal, ht as recordDisplacedSkips, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForImport, ic as escapeRegExp, ii as AWS_NO_VALUE, in as orphanRecordsPrintingBag, ir as isCustomResource, is as isSingleDynamicReferenceToken, it as namesAnyDeclaredParameter, j as readProtection, ja as findReplacedReadersOfRecreateTargets, jc as PARTITION_TABLE, ji as malformedOrphanRecordsRefusalMessage, jn as collectPublishedOutputNames, jo as errorCauseChain, jr as producerRegionsFromState, js as BOOTSTRAP_MARKER_PREFIX, jt as destroyStackRecordsView, k as isProtectionValueActive, ka as NO_CC_HANDLERS_REASON, kc as decodeListingKey, ki as malformedLocalResourceEntriesWarning, kn as noEchoParameterValueSeed, ko as shareLogOnlyValues, kr as poisonRenderedSpellingsCollidingIn, ks as rewriteTemplateAssetReferences, kt as replayRollback, l as templateIdentity, la as refuseMalformedResourcePropertiesForExport, lc as synthesisStatusMessage, li as withSharedDrainBudget, ln as buildFinalSnapshotIdentifier, lo as maskAtCoordinates, ls as splitImportedOps, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, ma as refuseMalformedState, mc as resolveAutoAssetStorage, mi as STATE_RESOURCES_MALFORMED, mn as refusesFinalSnapshot, mo as noEchoLeavesOf, mr as UNSPECIFIED_SKIP_REASON, ms as hasReasonlessBaselineRefusal, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntriesForDeploy, nc as runDockerStreaming, ni as isNamelessDynamicReferenceError, nn as journaledOrphanPrintingBag, nr as ProviderRegistry, ns as TEMPLATE_SOURCED_RULES, nt as yellow, o as isAbsoluteAssetPath, oa as refuseMalformedResourceEntriesForOrphan, oc as AssetManifestLoader, oi as isStalePlaceholderArnAttribute, on as stateSecretNameNeedles, oo as TemplateParser, or as TemplateNoEchoReresolver, os as isLockInfoExpired, ot as resourcesNamingDeclaredParameter, p as readRecordedConditionVerdicts, pa as refuseMalformedResourcesForExport, pc as resolveApp, pi as STATE_REGION_DIVERGED, pn as isFinalSnapshotError, po as noEchoCoordinatesOf, ps as hasReadableExportSet, qi as refuseMalformedOrphanRecords, qo as recordMaskOnlyValue, qs as finchSecretArgvRefusal, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForDestroy, rc as warnFinchArgvExposure, ri as keepsSecretReferenceToken, rn as maskEventTextWithBoundBags, rr as ccBrokenReason, rs as WHOLE_DYNAMIC_REFERENCE_PATTERN, rt as computeParameterTaint, s as listNestedTemplateRows, sa as refuseMalformedResourcePropertiesForDestroy, sc as getDockerImageBySourceHash, si as refStateLookupFromResource, sn as ATOMIC_FINAL_SNAPSHOT_TYPES, so as canonicalCoordinates, sr as readsNoEchoDeleteValues, ss as S3StateBackend, st as makeSiblingClaimReader, t as DeployEngine, ta as refuseMalformedResourceEntries, tc as runDockerForeground, ti as carriesFetchableDynamicReference, tn as completedReplayEntries, to as withRetry, tr as CC_BROKEN_REASON, ts as STATE_SOURCED_READBACK_RULES, tt as red, u as conditionFingerprint, ua as refuseMalformedResourcePropertiesForOrphan, uc as getDefaultStateBucketName, ui as parameterInputsFor, un as ccRoutedFinalSnapshotError, uo as maskReadbackAtCoordinates, ur as withPrintingSecrets, us as acceptedCreateOnlyDropsOf, ut as displacedOpClause, v as deferredServiceTokenWarning, va as repairMalformedResourceEntriesForReadOnly, vc as resolveStateBucketWithDefaultAndSource, vi as deployRefusesOrphanRowsReason, vn as extractDeploymentEventError, vo as readsNoEchoSource, vr as isWaitAbandonedError, vs as isReadableBag, vt as withNestedRevertRun, w as noEchoExactEchoLeavesOf, wa as withheldAccountClause, wc as CFN_TEMPLATE_URL_LIMIT, wi as isReadableResourceEntry, wn as secretSafeKeyDisplay, wo as literalSplitDelimitersOf, ws as stringifyValue, wt as journaledOrphanLines, x as withResourceDeadline, xa as unpreviewableOrphanRecords, xc as warnDeprecatedNoPrefixCliFlag, xi as hasReadableOutputs, xn as exportAliasCollisionScrubWarning, xo as carryLogOnlyValues, xs as shouldRetainResource, xt as deleteJournaledOrphans, y as findServiceTokenRefusals, ya as repairMalformedResourcePropertiesForReadOnly, yc as resolveUseCdkBootstrapAssets, yi as displayLogicalId, yn as WITHHELD_NAME_DISPLAY, yo as valueAtCoordinate, ys as orphansAfterRollback, zc as hasPlainPrototype, zi as malformedResourceEntriesWarning, zn as formatDestructiveChange, zo as isUncertifiedBaselineMaskPosition, zr as AWS_CREDENTIAL_ENV_KEYS, zs as validateContainerRepoName, zt as planFailedOps } from "./deploy-engine-DC4Yblxp.js";
-import { t as getCdkdVersion } from "./version-Cs9QbaaH.js";
+import { $c as nullPrototypeRecord, $o as provenPublicValue, $s as buildDenyExternalAccessPolicy, $t as findNestedStackTypeChanges, A as noEchoExactEchoLeavesOf, Aa as unreadableResourceEntries, Ac as resolveStateBucketWithDefault, Ai as isReadableOrphanRecord, An as orphanRecordsPrintingBag, Ao as hasMaskableValues, As as importableOutputs, At as journaledOrphanLines, Ba as MULTI_REGION_RECREATE_BLOCKED_TYPES, Bc as uploadCfnTemplate, Bi as malformedOrphanRowsKeptWarning, Bn as isFinalSnapshotError, Bo as maskSecretsInText, Br as applyRoleArnIfSet, Bs as createAssetRedirectResolver, Bt as removeProtectionTypeList, C as recordRetainedForReadoption, Ca as repairMalformedOrphansForReadOnly, Cc as getDefaultStateBucketName, Ci as UNREADABLE_RESOURCES_MAP_ROW, Cn as isExportAliasCollision, Cr as deleteSkipReason, Cs as acceptedCreateOnlyDropsOf, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as repairMalformedResourcesForReadOnly, Dc as resolveAutoAssetStorage, Di as hasReadableOrphans, Dn as completedReplayEntries, Do as liveMatchesUnresolvedTokenFrame, Ds as hasReasonlessBaselineRefusal, Dt as deleteJournaledOrphans, E as serviceTokenBlockingReason, Ea as repairMalformedResourcePropertiesForReadOnly, Ec as resolveApp, Ei as displayLogicalId, En as DEFAULT_RESOURCE_WARN_AFTER_MS, Eo as valueAtCoordinate, Es as hasReadableExportSet, Et as withNestedStackContext, F as isProtectionValueActive, Fc as ssmResolvedValueType, Fi as malformedLocalOutputsWarning, Fn as PRE_DELETE_SNAPSHOT_TYPES, Fo as recordLogOnlyValue, Fr as IntrinsicFunctionResolver, Fs as AssetPublisher, Ft as replayRollback, Gc as canonicalizeRegion, Gi as malformedRenderedContainersWarning, Gn as findDestructiveChanges, Go as dynamicReferenceTokens, Gr as sendableAssumeRoleCommand, Gs as assertAssetBucketRegion, Gt as planFailedOps, Ha as isStatefulRecreateTargetSync, Hc as decodeListingKey, Hi as malformedOrphansWarning, Hn as unsupportedFinalSnapshotError, Ho as redactSecretsForState, Hr as assertSendableRoleArn, Hs as rewriteTemplateAssetReferences, Ht as demoteSupersededOrphans, I as perType, Ia as NO_CC_HANDLERS_REASON, Ic as CFN_TEMPLATE_BODY_LIMIT, Ii as malformedLocalResourceEntriesWarning, In as buildFinalSnapshotIdentifier, Io as shareLogOnlyValues, Ir as poisonRenderedSpellingsCollidingIn, Is as isSensitiveAttributeName, Jc as StageLoadError, Ji as malformedResourcesWarning, Jo as identityKeyFor, Jr as callerEnvCredentials, Js as isCrossRegionRedirect, Jt as recordUnderIdIsNotOwn, Kc as derivePartitionAndUrlSuffix, Ki as malformedResourceEntriesWarning, Kn as formatDestructiveChange, Ko as isUncertifiedBaselineMaskPosition, Kr as AWS_CREDENTIAL_ENV_KEYS, Ks as ensureAssetStorage, Kt as planRollback, L as readProtection, La as hasNoCloudControlHandlers, Lc as CFN_TEMPLATE_URL_LIMIT, Li as malformedLocalResourcesWarning, Ln as ccRoutedFinalSnapshotError, Lo as createSecretMasker, Lr as classifyReplaySecretRegion, Ls as stringifyValue, Lt as destroyStackRecordsView, M as recordedProtectionEvidence, Ma as findActionableSilentDrops, Mc as resolveUseCdkBootstrapAssets, Mi as malformedDriftResourcePropertiesWarning, Mn as stateSecretNameNeedles, Mo as logOnlyValueCount, Ms as orphansAfterRollback, Mt as makeForeignHolderScan, N as recordedProtectionNote, Nc as stateBucketExistenceConfirmed, Ni as malformedExportNamesWarning, Nn as extractDeploymentEventError, No as printingCorpusOf, Nr as DiffCalculator, Ns as orphansCarriedFrom, Nt as sameJournaledOrphans, O as noEchoAttributeNamesOf, Oa as unpreviewableOrphanRecords, Oc as resolveCaptureObservedState, Oi as hasReadableOutputs, On as journaledOrphanPrintingBag, Oo as carryLogOnlyValues, Os as hasUnverifiableParameterRefusal, Ot as dropFailedHint, P as PROTECTION_PROPERTY_BY_TYPE, Pa as unwrittenCreateOnlyReplacement, Pc as warnDeprecatedNoPrefixCliFlag, Pi as malformedExportSourceWarning, Pn as ATOMIC_FINAL_SNAPSHOT_TYPES, Po as recordLogOnlyParameterValue, Pr as INTRINSIC_KEYS, Ps as shouldRetainResource, Pt as replayFailedOperations, Qc as hasPlainPrototype, Qi as refuseDivergentRecordRegionForDestroy, Qo as carriesSecretMask, Qs as validateContainerRepoName, Qt as orphanDeleteNeedsIdentity, Ra as findReplacedReadersOfRecreateTargets, Rc as MIGRATE_TMP_PREFIX, Ri as malformedOrphanRecordsRefusalMessage, Rn as createPreDeleteFinalSnapshot, Ro as errorCauseChain, Rr as producerRegionsFromState, Rs as WorkGraph, S as keptForReadoption, Sa as repairMalformedOrphanRecordsForReadOnly, Sc as synthesisStatusMessage, Si as UNREADABLE_ORPHANS_CONTAINER_ROW, Sn as collectPublishedOutputNames, So as noEchoOutputsComparison, Sr as deleteIndeterminateGuards, Ss as splitImportedOps, T as findServiceTokenRefusals, Ta as repairMalformedResourceEntriesForReadOnly, Tc as loadCdkJson, Ti as deployRefusesOrphanRowsReason, Tn as DEFAULT_RESOURCE_TIMEOUT_MS, To as readsNoEchoSource, Tr as isWaitAbandonedError, Ts as exportNamesCarriedFrom, Ua as renderStatefulReason, Uc as expectedOwnerParam, Ui as malformedOutputsRefusalMessage, Un as maskingRetryLogger, Uo as scrubResourceRecord, Ur as explicitRoleArnOrThrow, Us as AssetModeResolver, Ut as isJournaledOrphan, Va as isStatefulRecreateTargetForReplace, Vc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vi as malformedOrphansRefusalMessage, Vn as refusesFinalSnapshot, Vo as markSameGenerationBag, Vr as assertFlagRoleArn, Vs as loadPublishableAssetManifest, Vt as recordAfterRollbackUpdate, Wc as PARTITION_TABLE, Wi as malformedOutputsWarning, Wn as constructPathOf, Wo as DYNAMIC_REFERENCE_TOKEN_SCAN, Wr as isIamRoleArn, Ws as BOOTSTRAP_MARKER_PREFIX, Wt as isReplacementOrphan, Xc as defineOwnKey, Xi as malformedStateRefusalMessage, Xo as recordNestedStackParameterExpressions, Xs as readBootstrapMarkerBody, Xt as resolveReplacementOldType, Yc as processStackMessages, Yi as malformedScrubResourceEntriesRefusalMessage, Yn as ledgerForStack, Yo as inheritNestedStackParameterAssociations, Yr as envCredentialsAreAssumedRole, Ys as parseBootstrapMarker, Yt as replacementNeverSwapped, Zc as hasOwnKey, Zi as previewableOrphanRecords, Zn as withCreateTokenLedger, Zs as validateAssetBucketName, Zt as seedsDeleteFirstGuard, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourcePropertiesForOrphan, _c as escapeRegExp, _i as parameterInputsFor, _n as exportNameNoEchoParameters, _o as maskReadbackAtCoordinates, _r as withPrintingSecrets, _s as CrossPrefixScanCache, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseMalformedOutputs, ac as dockerSpawnEnvWithSensitive, ai as getAccountInfo, al as resolveAssemblyPath, ao as prefetchCreateOnlyPropertyPaths, as as wholeStringLeavesOf, at as gray, ba as refuseMalformedResourcesForExport, bc as getDockerImageBySourceHash, bi as STATE_REGION_DIVERGED, bn as noEchoParameterValueSeed, bo as noEchoCoordinatesOf, bs as isAccessDenied, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourceEntries, cc as getDockerCmd, ci as carriesFetchableDynamicReference, cn as DeploymentEventsReader, co as withRetry, cr as CC_BROKEN_REASON, cs as STATE_SOURCED_READBACK_RULES, ct as yellow, d as conditionInputsFrom, da as refuseMalformedResourceEntriesForImport, dc as partitionSensitiveEnv, di as AWS_NO_VALUE, dn as displayTextOrWithheld, dr as isCustomResource, ds as isSingleDynamicReferenceToken, dt as reachableDivergentParameters, ea as refuseMalformedOrphanRecords, ec as buildDockerImage, el as ownValue, es as recordMaskOnlyValue, f as parentSuppliedValues, fa as refuseMalformedResourceEntriesForImportSave, fc as redactDockerArgvValues, fi as cfnRefValueFromPhysicalId, fn as exportAliasCollisionScrubWarning, fo as DagBuilder, fr as wouldReturnToSdkProvider, fs as LockManager, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourcePropertiesForExport, gc as warnFinchArgvExposure, gi as withSharedDrainBudget, gn as carriedExportAliasExposure, go as maskAtCoordinates, gs as CrossPrefixReadError, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourcePropertiesForDrift, hc as runDockerStreaming, hn as secretSafeKeyDisplay, ho as isMarkedCoordinate, hr as isCustomResourceType$1, hs as rebuildClientForBucketRegion, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as refuseMalformedOrphansForOrphan, ic as describeDockerFailure, ii as parameterTypeMayLoseSecretIdentity, il as renderAssemblyPathEscape, is as recordProvenPublicExpression, it as cyan, j as noEchoParameterNamesOf, ja as withheldAccountClause, jc as resolveStateBucketWithDefaultAndSource, ji as isReadableResourceEntry, jn as secretNamePrintingBag, jo as literalSplitDelimitersOf, js as isReadableBag, jt as loadJournaledOrphans, k as noEchoComparisonForTemplate, ka as unreadableOrphanRecords, kc as resolveSkipPrefix, ki as hasReadableResources, kn as maskEventTextWithBoundBags, ko as createUnionSecretMasker, ks as importableOutputKeys, kt as isHandledOrphan, l as templateIdentity, la as refuseMalformedResourceEntriesForDeploy, lc as isDockerClientEnvKey, li as isNamelessDynamicReferenceError, ln as DeploymentEventsStore, lr as ProviderRegistry, ls as TEMPLATE_SOURCED_RULES, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourcePropertiesForDestroy, mc as runDockerForeground, mi as refStateLookupFromResource, mn as secretBearingStateKeyWarning, mo as canonicalCoordinates, mr as readsNoEchoDeleteValues, ms as S3StateBackend, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedOrphans, nc as describeDockerCapturedOutput, ni as coerceParameterTypedValue, nl as describeFileReadFailure, ns as recordNoEchoAttributeValues, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oa as refuseMalformedOutputsForDestroy, oc as finchSecretArgvRefusal, oi as isImpossibleEmptyStoredAttribute, on as updatePartialMessage, oo as templateResourceTypes, os as STATE_SOURCED_BASELINE_RULES, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedResourceEntriesForOrphan, pc as redactedDockerCause, pi as isStalePlaceholderArnAttribute, pn as secretBearing, po as TemplateParser, pr as TemplateNoEchoReresolver, ps as isLockInfoExpired, pt as makeSiblingClaimReader, qc as AssemblyReader, qi as malformedResourcePropertiesWarning, qn as RollbackInlinePolicyWriters, qo as pathCrossesDottedKey, qr as applyCallerIdentityCredentials, qs as getBootstrapMarkerKey, qt as recheckFailedPlan, r as computeImplicitDeleteEdges, ra as refuseMalformedOrphansForDestroy, rc as describeDockerExecFailure, ri as isUnboundTemplateParameter, rl as displayAssemblyPath, rs as recordNoEchoParameterFreshValue, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedResourceAttributesForOrphan, sc as formatDockerLoginError, si as carriesDynamicReference, sl as resolveBucketRegion, sn as updatePartialReason, so as describeTypeWithThrottleRetry, ss as STATE_SOURCED_CROSS_GENERATION_RULES, st as red, t as DeployEngine, ta as refuseMalformedOrphanRecordsForDestroy, tc as resolveDockerContextDirectory, tl as absoluteAssemblyPathEscape, tn as inheritProducerRegions, ts as recordMaskOnlyValuesIn, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedResourceEntriesForDestroy, uc as isMalformedEnvKey, ui as keepsSecretReferenceToken, un as WITHHELD_NAME_DISPLAY, ur as ccBrokenReason, us as WHOLE_DYNAMIC_REFERENCE_PATTERN, ut as namesAnyDeclaredParameter, va as refuseMalformedResourcesForDeploy, vc as stripControlChars, vn as exportNameSecretExposure, vo as maskWholeValue, vr as CloudControlProvider, vs as applyCrossPrefixScan, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as repairMalformedOutputsForReadOnly, wc as getLegacyStateBucketName, wi as accountArgs, wn as bindingSkippedOutputs, wo as readbackPathFor, ws as describeRegionValueKind, wt as withNestedRevertRun, xa as refuseMalformedState, xc as Synthesizer, xi as STATE_RESOURCES_MALFORMED, xn as collectDeclaredOutputNames, xo as noEchoLeavesOf, xr as UNSPECIFIED_SKIP_REASON, xs as isNotImplemented, xt as recordDisplacedSkips, ya as refuseMalformedResourcesForDestroy, yc as AssetManifestLoader, yi as JSON_LISTING_HOLE_VALUE, yn as isWholeDynamicReferenceValue, yo as maskedLeafCoordinatesOf, yr as slowCcOperationTimeoutMs, ys as crossPrefixDeniedWarning, za as shownType, zc as findLargeInlineResources, zi as malformedOrphanRecordsWarning, zn as effectiveDeletionPolicy, zo as maskSecretsInError, zr as regionLessSecretName, zs as buildAssetRedirectMap, zt as withStackRecords } from "./deploy-engine-Bt-8KvUj.js";
+import { t as getCdkdVersion } from "./version-DyV_xwRX.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1306,6 +1306,14 @@ function createListCommand() {
 
 //#endregion
 //#region src/utils/interrupt-signals.ts
+const postCleanupListeners = /* @__PURE__ */ new WeakSet();
+function prependPostCleanupSigintListener(listener) {
+	postCleanupListeners.add(listener);
+	process.prependListener("SIGINT", listener);
+	return () => {
+		process.removeListener("SIGINT", listener);
+	};
+}
 function forwardSigtermToSigint() {
 	beginCommandInterruptScope();
 	try {
@@ -1333,7 +1341,7 @@ function watchCommandInterrupt(opts) {
 	}
 	let stacksInFlight = 0;
 	function gracefulOwnerArmed() {
-		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
+		return process.listeners("SIGINT").filter((l) => l !== handler && !postCleanupListeners.has(l)).length - interruptWatchListenerCount() > 0;
 	}
 	const handler = () => {
 		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
@@ -1923,8 +1931,8 @@ function resolveRequireApproval(cliValue, logger, cdkJson = loadCdkJson()) {
 	throw new CdkdError(`cdk.json "requireApproval" must be one of ${REQUIRE_APPROVAL_VALUES.join(", ")}, got: ${displayIdent(typeof configured === "string" ? configured : JSON.stringify(configured))}`, "INVALID_REQUIRE_APPROVAL");
 }
 function createApprovalPrompter(options) {
+	if (options.yes) return Object.assign(() => Promise.resolve(true), { autoApproves: true });
 	return (request) => {
-		if (options.yes) return Promise.resolve(true);
 		return serializePrompt(() => getLiveRenderer().suspendWhile(async () => {
 			process.stdout.write(renderApprovalRequest(request));
 			return confirmOrRefuse("Do you wish to deploy these changes?", {
@@ -2396,7 +2404,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-BcSDENeH.js");
+	providerClasses ??= import("./provider-classes-eEgFT-Vt.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2637,6 +2645,262 @@ function createPrefixMigrationGate(opts) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/registry-release.ts
+async function releaseRegistryMarkerQuietly(backend, stackName, region, logger, known) {
+	if (stackName.includes("~")) return;
+	try {
+		const released = known === void 0 ? await backend.releaseRegistryMarker(stackName, region) : await backend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
+
+//#endregion
+//#region src/cli/commands/cross-prefix-gate.ts
+function deployStackRegion(stack, baseRegion) {
+	return stack.region || baseRegion;
+}
+function createCrossPrefixDeployGate(opts) {
+	return async (gateStackName, state) => {
+		if (gateStackName !== opts.stackName) return;
+		if (state !== void 0) return;
+		const result = await opts.guard.firstDeploy(opts.stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, "deploy", ...reportOnce(result));
+	};
+}
+const reported = /* @__PURE__ */ new WeakSet();
+function reportOnce(result) {
+	const first = !reported.has(result);
+	reported.add(result);
+	return first ? [(message) => getLogger().warn(message), (message) => getLogger().info(message)] : [() => void 0, () => void 0];
+}
+function createCrossPrefixDestructiveGate(opts) {
+	return async (stackName, _destructive, stage) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, stage === "late" ? "deploy-late-replace" : "deploy-destructive", ...reportOnce(result));
+	};
+}
+function createCrossPrefixHolder(opts) {
+	return async (stackName) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		switch (result.kind) {
+			case "found": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} also records this stack under another state prefix (${displayIdent(result.prefixes[0])}), whose record may hold it`
+			};
+			case "in-progress": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} assigns this stack to another state prefix (${displayIdent(result.prefix)}), where a deploy may be in progress`
+			};
+			case "failed": return {
+				kind: "unreadable",
+				what: safeMsg`the other state prefixes of bucket ${opts.bucket} could not be checked`,
+				retryable: true
+			};
+			case "denied":
+				reportOnce(result)[0](crossPrefixDeniedWarning({
+					stackName,
+					region: opts.region,
+					bucket: opts.bucket
+				}, result.error, result.stage));
+				return;
+			default: return;
+		}
+	};
+}
+function crossPrefixEngineOptions(opts) {
+	const backend = opts.backend;
+	return {
+		...backend !== void 0 && { onFirstDeployLeftNoRecord: async (stackName) => {
+			if (stackName !== opts.stackName) return;
+			const known = await opts.guard.knownMarker?.(stackName, opts.region);
+			await releaseRegistryMarkerQuietly(backend, stackName, opts.region, getLogger(), known);
+		} },
+		firstDeployGate: createCrossPrefixDeployGate({
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			guard: opts.guard
+		}),
+		onDestructivePlan: createCrossPrefixDestructiveGate({
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			cache: opts.guard
+		}),
+		crossPrefixHolder: createCrossPrefixHolder({
+			region: opts.region,
+			bucket: opts.bucket,
+			cache: opts.guard
+		})
+	};
+}
+function composeStateLoadedGates(crossPrefix, migration) {
+	return async (stackName, state) => {
+		await crossPrefix(stackName, state);
+		if (migration) await migration(stackName, state);
+	};
+}
+
+//#endregion
+//#region src/state/stack-registry.ts
+function unwrapReadError(error) {
+	return error instanceof CrossPrefixReadError ? error.cause : error;
+}
+function topLevelStackName(stackName) {
+	return stackName.split("~")[0];
+}
+var CrossPrefixGuard = class {
+	scan;
+	backend;
+	readOnly;
+	markers = /* @__PURE__ */ new Map();
+	answers = /* @__PURE__ */ new Map();
+	constructor(backend, opts = {}) {
+		this.backend = backend;
+		this.readOnly = opts.readOnly === true;
+		this.scan = opts.scan ?? new CrossPrefixScanCache(backend);
+	}
+	get target() {
+		return this.scan.target;
+	}
+	full(stackName, region, when = "now") {
+		const key = JSON.stringify([stackName, region]);
+		let answer = this.answers.get(key);
+		if (answer === void 0) {
+			answer = this.evaluate(stackName, region, false, when);
+			this.answers.set(key, answer);
+		} else if (when === "now") this.scan.target.rank(stackName, region, "now");
+		return answer;
+	}
+	firstDeploy(stackName, region) {
+		const key = JSON.stringify([stackName, region]);
+		const answer = this.evaluate(stackName, region, true, "now");
+		this.answers.set(key, answer);
+		return answer;
+	}
+	async knownMarker(stackName, region) {
+		const read = this.markers.get(JSON.stringify([topLevelStackName(stackName), region]));
+		if (read === void 0) return void 0;
+		return read.catch(() => void 0);
+	}
+	marker(top, region, fresh = false) {
+		const key = JSON.stringify([top, region]);
+		let read = fresh ? void 0 : this.markers.get(key);
+		if (read === void 0) {
+			read = this.backend.getRegistryMarker(top, region);
+			this.markers.set(key, read);
+		}
+		return read;
+	}
+	async evaluate(stackName, region, firstDeploy, when) {
+		const top = topLevelStackName(stackName);
+		const claimable = top === stackName && !this.readOnly;
+		if (firstDeploy && claimable && !this.markers.has(JSON.stringify([top, region]))) {
+			if (await this.claim(top, region) === "claimed") return { kind: "clear" };
+		}
+		for (let attempt = 0; attempt < 2; attempt++) {
+			let marker;
+			try {
+				marker = await this.marker(top, region, attempt > 0);
+			} catch (error) {
+				return this.fallback(stackName, region, when, error);
+			}
+			if (marker === null) {
+				if (firstDeploy) {
+					if (!claimable) return { kind: "clear" };
+					const claimed = await this.claim(top, region);
+					if (claimed === "conflict") continue;
+					if (claimed !== "claimed") return this.fallback(stackName, region, when, claimed.error);
+					return { kind: "clear" };
+				}
+				const scanned = await this.scan.full(stackName, region, when);
+				if (scanned.kind === "clear" && claimable) {
+					if (await this.claim(top, region) === "conflict") continue;
+				}
+				return scanned;
+			}
+			if (marker.prefix === this.backend.prefix) return { kind: "clear" };
+			let held;
+			let locked;
+			try {
+				held = await this.backend.recordUnderPrefix(marker.prefix, stackName, region);
+				locked = held === "holder" ? false : await this.backend.lockUnderPrefix(marker.prefix, top, region);
+			} catch (error) {
+				return isAccessDenied(error) ? {
+					kind: "denied",
+					error,
+					stage: "probe"
+				} : {
+					kind: "failed",
+					error
+				};
+			}
+			if (held === "holder") return {
+				kind: "found",
+				prefixes: [marker.prefix]
+			};
+			if (locked) return {
+				kind: "in-progress",
+				prefix: marker.prefix
+			};
+			const stale = held === "empty" ? [marker.prefix] : [];
+			const scanned = await this.scan.full(stackName, region, when);
+			if (scanned.kind !== "clear") return scanned;
+			const allStale = [.../* @__PURE__ */ new Set([...stale, ...scanned.stale ?? []])];
+			const answer = {
+				kind: "clear",
+				...allStale.length > 0 && { stale: allStale }
+			};
+			if (!claimable) return answer;
+			if (await this.claim(top, region, marker.etag) === "conflict") continue;
+			return answer;
+		}
+		return {
+			kind: "failed",
+			error: new CrossPrefixReadError(`_cdkd-registry/${region}/${top}.json`, Object.assign(/* @__PURE__ */ new Error("the marker changed twice while cdkd was claiming it"), { name: "ConcurrentClaim" }))
+		};
+	}
+	async claim(top, region, ifMatch) {
+		try {
+			const result = await this.backend.claimRegistryMarker(top, region, ifMatch);
+			if (result === "claimed") this.markers.set(JSON.stringify([top, region]), Promise.resolve({
+				prefix: this.backend.prefix,
+				etag: ""
+			}));
+			return result;
+		} catch (error) {
+			return { error };
+		}
+	}
+	async fallback(stackName, region, when, error) {
+		if (!isAccessDenied(error) && !isNotImplemented(unwrapReadError(error))) return {
+			kind: "failed",
+			error
+		};
+		const scanned = await this.scan.full(stackName, region, when);
+		return scanned.kind === "clear" ? {
+			kind: "denied",
+			error,
+			stage: "registry",
+			...scanned.stale && { stale: scanned.stale }
+		} : scanned;
+	}
+};
+
 //#endregion
 //#region src/cli/commands/deploy.ts
 async function deployCommand(stacks, options) {
@@ -2706,6 +2970,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 	};
 	process.on("SIGINT", topLevelSigintHandler);
 	const unforwardSigterm = forwardSigtermToSigint();
+	let preflightBackendForCleanup;
 	try {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
@@ -2721,6 +2986,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
+		preflightBackendForCleanup = preflightStateBackend;
 		synthOptions.stateBucket = stateBucket;
 		const refusalRecovery = {
 			profile: options.profile,
@@ -2787,6 +3053,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			ignoreErrors: options.ignoreErrors === true
 		});
 		refuseMalformedNestedTemplateTrees(targetStacks);
+		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
+		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
@@ -2816,7 +3084,6 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const dagBuilder = new DagBuilder({ relaxCdkVpcDefensiveDeps: !!options.aggressiveVpcParallel });
 		const diffCalculator = new DiffCalculator();
-		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
 		const stackRedirects = /* @__PURE__ */ new Map();
@@ -2864,13 +3131,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
 		const bufferStackOutput = targetStacks.length > 1;
 		let totalUnaddressed = 0;
+		let totalCrossPrefixKept = 0;
 		let cancelledStacks = 0;
 		const runStack = async (stackInfo) => {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
 		const runStackInner = async (stackInfo) => {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
-			const stackRegion = stackInfo.region || baseRegion;
+			const stackRegion = deployStackRegion(stackInfo, baseRegion);
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
@@ -2908,6 +3176,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					skipPrefix,
 					yes: options.yes
 				});
+				const crossPrefix = crossPrefixEngineOptions({
+					stackName: stackInfo.stackName,
+					region: stackRegion,
+					bucket: stateBucket,
+					recovery: refusalRecovery,
+					guard: crossPrefixGuard,
+					backend: preflightStateBackend
+				});
 				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
@@ -2987,7 +3263,10 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					refusalRecovery,
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
-					...migrationGate && { onCurrentStateLoaded: migrationGate },
+					onCurrentStateLoaded: composeStateLoadedGates(crossPrefix.firstDeployGate, migrationGate),
+					...crossPrefix.onFirstDeployLeftNoRecord && { onFirstDeployLeftNoRecord: crossPrefix.onFirstDeployLeftNoRecord },
+					onDestructivePlan: crossPrefix.onDestructivePlan,
+					crossPrefixHolder: crossPrefix.crossPrefixHolder,
 					...options.pinCcApi?.length && { pinCcApi: {
 						stackName: stackInfo.stackName,
 						logicalIds: new Set(options.pinCcApi)
@@ -3038,10 +3317,15 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				logger.info(`  Updated: ${updatedTotal > 0 ? yellow(updatedTotal) : gray(updatedTotal)}`);
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
+				const crossPrefixKept = deployResult.crossPrefixKept ?? 0;
+				if (crossPrefixKept > 0) logger.info(`  Kept (replacement refused: another state prefix records the stack, or the check could not run): ${yellow(crossPrefixKept)}`);
 				if (ownUpdatePartial > 0) logger.info(safeMsg`    of which left an orphaned predecessor: ${yellow(ownUpdatePartial)}`);
 				if (nestedUpdatePartial > 0) logger.info(safeMsg`  Left an orphaned predecessor in a nested stack: ${yellow(nestedUpdatePartial)}`);
-				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial;
-				if (!options.dryRun) totalUnaddressed += stackUnaddressed;
+				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial + crossPrefixKept;
+				if (!options.dryRun) {
+					totalUnaddressed += stackUnaddressed;
+					totalCrossPrefixKept += crossPrefixKept;
+				}
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -3057,7 +3341,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					created: deployResult.created,
 					updated: updatedTotal,
 					deleted: deployResult.deleted,
-					...deployResult.deleteSkipped + deployResult.updatePartial > 0 && { skipped: deployResult.deleteSkipped + deployResult.updatePartial }
+					...stackUnaddressed > 0 && { skipped: stackUnaddressed }
 				}, deployResult.durationMs);
 			} catch (deployError) {
 				if (deployError instanceof DeployCancelledError) {
@@ -3102,11 +3386,12 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				if (!outcome.ok) throw outcome.error;
 			}
 		});
-		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. ` + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
+		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. ` + (totalCrossPrefixKept > 0 ? "A replacement kept because another state prefix records the stack, or the check could not run, keeps its old resource and applies no new value — resolve the pair, or let the check run, and re-deploy. " : "") + "The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. " + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
 	} finally {
 		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
+		preflightBackendForCleanup?.destroyClient();
 	}
 }
 function createDeployCommand() {
@@ -4372,7 +4657,7 @@ function maskOutputChangeForDisplay(change, mask, nameCorpus) {
 	return changed ? shown : change;
 }
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
-	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate, inheritedSecrets, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
+	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate, inheritedSecrets, inheritedDerivedNames, attributeHealer, parentUnresolvedParameters, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict } = options;
 	const noEchoParametersOf = (t) => /* @__PURE__ */ new Set([...noEchoParameterNamesOf(t), ...inheritedNoEchoParameters ?? []]);
 	const inheritedForResolver = inheritedSecrets !== void 0 && hasMaskableValues(inheritedSecrets) ? inheritedSecrets : void 0;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
@@ -4502,7 +4787,11 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		diffSecrets,
 		inheritedForResolver,
 		outputsPassSecrets
-	], [splitPieces, derivedNames]);
+	], [
+		splitPieces,
+		derivedNames,
+		...inheritedDerivedNames ? [inheritedDerivedNames] : []
+	]);
 	const maskForLog = printing.mask;
 	const resolveRecordingInto = (bag, printingSecrets) => (value) => intrinsicResolver.resolve(value, {
 		recordedSecretValues: bag,
@@ -4706,6 +4995,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		deployRefusals: shownDeployRefusals,
 		effectiveTemplate,
 		printingSecrets,
+		derivedNames: diffPrintingSecrets([derivedNames, inheritedDerivedNames]),
 		resolvedParameters: mergedParameters,
 		conditions,
 		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
@@ -4879,7 +5169,7 @@ function noEchoFedChildParameters(parentStackRow, parentNoEchoParameters, parent
 	})) fed.add(name);
 	return fed;
 }
-async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust) {
+async function resolveChildStackParameters(parentStackRow, parentTemplate, parentState, region, parentStackName, stateBackend, parentParameters, parentConditions, cfnFallback, printingSecrets, attributeHealer, unresolvedKeys, trust, derivedNameSink) {
 	const rawParams = parentStackRow.Properties?.["Parameters"];
 	if (!rawParams || typeof rawParams !== "object" || Array.isArray(rawParams)) return {};
 	const resolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
@@ -4891,7 +5181,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 				template: parentTemplate,
 				resources: parentState.resources,
 				secretNameNeedles: stateSecretNameNeedles(parentState.resources),
-				secretNameSink: /* @__PURE__ */ new Map(),
+				secretNameSink: derivedNameSink ?? /* @__PURE__ */ new Map(),
 				stateBackend,
 				stackName: parentStackName,
 				bestEffort: true,
@@ -4918,7 +5208,7 @@ function recordedTemplateResources(template, state) {
 	return recorded;
 }
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, inheritedDerivedNames, inheritedNoEchoParameters, inheritedNoEchoParametersAnyVerdict, refusalRecovery } = args;
 	const attributeHealer = attributeHealerFor?.(stackName, region);
 	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
@@ -4932,6 +5222,7 @@ async function buildDiffTree(args) {
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
+			...inheritedDerivedNames && { inheritedDerivedNames },
 			...inheritedNoEchoParameters && { inheritedNoEchoParameters },
 			...inheritedNoEchoParametersAnyVerdict && { inheritedNoEchoParametersAnyVerdict },
 			...attributeHealer && { attributeHealer },
@@ -4943,7 +5234,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -4992,8 +5283,10 @@ async function buildDiffTree(args) {
 			...inheritedNoEchoParameters ?? [],
 			...inheritedNoEchoParametersAnyVerdict ?? []
 		]), void 0, stateAfterAdoption.resources);
-		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust);
-		node.children.push(await buildDiffTree({
+		const rowDerivedNames = /* @__PURE__ */ new Map();
+		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust, rowDerivedNames);
+		const childDerivedNames = diffPrintingSecrets([inheritedDerivedNames, rowDerivedNames]);
+		const buildChild = () => buildDiffTree({
 			stackName: childStackName,
 			displayName: childStackName,
 			region,
@@ -5013,10 +5306,12 @@ async function buildDiffTree(args) {
 			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove,
 			inheritedSecrets: printingSecrets,
+			...hasMaskableValues(childDerivedNames) && { inheritedDerivedNames: childDerivedNames },
 			...childNoEchoParameters.size > 0 && { inheritedNoEchoParameters: childNoEchoParameters },
 			...childNoEchoParametersAnyVerdict.size > 0 && { inheritedNoEchoParametersAnyVerdict: childNoEchoParametersAnyVerdict },
 			...refusalRecovery && { refusalRecovery }
-		}));
+		});
+		node.children.push(await (hasMaskableValues(childDerivedNames) ? withPrintingSecrets(childDerivedNames, buildChild) : buildChild()));
 	}
 	if (!isNestedChild) {
 		const defect = findNestedTemplateTreeDefect(nestedTemplates);
@@ -5025,15 +5320,17 @@ async function buildDiffTree(args) {
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery, diffPrintingSecrets([nodeDerivedNames, stateDerivedNames(state.resources ?? {})])));
 	}
 	return node;
 }
-async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery) {
+async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery, inheritedDerivedNames) {
 	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
+	const derivedNames = diffPrintingSecrets([inheritedDerivedNames, stateDerivedNames(state.resources ?? {})]);
 	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, {
 		inheritSecretBearingTemplate: parentHasSecretReference,
 		inheritedSecrets,
+		...hasMaskableValues(derivedNames) && { inheritedDerivedNames: derivedNames },
 		...refusalRecovery && { refusalRecovery }
 	});
 	const node = {
@@ -5053,10 +5350,16 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery, derivedNames));
 	}
 	return node;
 }
+function stateDerivedNames(resources) {
+	const bag = /* @__PURE__ */ new Map();
+	const needlesOf = stateSecretNameNeedles(resources);
+	for (const logicalId of Object.keys(resources)) for (const needle of needlesOf(logicalId) ?? []) recordLogOnlyValue(bag, needle);
+	return bag;
+}
 const EMPTY_ALLOW_SET = /* @__PURE__ */ new Set();
 function diffReplaces(change, record) {
 	if (change?.changeType !== "UPDATE") return false;
@@ -10726,19 +11029,40 @@ async function acquireStackLock(opts) {
 		get interrupted() {
 			return interrupted;
 		},
-		async release({ failureMessage, beforeRelease }) {
+		async release({ failureMessage, beforeRelease, holdUntil }) {
 			if (released) return;
 			released = true;
-			try {
-				await beforeRelease?.();
+			const releaseNow = async () => {
 				try {
 					await lockManager.releaseLock(stackName, region);
 					lockHeld = false;
 				} catch (releaseErr) {
 					getLogger().warn(safeMsg`${failureMessage}: ${describeAwsFailure(releaseErr).detail}`);
 				}
+			};
+			let deferred = false;
+			try {
+				await beforeRelease?.();
+				if (holdUntil !== void 0) {
+					process.removeListener("SIGINT", sigintHandler);
+					let forced = false;
+					const removeDeferred = prependPostCleanupSigintListener(() => {
+						if (!interrupted) {
+							interrupted = true;
+							return;
+						}
+						if (forced || !lockHeld) return;
+						forced = true;
+						lockManager.releaseLock(stackName, region).catch(() => {});
+						process.stderr.write(`\nForce-quit (post-destroy cleanup): stack lock may not be released.${forceQuitRecoveryClause(stackName, region, recovery)}\n`);
+					});
+					holdUntil.defer(holdUntil.work.then(() => void 0, () => void 0).then(releaseNow).finally(removeDeferred));
+					deferred = true;
+					return;
+				}
+				await releaseNow();
 			} finally {
-				process.removeListener("SIGINT", sigintHandler);
+				if (!deferred) process.removeListener("SIGINT", sigintHandler);
 			}
 		}
 	};
@@ -10846,6 +11170,16 @@ function countProtectedJournaledOrphans(orphans, region) {
 	}
 	return count;
 }
+async function releaseRegistryMarkerAfterDestroy(ctx, stackName, region, logger) {
+	if (ctx.crossPrefixCheck === void 0) return;
+	try {
+		const known = await ctx.crossPrefixCheck.cache.knownMarker?.(stackName, region);
+		const released = await ctx.stateBackend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
 async function runDestroyForStack(stackName, state, ctx) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -10860,8 +11194,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 		errorCount: 0,
 		interrupted: false
 	};
+	const retainedForReadoption = [];
+	let retainedEarlier;
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
+	const crossPrefixScan = ctx.crossPrefixCheck?.cache.full(stackName, regionForState);
 	const refusalRecovery = {
 		profile: ctx.profile,
 		stateBucket: ctx.stateBucket,
@@ -10884,6 +11221,15 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState, refusalRecovery);
+	if (crossPrefixScan) applyCrossPrefixScan(await crossPrefixScan, {
+		stackName,
+		region: regionForState,
+		bucket: ctx.stateBucket,
+		recovery: {
+			profile: ctx.profile,
+			stateBucket: ctx.stateBucket
+		}
+	}, "destroy", (message) => logger.warn(message), (message) => logger.info(message));
 	if (resourceCount === 0 && orphanCount === 0 && journaledOrphans.count === 0) {
 		logger.info(`Stack ${displayStackName(stackName)} has no resources, cleaning up state...`);
 		const emptyLock = await acquireStackLock({
@@ -10907,6 +11253,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.info(`${green("✓")} State deleted`);
+			await Promise.all([recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, [], logger), releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger)]);
 		} finally {
 			await emptyLock.release({ failureMessage: "Failed to release lock after empty-state cleanup" });
 		}
@@ -10994,11 +11341,14 @@ async function runDestroyForStack(stackName, state, ctx) {
 	}
 	const renderer = getLiveRenderer();
 	let statePreserved = false;
+	let heldTail;
+	let stackFinished = false;
 	let journaledOrphanFailures = 0;
 	let journaledOrphanSkips = 0;
 	const lock = await acquireStackLock({
 		...stackLockBase,
 		onFirstSignal: () => {
+			if (stackFinished) return;
 			renderer.printAbove(() => {
 				process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
 			});
@@ -11172,6 +11522,17 @@ async function runDestroyForStack(stackName, state, ctx) {
 				if (shouldRetainResource(resource.deletionPolicy)) {
 					logger.info(`  ⊘ ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) retained — DeletionPolicy: ${displaySafe(resource.deletionPolicy)}`);
 					result.retainedCount++;
+					if (keptForReadoption(resource)) {
+						retainedForReadoption.push({
+							logicalId,
+							resourceType: resource.resourceType,
+							physicalId: resource.physicalId
+						});
+						if (retainedEarlier === void 0) {
+							retainedEarlier = Promise.resolve().then(() => ctx.stateBackend.loadRetainedRecord(stackName, regionForState));
+							retainedEarlier.catch(() => void 0);
+						}
+					}
 					recordDestroyEvent(ctx.eventRecorder, {
 						eventType: "RESOURCE_RETAINED",
 						stackName,
@@ -11383,7 +11744,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.debug("State deleted");
-			if (ctx.exportIndexStore) await ctx.exportIndexStore.removeStack(stackName, regionForState);
+			const writeKept = () => recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, retainedForReadoption, logger, retainedEarlier);
+			const releaseMarker = () => releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger);
+			if (ctx.deferRegistryTail !== void 0) {
+				heldTail = writeKept().then(releaseMarker);
+				await ctx.exportIndexStore?.removeStack(stackName, regionForState);
+			} else await Promise.all([
+				writeKept(),
+				releaseMarker(),
+				ctx.exportIndexStore?.removeStack(stackName, regionForState)
+			]);
 		} else {
 			try {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
@@ -11430,6 +11800,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 		try {
 			await lock.release({
 				failureMessage: `Failed to release lock for stack ${displayStackName(stackName)}`,
+				...heldTail !== void 0 && ctx.deferRegistryTail !== void 0 && { holdUntil: {
+					work: heldTail,
+					defer: ctx.deferRegistryTail
+				} },
 				beforeRelease: async () => {
 					try {
 						renderer.stop();
@@ -11440,6 +11814,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					logger.debug("Releasing lock...");
 				}
 			});
+			stackFinished = true;
 		} finally {
 			restoreBaseRegionAndClients();
 		}
@@ -11490,6 +11865,10 @@ function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
 	}
 	return ordered;
 }
+function plannedDestroyRegion(refs, synthRegion, cliRegion) {
+	if (refs.length === 1) return refs[0]?.region || cliRegion;
+	if (refs.length > 1 && synthRegion && refs.some((r) => r.region === synthRegion)) return synthRegion;
+}
 async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger) {
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
@@ -11547,6 +11926,9 @@ async function destroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	let stateBackendForCleanup;
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -11556,6 +11938,7 @@ async function destroyCommand(stackArgs, options) {
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile }
 		});
+		stateBackendForCleanup = stateBackend;
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
 		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
@@ -11698,6 +12081,14 @@ async function destroyCommand(stackArgs, options) {
 			arr.push(ref);
 			stateRefsByName.set(ref.stackName, arr);
 		}
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const synth = appStacks.find((s) => s.stackName === name);
+			if (synth?.terminationProtection === true && !options.removeProtection) continue;
+			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, region);
+			if (planned !== void 0) crossPrefixCheck.cache.full(name, planned, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			logger.info(`\nPreparing to destroy stack: ${displaySafe(stackName)}`);
 			const refs = stateRefsByName.get(stackName) ?? [];
@@ -11715,15 +12106,12 @@ async function destroyCommand(stackArgs, options) {
 					continue;
 				}
 			}
+			const plannedRegion = plannedDestroyRegion(refs, synthRegion, region);
 			let stackTargetRegion;
 			if (refs.length === 0) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
 				continue;
-			} else if (refs.length === 1) {
-				const onlyRegion = refs[0]?.region;
-				if (!onlyRegion) stackTargetRegion = region;
-				else stackTargetRegion = onlyRegion;
-			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
+			} else if (plannedRegion !== void 0) stackTargetRegion = plannedRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
 				const orphanOneClause = withheldAccountClause(accountRecovery, "the command below prints").trimEnd();
@@ -11801,6 +12189,8 @@ async function destroyCommand(stackArgs, options) {
 					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					resolveSecretDerivedPrincipals: {},
 					stackDestroy: true,
+					crossPrefixCheck,
+					...deferRegistryTail !== void 0 && { deferRegistryTail },
 					exportIndexStore,
 					...TemplateNoEchoReresolver.usable(synthStack?.template) && (synthStack.region === void 0 || synthStack.region === stackTargetRegion) && { noEchoReresolver: new TemplateNoEchoReresolver({
 						template: synthStack.template,
@@ -11854,9 +12244,11 @@ async function destroyCommand(stackArgs, options) {
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		awsClients.destroy();
+		stateBackendForCleanup?.destroyClient();
 	}
 }
 function createDestroyCommand() {
@@ -14004,7 +14396,7 @@ async function exportCommand(stackArg, options) {
   2. Re-run the phase 2 UPDATE manually with the full synth template:
        ${phase2RetryCommand(cfnStackName)}\n  3. Once phase 2 succeeds, clean up cdkd's stale state record.${orphan.note}\n     Run: ${orphan.command}`);
 			}
-			await stateBackend.deleteState(resolvedStackName, targetRegion);
+			await removeExportedStackRecord(stateBackend, resolvedStackName, targetRegion, logger);
 			logger.info(`cdkd state for ${quotedOrNotShown(resolvedStackName)} (${quotedRegion(targetRegion)}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
 			printNextSteps({
 				cfnStackName,
@@ -15608,6 +16000,11 @@ async function buildResolvedParametersPerStack(args) {
 		intrinsicSkippedByCdkdName
 	};
 }
+async function removeExportedStackRecord(stateBackend, stackName, region, logger) {
+	await stateBackend.deleteState(stackName, region);
+	await recordRetainedForReadoption(stateBackend, stackName, region, [], logger);
+	await releaseRegistryMarkerQuietly(stateBackend, stackName, region, logger);
+}
 async function runPerStackImportLoop(args) {
 	const logger = getLogger();
 	const { rootStackName, rootRegion, rootStackInfoNestedTemplates, rootTemplateFormat, tree, rootTemplate, cfnStackNameOverrides, rootParameters, deps, options } = args;
@@ -15885,7 +16282,7 @@ async function runPerStackImportLoop(args) {
 			}
 			const stateDeletionFailures = [];
 			for (const node of leafFirst) try {
-				await deps.stateBackend.deleteState(node.stackName, node.region);
+				await removeExportedStackRecord(deps.stateBackend, node.stackName, node.region, logger);
 				logger.info(`cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}) removed.`);
 			} catch (err) {
 				stateDeletionFailures.push({
@@ -16111,6 +16508,10 @@ const STATE_READ_REASONS = {
 	"read-failed": STATE_READ_FAILED_REASON,
 	"resources-malformed": "resources is not a JSON object; run `cdkd state show --json` to see the record"
 };
+function stateDestroyTargets(refs, stackRegion) {
+	if (stackRegion) return refs.filter((r) => r.region === stackRegion || !r.region);
+	return refs.length === 1 ? [...refs] : void 0;
+}
 function resourceCountOrNull(resources) {
 	if (resources === void 0 || resources === null) return 0;
 	if (typeof resources !== "object" || Array.isArray(resources)) return null;
@@ -16231,7 +16632,10 @@ async function setupStateBackend(options) {
 		bucket,
 		prefix,
 		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
-		dispose: () => awsClients.destroy()
+		dispose: () => {
+			awsClients.destroy();
+			stateBackend.destroyClient();
+		}
 	};
 }
 function renderRecovery(options, setup) {
@@ -16672,6 +17076,43 @@ function createStateShowCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+async function clearRetainedQuietly(backend, stackName, region, logger) {
+	try {
+		await backend.saveRetainedResources(stackName, region, []);
+		return true;
+	} catch (error) {
+		logger.warn(safeMsg`Could not empty the kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}): a later deploy here may still take a kept ` + `resource back. Re-run 'cdkd state orphan' once it can write.`);
+		return false;
+	}
+}
+async function clearRetainedWithoutRecord(backend, stackName, stackRegion, logger) {
+	if (stackName.includes("/")) return {
+		cleared: [],
+		attempted: 0
+	};
+	const base = `${backend.prefix}/${stackName}/`;
+	let regions;
+	try {
+		const keys = (await backend.listRawKeys(base)).map((key) => key.slice(base.length).split("/")).filter((parts) => parts.length >= 2 && parts[0] !== "");
+		const recorded = new Set(keys.filter((parts) => parts.length === 2 && parts[1] === "state.json").map((parts) => parts[0]));
+		regions = [...new Set(keys.map((parts) => parts[0]).filter((region) => stackRegion === void 0 || region === stackRegion).filter((region) => !recorded.has(region)))];
+	} catch (error) {
+		logger.warn(safeMsg`Could not look for a kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}).`);
+		return {
+			cleared: [],
+			attempted: 0
+		};
+	}
+	const cleared = [];
+	for (const region of regions) {
+		if (await clearRetainedQuietly(backend, stackName, region, logger)) cleared.push(region);
+		await releaseRegistryMarkerQuietly(backend, stackName, region, logger);
+	}
+	return {
+		cleared,
+		attempted: regions.length
+	};
+}
 async function stateOrphanCommand(stackArgs, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -16687,6 +17128,12 @@ async function stateOrphanCommand(stackArgs, options) {
 		for (const stackName of stackArgs) {
 			const stackRefs = refs.filter((r) => r.stackName === stackName);
 			if (stackRefs.length === 0) {
+				const { cleared, attempted } = await clearRetainedWithoutRecord(setup.stateBackend, stackName, options.stackRegion, logger);
+				if (attempted > 0 && cleared.length === 0) continue;
+				if (cleared.length > 0) {
+					logger.info(safeMsg`Cleared the kept-resource record of ${plainOrDescribed(stackName, "stack name")} ` + safeMsg`(${cleared.map((r) => displaySafe(r, { asciiOnly: true })).join(", ")}): ` + `a later deploy here no longer takes a kept resource back.`);
+					continue;
+				}
 				logger.info(safeMsg`No state found for stack: ${plainOrDescribed(stackName, "stack name")}, skipping` + (isPasteableIdent(stackName) ? "" : safeMsg`. ${STATE_LIST_POINTER}`));
 				continue;
 			}
@@ -16730,10 +17177,13 @@ async function stateOrphanCommand(stackArgs, options) {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, target.region, logger);
 					await setup.stateBackend.deleteState(stackName, target.region);
 					await setup.lockManager.forceReleaseLock(stackName, target.region);
+					await clearRetainedQuietly(setup.stateBackend, stackName, target.region, logger);
+					await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, target.region, logger);
 				} else {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, void 0, logger);
 					await setup.stateBackend.deleteLegacyState(stackName);
 					await setup.lockManager.forceReleaseLock(stackName, void 0);
+					await clearRetainedWithoutRecord(setup.stateBackend, stackName, void 0, logger);
 				}
 				logger.info(safeMsg`✓ Removed state for stack: ${describedStackRef(target)}` + ((options.yes || options.force) && refIsDescribed(target) ? safeMsg`. ${STATE_LIST_POINTER}` : ""));
 			}
@@ -16881,6 +17331,8 @@ async function stateDestroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -16898,16 +17350,23 @@ async function stateDestroyCommand(stackArgs, options) {
 			if (!options.stackRegion) return laterRefs.length > 0;
 			return laterRefs.some((r) => r.region === options.stackRegion || !r.region);
 		});
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(setup.stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const refs = stateRefs.filter((r) => r.stackName === name);
+			for (const ref of stateDestroyTargets(refs, options.stackRegion) ?? []) crossPrefixCheck.cache.full(name, ref.region ?? setup.region, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
+			const planned = stateDestroyTargets(refs, options.stackRegion);
 			if (options.stackRegion) {
-				targets = refs.filter((r) => r.region === options.stackRegion || !r.region);
+				targets = planned ?? [];
 				if (targets.length === 0) {
 					logger.warn(safeMsg`Skipping ${plainOrDescribed(stackName, "stack name")} (no state record matches ` + safeMsg`--stack-region ${displayIdent(options.stackRegion)})`);
 					continue;
 				}
-			} else if (refs.length === 1) targets = refs;
+			} else if (planned !== void 0) targets = planned;
 			else throw multipleRegionsError(stackName, refs, `Use --stack-region ${commandHole("region")} to pick one.`);
 			for (const [refIndex, ref] of targets.entries()) {
 				logger.info(safeMsg`\nPreparing to destroy stack: ${formatStackRefSafe(ref)}`);
@@ -16964,6 +17423,8 @@ async function stateDestroyCommand(stackArgs, options) {
 						skipFinalSnapshot: options.skipFinalSnapshot === true,
 						resolveSecretDerivedPrincipals: {},
 						stackDestroy: true,
+						crossPrefixCheck,
+						...deferRegistryTail !== void 0 && { deferRegistryTail },
 						exportIndexStore: setup.exportIndexStore,
 						...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -17004,6 +17465,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd state destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		setup.dispose();
@@ -17666,6 +18128,7 @@ async function rollbackCommand(stackArg, options) {
 			});
 			return;
 		}
+		const crossPrefixScan = new CrossPrefixGuard(setup.stateBackend).full(stackName, region);
 		stackAwsClients = new AwsClients({
 			region,
 			...options.profile && { profile: options.profile }
@@ -17700,6 +18163,15 @@ async function rollbackCommand(stackArg, options) {
 				segments: journal.segments.filter((s) => s.reason !== NESTED_PENDING_PARENT_REASON)
 			};
 			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+			applyCrossPrefixScan(await crossPrefixScan, {
+				stackName,
+				region,
+				bucket: setup.bucket,
+				recovery: {
+					profile: options.profile,
+					stateBucket: setup.bucket
+				}
+			}, "rollback", (message) => logger.warn(message), (message) => logger.info(message));
 			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
 			if (!options.revertFailed) for (const segment of journal.segments) {
@@ -17869,6 +18341,7 @@ async function rollbackCommand(stackArg, options) {
 							let failedOpFailures = 0;
 							let failedOpWarnings = 0;
 							const failedOps = splitImportedOps(segment.failedOperations ?? [], segment);
+							const failedForGuard = segment.failedOperations ?? [];
 							const failedToReplay = failedOpsToReplay(failedOps.replay, options.revertFailed === true);
 							if (failedToReplay.length > 0) {
 								const failedResult = await withPrintingSecrets(failedOpsPrinting, () => withPrintingSecrets(journaledOrphanPrintingBag(failedToReplay, stateResources), () => replayFailedOperations(failedToReplay, stateResources, stackName, ctx, {
@@ -17885,7 +18358,8 @@ async function rollbackCommand(stackArg, options) {
 									...failedOps.imported,
 									...failedOps.displaced,
 									...failedOps.replay.filter((op) => !failedToReplay.includes(op)),
-									...failedResult.remainingFailedOps
+									...failedResult.remainingFailedOps,
+									...completedOps.length > 0 ? failedToReplay.filter((op) => seedsDeleteFirstGuard(op) && !failedResult.remainingFailedOps.includes(op)) : []
 								];
 								if (!declinedDivergentRewrite && remaining.length !== (segment.failedOperations ?? []).length) try {
 									await setup.stateBackend.setRollbackJournalFailedOperations(stackName, region, remaining);
@@ -17905,7 +18379,8 @@ async function rollbackCommand(stackArg, options) {
 								afterOp: saveState,
 								isInterrupted: () => interrupted,
 								onOrphan: (record) => mintedOrphans.push(record),
-								inlinePolicyWriters
+								inlinePolicyWriters,
+								failedOperations: failedForGuard
 							}));
 							return {
 								failures: replayResult.failures + failedOpFailures,
@@ -17940,6 +18415,8 @@ async function rollbackCommand(stackArg, options) {
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
+				await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
+				await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
 				logger.info(`State for ${stackRegionShown(stackName, region)} removed (stack fully rolled back).`);
 			}
 			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
@@ -19087,8 +19564,20 @@ async function forceUnlockCommand(stackArgs, options) {
 				const where = r ? `${displayStackName(stackName)} (${displayIdent(r)})` : `${displayStackName(stackName)} (legacy lock key)`;
 				logger.info(`Force-unlocking stack: ${where}`);
 				try {
-					await lockManager.forceReleaseLock(stackName, r);
+					let ledgerError;
+					let recorded = false;
+					await lockManager.forceReleaseLock(stackName, r, async (horizon) => {
+						if (r === void 0) return;
+						const ledger = ledgerForStack(stateBackend, stackName, r);
+						for (let attempt = 0; attempt < 2 && !recorded; attempt++) try {
+							await ledger.noteAbandoned(horizon);
+							recorded = true;
+						} catch (error) {
+							ledgerError = error;
+						}
+					});
 					logger.info(`✓ Lock released for stack: ${where}`);
+					if (!recorded && ledgerError !== void 0) logger.warn(safeMsg`Lock released, but the create-token ledger of ${where} could not record when the ` + safeMsg`abandoned run stopped: ${describeAwsFailure(ledgerError).summary}. ` + "A later deploy may take back a resource of those names that another deployment creates.");
 				} catch (error) {
 					const message = describeAwsFailure(error).detail;
 					if (message.includes("No lock found") || message.includes("NoSuchKey")) logger.info(`No lock found for stack: ${where}`);
@@ -19198,6 +19687,20 @@ var ObservedBaselineRefusals = class extends Set {
 	unverifiableParameter = /* @__PURE__ */ new Set();
 	hadDeployedParameterSource = false;
 };
+async function claimRegistryMarkerAfterImport(backend, stackName, region, logger) {
+	const answer = await new CrossPrefixGuard(backend).full(stackName, region);
+	const regionShown = displaySafe(region, { asciiOnly: true });
+	switch (answer.kind) {
+		case "clear": return;
+		case "found":
+			logger.warn(safeMsg`The state bucket also records ${displayStackName(stackName)} (${regionShown}) under another state prefix ` + safeMsg`(${answer.prefixes.map((p) => displayIdent(p)).join(", ")}). One stack name per ` + "account and region is supported: drop one of the records with 'cdkd state orphan' before deploying or destroying either.");
+			return;
+		case "in-progress":
+			logger.warn(safeMsg`A deploy of ${displayStackName(stackName)} (${regionShown}) holds a lock under another state prefix ` + safeMsg`(${displayIdent(answer.prefix)}). One stack name per account and region is ` + `supported: keep one of the two before deploying or destroying either.`);
+			return;
+		default: logger.warn(safeMsg`Could not record ${displayStackName(stackName)} (${regionShown}) in the state bucket's stack registry` + (answer.kind === "denied" || answer.kind === "failed" ? safeMsg` (${describeAwsFailure(answer.error).summary})` : "") + `. Its next guarded command records it.`);
+	}
+}
 async function importCommand(stackArg, options) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -19418,6 +19921,7 @@ async function importCommand(stackArg, options) {
 			await recordImportOnRollbackJournal(stateBackend, stackInfo.stackName, targetRegion, importedRows.map((r) => r.logicalId), stackState.resources, logger);
 			await stateBackend.saveState(stackInfo.stackName, targetRegion, stackState, saveOptions);
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
+			await claimRegistryMarkerAfterImport(stateBackend, stackInfo.stackName, targetRegion, logger);
 			logger.info(`  ${importedRows.length} resource(s) imported. Run 'cdkd diff' to see how the imported state lines up with the template.`);
 			if (migrationCfnStackName && migrationTree && accountIdForNestedSynth) await importNestedStackChildrenRecursive({
 				lockRecovery,
@@ -27745,4 +28249,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-BwNb3_Ot.js.map
+//# sourceMappingURL=program-CN7Dqb3j.js.map