@go-to-k/cdkd 0.296.28 → 0.296.29

package/dist/{program-v_QNBjtZ.js → program-CN7Dqb3j.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as gray, $a as prefetchCreateOnlyPropertyPaths, $i as refuseMalformedOutputs, $o as wholeStringLeavesOf, $r as getAccountInfo, $s as partitionSensitiveEnv, A as perType, Aa as NO_CC_HANDLERS_REASON, Ac as decodeListingKey, Ai as malformedLocalResourceEntriesWarning, An as buildFinalSnapshotIdentifier, Ao as shareLogOnlyValues, Ar as poisonRenderedSpellingsCollidingIn, As as rewriteTemplateAssetReferences, Bc as hasPlainPrototype, Bi as malformedResourceEntriesWarning, Bn as formatDestructiveChange, Bo as isUncertifiedBaselineMaskPosition, Br as AWS_CREDENTIAL_ENV_KEYS, Bs as validateContainerRepoName, Bt as planRollback, C as noEchoComparisonForTemplate, Ca as unreadableOrphanRecords, Cc as ssmResolvedValueType, Ci as hasReadableResources, Cn as maskEventTextWithBoundBags, Co as createUnionSecretMasker, Cs as AssetPublisher, Ct as isHandledOrphan, D as recordedProtectionNote, Dc as findLargeInlineResources, Di as malformedExportNamesWarning, Dn as extractDeploymentEventError, Do as printingCorpusOf, Dr as DiffCalculator, Ds as buildAssetRedirectMap, Dt as sameJournaledOrphans, E as recordedProtectionEvidence, Ea as findActionableSilentDrops, Ec as MIGRATE_TMP_PREFIX, Ei as malformedDriftResourcePropertiesWarning, En as stateSecretNameNeedles, Eo as logOnlyValueCount, Es as WorkGraph, Et as makeForeignHolderScan, Fa as isStatefulRecreateTargetForReplace, Fc as AssemblyReader, Fi as malformedOrphansRefusalMessage, Fn as refusesFinalSnapshot, Fo as markSameGenerationBag, Fr as assertFlagRoleArn, Fs as getBootstrapMarkerKey, Ft as recordAfterRollbackUpdate, Gc as displayAssemblyPath, Gi as previewableOrphanRecords, Gn as withCreateTokenLedger, Gs as describeDockerExecFailure, Gt as seedsDeleteFirstGuard, Hc as ownValue, Hi as malformedResourcesWarning, Ho as identityKeyFor, Hr as callerEnvCredentials, Hs as buildDockerImage, Ht as recordUnderIdIsNotOwn, Ia as isStatefulRecreateTargetSync, Ic as StageLoadError, Ii as malformedOrphansWarning, In as unsupportedFinalSnapshotError, Io as redactSecretsForState, Ir as assertSendableRoleArn, Is as isCrossRegionRedirect, It as demoteSupersededOrphans, Ji as refuseMalformedOrphanRecords, Jo as recordMaskOnlyValue, Js as finchSecretArgvRefusal, Kc as renderAssemblyPathEscape, Ki as refuseDivergentRecordRegionForDestroy, Ko as carriesSecretMask, Ks as describeDockerFailure, Kt as orphanDeleteNeedsIdentity, La as renderStatefulReason, Lc as processStackMessages, Li as malformedOutputsRefusalMessage, Ln as maskingRetryLogger, Lo as scrubResourceRecord, Lr as explicitRoleArnOrThrow, Ls as parseBootstrapMarker, Lt as isJournaledOrphan, Ma as findReplacedReadersOfRecreateTargets, Mc as PARTITION_TABLE, Mi as malformedOrphanRecordsRefusalMessage, Mn as createPreDeleteFinalSnapshot, Mo as errorCauseChain, Mr as producerRegionsFromState, Ms as BOOTSTRAP_MARKER_PREFIX, Na as shownType, Nc as canonicalizeRegion, Ni as malformedOrphanRecordsWarning, Nn as effectiveDeletionPolicy, No as maskSecretsInError, Nr as regionLessSecretName, Ns as assertAssetBucketRegion, Nt as withStackRecords, O as PROTECTION_PROPERTY_BY_TYPE, Oa as unwrittenCreateOnlyReplacement, Oc as uploadCfnTemplate, Oi as malformedExportSourceWarning, On as ATOMIC_FINAL_SNAPSHOT_TYPES, Oo as recordLogOnlyParameterValue, Or as INTRINSIC_KEYS, Os as createAssetRedirectResolver, Ot as replayFailedOperations, Pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pc as derivePartitionAndUrlSuffix, Pi as malformedOrphanRowsKeptWarning, Pn as isFinalSnapshotError, Po as maskSecretsInText, Pr as applyRoleArnIfSet, Ps as ensureAssetStorage, Pt as removeProtectionTypeList, Q as cyan, Qi as refuseMalformedOrphansForOrphan, Qo as recordProvenPublicExpression, Qr as parameterTypeMayLoseSecretIdentity, Qs as isMalformedEnvKey, Rc as defineOwnKey, Ri as malformedOutputsWarning, Rn as constructPathOf, Ro as DYNAMIC_REFERENCE_TOKEN_SCAN, Rr as isIamRoleArn, Rs as readBootstrapMarkerBody, Rt as isReplacementOrphan, S as noEchoAttributeNamesOf, Sa as unpreviewableOrphanRecords, Sc as warnDeprecatedNoPrefixCliFlag, Si as hasReadableOutputs, Sn as journaledOrphanPrintingBag, So as carryLogOnlyValues, Ss as shouldRetainResource, St as dropFailedHint, T as noEchoParameterNamesOf, Ta as withheldAccountClause, Tc as CFN_TEMPLATE_URL_LIMIT, Ti as isReadableResourceEntry, Tn as secretNamePrintingBag, To as literalSplitDelimitersOf, Ts as stringifyValue, Tt as loadJournaledOrphans, Uc as absoluteAssemblyPathEscape, Ui as malformedScrubResourceEntriesRefusalMessage, Un as ledgerForStack, Uo as inheritNestedStackParameterAssociations, Ur as envCredentialsAreAssumedRole, Us as resolveDockerContextDirectory, Ut as replacementNeverSwapped, Vc as nullPrototypeRecord, Vi as malformedResourcePropertiesWarning, Vn as RollbackInlinePolicyWriters, Vo as pathCrossesDottedKey, Vr as applyCallerIdentityCredentials, Vs as buildDenyExternalAccessPolicy, Vt as recheckFailedPlan, Wc as describeFileReadFailure, Wi as malformedStateRefusalMessage, Wo as recordNestedStackParameterExpressions, Ws as describeDockerCapturedOutput, Wt as resolveReplacementOldType, X as createReadOnlyAttributeHealerFactory, Xi as refuseMalformedOrphans, Xo as recordNoEchoAttributeValues, Xr as coerceParameterTypedValue, Xs as getDockerCmd, Y as formatResourceLine, Yc as resolveBucketRegion, Yi as refuseMalformedOrphanRecordsForDestroy, Yo as recordMaskOnlyValuesIn, Ys as formatDockerLoginError, Yt as inheritProducerRegions, Z as bold, Zi as refuseMalformedOrphansForDestroy, Zo as recordNoEchoParameterFreshValue, Zr as isUnboundTemplateParameter, Zs as isDockerClientEnvKey, _ as makeCanonicalizePropertiesFn, _a as repairMalformedOrphansForReadOnly, _c as resolveSkipPrefix, _i as UNREADABLE_RESOURCES_MAP_ROW, _n as isExportAliasCollision, _r as deleteSkipReason, _s as importableOutputKeys, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForImport, ac as escapeRegExp, ai as AWS_NO_VALUE, an as displayTextOrWithheld, ar as isCustomResource, as as isSingleDynamicReferenceToken, at as reachableDivergentParameters, b as serviceTokenBlockingReason, ba as repairMalformedResourcePropertiesForReadOnly, bc as resolveUseCdkBootstrapAssets, bi as displayLogicalId, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as valueAtCoordinate, bs as orphansAfterRollback, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForDestroy, cc as getDockerImageBySourceHash, ci as refStateLookupFromResource, cn as secretBearingStateKeyWarning, co as canonicalCoordinates, cr as readsNoEchoDeleteValues, cs as S3StateBackend, ct as planOrphanAdoption, d as conditionInputsFrom, da as refuseMalformedResourcePropertiesForOrphan, dc as getDefaultStateBucketName, di as parameterInputsFor, dn as exportNameNoEchoParameters, do as maskReadbackAtCoordinates, dr as withPrintingSecrets, ds as acceptedCreateOnlyDropsOf, dt as displacedPhysicalIdShown, ea as refuseMalformedOutputsForDestroy, ec as redactDockerArgvValues, ei as isImpossibleEmptyStoredAttribute, en as updatePartialMessage, eo as templateResourceTypes, es as STATE_SOURCED_BASELINE_RULES, et as green, f as parentSuppliedValues, fa as refuseMalformedResourcesForDeploy, fc as getLegacyStateBucketName, fn as exportNameSecretExposure, fo as maskWholeValue, fr as CloudControlProvider, fs as describeRegionValueKind, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, ga as repairMalformedOrphanRecordsForReadOnly, gc as resolveCaptureObservedState, gi as UNREADABLE_ORPHANS_CONTAINER_ROW, gn as collectPublishedOutputNames, go as noEchoOutputsComparison, gr as deleteIndeterminateGuards, gs as hasUnverifiableParameterRefusal, h as keptWholeReasonText, ha as refuseMalformedState, hc as resolveAutoAssetStorage, hi as STATE_RESOURCES_MALFORMED, hn as collectDeclaredOutputNames, ho as noEchoLeavesOf, hr as UNSPECIFIED_SKIP_REASON, hs as hasReasonlessBaselineRefusal, ht as recordDisplacedSkips, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForDestroy, ic as warnFinchArgvExposure, ii as keepsSecretReferenceToken, in as WITHHELD_NAME_DISPLAY, ir as ccBrokenReason, is as WHOLE_DYNAMIC_REFERENCE_PATTERN, it as namesAnyDeclaredParameter, j as readProtection, ja as hasNoCloudControlHandlers, jc as expectedOwnerParam, ji as malformedLocalResourcesWarning, jn as ccRoutedFinalSnapshotError, jo as createSecretMasker, jr as classifyReplaySecretRegion, js as AssetModeResolver, jt as destroyStackRecordsView, k as isProtectionValueActive, kc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ki as malformedLocalOutputsWarning, kn as PRE_DELETE_SNAPSHOT_TYPES, ko as recordLogOnlyValue, kr as IntrinsicFunctionResolver, ks as loadPublishableAssetManifest, kt as replayRollback, l as templateIdentity, la as refuseMalformedResourcePropertiesForDrift, lc as Synthesizer, ln as secretSafeKeyDisplay, lo as isMarkedCoordinate, lr as isCustomResourceType$1, ls as rebuildClientForBucketRegion, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, ma as refuseMalformedResourcesForExport, mc as resolveApp, mi as STATE_REGION_DIVERGED, mn as noEchoParameterValueSeed, mo as noEchoCoordinatesOf, ms as hasReadableExportSet, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntries, nc as runDockerForeground, ni as carriesFetchableDynamicReference, nn as DeploymentEventsReader, no as withRetry, nr as CC_BROKEN_REASON, ns as STATE_SOURCED_READBACK_RULES, nt as yellow, o as isAbsoluteAssetPath, oa as refuseMalformedResourceEntriesForImportSave, oc as stripControlChars, oi as cfnRefValueFromPhysicalId, on as exportAliasCollisionScrubWarning, oo as DagBuilder, or as wouldReturnToSdkProvider, os as LockManager, ot as resourcesNamingDeclaredParameter, p as readRecordedConditionVerdicts, pa as refuseMalformedResourcesForDestroy, pc as loadCdkJson, pi as JSON_LISTING_HOLE_VALUE, pn as isWholeDynamicReferenceValue, po as maskedLeafCoordinatesOf, pr as slowCcOperationTimeoutMs, ps as exportNamesCarriedFrom, qc as resolveAssemblyPath, qo as provenPublicValue, qs as dockerSpawnEnvWithSensitive, qt as findNestedStackTypeChanges, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForDeploy, rc as runDockerStreaming, ri as isNamelessDynamicReferenceError, rn as DeploymentEventsStore, rr as ProviderRegistry, rs as TEMPLATE_SOURCED_RULES, rt as computeParameterTaint, s as listNestedTemplateRows, sa as refuseMalformedResourceEntriesForOrphan, sc as AssetManifestLoader, si as isStalePlaceholderArnAttribute, sn as secretBearing, so as TemplateParser, sr as TemplateNoEchoReresolver, ss as isLockInfoExpired, st as makeSiblingClaimReader, t as DeployEngine, ta as refuseMalformedResourceAttributesForOrphan, tc as redactedDockerCause, ti as carriesDynamicReference, tn as updatePartialReason, to as describeTypeWithThrottleRetry, ts as STATE_SOURCED_CROSS_GENERATION_RULES, tt as red, u as conditionFingerprint, ua as refuseMalformedResourcePropertiesForExport, uc as synthesisStatusMessage, ui as withSharedDrainBudget, un as carriedExportAliasExposure, uo as maskAtCoordinates, us as splitImportedOps, ut as displacedOpClause, v as deferredServiceTokenWarning, va as repairMalformedOutputsForReadOnly, vc as resolveStateBucketWithDefault, vi as accountArgs, vn as bindingSkippedOutputs, vo as readbackPathFor, vs as importableOutputs, vt as withNestedRevertRun, w as noEchoExactEchoLeavesOf, wa as unreadableResourceEntries, wc as CFN_TEMPLATE_BODY_LIMIT, wi as isReadableOrphanRecord, wn as orphanRecordsPrintingBag, wo as hasMaskableValues, ws as isSensitiveAttributeName, wt as journaledOrphanLines, x as withResourceDeadline, xa as repairMalformedResourcesForReadOnly, xc as stateBucketExistenceConfirmed, xi as hasReadableOrphans, xn as completedReplayEntries, xo as liveMatchesUnresolvedTokenFrame, xs as orphansCarriedFrom, xt as deleteJournaledOrphans, y as findServiceTokenRefusals, ya as repairMalformedResourceEntriesForReadOnly, yc as resolveStateBucketWithDefaultAndSource, yi as deployRefusesOrphanRowsReason, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as readsNoEchoSource, yr as isWaitAbandonedError, ys as isReadableBag, zc as hasOwnKey, zi as malformedRenderedContainersWarning, zn as findDestructiveChanges, zo as dynamicReferenceTokens, zr as sendableAssumeRoleCommand, zs as validateAssetBucketName, zt as planFailedOps } from "./deploy-engine-D4FdwPCi.js";
-import { t as getCdkdVersion } from "./version-B0JEGOLV.js";
+import { $c as nullPrototypeRecord, $o as provenPublicValue, $s as buildDenyExternalAccessPolicy, $t as findNestedStackTypeChanges, A as noEchoExactEchoLeavesOf, Aa as unreadableResourceEntries, Ac as resolveStateBucketWithDefault, Ai as isReadableOrphanRecord, An as orphanRecordsPrintingBag, Ao as hasMaskableValues, As as importableOutputs, At as journaledOrphanLines, Ba as MULTI_REGION_RECREATE_BLOCKED_TYPES, Bc as uploadCfnTemplate, Bi as malformedOrphanRowsKeptWarning, Bn as isFinalSnapshotError, Bo as maskSecretsInText, Br as applyRoleArnIfSet, Bs as createAssetRedirectResolver, Bt as removeProtectionTypeList, C as recordRetainedForReadoption, Ca as repairMalformedOrphansForReadOnly, Cc as getDefaultStateBucketName, Ci as UNREADABLE_RESOURCES_MAP_ROW, Cn as isExportAliasCollision, Cr as deleteSkipReason, Cs as acceptedCreateOnlyDropsOf, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as repairMalformedResourcesForReadOnly, Dc as resolveAutoAssetStorage, Di as hasReadableOrphans, Dn as completedReplayEntries, Do as liveMatchesUnresolvedTokenFrame, Ds as hasReasonlessBaselineRefusal, Dt as deleteJournaledOrphans, E as serviceTokenBlockingReason, Ea as repairMalformedResourcePropertiesForReadOnly, Ec as resolveApp, Ei as displayLogicalId, En as DEFAULT_RESOURCE_WARN_AFTER_MS, Eo as valueAtCoordinate, Es as hasReadableExportSet, Et as withNestedStackContext, F as isProtectionValueActive, Fc as ssmResolvedValueType, Fi as malformedLocalOutputsWarning, Fn as PRE_DELETE_SNAPSHOT_TYPES, Fo as recordLogOnlyValue, Fr as IntrinsicFunctionResolver, Fs as AssetPublisher, Ft as replayRollback, Gc as canonicalizeRegion, Gi as malformedRenderedContainersWarning, Gn as findDestructiveChanges, Go as dynamicReferenceTokens, Gr as sendableAssumeRoleCommand, Gs as assertAssetBucketRegion, Gt as planFailedOps, Ha as isStatefulRecreateTargetSync, Hc as decodeListingKey, Hi as malformedOrphansWarning, Hn as unsupportedFinalSnapshotError, Ho as redactSecretsForState, Hr as assertSendableRoleArn, Hs as rewriteTemplateAssetReferences, Ht as demoteSupersededOrphans, I as perType, Ia as NO_CC_HANDLERS_REASON, Ic as CFN_TEMPLATE_BODY_LIMIT, Ii as malformedLocalResourceEntriesWarning, In as buildFinalSnapshotIdentifier, Io as shareLogOnlyValues, Ir as poisonRenderedSpellingsCollidingIn, Is as isSensitiveAttributeName, Jc as StageLoadError, Ji as malformedResourcesWarning, Jo as identityKeyFor, Jr as callerEnvCredentials, Js as isCrossRegionRedirect, Jt as recordUnderIdIsNotOwn, Kc as derivePartitionAndUrlSuffix, Ki as malformedResourceEntriesWarning, Kn as formatDestructiveChange, Ko as isUncertifiedBaselineMaskPosition, Kr as AWS_CREDENTIAL_ENV_KEYS, Ks as ensureAssetStorage, Kt as planRollback, L as readProtection, La as hasNoCloudControlHandlers, Lc as CFN_TEMPLATE_URL_LIMIT, Li as malformedLocalResourcesWarning, Ln as ccRoutedFinalSnapshotError, Lo as createSecretMasker, Lr as classifyReplaySecretRegion, Ls as stringifyValue, Lt as destroyStackRecordsView, M as recordedProtectionEvidence, Ma as findActionableSilentDrops, Mc as resolveUseCdkBootstrapAssets, Mi as malformedDriftResourcePropertiesWarning, Mn as stateSecretNameNeedles, Mo as logOnlyValueCount, Ms as orphansAfterRollback, Mt as makeForeignHolderScan, N as recordedProtectionNote, Nc as stateBucketExistenceConfirmed, Ni as malformedExportNamesWarning, Nn as extractDeploymentEventError, No as printingCorpusOf, Nr as DiffCalculator, Ns as orphansCarriedFrom, Nt as sameJournaledOrphans, O as noEchoAttributeNamesOf, Oa as unpreviewableOrphanRecords, Oc as resolveCaptureObservedState, Oi as hasReadableOutputs, On as journaledOrphanPrintingBag, Oo as carryLogOnlyValues, Os as hasUnverifiableParameterRefusal, Ot as dropFailedHint, P as PROTECTION_PROPERTY_BY_TYPE, Pa as unwrittenCreateOnlyReplacement, Pc as warnDeprecatedNoPrefixCliFlag, Pi as malformedExportSourceWarning, Pn as ATOMIC_FINAL_SNAPSHOT_TYPES, Po as recordLogOnlyParameterValue, Pr as INTRINSIC_KEYS, Ps as shouldRetainResource, Pt as replayFailedOperations, Qc as hasPlainPrototype, Qi as refuseDivergentRecordRegionForDestroy, Qo as carriesSecretMask, Qs as validateContainerRepoName, Qt as orphanDeleteNeedsIdentity, Ra as findReplacedReadersOfRecreateTargets, Rc as MIGRATE_TMP_PREFIX, Ri as malformedOrphanRecordsRefusalMessage, Rn as createPreDeleteFinalSnapshot, Ro as errorCauseChain, Rr as producerRegionsFromState, Rs as WorkGraph, S as keptForReadoption, Sa as repairMalformedOrphanRecordsForReadOnly, Sc as synthesisStatusMessage, Si as UNREADABLE_ORPHANS_CONTAINER_ROW, Sn as collectPublishedOutputNames, So as noEchoOutputsComparison, Sr as deleteIndeterminateGuards, Ss as splitImportedOps, T as findServiceTokenRefusals, Ta as repairMalformedResourceEntriesForReadOnly, Tc as loadCdkJson, Ti as deployRefusesOrphanRowsReason, Tn as DEFAULT_RESOURCE_TIMEOUT_MS, To as readsNoEchoSource, Tr as isWaitAbandonedError, Ts as exportNamesCarriedFrom, Ua as renderStatefulReason, Uc as expectedOwnerParam, Ui as malformedOutputsRefusalMessage, Un as maskingRetryLogger, Uo as scrubResourceRecord, Ur as explicitRoleArnOrThrow, Us as AssetModeResolver, Ut as isJournaledOrphan, Va as isStatefulRecreateTargetForReplace, Vc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vi as malformedOrphansRefusalMessage, Vn as refusesFinalSnapshot, Vo as markSameGenerationBag, Vr as assertFlagRoleArn, Vs as loadPublishableAssetManifest, Vt as recordAfterRollbackUpdate, Wc as PARTITION_TABLE, Wi as malformedOutputsWarning, Wn as constructPathOf, Wo as DYNAMIC_REFERENCE_TOKEN_SCAN, Wr as isIamRoleArn, Ws as BOOTSTRAP_MARKER_PREFIX, Wt as isReplacementOrphan, Xc as defineOwnKey, Xi as malformedStateRefusalMessage, Xo as recordNestedStackParameterExpressions, Xs as readBootstrapMarkerBody, Xt as resolveReplacementOldType, Yc as processStackMessages, Yi as malformedScrubResourceEntriesRefusalMessage, Yn as ledgerForStack, Yo as inheritNestedStackParameterAssociations, Yr as envCredentialsAreAssumedRole, Ys as parseBootstrapMarker, Yt as replacementNeverSwapped, Zc as hasOwnKey, Zi as previewableOrphanRecords, Zn as withCreateTokenLedger, Zs as validateAssetBucketName, Zt as seedsDeleteFirstGuard, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourcePropertiesForOrphan, _c as escapeRegExp, _i as parameterInputsFor, _n as exportNameNoEchoParameters, _o as maskReadbackAtCoordinates, _r as withPrintingSecrets, _s as CrossPrefixScanCache, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseMalformedOutputs, ac as dockerSpawnEnvWithSensitive, ai as getAccountInfo, al as resolveAssemblyPath, ao as prefetchCreateOnlyPropertyPaths, as as wholeStringLeavesOf, at as gray, ba as refuseMalformedResourcesForExport, bc as getDockerImageBySourceHash, bi as STATE_REGION_DIVERGED, bn as noEchoParameterValueSeed, bo as noEchoCoordinatesOf, bs as isAccessDenied, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourceEntries, cc as getDockerCmd, ci as carriesFetchableDynamicReference, cn as DeploymentEventsReader, co as withRetry, cr as CC_BROKEN_REASON, cs as STATE_SOURCED_READBACK_RULES, ct as yellow, d as conditionInputsFrom, da as refuseMalformedResourceEntriesForImport, dc as partitionSensitiveEnv, di as AWS_NO_VALUE, dn as displayTextOrWithheld, dr as isCustomResource, ds as isSingleDynamicReferenceToken, dt as reachableDivergentParameters, ea as refuseMalformedOrphanRecords, ec as buildDockerImage, el as ownValue, es as recordMaskOnlyValue, f as parentSuppliedValues, fa as refuseMalformedResourceEntriesForImportSave, fc as redactDockerArgvValues, fi as cfnRefValueFromPhysicalId, fn as exportAliasCollisionScrubWarning, fo as DagBuilder, fr as wouldReturnToSdkProvider, fs as LockManager, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourcePropertiesForExport, gc as warnFinchArgvExposure, gi as withSharedDrainBudget, gn as carriedExportAliasExposure, go as maskAtCoordinates, gs as CrossPrefixReadError, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourcePropertiesForDrift, hc as runDockerStreaming, hn as secretSafeKeyDisplay, ho as isMarkedCoordinate, hr as isCustomResourceType$1, hs as rebuildClientForBucketRegion, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as refuseMalformedOrphansForOrphan, ic as describeDockerFailure, ii as parameterTypeMayLoseSecretIdentity, il as renderAssemblyPathEscape, is as recordProvenPublicExpression, it as cyan, j as noEchoParameterNamesOf, ja as withheldAccountClause, jc as resolveStateBucketWithDefaultAndSource, ji as isReadableResourceEntry, jn as secretNamePrintingBag, jo as literalSplitDelimitersOf, js as isReadableBag, jt as loadJournaledOrphans, k as noEchoComparisonForTemplate, ka as unreadableOrphanRecords, kc as resolveSkipPrefix, ki as hasReadableResources, kn as maskEventTextWithBoundBags, ko as createUnionSecretMasker, ks as importableOutputKeys, kt as isHandledOrphan, l as templateIdentity, la as refuseMalformedResourceEntriesForDeploy, lc as isDockerClientEnvKey, li as isNamelessDynamicReferenceError, ln as DeploymentEventsStore, lr as ProviderRegistry, ls as TEMPLATE_SOURCED_RULES, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourcePropertiesForDestroy, mc as runDockerForeground, mi as refStateLookupFromResource, mn as secretBearingStateKeyWarning, mo as canonicalCoordinates, mr as readsNoEchoDeleteValues, ms as S3StateBackend, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedOrphans, nc as describeDockerCapturedOutput, ni as coerceParameterTypedValue, nl as describeFileReadFailure, ns as recordNoEchoAttributeValues, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oa as refuseMalformedOutputsForDestroy, oc as finchSecretArgvRefusal, oi as isImpossibleEmptyStoredAttribute, on as updatePartialMessage, oo as templateResourceTypes, os as STATE_SOURCED_BASELINE_RULES, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedResourceEntriesForOrphan, pc as redactedDockerCause, pi as isStalePlaceholderArnAttribute, pn as secretBearing, po as TemplateParser, pr as TemplateNoEchoReresolver, ps as isLockInfoExpired, pt as makeSiblingClaimReader, qc as AssemblyReader, qi as malformedResourcePropertiesWarning, qn as RollbackInlinePolicyWriters, qo as pathCrossesDottedKey, qr as applyCallerIdentityCredentials, qs as getBootstrapMarkerKey, qt as recheckFailedPlan, r as computeImplicitDeleteEdges, ra as refuseMalformedOrphansForDestroy, rc as describeDockerExecFailure, ri as isUnboundTemplateParameter, rl as displayAssemblyPath, rs as recordNoEchoParameterFreshValue, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedResourceAttributesForOrphan, sc as formatDockerLoginError, si as carriesDynamicReference, sl as resolveBucketRegion, sn as updatePartialReason, so as describeTypeWithThrottleRetry, ss as STATE_SOURCED_CROSS_GENERATION_RULES, st as red, t as DeployEngine, ta as refuseMalformedOrphanRecordsForDestroy, tc as resolveDockerContextDirectory, tl as absoluteAssemblyPathEscape, tn as inheritProducerRegions, ts as recordMaskOnlyValuesIn, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedResourceEntriesForDestroy, uc as isMalformedEnvKey, ui as keepsSecretReferenceToken, un as WITHHELD_NAME_DISPLAY, ur as ccBrokenReason, us as WHOLE_DYNAMIC_REFERENCE_PATTERN, ut as namesAnyDeclaredParameter, va as refuseMalformedResourcesForDeploy, vc as stripControlChars, vn as exportNameSecretExposure, vo as maskWholeValue, vr as CloudControlProvider, vs as applyCrossPrefixScan, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as repairMalformedOutputsForReadOnly, wc as getLegacyStateBucketName, wi as accountArgs, wn as bindingSkippedOutputs, wo as readbackPathFor, ws as describeRegionValueKind, wt as withNestedRevertRun, xa as refuseMalformedState, xc as Synthesizer, xi as STATE_RESOURCES_MALFORMED, xn as collectDeclaredOutputNames, xo as noEchoLeavesOf, xr as UNSPECIFIED_SKIP_REASON, xs as isNotImplemented, xt as recordDisplacedSkips, ya as refuseMalformedResourcesForDestroy, yc as AssetManifestLoader, yi as JSON_LISTING_HOLE_VALUE, yn as isWholeDynamicReferenceValue, yo as maskedLeafCoordinatesOf, yr as slowCcOperationTimeoutMs, ys as crossPrefixDeniedWarning, za as shownType, zc as findLargeInlineResources, zi as malformedOrphanRecordsWarning, zn as effectiveDeletionPolicy, zo as maskSecretsInError, zr as regionLessSecretName, zs as buildAssetRedirectMap, zt as withStackRecords } from "./deploy-engine-Bt-8KvUj.js";
+import { t as getCdkdVersion } from "./version-DyV_xwRX.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1306,6 +1306,14 @@ function createListCommand() {
 
 //#endregion
 //#region src/utils/interrupt-signals.ts
+const postCleanupListeners = /* @__PURE__ */ new WeakSet();
+function prependPostCleanupSigintListener(listener) {
+	postCleanupListeners.add(listener);
+	process.prependListener("SIGINT", listener);
+	return () => {
+		process.removeListener("SIGINT", listener);
+	};
+}
 function forwardSigtermToSigint() {
 	beginCommandInterruptScope();
 	try {
@@ -1333,7 +1341,7 @@ function watchCommandInterrupt(opts) {
 	}
 	let stacksInFlight = 0;
 	function gracefulOwnerArmed() {
-		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
+		return process.listeners("SIGINT").filter((l) => l !== handler && !postCleanupListeners.has(l)).length - interruptWatchListenerCount() > 0;
 	}
 	const handler = () => {
 		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
@@ -1923,8 +1931,8 @@ function resolveRequireApproval(cliValue, logger, cdkJson = loadCdkJson()) {
 	throw new CdkdError(`cdk.json "requireApproval" must be one of ${REQUIRE_APPROVAL_VALUES.join(", ")}, got: ${displayIdent(typeof configured === "string" ? configured : JSON.stringify(configured))}`, "INVALID_REQUIRE_APPROVAL");
 }
 function createApprovalPrompter(options) {
+	if (options.yes) return Object.assign(() => Promise.resolve(true), { autoApproves: true });
 	return (request) => {
-		if (options.yes) return Promise.resolve(true);
 		return serializePrompt(() => getLiveRenderer().suspendWhile(async () => {
 			process.stdout.write(renderApprovalRequest(request));
 			return confirmOrRefuse("Do you wish to deploy these changes?", {
@@ -2396,7 +2404,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-wbKBBEol.js");
+	providerClasses ??= import("./provider-classes-eEgFT-Vt.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2637,6 +2645,262 @@ function createPrefixMigrationGate(opts) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/registry-release.ts
+async function releaseRegistryMarkerQuietly(backend, stackName, region, logger, known) {
+	if (stackName.includes("~")) return;
+	try {
+		const released = known === void 0 ? await backend.releaseRegistryMarker(stackName, region) : await backend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
+
+//#endregion
+//#region src/cli/commands/cross-prefix-gate.ts
+function deployStackRegion(stack, baseRegion) {
+	return stack.region || baseRegion;
+}
+function createCrossPrefixDeployGate(opts) {
+	return async (gateStackName, state) => {
+		if (gateStackName !== opts.stackName) return;
+		if (state !== void 0) return;
+		const result = await opts.guard.firstDeploy(opts.stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, "deploy", ...reportOnce(result));
+	};
+}
+const reported = /* @__PURE__ */ new WeakSet();
+function reportOnce(result) {
+	const first = !reported.has(result);
+	reported.add(result);
+	return first ? [(message) => getLogger().warn(message), (message) => getLogger().info(message)] : [() => void 0, () => void 0];
+}
+function createCrossPrefixDestructiveGate(opts) {
+	return async (stackName, _destructive, stage) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, stage === "late" ? "deploy-late-replace" : "deploy-destructive", ...reportOnce(result));
+	};
+}
+function createCrossPrefixHolder(opts) {
+	return async (stackName) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		switch (result.kind) {
+			case "found": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} also records this stack under another state prefix (${displayIdent(result.prefixes[0])}), whose record may hold it`
+			};
+			case "in-progress": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} assigns this stack to another state prefix (${displayIdent(result.prefix)}), where a deploy may be in progress`
+			};
+			case "failed": return {
+				kind: "unreadable",
+				what: safeMsg`the other state prefixes of bucket ${opts.bucket} could not be checked`,
+				retryable: true
+			};
+			case "denied":
+				reportOnce(result)[0](crossPrefixDeniedWarning({
+					stackName,
+					region: opts.region,
+					bucket: opts.bucket
+				}, result.error, result.stage));
+				return;
+			default: return;
+		}
+	};
+}
+function crossPrefixEngineOptions(opts) {
+	const backend = opts.backend;
+	return {
+		...backend !== void 0 && { onFirstDeployLeftNoRecord: async (stackName) => {
+			if (stackName !== opts.stackName) return;
+			const known = await opts.guard.knownMarker?.(stackName, opts.region);
+			await releaseRegistryMarkerQuietly(backend, stackName, opts.region, getLogger(), known);
+		} },
+		firstDeployGate: createCrossPrefixDeployGate({
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			guard: opts.guard
+		}),
+		onDestructivePlan: createCrossPrefixDestructiveGate({
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			cache: opts.guard
+		}),
+		crossPrefixHolder: createCrossPrefixHolder({
+			region: opts.region,
+			bucket: opts.bucket,
+			cache: opts.guard
+		})
+	};
+}
+function composeStateLoadedGates(crossPrefix, migration) {
+	return async (stackName, state) => {
+		await crossPrefix(stackName, state);
+		if (migration) await migration(stackName, state);
+	};
+}
+
+//#endregion
+//#region src/state/stack-registry.ts
+function unwrapReadError(error) {
+	return error instanceof CrossPrefixReadError ? error.cause : error;
+}
+function topLevelStackName(stackName) {
+	return stackName.split("~")[0];
+}
+var CrossPrefixGuard = class {
+	scan;
+	backend;
+	readOnly;
+	markers = /* @__PURE__ */ new Map();
+	answers = /* @__PURE__ */ new Map();
+	constructor(backend, opts = {}) {
+		this.backend = backend;
+		this.readOnly = opts.readOnly === true;
+		this.scan = opts.scan ?? new CrossPrefixScanCache(backend);
+	}
+	get target() {
+		return this.scan.target;
+	}
+	full(stackName, region, when = "now") {
+		const key = JSON.stringify([stackName, region]);
+		let answer = this.answers.get(key);
+		if (answer === void 0) {
+			answer = this.evaluate(stackName, region, false, when);
+			this.answers.set(key, answer);
+		} else if (when === "now") this.scan.target.rank(stackName, region, "now");
+		return answer;
+	}
+	firstDeploy(stackName, region) {
+		const key = JSON.stringify([stackName, region]);
+		const answer = this.evaluate(stackName, region, true, "now");
+		this.answers.set(key, answer);
+		return answer;
+	}
+	async knownMarker(stackName, region) {
+		const read = this.markers.get(JSON.stringify([topLevelStackName(stackName), region]));
+		if (read === void 0) return void 0;
+		return read.catch(() => void 0);
+	}
+	marker(top, region, fresh = false) {
+		const key = JSON.stringify([top, region]);
+		let read = fresh ? void 0 : this.markers.get(key);
+		if (read === void 0) {
+			read = this.backend.getRegistryMarker(top, region);
+			this.markers.set(key, read);
+		}
+		return read;
+	}
+	async evaluate(stackName, region, firstDeploy, when) {
+		const top = topLevelStackName(stackName);
+		const claimable = top === stackName && !this.readOnly;
+		if (firstDeploy && claimable && !this.markers.has(JSON.stringify([top, region]))) {
+			if (await this.claim(top, region) === "claimed") return { kind: "clear" };
+		}
+		for (let attempt = 0; attempt < 2; attempt++) {
+			let marker;
+			try {
+				marker = await this.marker(top, region, attempt > 0);
+			} catch (error) {
+				return this.fallback(stackName, region, when, error);
+			}
+			if (marker === null) {
+				if (firstDeploy) {
+					if (!claimable) return { kind: "clear" };
+					const claimed = await this.claim(top, region);
+					if (claimed === "conflict") continue;
+					if (claimed !== "claimed") return this.fallback(stackName, region, when, claimed.error);
+					return { kind: "clear" };
+				}
+				const scanned = await this.scan.full(stackName, region, when);
+				if (scanned.kind === "clear" && claimable) {
+					if (await this.claim(top, region) === "conflict") continue;
+				}
+				return scanned;
+			}
+			if (marker.prefix === this.backend.prefix) return { kind: "clear" };
+			let held;
+			let locked;
+			try {
+				held = await this.backend.recordUnderPrefix(marker.prefix, stackName, region);
+				locked = held === "holder" ? false : await this.backend.lockUnderPrefix(marker.prefix, top, region);
+			} catch (error) {
+				return isAccessDenied(error) ? {
+					kind: "denied",
+					error,
+					stage: "probe"
+				} : {
+					kind: "failed",
+					error
+				};
+			}
+			if (held === "holder") return {
+				kind: "found",
+				prefixes: [marker.prefix]
+			};
+			if (locked) return {
+				kind: "in-progress",
+				prefix: marker.prefix
+			};
+			const stale = held === "empty" ? [marker.prefix] : [];
+			const scanned = await this.scan.full(stackName, region, when);
+			if (scanned.kind !== "clear") return scanned;
+			const allStale = [.../* @__PURE__ */ new Set([...stale, ...scanned.stale ?? []])];
+			const answer = {
+				kind: "clear",
+				...allStale.length > 0 && { stale: allStale }
+			};
+			if (!claimable) return answer;
+			if (await this.claim(top, region, marker.etag) === "conflict") continue;
+			return answer;
+		}
+		return {
+			kind: "failed",
+			error: new CrossPrefixReadError(`_cdkd-registry/${region}/${top}.json`, Object.assign(/* @__PURE__ */ new Error("the marker changed twice while cdkd was claiming it"), { name: "ConcurrentClaim" }))
+		};
+	}
+	async claim(top, region, ifMatch) {
+		try {
+			const result = await this.backend.claimRegistryMarker(top, region, ifMatch);
+			if (result === "claimed") this.markers.set(JSON.stringify([top, region]), Promise.resolve({
+				prefix: this.backend.prefix,
+				etag: ""
+			}));
+			return result;
+		} catch (error) {
+			return { error };
+		}
+	}
+	async fallback(stackName, region, when, error) {
+		if (!isAccessDenied(error) && !isNotImplemented(unwrapReadError(error))) return {
+			kind: "failed",
+			error
+		};
+		const scanned = await this.scan.full(stackName, region, when);
+		return scanned.kind === "clear" ? {
+			kind: "denied",
+			error,
+			stage: "registry",
+			...scanned.stale && { stale: scanned.stale }
+		} : scanned;
+	}
+};
+
 //#endregion
 //#region src/cli/commands/deploy.ts
 async function deployCommand(stacks, options) {
@@ -2706,6 +2970,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 	};
 	process.on("SIGINT", topLevelSigintHandler);
 	const unforwardSigterm = forwardSigtermToSigint();
+	let preflightBackendForCleanup;
 	try {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
@@ -2721,6 +2986,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
+		preflightBackendForCleanup = preflightStateBackend;
 		synthOptions.stateBucket = stateBucket;
 		const refusalRecovery = {
 			profile: options.profile,
@@ -2787,6 +3053,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			ignoreErrors: options.ignoreErrors === true
 		});
 		refuseMalformedNestedTemplateTrees(targetStacks);
+		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
+		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
@@ -2816,7 +3084,6 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const dagBuilder = new DagBuilder({ relaxCdkVpcDefensiveDeps: !!options.aggressiveVpcParallel });
 		const diffCalculator = new DiffCalculator();
-		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
 		const stackRedirects = /* @__PURE__ */ new Map();
@@ -2864,13 +3131,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
 		const bufferStackOutput = targetStacks.length > 1;
 		let totalUnaddressed = 0;
+		let totalCrossPrefixKept = 0;
 		let cancelledStacks = 0;
 		const runStack = async (stackInfo) => {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
 		const runStackInner = async (stackInfo) => {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
-			const stackRegion = stackInfo.region || baseRegion;
+			const stackRegion = deployStackRegion(stackInfo, baseRegion);
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
@@ -2908,6 +3176,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					skipPrefix,
 					yes: options.yes
 				});
+				const crossPrefix = crossPrefixEngineOptions({
+					stackName: stackInfo.stackName,
+					region: stackRegion,
+					bucket: stateBucket,
+					recovery: refusalRecovery,
+					guard: crossPrefixGuard,
+					backend: preflightStateBackend
+				});
 				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
@@ -2987,7 +3263,10 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					refusalRecovery,
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
-					...migrationGate && { onCurrentStateLoaded: migrationGate },
+					onCurrentStateLoaded: composeStateLoadedGates(crossPrefix.firstDeployGate, migrationGate),
+					...crossPrefix.onFirstDeployLeftNoRecord && { onFirstDeployLeftNoRecord: crossPrefix.onFirstDeployLeftNoRecord },
+					onDestructivePlan: crossPrefix.onDestructivePlan,
+					crossPrefixHolder: crossPrefix.crossPrefixHolder,
 					...options.pinCcApi?.length && { pinCcApi: {
 						stackName: stackInfo.stackName,
 						logicalIds: new Set(options.pinCcApi)
@@ -3038,10 +3317,15 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				logger.info(`  Updated: ${updatedTotal > 0 ? yellow(updatedTotal) : gray(updatedTotal)}`);
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
+				const crossPrefixKept = deployResult.crossPrefixKept ?? 0;
+				if (crossPrefixKept > 0) logger.info(`  Kept (replacement refused: another state prefix records the stack, or the check could not run): ${yellow(crossPrefixKept)}`);
 				if (ownUpdatePartial > 0) logger.info(safeMsg`    of which left an orphaned predecessor: ${yellow(ownUpdatePartial)}`);
 				if (nestedUpdatePartial > 0) logger.info(safeMsg`  Left an orphaned predecessor in a nested stack: ${yellow(nestedUpdatePartial)}`);
-				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial;
-				if (!options.dryRun) totalUnaddressed += stackUnaddressed;
+				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial + crossPrefixKept;
+				if (!options.dryRun) {
+					totalUnaddressed += stackUnaddressed;
+					totalCrossPrefixKept += crossPrefixKept;
+				}
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -3057,7 +3341,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					created: deployResult.created,
 					updated: updatedTotal,
 					deleted: deployResult.deleted,
-					...deployResult.deleteSkipped + deployResult.updatePartial > 0 && { skipped: deployResult.deleteSkipped + deployResult.updatePartial }
+					...stackUnaddressed > 0 && { skipped: stackUnaddressed }
 				}, deployResult.durationMs);
 			} catch (deployError) {
 				if (deployError instanceof DeployCancelledError) {
@@ -3102,11 +3386,12 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				if (!outcome.ok) throw outcome.error;
 			}
 		});
-		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. ` + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
+		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. ` + (totalCrossPrefixKept > 0 ? "A replacement kept because another state prefix records the stack, or the check could not run, keeps its old resource and applies no new value — resolve the pair, or let the check run, and re-deploy. " : "") + "The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. " + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
 	} finally {
 		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
+		preflightBackendForCleanup?.destroyClient();
 	}
 }
 function createDeployCommand() {
@@ -10744,19 +11029,40 @@ async function acquireStackLock(opts) {
 		get interrupted() {
 			return interrupted;
 		},
-		async release({ failureMessage, beforeRelease }) {
+		async release({ failureMessage, beforeRelease, holdUntil }) {
 			if (released) return;
 			released = true;
-			try {
-				await beforeRelease?.();
+			const releaseNow = async () => {
 				try {
 					await lockManager.releaseLock(stackName, region);
 					lockHeld = false;
 				} catch (releaseErr) {
 					getLogger().warn(safeMsg`${failureMessage}: ${describeAwsFailure(releaseErr).detail}`);
 				}
+			};
+			let deferred = false;
+			try {
+				await beforeRelease?.();
+				if (holdUntil !== void 0) {
+					process.removeListener("SIGINT", sigintHandler);
+					let forced = false;
+					const removeDeferred = prependPostCleanupSigintListener(() => {
+						if (!interrupted) {
+							interrupted = true;
+							return;
+						}
+						if (forced || !lockHeld) return;
+						forced = true;
+						lockManager.releaseLock(stackName, region).catch(() => {});
+						process.stderr.write(`\nForce-quit (post-destroy cleanup): stack lock may not be released.${forceQuitRecoveryClause(stackName, region, recovery)}\n`);
+					});
+					holdUntil.defer(holdUntil.work.then(() => void 0, () => void 0).then(releaseNow).finally(removeDeferred));
+					deferred = true;
+					return;
+				}
+				await releaseNow();
 			} finally {
-				process.removeListener("SIGINT", sigintHandler);
+				if (!deferred) process.removeListener("SIGINT", sigintHandler);
 			}
 		}
 	};
@@ -10864,6 +11170,16 @@ function countProtectedJournaledOrphans(orphans, region) {
 	}
 	return count;
 }
+async function releaseRegistryMarkerAfterDestroy(ctx, stackName, region, logger) {
+	if (ctx.crossPrefixCheck === void 0) return;
+	try {
+		const known = await ctx.crossPrefixCheck.cache.knownMarker?.(stackName, region);
+		const released = await ctx.stateBackend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
 async function runDestroyForStack(stackName, state, ctx) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -10878,8 +11194,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 		errorCount: 0,
 		interrupted: false
 	};
+	const retainedForReadoption = [];
+	let retainedEarlier;
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
+	const crossPrefixScan = ctx.crossPrefixCheck?.cache.full(stackName, regionForState);
 	const refusalRecovery = {
 		profile: ctx.profile,
 		stateBucket: ctx.stateBucket,
@@ -10902,6 +11221,15 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState, refusalRecovery);
+	if (crossPrefixScan) applyCrossPrefixScan(await crossPrefixScan, {
+		stackName,
+		region: regionForState,
+		bucket: ctx.stateBucket,
+		recovery: {
+			profile: ctx.profile,
+			stateBucket: ctx.stateBucket
+		}
+	}, "destroy", (message) => logger.warn(message), (message) => logger.info(message));
 	if (resourceCount === 0 && orphanCount === 0 && journaledOrphans.count === 0) {
 		logger.info(`Stack ${displayStackName(stackName)} has no resources, cleaning up state...`);
 		const emptyLock = await acquireStackLock({
@@ -10925,6 +11253,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.info(`${green("✓")} State deleted`);
+			await Promise.all([recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, [], logger), releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger)]);
 		} finally {
 			await emptyLock.release({ failureMessage: "Failed to release lock after empty-state cleanup" });
 		}
@@ -11012,11 +11341,14 @@ async function runDestroyForStack(stackName, state, ctx) {
 	}
 	const renderer = getLiveRenderer();
 	let statePreserved = false;
+	let heldTail;
+	let stackFinished = false;
 	let journaledOrphanFailures = 0;
 	let journaledOrphanSkips = 0;
 	const lock = await acquireStackLock({
 		...stackLockBase,
 		onFirstSignal: () => {
+			if (stackFinished) return;
 			renderer.printAbove(() => {
 				process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
 			});
@@ -11190,6 +11522,17 @@ async function runDestroyForStack(stackName, state, ctx) {
 				if (shouldRetainResource(resource.deletionPolicy)) {
 					logger.info(`  ⊘ ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) retained — DeletionPolicy: ${displaySafe(resource.deletionPolicy)}`);
 					result.retainedCount++;
+					if (keptForReadoption(resource)) {
+						retainedForReadoption.push({
+							logicalId,
+							resourceType: resource.resourceType,
+							physicalId: resource.physicalId
+						});
+						if (retainedEarlier === void 0) {
+							retainedEarlier = Promise.resolve().then(() => ctx.stateBackend.loadRetainedRecord(stackName, regionForState));
+							retainedEarlier.catch(() => void 0);
+						}
+					}
 					recordDestroyEvent(ctx.eventRecorder, {
 						eventType: "RESOURCE_RETAINED",
 						stackName,
@@ -11401,7 +11744,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.debug("State deleted");
-			if (ctx.exportIndexStore) await ctx.exportIndexStore.removeStack(stackName, regionForState);
+			const writeKept = () => recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, retainedForReadoption, logger, retainedEarlier);
+			const releaseMarker = () => releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger);
+			if (ctx.deferRegistryTail !== void 0) {
+				heldTail = writeKept().then(releaseMarker);
+				await ctx.exportIndexStore?.removeStack(stackName, regionForState);
+			} else await Promise.all([
+				writeKept(),
+				releaseMarker(),
+				ctx.exportIndexStore?.removeStack(stackName, regionForState)
+			]);
 		} else {
 			try {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
@@ -11448,6 +11800,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 		try {
 			await lock.release({
 				failureMessage: `Failed to release lock for stack ${displayStackName(stackName)}`,
+				...heldTail !== void 0 && ctx.deferRegistryTail !== void 0 && { holdUntil: {
+					work: heldTail,
+					defer: ctx.deferRegistryTail
+				} },
 				beforeRelease: async () => {
 					try {
 						renderer.stop();
@@ -11458,6 +11814,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					logger.debug("Releasing lock...");
 				}
 			});
+			stackFinished = true;
 		} finally {
 			restoreBaseRegionAndClients();
 		}
@@ -11508,6 +11865,10 @@ function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
 	}
 	return ordered;
 }
+function plannedDestroyRegion(refs, synthRegion, cliRegion) {
+	if (refs.length === 1) return refs[0]?.region || cliRegion;
+	if (refs.length > 1 && synthRegion && refs.some((r) => r.region === synthRegion)) return synthRegion;
+}
 async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger) {
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
@@ -11565,6 +11926,9 @@ async function destroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	let stateBackendForCleanup;
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -11574,6 +11938,7 @@ async function destroyCommand(stackArgs, options) {
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile }
 		});
+		stateBackendForCleanup = stateBackend;
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
 		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
@@ -11716,6 +12081,14 @@ async function destroyCommand(stackArgs, options) {
 			arr.push(ref);
 			stateRefsByName.set(ref.stackName, arr);
 		}
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const synth = appStacks.find((s) => s.stackName === name);
+			if (synth?.terminationProtection === true && !options.removeProtection) continue;
+			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, region);
+			if (planned !== void 0) crossPrefixCheck.cache.full(name, planned, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			logger.info(`\nPreparing to destroy stack: ${displaySafe(stackName)}`);
 			const refs = stateRefsByName.get(stackName) ?? [];
@@ -11733,15 +12106,12 @@ async function destroyCommand(stackArgs, options) {
 					continue;
 				}
 			}
+			const plannedRegion = plannedDestroyRegion(refs, synthRegion, region);
 			let stackTargetRegion;
 			if (refs.length === 0) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
 				continue;
-			} else if (refs.length === 1) {
-				const onlyRegion = refs[0]?.region;
-				if (!onlyRegion) stackTargetRegion = region;
-				else stackTargetRegion = onlyRegion;
-			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
+			} else if (plannedRegion !== void 0) stackTargetRegion = plannedRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
 				const orphanOneClause = withheldAccountClause(accountRecovery, "the command below prints").trimEnd();
@@ -11819,6 +12189,8 @@ async function destroyCommand(stackArgs, options) {
 					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					resolveSecretDerivedPrincipals: {},
 					stackDestroy: true,
+					crossPrefixCheck,
+					...deferRegistryTail !== void 0 && { deferRegistryTail },
 					exportIndexStore,
 					...TemplateNoEchoReresolver.usable(synthStack?.template) && (synthStack.region === void 0 || synthStack.region === stackTargetRegion) && { noEchoReresolver: new TemplateNoEchoReresolver({
 						template: synthStack.template,
@@ -11872,9 +12244,11 @@ async function destroyCommand(stackArgs, options) {
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		awsClients.destroy();
+		stateBackendForCleanup?.destroyClient();
 	}
 }
 function createDestroyCommand() {
@@ -14022,7 +14396,7 @@ async function exportCommand(stackArg, options) {
   2. Re-run the phase 2 UPDATE manually with the full synth template:
        ${phase2RetryCommand(cfnStackName)}\n  3. Once phase 2 succeeds, clean up cdkd's stale state record.${orphan.note}\n     Run: ${orphan.command}`);
 			}
-			await stateBackend.deleteState(resolvedStackName, targetRegion);
+			await removeExportedStackRecord(stateBackend, resolvedStackName, targetRegion, logger);
 			logger.info(`cdkd state for ${quotedOrNotShown(resolvedStackName)} (${quotedRegion(targetRegion)}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
 			printNextSteps({
 				cfnStackName,
@@ -15626,6 +16000,11 @@ async function buildResolvedParametersPerStack(args) {
 		intrinsicSkippedByCdkdName
 	};
 }
+async function removeExportedStackRecord(stateBackend, stackName, region, logger) {
+	await stateBackend.deleteState(stackName, region);
+	await recordRetainedForReadoption(stateBackend, stackName, region, [], logger);
+	await releaseRegistryMarkerQuietly(stateBackend, stackName, region, logger);
+}
 async function runPerStackImportLoop(args) {
 	const logger = getLogger();
 	const { rootStackName, rootRegion, rootStackInfoNestedTemplates, rootTemplateFormat, tree, rootTemplate, cfnStackNameOverrides, rootParameters, deps, options } = args;
@@ -15903,7 +16282,7 @@ async function runPerStackImportLoop(args) {
 			}
 			const stateDeletionFailures = [];
 			for (const node of leafFirst) try {
-				await deps.stateBackend.deleteState(node.stackName, node.region);
+				await removeExportedStackRecord(deps.stateBackend, node.stackName, node.region, logger);
 				logger.info(`cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}) removed.`);
 			} catch (err) {
 				stateDeletionFailures.push({
@@ -16129,6 +16508,10 @@ const STATE_READ_REASONS = {
 	"read-failed": STATE_READ_FAILED_REASON,
 	"resources-malformed": "resources is not a JSON object; run `cdkd state show --json` to see the record"
 };
+function stateDestroyTargets(refs, stackRegion) {
+	if (stackRegion) return refs.filter((r) => r.region === stackRegion || !r.region);
+	return refs.length === 1 ? [...refs] : void 0;
+}
 function resourceCountOrNull(resources) {
 	if (resources === void 0 || resources === null) return 0;
 	if (typeof resources !== "object" || Array.isArray(resources)) return null;
@@ -16249,7 +16632,10 @@ async function setupStateBackend(options) {
 		bucket,
 		prefix,
 		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
-		dispose: () => awsClients.destroy()
+		dispose: () => {
+			awsClients.destroy();
+			stateBackend.destroyClient();
+		}
 	};
 }
 function renderRecovery(options, setup) {
@@ -16690,6 +17076,43 @@ function createStateShowCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+async function clearRetainedQuietly(backend, stackName, region, logger) {
+	try {
+		await backend.saveRetainedResources(stackName, region, []);
+		return true;
+	} catch (error) {
+		logger.warn(safeMsg`Could not empty the kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}): a later deploy here may still take a kept ` + `resource back. Re-run 'cdkd state orphan' once it can write.`);
+		return false;
+	}
+}
+async function clearRetainedWithoutRecord(backend, stackName, stackRegion, logger) {
+	if (stackName.includes("/")) return {
+		cleared: [],
+		attempted: 0
+	};
+	const base = `${backend.prefix}/${stackName}/`;
+	let regions;
+	try {
+		const keys = (await backend.listRawKeys(base)).map((key) => key.slice(base.length).split("/")).filter((parts) => parts.length >= 2 && parts[0] !== "");
+		const recorded = new Set(keys.filter((parts) => parts.length === 2 && parts[1] === "state.json").map((parts) => parts[0]));
+		regions = [...new Set(keys.map((parts) => parts[0]).filter((region) => stackRegion === void 0 || region === stackRegion).filter((region) => !recorded.has(region)))];
+	} catch (error) {
+		logger.warn(safeMsg`Could not look for a kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}).`);
+		return {
+			cleared: [],
+			attempted: 0
+		};
+	}
+	const cleared = [];
+	for (const region of regions) {
+		if (await clearRetainedQuietly(backend, stackName, region, logger)) cleared.push(region);
+		await releaseRegistryMarkerQuietly(backend, stackName, region, logger);
+	}
+	return {
+		cleared,
+		attempted: regions.length
+	};
+}
 async function stateOrphanCommand(stackArgs, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -16705,6 +17128,12 @@ async function stateOrphanCommand(stackArgs, options) {
 		for (const stackName of stackArgs) {
 			const stackRefs = refs.filter((r) => r.stackName === stackName);
 			if (stackRefs.length === 0) {
+				const { cleared, attempted } = await clearRetainedWithoutRecord(setup.stateBackend, stackName, options.stackRegion, logger);
+				if (attempted > 0 && cleared.length === 0) continue;
+				if (cleared.length > 0) {
+					logger.info(safeMsg`Cleared the kept-resource record of ${plainOrDescribed(stackName, "stack name")} ` + safeMsg`(${cleared.map((r) => displaySafe(r, { asciiOnly: true })).join(", ")}): ` + `a later deploy here no longer takes a kept resource back.`);
+					continue;
+				}
 				logger.info(safeMsg`No state found for stack: ${plainOrDescribed(stackName, "stack name")}, skipping` + (isPasteableIdent(stackName) ? "" : safeMsg`. ${STATE_LIST_POINTER}`));
 				continue;
 			}
@@ -16748,10 +17177,13 @@ async function stateOrphanCommand(stackArgs, options) {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, target.region, logger);
 					await setup.stateBackend.deleteState(stackName, target.region);
 					await setup.lockManager.forceReleaseLock(stackName, target.region);
+					await clearRetainedQuietly(setup.stateBackend, stackName, target.region, logger);
+					await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, target.region, logger);
 				} else {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, void 0, logger);
 					await setup.stateBackend.deleteLegacyState(stackName);
 					await setup.lockManager.forceReleaseLock(stackName, void 0);
+					await clearRetainedWithoutRecord(setup.stateBackend, stackName, void 0, logger);
 				}
 				logger.info(safeMsg`✓ Removed state for stack: ${describedStackRef(target)}` + ((options.yes || options.force) && refIsDescribed(target) ? safeMsg`. ${STATE_LIST_POINTER}` : ""));
 			}
@@ -16899,6 +17331,8 @@ async function stateDestroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -16916,16 +17350,23 @@ async function stateDestroyCommand(stackArgs, options) {
 			if (!options.stackRegion) return laterRefs.length > 0;
 			return laterRefs.some((r) => r.region === options.stackRegion || !r.region);
 		});
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(setup.stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const refs = stateRefs.filter((r) => r.stackName === name);
+			for (const ref of stateDestroyTargets(refs, options.stackRegion) ?? []) crossPrefixCheck.cache.full(name, ref.region ?? setup.region, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
+			const planned = stateDestroyTargets(refs, options.stackRegion);
 			if (options.stackRegion) {
-				targets = refs.filter((r) => r.region === options.stackRegion || !r.region);
+				targets = planned ?? [];
 				if (targets.length === 0) {
 					logger.warn(safeMsg`Skipping ${plainOrDescribed(stackName, "stack name")} (no state record matches ` + safeMsg`--stack-region ${displayIdent(options.stackRegion)})`);
 					continue;
 				}
-			} else if (refs.length === 1) targets = refs;
+			} else if (planned !== void 0) targets = planned;
 			else throw multipleRegionsError(stackName, refs, `Use --stack-region ${commandHole("region")} to pick one.`);
 			for (const [refIndex, ref] of targets.entries()) {
 				logger.info(safeMsg`\nPreparing to destroy stack: ${formatStackRefSafe(ref)}`);
@@ -16982,6 +17423,8 @@ async function stateDestroyCommand(stackArgs, options) {
 						skipFinalSnapshot: options.skipFinalSnapshot === true,
 						resolveSecretDerivedPrincipals: {},
 						stackDestroy: true,
+						crossPrefixCheck,
+						...deferRegistryTail !== void 0 && { deferRegistryTail },
 						exportIndexStore: setup.exportIndexStore,
 						...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -17022,6 +17465,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
 		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd state destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		setup.dispose();
@@ -17684,6 +18128,7 @@ async function rollbackCommand(stackArg, options) {
 			});
 			return;
 		}
+		const crossPrefixScan = new CrossPrefixGuard(setup.stateBackend).full(stackName, region);
 		stackAwsClients = new AwsClients({
 			region,
 			...options.profile && { profile: options.profile }
@@ -17718,6 +18163,15 @@ async function rollbackCommand(stackArg, options) {
 				segments: journal.segments.filter((s) => s.reason !== NESTED_PENDING_PARENT_REASON)
 			};
 			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+			applyCrossPrefixScan(await crossPrefixScan, {
+				stackName,
+				region,
+				bucket: setup.bucket,
+				recovery: {
+					profile: options.profile,
+					stateBucket: setup.bucket
+				}
+			}, "rollback", (message) => logger.warn(message), (message) => logger.info(message));
 			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
 			if (!options.revertFailed) for (const segment of journal.segments) {
@@ -17961,6 +18415,8 @@ async function rollbackCommand(stackArg, options) {
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
+				await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
+				await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
 				logger.info(`State for ${stackRegionShown(stackName, region)} removed (stack fully rolled back).`);
 			}
 			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
@@ -19108,8 +19564,20 @@ async function forceUnlockCommand(stackArgs, options) {
 				const where = r ? `${displayStackName(stackName)} (${displayIdent(r)})` : `${displayStackName(stackName)} (legacy lock key)`;
 				logger.info(`Force-unlocking stack: ${where}`);
 				try {
-					await lockManager.forceReleaseLock(stackName, r);
+					let ledgerError;
+					let recorded = false;
+					await lockManager.forceReleaseLock(stackName, r, async (horizon) => {
+						if (r === void 0) return;
+						const ledger = ledgerForStack(stateBackend, stackName, r);
+						for (let attempt = 0; attempt < 2 && !recorded; attempt++) try {
+							await ledger.noteAbandoned(horizon);
+							recorded = true;
+						} catch (error) {
+							ledgerError = error;
+						}
+					});
 					logger.info(`✓ Lock released for stack: ${where}`);
+					if (!recorded && ledgerError !== void 0) logger.warn(safeMsg`Lock released, but the create-token ledger of ${where} could not record when the ` + safeMsg`abandoned run stopped: ${describeAwsFailure(ledgerError).summary}. ` + "A later deploy may take back a resource of those names that another deployment creates.");
 				} catch (error) {
 					const message = describeAwsFailure(error).detail;
 					if (message.includes("No lock found") || message.includes("NoSuchKey")) logger.info(`No lock found for stack: ${where}`);
@@ -19219,6 +19687,20 @@ var ObservedBaselineRefusals = class extends Set {
 	unverifiableParameter = /* @__PURE__ */ new Set();
 	hadDeployedParameterSource = false;
 };
+async function claimRegistryMarkerAfterImport(backend, stackName, region, logger) {
+	const answer = await new CrossPrefixGuard(backend).full(stackName, region);
+	const regionShown = displaySafe(region, { asciiOnly: true });
+	switch (answer.kind) {
+		case "clear": return;
+		case "found":
+			logger.warn(safeMsg`The state bucket also records ${displayStackName(stackName)} (${regionShown}) under another state prefix ` + safeMsg`(${answer.prefixes.map((p) => displayIdent(p)).join(", ")}). One stack name per ` + "account and region is supported: drop one of the records with 'cdkd state orphan' before deploying or destroying either.");
+			return;
+		case "in-progress":
+			logger.warn(safeMsg`A deploy of ${displayStackName(stackName)} (${regionShown}) holds a lock under another state prefix ` + safeMsg`(${displayIdent(answer.prefix)}). One stack name per account and region is ` + `supported: keep one of the two before deploying or destroying either.`);
+			return;
+		default: logger.warn(safeMsg`Could not record ${displayStackName(stackName)} (${regionShown}) in the state bucket's stack registry` + (answer.kind === "denied" || answer.kind === "failed" ? safeMsg` (${describeAwsFailure(answer.error).summary})` : "") + `. Its next guarded command records it.`);
+	}
+}
 async function importCommand(stackArg, options) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -19439,6 +19921,7 @@ async function importCommand(stackArg, options) {
 			await recordImportOnRollbackJournal(stateBackend, stackInfo.stackName, targetRegion, importedRows.map((r) => r.logicalId), stackState.resources, logger);
 			await stateBackend.saveState(stackInfo.stackName, targetRegion, stackState, saveOptions);
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
+			await claimRegistryMarkerAfterImport(stateBackend, stackInfo.stackName, targetRegion, logger);
 			logger.info(`  ${importedRows.length} resource(s) imported. Run 'cdkd diff' to see how the imported state lines up with the template.`);
 			if (migrationCfnStackName && migrationTree && accountIdForNestedSynth) await importNestedStackChildrenRecursive({
 				lockRecovery,
@@ -27766,4 +28249,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-v_QNBjtZ.js.map
+//# sourceMappingURL=program-CN7Dqb3j.js.map