@go-to-k/cdkd 0.296.28 → 0.296.30

package/dist/{program-v_QNBjtZ.js → program-CIxuz2zX.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
-import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-B61e5_Sk.js";
+import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as gray, $a as prefetchCreateOnlyPropertyPaths, $i as refuseMalformedOutputs, $o as wholeStringLeavesOf, $r as getAccountInfo, $s as partitionSensitiveEnv, A as perType, Aa as NO_CC_HANDLERS_REASON, Ac as decodeListingKey, Ai as malformedLocalResourceEntriesWarning, An as buildFinalSnapshotIdentifier, Ao as shareLogOnlyValues, Ar as poisonRenderedSpellingsCollidingIn, As as rewriteTemplateAssetReferences, Bc as hasPlainPrototype, Bi as malformedResourceEntriesWarning, Bn as formatDestructiveChange, Bo as isUncertifiedBaselineMaskPosition, Br as AWS_CREDENTIAL_ENV_KEYS, Bs as validateContainerRepoName, Bt as planRollback, C as noEchoComparisonForTemplate, Ca as unreadableOrphanRecords, Cc as ssmResolvedValueType, Ci as hasReadableResources, Cn as maskEventTextWithBoundBags, Co as createUnionSecretMasker, Cs as AssetPublisher, Ct as isHandledOrphan, D as recordedProtectionNote, Dc as findLargeInlineResources, Di as malformedExportNamesWarning, Dn as extractDeploymentEventError, Do as printingCorpusOf, Dr as DiffCalculator, Ds as buildAssetRedirectMap, Dt as sameJournaledOrphans, E as recordedProtectionEvidence, Ea as findActionableSilentDrops, Ec as MIGRATE_TMP_PREFIX, Ei as malformedDriftResourcePropertiesWarning, En as stateSecretNameNeedles, Eo as logOnlyValueCount, Es as WorkGraph, Et as makeForeignHolderScan, Fa as isStatefulRecreateTargetForReplace, Fc as AssemblyReader, Fi as malformedOrphansRefusalMessage, Fn as refusesFinalSnapshot, Fo as markSameGenerationBag, Fr as assertFlagRoleArn, Fs as getBootstrapMarkerKey, Ft as recordAfterRollbackUpdate, Gc as displayAssemblyPath, Gi as previewableOrphanRecords, Gn as withCreateTokenLedger, Gs as describeDockerExecFailure, Gt as seedsDeleteFirstGuard, Hc as ownValue, Hi as malformedResourcesWarning, Ho as identityKeyFor, Hr as callerEnvCredentials, Hs as buildDockerImage, Ht as recordUnderIdIsNotOwn, Ia as isStatefulRecreateTargetSync, Ic as StageLoadError, Ii as malformedOrphansWarning, In as unsupportedFinalSnapshotError, Io as redactSecretsForState, Ir as assertSendableRoleArn, Is as isCrossRegionRedirect, It as demoteSupersededOrphans, Ji as refuseMalformedOrphanRecords, Jo as recordMaskOnlyValue, Js as finchSecretArgvRefusal, Kc as renderAssemblyPathEscape, Ki as refuseDivergentRecordRegionForDestroy, Ko as carriesSecretMask, Ks as describeDockerFailure, Kt as orphanDeleteNeedsIdentity, La as renderStatefulReason, Lc as processStackMessages, Li as malformedOutputsRefusalMessage, Ln as maskingRetryLogger, Lo as scrubResourceRecord, Lr as explicitRoleArnOrThrow, Ls as parseBootstrapMarker, Lt as isJournaledOrphan, Ma as findReplacedReadersOfRecreateTargets, Mc as PARTITION_TABLE, Mi as malformedOrphanRecordsRefusalMessage, Mn as createPreDeleteFinalSnapshot, Mo as errorCauseChain, Mr as producerRegionsFromState, Ms as BOOTSTRAP_MARKER_PREFIX, Na as shownType, Nc as canonicalizeRegion, Ni as malformedOrphanRecordsWarning, Nn as effectiveDeletionPolicy, No as maskSecretsInError, Nr as regionLessSecretName, Ns as assertAssetBucketRegion, Nt as withStackRecords, O as PROTECTION_PROPERTY_BY_TYPE, Oa as unwrittenCreateOnlyReplacement, Oc as uploadCfnTemplate, Oi as malformedExportSourceWarning, On as ATOMIC_FINAL_SNAPSHOT_TYPES, Oo as recordLogOnlyParameterValue, Or as INTRINSIC_KEYS, Os as createAssetRedirectResolver, Ot as replayFailedOperations, Pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pc as derivePartitionAndUrlSuffix, Pi as malformedOrphanRowsKeptWarning, Pn as isFinalSnapshotError, Po as maskSecretsInText, Pr as applyRoleArnIfSet, Ps as ensureAssetStorage, Pt as removeProtectionTypeList, Q as cyan, Qi as refuseMalformedOrphansForOrphan, Qo as recordProvenPublicExpression, Qr as parameterTypeMayLoseSecretIdentity, Qs as isMalformedEnvKey, Rc as defineOwnKey, Ri as malformedOutputsWarning, Rn as constructPathOf, Ro as DYNAMIC_REFERENCE_TOKEN_SCAN, Rr as isIamRoleArn, Rs as readBootstrapMarkerBody, Rt as isReplacementOrphan, S as noEchoAttributeNamesOf, Sa as unpreviewableOrphanRecords, Sc as warnDeprecatedNoPrefixCliFlag, Si as hasReadableOutputs, Sn as journaledOrphanPrintingBag, So as carryLogOnlyValues, Ss as shouldRetainResource, St as dropFailedHint, T as noEchoParameterNamesOf, Ta as withheldAccountClause, Tc as CFN_TEMPLATE_URL_LIMIT, Ti as isReadableResourceEntry, Tn as secretNamePrintingBag, To as literalSplitDelimitersOf, Ts as stringifyValue, Tt as loadJournaledOrphans, Uc as absoluteAssemblyPathEscape, Ui as malformedScrubResourceEntriesRefusalMessage, Un as ledgerForStack, Uo as inheritNestedStackParameterAssociations, Ur as envCredentialsAreAssumedRole, Us as resolveDockerContextDirectory, Ut as replacementNeverSwapped, Vc as nullPrototypeRecord, Vi as malformedResourcePropertiesWarning, Vn as RollbackInlinePolicyWriters, Vo as pathCrossesDottedKey, Vr as applyCallerIdentityCredentials, Vs as buildDenyExternalAccessPolicy, Vt as recheckFailedPlan, Wc as describeFileReadFailure, Wi as malformedStateRefusalMessage, Wo as recordNestedStackParameterExpressions, Ws as describeDockerCapturedOutput, Wt as resolveReplacementOldType, X as createReadOnlyAttributeHealerFactory, Xi as refuseMalformedOrphans, Xo as recordNoEchoAttributeValues, Xr as coerceParameterTypedValue, Xs as getDockerCmd, Y as formatResourceLine, Yc as resolveBucketRegion, Yi as refuseMalformedOrphanRecordsForDestroy, Yo as recordMaskOnlyValuesIn, Ys as formatDockerLoginError, Yt as inheritProducerRegions, Z as bold, Zi as refuseMalformedOrphansForDestroy, Zo as recordNoEchoParameterFreshValue, Zr as isUnboundTemplateParameter, Zs as isDockerClientEnvKey, _ as makeCanonicalizePropertiesFn, _a as repairMalformedOrphansForReadOnly, _c as resolveSkipPrefix, _i as UNREADABLE_RESOURCES_MAP_ROW, _n as isExportAliasCollision, _r as deleteSkipReason, _s as importableOutputKeys, _t as revertedNestedRowIds, a as findNestedTemplateTreeDefect, aa as refuseMalformedResourceEntriesForImport, ac as escapeRegExp, ai as AWS_NO_VALUE, an as displayTextOrWithheld, ar as isCustomResource, as as isSingleDynamicReferenceToken, at as reachableDivergentParameters, b as serviceTokenBlockingReason, ba as repairMalformedResourcePropertiesForReadOnly, bc as resolveUseCdkBootstrapAssets, bi as displayLogicalId, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as valueAtCoordinate, bs as orphansAfterRollback, bt as withNestedStackContext, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourcePropertiesForDestroy, cc as getDockerImageBySourceHash, ci as refStateLookupFromResource, cn as secretBearingStateKeyWarning, co as canonicalCoordinates, cr as readsNoEchoDeleteValues, cs as S3StateBackend, ct as planOrphanAdoption, d as conditionInputsFrom, da as refuseMalformedResourcePropertiesForOrphan, dc as getDefaultStateBucketName, di as parameterInputsFor, dn as exportNameNoEchoParameters, do as maskReadbackAtCoordinates, dr as withPrintingSecrets, ds as acceptedCreateOnlyDropsOf, dt as displacedPhysicalIdShown, ea as refuseMalformedOutputsForDestroy, ec as redactDockerArgvValues, ei as isImpossibleEmptyStoredAttribute, en as updatePartialMessage, eo as templateResourceTypes, es as STATE_SOURCED_BASELINE_RULES, et as green, f as parentSuppliedValues, fa as refuseMalformedResourcesForDeploy, fc as getLegacyStateBucketName, fn as exportNameSecretExposure, fo as maskWholeValue, fr as CloudControlProvider, fs as describeRegionValueKind, ft as dropSettledNestedJournals, g as mergeNoChangeOutputs, ga as repairMalformedOrphanRecordsForReadOnly, gc as resolveCaptureObservedState, gi as UNREADABLE_ORPHANS_CONTAINER_ROW, gn as collectPublishedOutputNames, go as noEchoOutputsComparison, gr as deleteIndeterminateGuards, gs as hasUnverifiableParameterRefusal, h as keptWholeReasonText, ha as refuseMalformedState, hc as resolveAutoAssetStorage, hi as STATE_RESOURCES_MALFORMED, hn as collectDeclaredOutputNames, ho as noEchoLeavesOf, hr as UNSPECIFIED_SKIP_REASON, hs as hasReasonlessBaselineRefusal, ht as recordDisplacedSkips, i as childTemplateLoader, ia as refuseMalformedResourceEntriesForDestroy, ic as warnFinchArgvExposure, ii as keepsSecretReferenceToken, in as WITHHELD_NAME_DISPLAY, ir as ccBrokenReason, is as WHOLE_DYNAMIC_REFERENCE_PATTERN, it as namesAnyDeclaredParameter, j as readProtection, ja as hasNoCloudControlHandlers, jc as expectedOwnerParam, ji as malformedLocalResourcesWarning, jn as ccRoutedFinalSnapshotError, jo as createSecretMasker, jr as classifyReplaySecretRegion, js as AssetModeResolver, jt as destroyStackRecordsView, k as isProtectionValueActive, kc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ki as malformedLocalOutputsWarning, kn as PRE_DELETE_SNAPSHOT_TYPES, ko as recordLogOnlyValue, kr as IntrinsicFunctionResolver, ks as loadPublishableAssetManifest, kt as replayRollback, l as templateIdentity, la as refuseMalformedResourcePropertiesForDrift, lc as Synthesizer, ln as secretSafeKeyDisplay, lo as isMarkedCoordinate, lr as isCustomResourceType$1, ls as rebuildClientForBucketRegion, lt as NESTED_PENDING_PARENT_REASON, m as isSecretBearingReferenceString, ma as refuseMalformedResourcesForExport, mc as resolveApp, mi as STATE_REGION_DIVERGED, mn as noEchoParameterValueSeed, mo as noEchoCoordinatesOf, ms as hasReadableExportSet, mt as nestedChildStackName$1, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourceEntries, nc as runDockerForeground, ni as carriesFetchableDynamicReference, nn as DeploymentEventsReader, no as withRetry, nr as CC_BROKEN_REASON, ns as STATE_SOURCED_READBACK_RULES, nt as yellow, o as isAbsoluteAssetPath, oa as refuseMalformedResourceEntriesForImportSave, oc as stripControlChars, oi as cfnRefValueFromPhysicalId, on as exportAliasCollisionScrubWarning, oo as DagBuilder, or as wouldReturnToSdkProvider, os as LockManager, ot as resourcesNamingDeclaredParameter, p as readRecordedConditionVerdicts, pa as refuseMalformedResourcesForDestroy, pc as loadCdkJson, pi as JSON_LISTING_HOLE_VALUE, pn as isWholeDynamicReferenceValue, po as maskedLeafCoordinatesOf, pr as slowCcOperationTimeoutMs, ps as exportNamesCarriedFrom, qc as resolveAssemblyPath, qo as provenPublicValue, qs as dockerSpawnEnvWithSensitive, qt as findNestedStackTypeChanges, r as computeImplicitDeleteEdges, ra as refuseMalformedResourceEntriesForDeploy, rc as runDockerStreaming, ri as isNamelessDynamicReferenceError, rn as DeploymentEventsStore, rr as ProviderRegistry, rs as TEMPLATE_SOURCED_RULES, rt as computeParameterTaint, s as listNestedTemplateRows, sa as refuseMalformedResourceEntriesForOrphan, sc as AssetManifestLoader, si as isStalePlaceholderArnAttribute, sn as secretBearing, so as TemplateParser, sr as TemplateNoEchoReresolver, ss as isLockInfoExpired, st as makeSiblingClaimReader, t as DeployEngine, ta as refuseMalformedResourceAttributesForOrphan, tc as redactedDockerCause, ti as carriesDynamicReference, tn as updatePartialReason, to as describeTypeWithThrottleRetry, ts as STATE_SOURCED_CROSS_GENERATION_RULES, tt as red, u as conditionFingerprint, ua as refuseMalformedResourcePropertiesForExport, uc as synthesisStatusMessage, ui as withSharedDrainBudget, un as carriedExportAliasExposure, uo as maskAtCoordinates, us as splitImportedOps, ut as displacedOpClause, v as deferredServiceTokenWarning, va as repairMalformedOutputsForReadOnly, vc as resolveStateBucketWithDefault, vi as accountArgs, vn as bindingSkippedOutputs, vo as readbackPathFor, vs as importableOutputs, vt as withNestedRevertRun, w as noEchoExactEchoLeavesOf, wa as unreadableResourceEntries, wc as CFN_TEMPLATE_BODY_LIMIT, wi as isReadableOrphanRecord, wn as orphanRecordsPrintingBag, wo as hasMaskableValues, ws as isSensitiveAttributeName, wt as journaledOrphanLines, x as withResourceDeadline, xa as repairMalformedResourcesForReadOnly, xc as stateBucketExistenceConfirmed, xi as hasReadableOrphans, xn as completedReplayEntries, xo as liveMatchesUnresolvedTokenFrame, xs as orphansCarriedFrom, xt as deleteJournaledOrphans, y as findServiceTokenRefusals, ya as repairMalformedResourceEntriesForReadOnly, yc as resolveStateBucketWithDefaultAndSource, yi as deployRefusesOrphanRowsReason, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as readsNoEchoSource, yr as isWaitAbandonedError, ys as isReadableBag, zc as hasOwnKey, zi as malformedRenderedContainersWarning, zn as findDestructiveChanges, zo as dynamicReferenceTokens, zr as sendableAssumeRoleCommand, zs as validateAssetBucketName, zt as planFailedOps } from "./deploy-engine-D4FdwPCi.js";
-import { t as getCdkdVersion } from "./version-B0JEGOLV.js";
+import { $c as hasOwnKey, $i as previewableOrphanRecords, $s as validateAssetBucketName, $t as orphanDeleteNeedsIdentity, A as noEchoExactEchoLeavesOf, Aa as unpreviewableOrphanRecords, Ac as resolveCaptureObservedState, Ai as hasReadableOutputs, An as maskEventTextWithBoundBags, Ao as carryLogOnlyValues, As as hasUnverifiableParameterRefusal, At as isHandledOrphan, Ba as findReplacedReadersOfRecreateTargets, Bc as MIGRATE_TMP_PREFIX, Bi as malformedOrphanRecordsRefusalMessage, Bn as effectiveDeletionPolicy, Bo as errorCauseChain, Br as producerRegionsFromState, Bs as WorkGraph, Bt as withStackRecords, C as recordRetainedForReadoption, Ca as refuseMalformedState, Cc as Synthesizer, Ci as STATE_RESOURCES_MALFORMED, Cn as collectPublishedOutputNames, Co as noEchoLeavesOf, Cr as deleteIndeterminateGuards, Cs as isNotImplemented, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as repairMalformedResourceEntriesForReadOnly, Dc as loadCdkJson, Di as deployRefusesOrphanRowsReason, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Do as readsNoEchoSource, Dr as isWaitAbandonedError, Ds as exportNamesCarriedFrom, Dt as withNestedStackContext, E as serviceTokenBlockingReason, Ea as repairMalformedOutputsForReadOnly, Ec as getLegacyStateBucketName, Ei as accountArgs, En as DEFAULT_RESOURCE_TIMEOUT_MS, Eo as readbackPathFor, Es as describeRegionValueKind, F as isProtectionValueActive, Fc as stateBucketExistenceConfirmed, Fi as malformedExportNamesWarning, Fn as ATOMIC_FINAL_SNAPSHOT_TYPES, Fo as printingCorpusOf, Fr as DiffCalculator, Fs as orphansCarriedFrom, Ft as replayFailedOperations, Ga as renderStatefulReason, Gc as expectedOwnerParam, Gi as malformedOutputsRefusalMessage, Gn as constructPathOf, Go as scrubResourceRecord, Gr as explicitRoleArnOrThrow, Gs as AssetModeResolver, Gt as isReplacementOrphan, Ha as MULTI_REGION_RECREATE_BLOCKED_TYPES, Hc as uploadCfnTemplate, Hi as malformedOrphanRowsKeptWarning, Hn as refusesFinalSnapshot, Ho as maskSecretsInText, Hr as applyRoleArnIfSet, Hs as createAssetRedirectResolver, Ht as recordAfterRollbackUpdate, I as perType, Ia as unwrittenCreateOnlyReplacement, Ic as warnDeprecatedNoPrefixCliFlag, Ii as malformedExportSourceWarning, In as PRE_DELETE_SNAPSHOT_TYPES, Io as recordLogOnlyParameterValue, Ir as INTRINSIC_KEYS, Is as shouldRetainResource, It as replayRollback, Jc as derivePartitionAndUrlSuffix, Ji as malformedResourceEntriesWarning, Jn as RollbackInlinePolicyWriters, Jo as isUncertifiedBaselineMaskPosition, Jr as AWS_CREDENTIAL_ENV_KEYS, Js as ensureAssetStorage, Jt as recheckFailedPlan, Kc as PARTITION_TABLE, Ki as malformedOutputsWarning, Kn as findDestructiveChanges, Ko as DYNAMIC_REFERENCE_TOKEN_SCAN, Kr as isIamRoleArn, Ks as BOOTSTRAP_MARKER_PREFIX, Kt as planFailedOps, L as readProtection, Lc as ssmResolvedValueType, Li as malformedLocalOutputsWarning, Ln as buildFinalSnapshotIdentifier, Lo as recordLogOnlyValue, Lr as IntrinsicFunctionResolver, Ls as AssetPublisher, M as recordedProtectionEvidence, Ma as unreadableResourceEntries, Mc as resolveStateBucketWithDefault, Mi as isReadableOrphanRecord, Mn as secretNamePrintingBag, Mo as hasMaskableValues, Ms as importableOutputs, Mt as loadJournaledOrphans, N as recordedProtectionNote, Na as withheldAccountClause, Nc as resolveStateBucketWithDefaultAndSource, Ni as isReadableResourceEntry, Nn as stateSecretNameNeedles, No as literalSplitDelimitersOf, Ns as isReadableBag, Nt as makeForeignHolderScan, O as noEchoAttributeNamesOf, Oa as repairMalformedResourcePropertiesForReadOnly, Oc as resolveApp, Oi as displayLogicalId, On as completedReplayEntries, Oo as valueAtCoordinate, Os as hasReadableExportSet, Ot as deleteJournaledOrphans, P as PROTECTION_PROPERTY_BY_TYPE, Pa as findActionableSilentDrops, Pc as resolveUseCdkBootstrapAssets, Pi as malformedDriftResourcePropertiesWarning, Pn as extractDeploymentEventError, Po as logOnlyValueCount, Ps as orphansAfterRollback, Pt as sameJournaledOrphans, Qc as defineOwnKey, Qi as malformedStateRefusalMessage, Qn as withCreateTokenLedger, Qo as recordNestedStackParameterExpressions, Qs as readBootstrapMarkerBody, Qt as seedsDeleteFirstGuard, Ra as NO_CC_HANDLERS_REASON, Rc as CFN_TEMPLATE_BODY_LIMIT, Ri as malformedLocalResourceEntriesWarning, Rn as ccRoutedFinalSnapshotError, Ro as shareLogOnlyValues, Rr as poisonRenderedSpellingsCollidingIn, Rs as isSensitiveAttributeName, Rt as destroyStackRecordsView, S as keptForReadoption, Sa as refuseMalformedResourcesForExport, Sc as getDockerImageBySourceHash, Si as STATE_REGION_DIVERGED, Sn as collectDeclaredOutputNames, So as noEchoCoordinatesOf, Sr as UNSPECIFIED_SKIP_REASON, Ss as isAccessDenied, T as findServiceTokenRefusals, Ta as repairMalformedOrphansForReadOnly, Tc as getDefaultStateBucketName, Ti as UNREADABLE_RESOURCES_MAP_ROW, Tn as bindingSkippedOutputs, Tr as deleteSkipReason, Ts as acceptedCreateOnlyDropsOf, Tt as collectNestedChildUnaddressed, Ua as isStatefulRecreateTargetForReplace, Uc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Ui as malformedOrphansRefusalMessage, Un as unsupportedFinalSnapshotError, Uo as markSameGenerationBag, Ur as assertFlagRoleArn, Us as loadPublishableAssetManifest, Ut as demoteSupersededOrphans, Va as shownType, Vc as findLargeInlineResources, Vi as malformedOrphanRecordsWarning, Vn as isFinalSnapshotError, Vo as maskSecretsInError, Vr as regionLessSecretName, Vs as buildAssetRedirectMap, Vt as removeProtectionTypeList, Wa as isStatefulRecreateTargetSync, Wc as decodeListingKey, Wi as malformedOrphansWarning, Wn as maskingRetryLogger, Wo as redactSecretsForState, Wr as assertSendableRoleArn, Ws as rewriteTemplateAssetReferences, Wt as isJournaledOrphan, Xc as StageLoadError, Xi as malformedResourcesWarning, Xn as ledgerForStack, Xo as identityKeyFor, Xr as callerEnvCredentials, Xs as isCrossRegionRedirect, Xt as replacementNeverSwapped, Yc as AssemblyReader, Yi as malformedResourcePropertiesWarning, Yo as pathCrossesDottedKey, Yr as applyCallerIdentityCredentials, Ys as getBootstrapMarkerKey, Yt as recordUnderIdIsNotOwn, Zc as processStackMessages, Zi as malformedScrubResourceEntriesRefusalMessage, Zo as inheritNestedStackParameterAssociations, Zr as envCredentialsAreAssumedRole, Zs as parseBootstrapMarker, Zt as resolveReplacementOldType, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourcePropertiesForDrift, _c as runDockerStreaming, _n as carriedExportAliasExposure, _o as isMarkedCoordinate, _s as rebuildClientForBucketRegion, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseMalformedOrphansForDestroy, ac as describeDockerExecFailure, ai as isUnboundTemplateParameter, al as displayAssemblyPath, as as recordNoEchoParameterFreshValue, at as gray, ba as refuseMalformedResourcesForDeploy, bc as stripControlChars, bn as isWholeDynamicReferenceValue, bo as maskWholeValue, br as slowCcOperationTimeoutMs, bs as applyCrossPrefixScan, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedOutputsForDestroy, cc as finchSecretArgvRefusal, ci as isImpossibleEmptyStoredAttribute, cn as updatePartialReason, co as templateResourceTypes, cs as STATE_SOURCED_BASELINE_RULES, ct as yellow, d as conditionInputsFrom, da as refuseMalformedResourceEntriesForDeploy, dc as isDockerClientEnvKey, di as isNamelessDynamicReferenceError, dn as WITHHELD_NAME_DISPLAY, dr as ccBrokenReason, ds as TEMPLATE_SOURCED_RULES, dt as reachableDivergentParameters, ea as refuseDivergentRecordRegionForDestroy, ec as validateContainerRepoName, el as hasPlainPrototype, en as findNestedStackTypeChanges, es as carriesSecretMask, f as parentSuppliedValues, fa as refuseMalformedResourceEntriesForDestroy, fc as isMalformedEnvKey, fi as keepsSecretReferenceToken, fn as displayTextOrWithheld, fr as isCustomResource, fs as WHOLE_DYNAMIC_REFERENCE_PATTERN, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourcePropertiesForDestroy, gc as runDockerForeground, gi as refStateLookupFromResource, gn as secretSafeKeyDisplay, go as canonicalCoordinates, gr as isCustomResourceType$1, gs as S3StateBackend, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourceEntriesForOrphan, hc as redactedDockerCause, hi as isStalePlaceholderArnAttribute, hn as secretBearingStateKeyWarning, ho as TemplateParser, hr as readsNoEchoDeleteValues, hs as isLockInfoExpired, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as refuseMalformedOrphans, ic as describeDockerCapturedOutput, ii as coerceParameterTypedValue, il as describeFileReadFailure, is as recordNoEchoAttributeValues, it as cyan, j as noEchoParameterNamesOf, ja as unreadableOrphanRecords, jc as resolveSkipPrefix, ji as hasReadableResources, jn as orphanRecordsPrintingBag, jo as createUnionSecretMasker, js as importableOutputKeys, jt as journaledOrphanLines, k as noEchoComparisonForTemplate, ka as repairMalformedResourcesForReadOnly, kc as resolveAutoAssetStorage, ki as hasReadableOrphans, kn as journaledOrphanPrintingBag, ko as liveMatchesUnresolvedTokenFrame, ks as hasReasonlessBaselineRefusal, kt as dropFailedHint, l as templateIdentity, la as refuseMalformedResourceAttributesForOrphan, lc as formatDockerLoginError, li as carriesDynamicReference, ll as resolveBucketRegion, ln as DeploymentEventsReader, lo as describeTypeWithThrottleRetry, lr as CC_BROKEN_REASON, ls as STATE_SOURCED_CROSS_GENERATION_RULES, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourceEntriesForImportSave, mc as redactDockerArgvValues, mi as cfnRefValueFromPhysicalId, mn as secretBearing, mo as DagBuilder, mr as TemplateNoEchoReresolver, ms as LockManager, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedOrphanRecords, nc as buildDockerImage, nl as ownValue, nn as inheritProducerRegions, ns as recordMaskOnlyValue, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oa as refuseMalformedOrphansForOrphan, oc as describeDockerFailure, oi as parameterTypeMayLoseSecretIdentity, ol as renderAssemblyPathEscape, os as recordProvenPublicExpression, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedResourceEntriesForImport, pc as partitionSensitiveEnv, pi as AWS_NO_VALUE, pn as exportAliasCollisionScrubWarning, pr as wouldReturnToSdkProvider, ps as isSingleDynamicReferenceToken, pt as makeSiblingClaimReader, qc as canonicalizeRegion, qi as malformedRenderedContainersWarning, qn as formatDestructiveChange, qo as dynamicReferenceTokens, qr as sendableAssumeRoleCommand, qs as assertAssetBucketRegion, qt as planRollback, r as computeImplicitDeleteEdges, ra as refuseMalformedOrphanRecordsForDestroy, rc as resolveDockerContextDirectory, rl as absoluteAssemblyPathEscape, rs as recordMaskOnlyValuesIn, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedOutputs, sc as dockerSpawnEnvWithSensitive, si as getAccountInfo, sl as resolveAssemblyPath, sn as updatePartialMessage, so as prefetchCreateOnlyPropertyPaths, ss as wholeStringLeavesOf, st as red, t as DeployEngine, tc as buildDenyExternalAccessPolicy, tl as nullPrototypeRecord, ts as provenPublicValue, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedResourceEntries, uc as getDockerCmd, ui as carriesFetchableDynamicReference, un as DeploymentEventsStore, uo as withRetry, ur as ProviderRegistry, us as STATE_SOURCED_READBACK_RULES, ut as namesAnyDeclaredParameter, va as refuseMalformedResourcePropertiesForExport, vc as warnFinchArgvExposure, vi as withSharedDrainBudget, vn as exportNameNoEchoParameters, vo as maskAtCoordinates, vr as withPrintingSecrets, vs as CrossPrefixReadError, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as repairMalformedOrphanRecordsForReadOnly, wc as synthesisStatusMessage, wi as UNREADABLE_ORPHANS_CONTAINER_ROW, wn as isExportAliasCollision, wo as noEchoOutputsComparison, wr as deleteLeftInPlace, ws as splitImportedOps, wt as withNestedRevertRun, xa as refuseMalformedResourcesForDestroy, xc as AssetManifestLoader, xi as JSON_LISTING_HOLE_VALUE, xn as noEchoParameterValueSeed, xo as maskedLeafCoordinatesOf, xs as crossPrefixDeniedWarning, xt as recordDisplacedSkips, ya as refuseMalformedResourcePropertiesForOrphan, yc as escapeRegExp, yi as parameterInputsFor, yn as exportNameSecretExposure, yo as maskReadbackAtCoordinates, yr as CloudControlProvider, ys as CrossPrefixScanCache, za as hasNoCloudControlHandlers, zc as CFN_TEMPLATE_URL_LIMIT, zi as malformedLocalResourcesWarning, zn as createPreDeleteFinalSnapshot, zo as createSecretMasker, zr as classifyReplaySecretRegion, zs as stringifyValue } from "./deploy-engine-BuPc2Dfc.js";
+import { t as getCdkdVersion } from "./version-B__YmKBy.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1306,6 +1306,14 @@ function createListCommand() {
 
 //#endregion
 //#region src/utils/interrupt-signals.ts
+const postCleanupListeners = /* @__PURE__ */ new WeakSet();
+function prependPostCleanupSigintListener(listener) {
+	postCleanupListeners.add(listener);
+	process.prependListener("SIGINT", listener);
+	return () => {
+		process.removeListener("SIGINT", listener);
+	};
+}
 function forwardSigtermToSigint() {
 	beginCommandInterruptScope();
 	try {
@@ -1333,7 +1341,7 @@ function watchCommandInterrupt(opts) {
 	}
 	let stacksInFlight = 0;
 	function gracefulOwnerArmed() {
-		return process.listeners("SIGINT").filter((l) => l !== handler).length - interruptWatchListenerCount() > 0;
+		return process.listeners("SIGINT").filter((l) => l !== handler && !postCleanupListeners.has(l)).length - interruptWatchListenerCount() > 0;
 	}
 	const handler = () => {
 		if (stacksInFlight > 0 && gracefulOwnerArmed()) {
@@ -1923,8 +1931,8 @@ function resolveRequireApproval(cliValue, logger, cdkJson = loadCdkJson()) {
 	throw new CdkdError(`cdk.json "requireApproval" must be one of ${REQUIRE_APPROVAL_VALUES.join(", ")}, got: ${displayIdent(typeof configured === "string" ? configured : JSON.stringify(configured))}`, "INVALID_REQUIRE_APPROVAL");
 }
 function createApprovalPrompter(options) {
+	if (options.yes) return Object.assign(() => Promise.resolve(true), { autoApproves: true });
 	return (request) => {
-		if (options.yes) return Promise.resolve(true);
 		return serializePrompt(() => getLiveRenderer().suspendWhile(async () => {
 			process.stdout.write(renderApprovalRequest(request));
 			return confirmOrRefuse("Do you wish to deploy these changes?", {
@@ -2396,7 +2404,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-wbKBBEol.js");
+	providerClasses ??= import("./provider-classes-DmZ0J68L.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2637,6 +2645,262 @@ function createPrefixMigrationGate(opts) {
 	};
 }
 
+//#endregion
+//#region src/cli/commands/registry-release.ts
+async function releaseRegistryMarkerQuietly(backend, stackName, region, logger, known) {
+	if (stackName.includes("~")) return;
+	try {
+		const released = known === void 0 ? await backend.releaseRegistryMarker(stackName, region) : await backend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
+
+//#endregion
+//#region src/cli/commands/cross-prefix-gate.ts
+function deployStackRegion(stack, baseRegion) {
+	return stack.region || baseRegion;
+}
+function createCrossPrefixDeployGate(opts) {
+	return async (gateStackName, state) => {
+		if (gateStackName !== opts.stackName) return;
+		if (state !== void 0) return;
+		const result = await opts.guard.firstDeploy(opts.stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, "deploy", ...reportOnce(result));
+	};
+}
+const reported = /* @__PURE__ */ new WeakSet();
+function reportOnce(result) {
+	const first = !reported.has(result);
+	reported.add(result);
+	return first ? [(message) => getLogger().warn(message), (message) => getLogger().info(message)] : [() => void 0, () => void 0];
+}
+function createCrossPrefixDestructiveGate(opts) {
+	return async (stackName, _destructive, stage) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		applyCrossPrefixScan(result, {
+			stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery
+		}, stage === "late" ? "deploy-late-replace" : "deploy-destructive", ...reportOnce(result));
+	};
+}
+function createCrossPrefixHolder(opts) {
+	return async (stackName) => {
+		const result = await opts.cache.full(stackName, opts.region);
+		switch (result.kind) {
+			case "found": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} also records this stack under another state prefix (${displayIdent(result.prefixes[0])}), whose record may hold it`
+			};
+			case "in-progress": return {
+				kind: "unreadable",
+				what: safeMsg`bucket ${opts.bucket} assigns this stack to another state prefix (${displayIdent(result.prefix)}), where a deploy may be in progress`
+			};
+			case "failed": return {
+				kind: "unreadable",
+				what: safeMsg`the other state prefixes of bucket ${opts.bucket} could not be checked`,
+				retryable: true
+			};
+			case "denied":
+				reportOnce(result)[0](crossPrefixDeniedWarning({
+					stackName,
+					region: opts.region,
+					bucket: opts.bucket
+				}, result.error, result.stage));
+				return;
+			default: return;
+		}
+	};
+}
+function crossPrefixEngineOptions(opts) {
+	const backend = opts.backend;
+	return {
+		...backend !== void 0 && { onFirstDeployLeftNoRecord: async (stackName) => {
+			if (stackName !== opts.stackName) return;
+			const known = await opts.guard.knownMarker?.(stackName, opts.region);
+			await releaseRegistryMarkerQuietly(backend, stackName, opts.region, getLogger(), known);
+		} },
+		firstDeployGate: createCrossPrefixDeployGate({
+			stackName: opts.stackName,
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			guard: opts.guard
+		}),
+		onDestructivePlan: createCrossPrefixDestructiveGate({
+			region: opts.region,
+			bucket: opts.bucket,
+			recovery: opts.recovery,
+			cache: opts.guard
+		}),
+		crossPrefixHolder: createCrossPrefixHolder({
+			region: opts.region,
+			bucket: opts.bucket,
+			cache: opts.guard
+		})
+	};
+}
+function composeStateLoadedGates(crossPrefix, migration) {
+	return async (stackName, state) => {
+		await crossPrefix(stackName, state);
+		if (migration) await migration(stackName, state);
+	};
+}
+
+//#endregion
+//#region src/state/stack-registry.ts
+function unwrapReadError(error) {
+	return error instanceof CrossPrefixReadError ? error.cause : error;
+}
+function topLevelStackName(stackName) {
+	return stackName.split("~")[0];
+}
+var CrossPrefixGuard = class {
+	scan;
+	backend;
+	readOnly;
+	markers = /* @__PURE__ */ new Map();
+	answers = /* @__PURE__ */ new Map();
+	constructor(backend, opts = {}) {
+		this.backend = backend;
+		this.readOnly = opts.readOnly === true;
+		this.scan = opts.scan ?? new CrossPrefixScanCache(backend);
+	}
+	get target() {
+		return this.scan.target;
+	}
+	full(stackName, region, when = "now") {
+		const key = JSON.stringify([stackName, region]);
+		let answer = this.answers.get(key);
+		if (answer === void 0) {
+			answer = this.evaluate(stackName, region, false, when);
+			this.answers.set(key, answer);
+		} else if (when === "now") this.scan.target.rank(stackName, region, "now");
+		return answer;
+	}
+	firstDeploy(stackName, region) {
+		const key = JSON.stringify([stackName, region]);
+		const answer = this.evaluate(stackName, region, true, "now");
+		this.answers.set(key, answer);
+		return answer;
+	}
+	async knownMarker(stackName, region) {
+		const read = this.markers.get(JSON.stringify([topLevelStackName(stackName), region]));
+		if (read === void 0) return void 0;
+		return read.catch(() => void 0);
+	}
+	marker(top, region, fresh = false) {
+		const key = JSON.stringify([top, region]);
+		let read = fresh ? void 0 : this.markers.get(key);
+		if (read === void 0) {
+			read = this.backend.getRegistryMarker(top, region);
+			this.markers.set(key, read);
+		}
+		return read;
+	}
+	async evaluate(stackName, region, firstDeploy, when) {
+		const top = topLevelStackName(stackName);
+		const claimable = top === stackName && !this.readOnly;
+		if (firstDeploy && claimable && !this.markers.has(JSON.stringify([top, region]))) {
+			if (await this.claim(top, region) === "claimed") return { kind: "clear" };
+		}
+		for (let attempt = 0; attempt < 2; attempt++) {
+			let marker;
+			try {
+				marker = await this.marker(top, region, attempt > 0);
+			} catch (error) {
+				return this.fallback(stackName, region, when, error);
+			}
+			if (marker === null) {
+				if (firstDeploy) {
+					if (!claimable) return { kind: "clear" };
+					const claimed = await this.claim(top, region);
+					if (claimed === "conflict") continue;
+					if (claimed !== "claimed") return this.fallback(stackName, region, when, claimed.error);
+					return { kind: "clear" };
+				}
+				const scanned = await this.scan.full(stackName, region, when);
+				if (scanned.kind === "clear" && claimable) {
+					if (await this.claim(top, region) === "conflict") continue;
+				}
+				return scanned;
+			}
+			if (marker.prefix === this.backend.prefix) return { kind: "clear" };
+			let held;
+			let locked;
+			try {
+				held = await this.backend.recordUnderPrefix(marker.prefix, stackName, region);
+				locked = held === "holder" ? false : await this.backend.lockUnderPrefix(marker.prefix, top, region);
+			} catch (error) {
+				return isAccessDenied(error) ? {
+					kind: "denied",
+					error,
+					stage: "probe"
+				} : {
+					kind: "failed",
+					error
+				};
+			}
+			if (held === "holder") return {
+				kind: "found",
+				prefixes: [marker.prefix]
+			};
+			if (locked) return {
+				kind: "in-progress",
+				prefix: marker.prefix
+			};
+			const stale = held === "empty" ? [marker.prefix] : [];
+			const scanned = await this.scan.full(stackName, region, when);
+			if (scanned.kind !== "clear") return scanned;
+			const allStale = [.../* @__PURE__ */ new Set([...stale, ...scanned.stale ?? []])];
+			const answer = {
+				kind: "clear",
+				...allStale.length > 0 && { stale: allStale }
+			};
+			if (!claimable) return answer;
+			if (await this.claim(top, region, marker.etag) === "conflict") continue;
+			return answer;
+		}
+		return {
+			kind: "failed",
+			error: new CrossPrefixReadError(`_cdkd-registry/${region}/${top}.json`, Object.assign(/* @__PURE__ */ new Error("the marker changed twice while cdkd was claiming it"), { name: "ConcurrentClaim" }))
+		};
+	}
+	async claim(top, region, ifMatch) {
+		try {
+			const result = await this.backend.claimRegistryMarker(top, region, ifMatch);
+			if (result === "claimed") this.markers.set(JSON.stringify([top, region]), Promise.resolve({
+				prefix: this.backend.prefix,
+				etag: ""
+			}));
+			return result;
+		} catch (error) {
+			return { error };
+		}
+	}
+	async fallback(stackName, region, when, error) {
+		if (!isAccessDenied(error) && !isNotImplemented(unwrapReadError(error))) return {
+			kind: "failed",
+			error
+		};
+		const scanned = await this.scan.full(stackName, region, when);
+		return scanned.kind === "clear" ? {
+			kind: "denied",
+			error,
+			stage: "registry",
+			...scanned.stale && { stale: scanned.stale }
+		} : scanned;
+	}
+};
+
 //#endregion
 //#region src/cli/commands/deploy.ts
 async function deployCommand(stacks, options) {
@@ -2706,6 +2970,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 	};
 	process.on("SIGINT", topLevelSigintHandler);
 	const unforwardSigterm = forwardSigtermToSigint();
+	let preflightBackendForCleanup;
 	try {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
@@ -2721,6 +2986,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
+		preflightBackendForCleanup = preflightStateBackend;
 		synthOptions.stateBucket = stateBucket;
 		const refusalRecovery = {
 			profile: options.profile,
@@ -2787,6 +3053,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 			ignoreErrors: options.ignoreErrors === true
 		});
 		refuseMalformedNestedTemplateTrees(targetStacks);
+		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
+		const crossPrefixGuard = new CrossPrefixGuard(preflightStateBackend, { readOnly: options.dryRun === true });
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
@@ -2816,7 +3084,6 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		};
 		const dagBuilder = new DagBuilder({ relaxCdkVpcDefensiveDeps: !!options.aggressiveVpcParallel });
 		const diffCalculator = new DiffCalculator();
-		const baseRegion = namedCliRegion(options.region) ?? "us-east-1";
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
 		const stackRedirects = /* @__PURE__ */ new Map();
@@ -2864,13 +3131,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		logger.debug(`Work graph: ${summary["asset-publish"]} asset(s), ${summary["stack"]} stack(s)`);
 		const bufferStackOutput = targetStacks.length > 1;
 		let totalUnaddressed = 0;
+		let totalCrossPrefixKept = 0;
 		let cancelledStacks = 0;
 		const runStack = async (stackInfo) => {
 			return withSkipPrefix(skipPrefix, () => runStackInner(stackInfo));
 		};
 		const runStackInner = async (stackInfo) => {
 			if (deployInterrupted) throw new DeployCancelledError(`Deploy interrupted before stack '${stackInfo.stackName}' started — not starting it.`);
-			const stackRegion = stackInfo.region || baseRegion;
+			const stackRegion = deployStackRegion(stackInfo, baseRegion);
 			logger.info(`\n${cyan("Deploying stack:")} ${bold(cyan(stackInfo.stackName))}${stackRegion !== baseRegion ? gray(` (region: ${stackRegion})`) : ""}`);
 			const stackAwsClients = new AwsClients({
 				region: stackRegion,
@@ -2908,6 +3176,14 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					skipPrefix,
 					yes: options.yes
 				});
+				const crossPrefix = crossPrefixEngineOptions({
+					stackName: stackInfo.stackName,
+					region: stackRegion,
+					bucket: stateBucket,
+					recovery: refusalRecovery,
+					guard: crossPrefixGuard,
+					backend: preflightStateBackend
+				});
 				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
@@ -2987,7 +3263,10 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					refusalRecovery,
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
-					...migrationGate && { onCurrentStateLoaded: migrationGate },
+					onCurrentStateLoaded: composeStateLoadedGates(crossPrefix.firstDeployGate, migrationGate),
+					...crossPrefix.onFirstDeployLeftNoRecord && { onFirstDeployLeftNoRecord: crossPrefix.onFirstDeployLeftNoRecord },
+					onDestructivePlan: crossPrefix.onDestructivePlan,
+					crossPrefixHolder: crossPrefix.crossPrefixHolder,
 					...options.pinCcApi?.length && { pinCcApi: {
 						stackName: stackInfo.stackName,
 						logicalIds: new Set(options.pinCcApi)
@@ -3038,10 +3317,15 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				logger.info(`  Updated: ${updatedTotal > 0 ? yellow(updatedTotal) : gray(updatedTotal)}`);
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
+				const crossPrefixKept = deployResult.crossPrefixKept ?? 0;
+				if (crossPrefixKept > 0) logger.info(`  Kept (replacement refused: another state prefix records the stack, or the check could not run): ${yellow(crossPrefixKept)}`);
 				if (ownUpdatePartial > 0) logger.info(safeMsg`    of which left an orphaned predecessor: ${yellow(ownUpdatePartial)}`);
 				if (nestedUpdatePartial > 0) logger.info(safeMsg`  Left an orphaned predecessor in a nested stack: ${yellow(nestedUpdatePartial)}`);
-				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial;
-				if (!options.dryRun) totalUnaddressed += stackUnaddressed;
+				const stackUnaddressed = deployResult.deleteSkipped + deployResult.updatePartial + crossPrefixKept;
+				if (!options.dryRun) {
+					totalUnaddressed += stackUnaddressed;
+					totalCrossPrefixKept += crossPrefixKept;
+				}
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -3057,7 +3341,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					created: deployResult.created,
 					updated: updatedTotal,
 					deleted: deployResult.deleted,
-					...deployResult.deleteSkipped + deployResult.updatePartial > 0 && { skipped: deployResult.deleteSkipped + deployResult.updatePartial }
+					...stackUnaddressed > 0 && { skipped: stackUnaddressed }
 				}, deployResult.durationMs);
 			} catch (deployError) {
 				if (deployError instanceof DeployCancelledError) {
@@ -3102,11 +3386,12 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				if (!outcome.ok) throw outcome.error;
 			}
 		});
-		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. ` + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
+		if (totalUnaddressed > 0 && !options.allowUnaddressed) throw new PartialFailureError(`Deploy left ${totalUnaddressed} resource(s) unaddressed, so they may still exist in AWS. The two cases differ in what happens next: a DELETE the provider could not issue KEEPS its state record, so the next 'cdkd deploy' re-attempts it, while a replacement's surviving predecessor is NOT tracked and will never be retried — delete it by hand. ` + (totalCrossPrefixKept > 0 ? "A replacement kept because another state prefix records the stack, or the check could not run, keeps its old resource and applies no new value — resolve the pair, or let the check run, and re-deploy. " : "") + "The per-stack summaries above give the breakdown, and each resource's own warning names its cause and remedy. " + (cancelledStacks > 0 ? `Note ${cancelledStacks} stack(s) were also cancelled and never deployed, so the template is not fully applied beyond the resources named above. ` : "") + `Pass --allow-unaddressed to exit 0 instead.`);
 	} finally {
 		unforwardSigterm();
 		process.removeListener("SIGINT", topLevelSigintHandler);
 		awsClients.destroy();
+		preflightBackendForCleanup?.destroyClient();
 	}
 }
 function createDeployCommand() {
@@ -10744,19 +11029,40 @@ async function acquireStackLock(opts) {
 		get interrupted() {
 			return interrupted;
 		},
-		async release({ failureMessage, beforeRelease }) {
+		async release({ failureMessage, beforeRelease, holdUntil }) {
 			if (released) return;
 			released = true;
-			try {
-				await beforeRelease?.();
+			const releaseNow = async () => {
 				try {
 					await lockManager.releaseLock(stackName, region);
 					lockHeld = false;
 				} catch (releaseErr) {
 					getLogger().warn(safeMsg`${failureMessage}: ${describeAwsFailure(releaseErr).detail}`);
 				}
+			};
+			let deferred = false;
+			try {
+				await beforeRelease?.();
+				if (holdUntil !== void 0) {
+					process.removeListener("SIGINT", sigintHandler);
+					let forced = false;
+					const removeDeferred = prependPostCleanupSigintListener(() => {
+						if (!interrupted) {
+							interrupted = true;
+							return;
+						}
+						if (forced || !lockHeld) return;
+						forced = true;
+						lockManager.releaseLock(stackName, region).catch(() => {});
+						process.stderr.write(`\nForce-quit (post-destroy cleanup): stack lock may not be released.${forceQuitRecoveryClause(stackName, region, recovery)}\n`);
+					});
+					holdUntil.defer(holdUntil.work.then(() => void 0, () => void 0).then(releaseNow).finally(removeDeferred));
+					deferred = true;
+					return;
+				}
+				await releaseNow();
 			} finally {
-				process.removeListener("SIGINT", sigintHandler);
+				if (!deferred) process.removeListener("SIGINT", sigintHandler);
 			}
 		}
 	};
@@ -10864,6 +11170,16 @@ function countProtectedJournaledOrphans(orphans, region) {
 	}
 	return count;
 }
+async function releaseRegistryMarkerAfterDestroy(ctx, stackName, region, logger) {
+	if (ctx.crossPrefixCheck === void 0) return;
+	try {
+		const known = await ctx.crossPrefixCheck.cache.knownMarker?.(stackName, region);
+		const released = await ctx.stateBackend.releaseRegistryMarker(stackName, region, known);
+		logger.debug(safeMsg`Stack registry marker: ${released}`);
+	} catch (error) {
+		logger.warn(safeMsg`Could not delete the stack registry marker of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). It names this state prefix, which no longer ` + `records the stack, so a deploy under another prefix treats it as stale.`);
+	}
+}
 async function runDestroyForStack(stackName, state, ctx) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -10875,11 +11191,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 		retainedCount: 0,
 		skippedCount: 0,
 		guardIndeterminateCount: 0,
+		journaledOrphanSkips: 0,
+		stateDeleted: false,
 		errorCount: 0,
 		interrupted: false
 	};
+	const retainedForReadoption = [];
+	let retainedEarlier;
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
+	const crossPrefixScan = ctx.crossPrefixCheck?.cache.full(stackName, regionForState);
 	const refusalRecovery = {
 		profile: ctx.profile,
 		stateBucket: ctx.stateBucket,
@@ -10902,6 +11223,15 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState, refusalRecovery);
+	if (crossPrefixScan) applyCrossPrefixScan(await crossPrefixScan, {
+		stackName,
+		region: regionForState,
+		bucket: ctx.stateBucket,
+		recovery: {
+			profile: ctx.profile,
+			stateBucket: ctx.stateBucket
+		}
+	}, "destroy", (message) => logger.warn(message), (message) => logger.info(message));
 	if (resourceCount === 0 && orphanCount === 0 && journaledOrphans.count === 0) {
 		logger.info(`Stack ${displayStackName(stackName)} has no resources, cleaning up state...`);
 		const emptyLock = await acquireStackLock({
@@ -10924,7 +11254,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (recheckJournaled > 0) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but its rollback journal now records ${recheckJournaled} resource(s) a failed deploy created — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
+			result.stateDeleted = true;
 			logger.info(`${green("✓")} State deleted`);
+			await Promise.all([recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, [], logger), releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger)]);
 		} finally {
 			await emptyLock.release({ failureMessage: "Failed to release lock after empty-state cleanup" });
 		}
@@ -11012,11 +11344,13 @@ async function runDestroyForStack(stackName, state, ctx) {
 	}
 	const renderer = getLiveRenderer();
 	let statePreserved = false;
+	let heldTail;
+	let stackFinished = false;
 	let journaledOrphanFailures = 0;
-	let journaledOrphanSkips = 0;
 	const lock = await acquireStackLock({
 		...stackLockBase,
 		onFirstSignal: () => {
+			if (stackFinished) return;
 			renderer.printAbove(() => {
 				process.stderr.write("\nInterrupted — finishing in-flight deletes, then flushing state and releasing the lock (press Ctrl-C again to force-quit)...\n");
 			});
@@ -11114,7 +11448,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			result.errorCount += orphanOutcome.failures;
 			journaledOrphanFailures = orphanOutcome.failures;
 			result.skippedCount += orphanOutcome.skipped;
-			journaledOrphanSkips = orphanOutcome.skipped;
+			result.journaledOrphanSkips += orphanOutcome.skipped;
 			if (orphanOutcome.handled.length > 0) try {
 				await ctx.stateBackend.dropRollbackJournalFailedOperations(stackName, regionForState, (op, segment) => isHandledOrphan(orphanOutcome.handled, segment, op));
 			} catch (stripError) {
@@ -11190,6 +11524,17 @@ async function runDestroyForStack(stackName, state, ctx) {
 				if (shouldRetainResource(resource.deletionPolicy)) {
 					logger.info(`  ⊘ ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)}) retained — DeletionPolicy: ${displaySafe(resource.deletionPolicy)}`);
 					result.retainedCount++;
+					if (keptForReadoption(resource)) {
+						retainedForReadoption.push({
+							logicalId,
+							resourceType: resource.resourceType,
+							physicalId: resource.physicalId
+						});
+						if (retainedEarlier === void 0) {
+							retainedEarlier = Promise.resolve().then(() => ctx.stateBackend.loadRetainedRecord(stackName, regionForState));
+							retainedEarlier.catch(() => void 0);
+						}
+					}
 					recordDestroyEvent(ctx.eventRecorder, {
 						eventType: "RESOURCE_RETAINED",
 						stackName,
@@ -11247,6 +11592,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					let deleteResult;
+					let childLeftInAws = 0;
 					const secretPrincipalOptIn = secretPrincipalRegions !== void 0 ? {
 						importedProducerRegions: secretPrincipalRegions,
 						retryMemo: { detached: /* @__PURE__ */ new Set() }
@@ -11256,7 +11602,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 						const noEchoDeleteValues = readsNoEchoDeleteValues(resource.resourceType) ? await ctx.noEchoReresolver?.valuesFor(logicalId, resource) : void 0;
 						let lastDeleteError;
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
-							deleteResult = await runDeleteAttempt(attempt >= maxAttempts, () => withStackRecords(destroyStackRecordsView(state.resources), () => provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
+							const { value: outcome, unaddressed } = await runDeleteAttempt(attempt >= maxAttempts, () => collectNestedChildUnaddressed(() => withStackRecords(destroyStackRecordsView(state.resources), () => provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
 								...ctx.removeProtection === true && { removeProtection: true },
 								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
@@ -11268,7 +11614,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 								...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
 								...ctx.noEchoReresolver !== void 0 && { noEchoReresolver: ctx.noEchoReresolver },
 								...ctx.stackDestroy === true && { stackDestroy: true }
-							}))) ?? void 0;
+							}))));
+							deleteResult = outcome ?? void 0;
+							childLeftInAws = unaddressed?.deleteSkipped ?? 0;
 							lastDeleteError = null;
 							break;
 						} catch (retryError) {
@@ -11326,7 +11674,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 						});
 						return;
 					}
-					logger.info(`  ${formatResourceLine("deleted", logicalId, resource.resourceType)}`);
+					const leftInAws = childLeftInAws > 0 ? deleteLeftInPlace(deleteResult) ?? `${childLeftInAws} resource(s) a failed deploy created were left in AWS` : void 0;
+					const deletedLine = leftInAws !== void 0 ? formatResourceLine("skipped", logicalId, resource.resourceType, `deleted (${leftInAws})`) : formatResourceLine("deleted", logicalId, resource.resourceType);
+					logger.info(`  ${deletedLine}`);
+					result.skippedCount += childLeftInAws;
+					result.journaledOrphanSkips += childLeftInAws;
 					result.deletedCount++;
 					recordDestroyEvent(ctx.eventRecorder, {
 						eventType: "RESOURCE_SUCCEEDED",
@@ -11338,6 +11690,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 						...resource.physicalId && { physicalId: resource.physicalId },
 						durationMs: Date.now() - resourceStartedAt
 					});
+					if (leftInAws !== void 0) recordDestroyEvent(ctx.eventRecorder, {
+						eventType: "RESOURCE_SKIPPED",
+						stackName,
+						operation: "DELETE",
+						logicalId,
+						resourceType: resource.resourceType,
+						...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+						reason: leftInAws,
+						durationMs: Date.now() - resourceStartedAt
+					});
 					delete remainingResources[logicalId];
 					persistStateAfterDelete(logicalId);
 				} catch (error) {
@@ -11396,12 +11758,22 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 		result.interrupted = lock.interrupted;
 		await saveChain;
-		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > journaledOrphanSkips;
+		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > result.journaledOrphanSkips;
 		statePreserved = preserveState;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
+			result.stateDeleted = true;
 			logger.debug("State deleted");
-			if (ctx.exportIndexStore) await ctx.exportIndexStore.removeStack(stackName, regionForState);
+			const writeKept = () => recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, retainedForReadoption, logger, retainedEarlier);
+			const releaseMarker = () => releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger);
+			if (ctx.deferRegistryTail !== void 0) {
+				heldTail = writeKept().then(releaseMarker);
+				await ctx.exportIndexStore?.removeStack(stackName, regionForState);
+			} else await Promise.all([
+				writeKept(),
+				releaseMarker(),
+				ctx.exportIndexStore?.removeStack(stackName, regionForState)
+			]);
 		} else {
 			try {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
@@ -11410,7 +11782,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
 			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete` + (journaledOrphanFailures > 0 ? ` (${journaledOrphanFailures} of them recorded only in the rollback journal)` : "") + `. State preserved.`);
-			else logger.warn(`${result.skippedCount} resource(s) skipped — cdkd did not confirm they were deleted, so they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
+			else logger.warn(`${result.skippedCount - result.journaledOrphanSkips} resource(s) skipped — cdkd did not confirm they were deleted, so they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
 		}
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
 		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
@@ -11424,9 +11796,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, because it destroyed a nested-stack child, which threads no event recorder." : "The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run." + withheldTargetClause(eventsCommand, "stack", "cdkd events", "This stack's name") + `\nRead them with: ${eventsCommand.command}`;
 			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].map((t) => plainOrDescribed(t, "logical id")).join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
 		}
-		if (journaledOrphanSkips > 0) logger.warn(safeMsg`${journaledOrphanSkips} resource(s) a failed deploy created were left in AWS (each named in a ` + "warning above, which says what to do with it). This stack no longer records them.");
+		if (result.journaledOrphanSkips > 0) logger.warn(safeMsg`${result.journaledOrphanSkips} resource(s) a failed deploy created were left in AWS (each named in a ` + "warning above, which says what to do with it). This stack no longer records them.");
 		if (!preserveState) {
-			const leftInAws = journaledOrphanSkips > 0;
+			const leftInAws = result.journaledOrphanSkips > 0;
 			logger.info(`\n${leftInAws ? yellow("⚠") : green("✓")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} ${leftInAws ? "destroyed, with resources left in AWS" : "destroyed"}`)} (${green(result.deletedCount)} deleted${retainedSuffix}${leftInAws ? skippedSuffix : ""}${guardSuffix}, ${result.errorCount} errors)`);
 		} else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
 		else if (result.errorCount === 0) {
@@ -11448,6 +11820,10 @@ async function runDestroyForStack(stackName, state, ctx) {
 		try {
 			await lock.release({
 				failureMessage: `Failed to release lock for stack ${displayStackName(stackName)}`,
+				...heldTail !== void 0 && ctx.deferRegistryTail !== void 0 && { holdUntil: {
+					work: heldTail,
+					defer: ctx.deferRegistryTail
+				} },
 				beforeRelease: async () => {
 					try {
 						renderer.stop();
@@ -11458,6 +11834,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					logger.debug("Releasing lock...");
 				}
 			});
+			stackFinished = true;
 		} finally {
 			restoreBaseRegionAndClients();
 		}
@@ -11486,6 +11863,15 @@ async function scanActiveConsumers(producerStack, producerRegion, ctx) {
 	}))).filter((r) => r !== null).flat();
 }
 
+//#endregion
+//#region src/cli/commands/destroy-skip-message.ts
+function skippedDestroyMessage(totalSkipped, totalOrphanSkips, rerunCommand) {
+	const recordSkips = totalSkipped - totalOrphanSkips;
+	const orphanSentence = `${totalOrphanSkips} resource(s) a failed deploy created were left in AWS, and no state records them any more. The warning naming each says what to do with it.`;
+	if (recordSkips <= 0) return `Destroy finished, but ${orphanSentence}`;
+	return `Destroy skipped ${recordSkips} entr${recordSkips === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run '${rerunCommand}'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.` + (totalOrphanSkips > 0 ? ` Separately, ${orphanSentence}` : "");
+}
+
 //#endregion
 //#region src/cli/commands/destroy.ts
 function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
@@ -11508,6 +11894,10 @@ function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
 	}
 	return ordered;
 }
+function plannedDestroyRegion(refs, synthRegion, cliRegion) {
+	if (refs.length === 1) return refs[0]?.region || cliRegion;
+	if (refs.length > 1 && synthRegion && refs.some((r) => r.region === synthRegion)) return synthRegion;
+}
 async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger) {
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
@@ -11565,6 +11955,9 @@ async function destroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	let stateBackendForCleanup;
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -11574,6 +11967,7 @@ async function destroyCommand(stackArgs, options) {
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile }
 		});
+		stateBackendForCleanup = stateBackend;
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
 		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
@@ -11650,6 +12044,7 @@ async function destroyCommand(stackArgs, options) {
 		} else throw new CdkdError("Could not determine which stacks belong to this app. Specify stack names explicitly, or ensure --app / cdk.json is configured.", "DESTROY_NO_STACK_SELECTED", synthError);
 		let totalErrors = 0;
 		let totalSkipped = 0;
+		let totalOrphanSkips = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stoppedEarly = false;
@@ -11716,6 +12111,14 @@ async function destroyCommand(stackArgs, options) {
 			arr.push(ref);
 			stateRefsByName.set(ref.stackName, arr);
 		}
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const synth = appStacks.find((s) => s.stackName === name);
+			if (synth?.terminationProtection === true && !options.removeProtection) continue;
+			const planned = plannedDestroyRegion(stateRefsByName.get(name) ?? [], synth?.region, region);
+			if (planned !== void 0) crossPrefixCheck.cache.full(name, planned, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			logger.info(`\nPreparing to destroy stack: ${displaySafe(stackName)}`);
 			const refs = stateRefsByName.get(stackName) ?? [];
@@ -11733,15 +12136,12 @@ async function destroyCommand(stackArgs, options) {
 					continue;
 				}
 			}
+			const plannedRegion = plannedDestroyRegion(refs, synthRegion, region);
 			let stackTargetRegion;
 			if (refs.length === 0) {
 				logger.warn(`No state found for stack ${displaySafe(stackName)}, skipping`);
 				continue;
-			} else if (refs.length === 1) {
-				const onlyRegion = refs[0]?.region;
-				if (!onlyRegion) stackTargetRegion = region;
-				else stackTargetRegion = onlyRegion;
-			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
+			} else if (plannedRegion !== void 0) stackTargetRegion = plannedRegion;
 			else {
 				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
 				const orphanOneClause = withheldAccountClause(accountRecovery, "the command below prints").trimEnd();
@@ -11819,6 +12219,8 @@ async function destroyCommand(stackArgs, options) {
 					skipFinalSnapshot: options.skipFinalSnapshot === true,
 					resolveSecretDerivedPrincipals: {},
 					stackDestroy: true,
+					crossPrefixCheck,
+					...deferRegistryTail !== void 0 && { deferRegistryTail },
 					exportIndexStore,
 					...TemplateNoEchoReresolver.usable(synthStack?.template) && (synthStack.region === void 0 || synthStack.region === stackTargetRegion) && { noEchoReresolver: new TemplateNoEchoReresolver({
 						template: synthStack.template,
@@ -11835,6 +12237,7 @@ async function destroyCommand(stackArgs, options) {
 				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
+				totalOrphanSkips += result.journaledOrphanSkips;
 				stackInterrupted = result.interrupted;
 				stackCancelled = result.cancelled === true;
 				if (result.interrupted) interrupted = true;
@@ -11870,11 +12273,13 @@ async function destroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack> --stack-region <region>' removes the stack's state in that region (every resource's record) without deleting AWS resources.`);
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
-		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
+		if (totalSkipped > 0) throw new PartialFailureError(skippedDestroyMessage(totalSkipped, totalOrphanSkips, "cdkd destroy"));
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		awsClients.destroy();
+		stateBackendForCleanup?.destroyClient();
 	}
 }
 function createDestroyCommand() {
@@ -14022,7 +14427,7 @@ async function exportCommand(stackArg, options) {
   2. Re-run the phase 2 UPDATE manually with the full synth template:
        ${phase2RetryCommand(cfnStackName)}\n  3. Once phase 2 succeeds, clean up cdkd's stale state record.${orphan.note}\n     Run: ${orphan.command}`);
 			}
-			await stateBackend.deleteState(resolvedStackName, targetRegion);
+			await removeExportedStackRecord(stateBackend, resolvedStackName, targetRegion, logger);
 			logger.info(`cdkd state for ${quotedOrNotShown(resolvedStackName)} (${quotedRegion(targetRegion)}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
 			printNextSteps({
 				cfnStackName,
@@ -15626,6 +16031,11 @@ async function buildResolvedParametersPerStack(args) {
 		intrinsicSkippedByCdkdName
 	};
 }
+async function removeExportedStackRecord(stateBackend, stackName, region, logger) {
+	await stateBackend.deleteState(stackName, region);
+	await recordRetainedForReadoption(stateBackend, stackName, region, [], logger);
+	await releaseRegistryMarkerQuietly(stateBackend, stackName, region, logger);
+}
 async function runPerStackImportLoop(args) {
 	const logger = getLogger();
 	const { rootStackName, rootRegion, rootStackInfoNestedTemplates, rootTemplateFormat, tree, rootTemplate, cfnStackNameOverrides, rootParameters, deps, options } = args;
@@ -15903,7 +16313,7 @@ async function runPerStackImportLoop(args) {
 			}
 			const stateDeletionFailures = [];
 			for (const node of leafFirst) try {
-				await deps.stateBackend.deleteState(node.stackName, node.region);
+				await removeExportedStackRecord(deps.stateBackend, node.stackName, node.region, logger);
 				logger.info(`cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}) removed.`);
 			} catch (err) {
 				stateDeletionFailures.push({
@@ -16129,6 +16539,10 @@ const STATE_READ_REASONS = {
 	"read-failed": STATE_READ_FAILED_REASON,
 	"resources-malformed": "resources is not a JSON object; run `cdkd state show --json` to see the record"
 };
+function stateDestroyTargets(refs, stackRegion) {
+	if (stackRegion) return refs.filter((r) => r.region === stackRegion || !r.region);
+	return refs.length === 1 ? [...refs] : void 0;
+}
 function resourceCountOrNull(resources) {
 	if (resources === void 0 || resources === null) return 0;
 	if (typeof resources !== "object" || Array.isArray(resources)) return null;
@@ -16249,7 +16663,10 @@ async function setupStateBackend(options) {
 		bucket,
 		prefix,
 		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
-		dispose: () => awsClients.destroy()
+		dispose: () => {
+			awsClients.destroy();
+			stateBackend.destroyClient();
+		}
 	};
 }
 function renderRecovery(options, setup) {
@@ -16690,6 +17107,43 @@ function createStateShowCommand() {
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
 }
+async function clearRetainedQuietly(backend, stackName, region, logger) {
+	try {
+		await backend.saveRetainedResources(stackName, region, []);
+		return true;
+	} catch (error) {
+		logger.warn(safeMsg`Could not empty the kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}): a later deploy here may still take a kept ` + `resource back. Re-run 'cdkd state orphan' once it can write.`);
+		return false;
+	}
+}
+async function clearRetainedWithoutRecord(backend, stackName, stackRegion, logger) {
+	if (stackName.includes("/")) return {
+		cleared: [],
+		attempted: 0
+	};
+	const base = `${backend.prefix}/${stackName}/`;
+	let regions;
+	try {
+		const keys = (await backend.listRawKeys(base)).map((key) => key.slice(base.length).split("/")).filter((parts) => parts.length >= 2 && parts[0] !== "");
+		const recorded = new Set(keys.filter((parts) => parts.length === 2 && parts[1] === "state.json").map((parts) => parts[0]));
+		regions = [...new Set(keys.map((parts) => parts[0]).filter((region) => stackRegion === void 0 || region === stackRegion).filter((region) => !recorded.has(region)))];
+	} catch (error) {
+		logger.warn(safeMsg`Could not look for a kept-resource record of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}).`);
+		return {
+			cleared: [],
+			attempted: 0
+		};
+	}
+	const cleared = [];
+	for (const region of regions) {
+		if (await clearRetainedQuietly(backend, stackName, region, logger)) cleared.push(region);
+		await releaseRegistryMarkerQuietly(backend, stackName, region, logger);
+	}
+	return {
+		cleared,
+		attempted: regions.length
+	};
+}
 async function stateOrphanCommand(stackArgs, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
@@ -16705,6 +17159,12 @@ async function stateOrphanCommand(stackArgs, options) {
 		for (const stackName of stackArgs) {
 			const stackRefs = refs.filter((r) => r.stackName === stackName);
 			if (stackRefs.length === 0) {
+				const { cleared, attempted } = await clearRetainedWithoutRecord(setup.stateBackend, stackName, options.stackRegion, logger);
+				if (attempted > 0 && cleared.length === 0) continue;
+				if (cleared.length > 0) {
+					logger.info(safeMsg`Cleared the kept-resource record of ${plainOrDescribed(stackName, "stack name")} ` + safeMsg`(${cleared.map((r) => displaySafe(r, { asciiOnly: true })).join(", ")}): ` + `a later deploy here no longer takes a kept resource back.`);
+					continue;
+				}
 				logger.info(safeMsg`No state found for stack: ${plainOrDescribed(stackName, "stack name")}, skipping` + (isPasteableIdent(stackName) ? "" : safeMsg`. ${STATE_LIST_POINTER}`));
 				continue;
 			}
@@ -16748,10 +17208,13 @@ async function stateOrphanCommand(stackArgs, options) {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, target.region, logger);
 					await setup.stateBackend.deleteState(stackName, target.region);
 					await setup.lockManager.forceReleaseLock(stackName, target.region);
+					await clearRetainedQuietly(setup.stateBackend, stackName, target.region, logger);
+					await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, target.region, logger);
 				} else {
 					await warnOnLiveForeignLock(setup.lockManager, stackName, void 0, logger);
 					await setup.stateBackend.deleteLegacyState(stackName);
 					await setup.lockManager.forceReleaseLock(stackName, void 0);
+					await clearRetainedWithoutRecord(setup.stateBackend, stackName, void 0, logger);
 				}
 				logger.info(safeMsg`✓ Removed state for stack: ${describedStackRef(target)}` + ((options.yes || options.force) && refIsDescribed(target) ? safeMsg`. ${STATE_LIST_POINTER}` : ""));
 			}
@@ -16899,6 +17362,8 @@ async function stateDestroyCommand(stackArgs, options) {
 		interruptWatch.dispose();
 		throw error;
 	}
+	const deferredTails = [];
+	let deferRegistryTail;
 	try {
 		const stateRefs = await setup.stateBackend.listStacks();
 		const knownStackNames = new Set(stateRefs.map((r) => r.stackName));
@@ -16908,6 +17373,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		logger.info(safeMsg`Found ${stackNames.length} stack(s) to destroy: ${stackNames.map(listedStackName).join(", ")}`);
 		let totalErrors = 0;
 		let totalSkipped = 0;
+		let totalOrphanSkips = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stoppedEarly = false;
@@ -16916,16 +17382,23 @@ async function stateDestroyCommand(stackArgs, options) {
 			if (!options.stackRegion) return laterRefs.length > 0;
 			return laterRefs.some((r) => r.region === options.stackRegion || !r.region);
 		});
+		const crossPrefixCheck = { cache: new CrossPrefixGuard(setup.stateBackend) };
+		if (stackNames.length > 1) deferRegistryTail = (released) => deferredTails.push(released);
+		for (const name of stackNames) {
+			const refs = stateRefs.filter((r) => r.stackName === name);
+			for (const ref of stateDestroyTargets(refs, options.stackRegion) ?? []) crossPrefixCheck.cache.full(name, ref.region ?? setup.region, "prestart");
+		}
 		for (const [stackIndex, stackName] of stackNames.entries()) {
 			const refs = stateRefs.filter((r) => r.stackName === stackName);
 			let targets;
+			const planned = stateDestroyTargets(refs, options.stackRegion);
 			if (options.stackRegion) {
-				targets = refs.filter((r) => r.region === options.stackRegion || !r.region);
+				targets = planned ?? [];
 				if (targets.length === 0) {
 					logger.warn(safeMsg`Skipping ${plainOrDescribed(stackName, "stack name")} (no state record matches ` + safeMsg`--stack-region ${displayIdent(options.stackRegion)})`);
 					continue;
 				}
-			} else if (refs.length === 1) targets = refs;
+			} else if (planned !== void 0) targets = planned;
 			else throw multipleRegionsError(stackName, refs, `Use --stack-region ${commandHole("region")} to pick one.`);
 			for (const [refIndex, ref] of targets.entries()) {
 				logger.info(safeMsg`\nPreparing to destroy stack: ${formatStackRefSafe(ref)}`);
@@ -16982,6 +17455,8 @@ async function stateDestroyCommand(stackArgs, options) {
 						skipFinalSnapshot: options.skipFinalSnapshot === true,
 						resolveSecretDerivedPrincipals: {},
 						stackDestroy: true,
+						crossPrefixCheck,
+						...deferRegistryTail !== void 0 && { deferRegistryTail },
 						exportIndexStore: setup.exportIndexStore,
 						...options.allowUnsupportedTypes?.length && { allowUnsupportedTypes: options.allowUnsupportedTypes },
 						...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
@@ -17007,6 +17482,7 @@ async function stateDestroyCommand(stackArgs, options) {
 				}
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
+				totalOrphanSkips += result.journaledOrphanSkips;
 				if (result.interrupted) interrupted = true;
 				if (runInterrupted()) {
 					if (refIndex < targets.length - 1) stoppedEarly = true;
@@ -17020,8 +17496,9 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack> --stack-region <region>' removes the stack's state in that region (every resource's record) without deleting AWS resources.`);
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
-		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd state destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
+		if (totalSkipped > 0) throw new PartialFailureError(skippedDestroyMessage(totalSkipped, totalOrphanSkips, "cdkd state destroy"));
 	} finally {
+		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
 		interruptWatch.dispose();
 		setup.dispose();
@@ -17684,6 +18161,7 @@ async function rollbackCommand(stackArg, options) {
 			});
 			return;
 		}
+		const crossPrefixScan = new CrossPrefixGuard(setup.stateBackend).full(stackName, region);
 		stackAwsClients = new AwsClients({
 			region,
 			...options.profile && { profile: options.profile }
@@ -17718,6 +18196,15 @@ async function rollbackCommand(stackArg, options) {
 				segments: journal.segments.filter((s) => s.reason !== NESTED_PENDING_PARENT_REASON)
 			};
 			if (!journal || journal.segments.length === 0 && orphanedPending === 0) throw new Error(`Nothing to roll back for ${plainOrDescribed(stackName, "stack name")} (${plainOrDescribed(region, "region")}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+			applyCrossPrefixScan(await crossPrefixScan, {
+				stackName,
+				region,
+				bucket: setup.bucket,
+				recovery: {
+					profile: options.profile,
+					stateBucket: setup.bucket
+				}
+			}, "rollback", (message) => logger.warn(message), (message) => logger.info(message));
 			if (!stateData) throw new Error(`Rollback journal exists for ${safeStack(stackName)} (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			demoteSupersededOrphans(journal.segments, Array.isArray(stateData.state.orphans) ? stateData.state.orphans : []);
 			if (!options.revertFailed) for (const segment of journal.segments) {
@@ -17961,6 +18448,8 @@ async function rollbackCommand(stackArg, options) {
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
+				await recordRetainedForReadoption(setup.stateBackend, stackName, region, [], logger);
+				await releaseRegistryMarkerQuietly(setup.stateBackend, stackName, region, logger);
 				logger.info(`State for ${stackRegionShown(stackName, region)} removed (stack fully rolled back).`);
 			}
 			if (declinedDivergentRewrite) throw new PartialFailureError(`Rollback stopped: ${declinedDivergentReason}.` + (totalFailures > 0 ? ` ${totalFailures} operation(s) also failed.` : "") + " Journal preserved (this segment, any older ones, and their failed operations) — re-run the rollback once the record's region field matches its key.");
@@ -19108,8 +19597,20 @@ async function forceUnlockCommand(stackArgs, options) {
 				const where = r ? `${displayStackName(stackName)} (${displayIdent(r)})` : `${displayStackName(stackName)} (legacy lock key)`;
 				logger.info(`Force-unlocking stack: ${where}`);
 				try {
-					await lockManager.forceReleaseLock(stackName, r);
+					let ledgerError;
+					let recorded = false;
+					await lockManager.forceReleaseLock(stackName, r, async (horizon) => {
+						if (r === void 0) return;
+						const ledger = ledgerForStack(stateBackend, stackName, r);
+						for (let attempt = 0; attempt < 2 && !recorded; attempt++) try {
+							await ledger.noteAbandoned(horizon);
+							recorded = true;
+						} catch (error) {
+							ledgerError = error;
+						}
+					});
 					logger.info(`✓ Lock released for stack: ${where}`);
+					if (!recorded && ledgerError !== void 0) logger.warn(safeMsg`Lock released, but the create-token ledger of ${where} could not record when the ` + safeMsg`abandoned run stopped: ${describeAwsFailure(ledgerError).summary}. ` + "A later deploy may take back a resource of those names that another deployment creates.");
 				} catch (error) {
 					const message = describeAwsFailure(error).detail;
 					if (message.includes("No lock found") || message.includes("NoSuchKey")) logger.info(`No lock found for stack: ${where}`);
@@ -19219,6 +19720,20 @@ var ObservedBaselineRefusals = class extends Set {
 	unverifiableParameter = /* @__PURE__ */ new Set();
 	hadDeployedParameterSource = false;
 };
+async function claimRegistryMarkerAfterImport(backend, stackName, region, logger) {
+	const answer = await new CrossPrefixGuard(backend).full(stackName, region);
+	const regionShown = displaySafe(region, { asciiOnly: true });
+	switch (answer.kind) {
+		case "clear": return;
+		case "found":
+			logger.warn(safeMsg`The state bucket also records ${displayStackName(stackName)} (${regionShown}) under another state prefix ` + safeMsg`(${answer.prefixes.map((p) => displayIdent(p)).join(", ")}). One stack name per ` + "account and region is supported: drop one of the records with 'cdkd state orphan' before deploying or destroying either.");
+			return;
+		case "in-progress":
+			logger.warn(safeMsg`A deploy of ${displayStackName(stackName)} (${regionShown}) holds a lock under another state prefix ` + safeMsg`(${displayIdent(answer.prefix)}). One stack name per account and region is ` + `supported: keep one of the two before deploying or destroying either.`);
+			return;
+		default: logger.warn(safeMsg`Could not record ${displayStackName(stackName)} (${regionShown}) in the state bucket's stack registry` + (answer.kind === "denied" || answer.kind === "failed" ? safeMsg` (${describeAwsFailure(answer.error).summary})` : "") + `. Its next guarded command records it.`);
+	}
+}
 async function importCommand(stackArg, options) {
 	const providerClasses = await loadProviderClasses();
 	const logger = getLogger();
@@ -19439,6 +19954,7 @@ async function importCommand(stackArg, options) {
 			await recordImportOnRollbackJournal(stateBackend, stackInfo.stackName, targetRegion, importedRows.map((r) => r.logicalId), stackState.resources, logger);
 			await stateBackend.saveState(stackInfo.stackName, targetRegion, stackState, saveOptions);
 			logger.info(`✓ State written: ${stackInfo.stackName} (${targetRegion})`);
+			await claimRegistryMarkerAfterImport(stateBackend, stackInfo.stackName, targetRegion, logger);
 			logger.info(`  ${importedRows.length} resource(s) imported. Run 'cdkd diff' to see how the imported state lines up with the template.`);
 			if (migrationCfnStackName && migrationTree && accountIdForNestedSynth) await importNestedStackChildrenRecursive({
 				lockRecovery,
@@ -27766,4 +28282,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-v_QNBjtZ.js.map
+//# sourceMappingURL=program-CIxuz2zX.js.map