@go-to-k/cdkd 0.296.29 → 0.296.31

package/dist/{program-CN7Dqb3j.js → program-Db1eBDeq.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
 import { $n as isAmbiguousOutcomeError, $t as credentialFingerprint, Bn as withheldTargetClause, D as VALUE_NOT_SHOWN, Dn as TIMEOUT_FLAG_RESOURCE_TYPE, E as assertRegionMatch, En as withErrorHandling, Ft as buildLockContentionMessage, G as runDeleteAttempt, Hn as setPasteableVerbFlags, Ht as CUSTOM_RESOURCE_RESPONSE_PREFIX, In as plainOrDescribed, It as forceQuitRecoveryClause, Jt as setPasteableAwsProfile, Kt as producerCoordinateKey, Ln as quotedOrDescribed, Lt as formatLockExpiry, Nn as isInertUnquoted, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, P as remedyLogicalId, Pn as pasteableCommand, Pt as buildForceUnlockCommand, Qt as clientDefaultsFor, Rn as shellBoundedDisplay, Rt as formatLockOperation, Sn as SynthesisError, T as RESOURCE_NOT_FOUND, Tn as normalizeAwsError, Ut as DEFAULT_STATE_PREFIX, Vn as setPasteableRunFlags, Wt as injectiveKey, Xt as ambientClientDefaults, Yt as withPasteableAwsProfile, Z as isAwsCliLiteral, Zt as ambientCredentialConfig, _n as ResourceTimeoutError, ar as isMarkedNonRetryable, bn as StackTerminationProtectionError, cn as IntrinsicResolutionRefusalError, en as AccountIdUnavailableError, ft as logicalIdShown, gn as ProvisioningError, hn as PartialFailureError, in as CrossAccountSecretRefusalError, it as isInterruptedWaitError, jn as commandHole, kn as SHELL_ACTIVE_WHY, ln as LocalInvokeBuildError$1, mn as NestedStackChildDirectDestroyError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as CdkdError, nr as isTransientServerError, nt as endCommandInterruptScope, on as DeployCancelledError, or as isThrottlingError, pn as MalformedProducerRecordRefusalError, qt as producerRecordKey, rr as retryClassificationText, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as DynamicReferenceRegionAmbiguousError, sr as markNonRetryable, t as IAM_PRINCIPAL_NAME, tr as isRetryableTransientError, tt as beginCommandInterruptScope, un as LocalStartServiceError, vn as ResourceUpdateNotSupportedError, yn as StackHasActiveImportsError, zn as shellQuote, zt as formatLockOwner } from "./iam-policy-targets-Cz2tPxXk.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $c as nullPrototypeRecord, $o as provenPublicValue, $s as buildDenyExternalAccessPolicy, $t as findNestedStackTypeChanges, A as noEchoExactEchoLeavesOf, Aa as unreadableResourceEntries, Ac as resolveStateBucketWithDefault, Ai as isReadableOrphanRecord, An as orphanRecordsPrintingBag, Ao as hasMaskableValues, As as importableOutputs, At as journaledOrphanLines, Ba as MULTI_REGION_RECREATE_BLOCKED_TYPES, Bc as uploadCfnTemplate, Bi as malformedOrphanRowsKeptWarning, Bn as isFinalSnapshotError, Bo as maskSecretsInText, Br as applyRoleArnIfSet, Bs as createAssetRedirectResolver, Bt as removeProtectionTypeList, C as recordRetainedForReadoption, Ca as repairMalformedOrphansForReadOnly, Cc as getDefaultStateBucketName, Ci as UNREADABLE_RESOURCES_MAP_ROW, Cn as isExportAliasCollision, Cr as deleteSkipReason, Cs as acceptedCreateOnlyDropsOf, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as repairMalformedResourcesForReadOnly, Dc as resolveAutoAssetStorage, Di as hasReadableOrphans, Dn as completedReplayEntries, Do as liveMatchesUnresolvedTokenFrame, Ds as hasReasonlessBaselineRefusal, Dt as deleteJournaledOrphans, E as serviceTokenBlockingReason, Ea as repairMalformedResourcePropertiesForReadOnly, Ec as resolveApp, Ei as displayLogicalId, En as DEFAULT_RESOURCE_WARN_AFTER_MS, Eo as valueAtCoordinate, Es as hasReadableExportSet, Et as withNestedStackContext, F as isProtectionValueActive, Fc as ssmResolvedValueType, Fi as malformedLocalOutputsWarning, Fn as PRE_DELETE_SNAPSHOT_TYPES, Fo as recordLogOnlyValue, Fr as IntrinsicFunctionResolver, Fs as AssetPublisher, Ft as replayRollback, Gc as canonicalizeRegion, Gi as malformedRenderedContainersWarning, Gn as findDestructiveChanges, Go as dynamicReferenceTokens, Gr as sendableAssumeRoleCommand, Gs as assertAssetBucketRegion, Gt as planFailedOps, Ha as isStatefulRecreateTargetSync, Hc as decodeListingKey, Hi as malformedOrphansWarning, Hn as unsupportedFinalSnapshotError, Ho as redactSecretsForState, Hr as assertSendableRoleArn, Hs as rewriteTemplateAssetReferences, Ht as demoteSupersededOrphans, I as perType, Ia as NO_CC_HANDLERS_REASON, Ic as CFN_TEMPLATE_BODY_LIMIT, Ii as malformedLocalResourceEntriesWarning, In as buildFinalSnapshotIdentifier, Io as shareLogOnlyValues, Ir as poisonRenderedSpellingsCollidingIn, Is as isSensitiveAttributeName, Jc as StageLoadError, Ji as malformedResourcesWarning, Jo as identityKeyFor, Jr as callerEnvCredentials, Js as isCrossRegionRedirect, Jt as recordUnderIdIsNotOwn, Kc as derivePartitionAndUrlSuffix, Ki as malformedResourceEntriesWarning, Kn as formatDestructiveChange, Ko as isUncertifiedBaselineMaskPosition, Kr as AWS_CREDENTIAL_ENV_KEYS, Ks as ensureAssetStorage, Kt as planRollback, L as readProtection, La as hasNoCloudControlHandlers, Lc as CFN_TEMPLATE_URL_LIMIT, Li as malformedLocalResourcesWarning, Ln as ccRoutedFinalSnapshotError, Lo as createSecretMasker, Lr as classifyReplaySecretRegion, Ls as stringifyValue, Lt as destroyStackRecordsView, M as recordedProtectionEvidence, Ma as findActionableSilentDrops, Mc as resolveUseCdkBootstrapAssets, Mi as malformedDriftResourcePropertiesWarning, Mn as stateSecretNameNeedles, Mo as logOnlyValueCount, Ms as orphansAfterRollback, Mt as makeForeignHolderScan, N as recordedProtectionNote, Nc as stateBucketExistenceConfirmed, Ni as malformedExportNamesWarning, Nn as extractDeploymentEventError, No as printingCorpusOf, Nr as DiffCalculator, Ns as orphansCarriedFrom, Nt as sameJournaledOrphans, O as noEchoAttributeNamesOf, Oa as unpreviewableOrphanRecords, Oc as resolveCaptureObservedState, Oi as hasReadableOutputs, On as journaledOrphanPrintingBag, Oo as carryLogOnlyValues, Os as hasUnverifiableParameterRefusal, Ot as dropFailedHint, P as PROTECTION_PROPERTY_BY_TYPE, Pa as unwrittenCreateOnlyReplacement, Pc as warnDeprecatedNoPrefixCliFlag, Pi as malformedExportSourceWarning, Pn as ATOMIC_FINAL_SNAPSHOT_TYPES, Po as recordLogOnlyParameterValue, Pr as INTRINSIC_KEYS, Ps as shouldRetainResource, Pt as replayFailedOperations, Qc as hasPlainPrototype, Qi as refuseDivergentRecordRegionForDestroy, Qo as carriesSecretMask, Qs as validateContainerRepoName, Qt as orphanDeleteNeedsIdentity, Ra as findReplacedReadersOfRecreateTargets, Rc as MIGRATE_TMP_PREFIX, Ri as malformedOrphanRecordsRefusalMessage, Rn as createPreDeleteFinalSnapshot, Ro as errorCauseChain, Rr as producerRegionsFromState, Rs as WorkGraph, S as keptForReadoption, Sa as repairMalformedOrphanRecordsForReadOnly, Sc as synthesisStatusMessage, Si as UNREADABLE_ORPHANS_CONTAINER_ROW, Sn as collectPublishedOutputNames, So as noEchoOutputsComparison, Sr as deleteIndeterminateGuards, Ss as splitImportedOps, T as findServiceTokenRefusals, Ta as repairMalformedResourceEntriesForReadOnly, Tc as loadCdkJson, Ti as deployRefusesOrphanRowsReason, Tn as DEFAULT_RESOURCE_TIMEOUT_MS, To as readsNoEchoSource, Tr as isWaitAbandonedError, Ts as exportNamesCarriedFrom, Ua as renderStatefulReason, Uc as expectedOwnerParam, Ui as malformedOutputsRefusalMessage, Un as maskingRetryLogger, Uo as scrubResourceRecord, Ur as explicitRoleArnOrThrow, Us as AssetModeResolver, Ut as isJournaledOrphan, Va as isStatefulRecreateTargetForReplace, Vc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vi as malformedOrphansRefusalMessage, Vn as refusesFinalSnapshot, Vo as markSameGenerationBag, Vr as assertFlagRoleArn, Vs as loadPublishableAssetManifest, Vt as recordAfterRollbackUpdate, Wc as PARTITION_TABLE, Wi as malformedOutputsWarning, Wn as constructPathOf, Wo as DYNAMIC_REFERENCE_TOKEN_SCAN, Wr as isIamRoleArn, Ws as BOOTSTRAP_MARKER_PREFIX, Wt as isReplacementOrphan, Xc as defineOwnKey, Xi as malformedStateRefusalMessage, Xo as recordNestedStackParameterExpressions, Xs as readBootstrapMarkerBody, Xt as resolveReplacementOldType, Yc as processStackMessages, Yi as malformedScrubResourceEntriesRefusalMessage, Yn as ledgerForStack, Yo as inheritNestedStackParameterAssociations, Yr as envCredentialsAreAssumedRole, Ys as parseBootstrapMarker, Yt as replacementNeverSwapped, Zc as hasOwnKey, Zi as previewableOrphanRecords, Zn as withCreateTokenLedger, Zs as validateAssetBucketName, Zt as seedsDeleteFirstGuard, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourcePropertiesForOrphan, _c as escapeRegExp, _i as parameterInputsFor, _n as exportNameNoEchoParameters, _o as maskReadbackAtCoordinates, _r as withPrintingSecrets, _s as CrossPrefixScanCache, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseMalformedOutputs, ac as dockerSpawnEnvWithSensitive, ai as getAccountInfo, al as resolveAssemblyPath, ao as prefetchCreateOnlyPropertyPaths, as as wholeStringLeavesOf, at as gray, ba as refuseMalformedResourcesForExport, bc as getDockerImageBySourceHash, bi as STATE_REGION_DIVERGED, bn as noEchoParameterValueSeed, bo as noEchoCoordinatesOf, bs as isAccessDenied, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedResourceEntries, cc as getDockerCmd, ci as carriesFetchableDynamicReference, cn as DeploymentEventsReader, co as withRetry, cr as CC_BROKEN_REASON, cs as STATE_SOURCED_READBACK_RULES, ct as yellow, d as conditionInputsFrom, da as refuseMalformedResourceEntriesForImport, dc as partitionSensitiveEnv, di as AWS_NO_VALUE, dn as displayTextOrWithheld, dr as isCustomResource, ds as isSingleDynamicReferenceToken, dt as reachableDivergentParameters, ea as refuseMalformedOrphanRecords, ec as buildDockerImage, el as ownValue, es as recordMaskOnlyValue, f as parentSuppliedValues, fa as refuseMalformedResourceEntriesForImportSave, fc as redactDockerArgvValues, fi as cfnRefValueFromPhysicalId, fn as exportAliasCollisionScrubWarning, fo as DagBuilder, fr as wouldReturnToSdkProvider, fs as LockManager, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourcePropertiesForExport, gc as warnFinchArgvExposure, gi as withSharedDrainBudget, gn as carriedExportAliasExposure, go as maskAtCoordinates, gs as CrossPrefixReadError, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourcePropertiesForDrift, hc as runDockerStreaming, hn as secretSafeKeyDisplay, ho as isMarkedCoordinate, hr as isCustomResourceType$1, hs as rebuildClientForBucketRegion, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as refuseMalformedOrphansForOrphan, ic as describeDockerFailure, ii as parameterTypeMayLoseSecretIdentity, il as renderAssemblyPathEscape, is as recordProvenPublicExpression, it as cyan, j as noEchoParameterNamesOf, ja as withheldAccountClause, jc as resolveStateBucketWithDefaultAndSource, ji as isReadableResourceEntry, jn as secretNamePrintingBag, jo as literalSplitDelimitersOf, js as isReadableBag, jt as loadJournaledOrphans, k as noEchoComparisonForTemplate, ka as unreadableOrphanRecords, kc as resolveSkipPrefix, ki as hasReadableResources, kn as maskEventTextWithBoundBags, ko as createUnionSecretMasker, ks as importableOutputKeys, kt as isHandledOrphan, l as templateIdentity, la as refuseMalformedResourceEntriesForDeploy, lc as isDockerClientEnvKey, li as isNamelessDynamicReferenceError, ln as DeploymentEventsStore, lr as ProviderRegistry, ls as TEMPLATE_SOURCED_RULES, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourcePropertiesForDestroy, mc as runDockerForeground, mi as refStateLookupFromResource, mn as secretBearingStateKeyWarning, mo as canonicalCoordinates, mr as readsNoEchoDeleteValues, ms as S3StateBackend, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedOrphans, nc as describeDockerCapturedOutput, ni as coerceParameterTypedValue, nl as describeFileReadFailure, ns as recordNoEchoAttributeValues, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oa as refuseMalformedOutputsForDestroy, oc as finchSecretArgvRefusal, oi as isImpossibleEmptyStoredAttribute, on as updatePartialMessage, oo as templateResourceTypes, os as STATE_SOURCED_BASELINE_RULES, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedResourceEntriesForOrphan, pc as redactedDockerCause, pi as isStalePlaceholderArnAttribute, pn as secretBearing, po as TemplateParser, pr as TemplateNoEchoReresolver, ps as isLockInfoExpired, pt as makeSiblingClaimReader, qc as AssemblyReader, qi as malformedResourcePropertiesWarning, qn as RollbackInlinePolicyWriters, qo as pathCrossesDottedKey, qr as applyCallerIdentityCredentials, qs as getBootstrapMarkerKey, qt as recheckFailedPlan, r as computeImplicitDeleteEdges, ra as refuseMalformedOrphansForDestroy, rc as describeDockerExecFailure, ri as isUnboundTemplateParameter, rl as displayAssemblyPath, rs as recordNoEchoParameterFreshValue, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedResourceAttributesForOrphan, sc as formatDockerLoginError, si as carriesDynamicReference, sl as resolveBucketRegion, sn as updatePartialReason, so as describeTypeWithThrottleRetry, ss as STATE_SOURCED_CROSS_GENERATION_RULES, st as red, t as DeployEngine, ta as refuseMalformedOrphanRecordsForDestroy, tc as resolveDockerContextDirectory, tl as absoluteAssemblyPathEscape, tn as inheritProducerRegions, ts as recordMaskOnlyValuesIn, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedResourceEntriesForDestroy, uc as isMalformedEnvKey, ui as keepsSecretReferenceToken, un as WITHHELD_NAME_DISPLAY, ur as ccBrokenReason, us as WHOLE_DYNAMIC_REFERENCE_PATTERN, ut as namesAnyDeclaredParameter, va as refuseMalformedResourcesForDeploy, vc as stripControlChars, vn as exportNameSecretExposure, vo as maskWholeValue, vr as CloudControlProvider, vs as applyCrossPrefixScan, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as repairMalformedOutputsForReadOnly, wc as getLegacyStateBucketName, wi as accountArgs, wn as bindingSkippedOutputs, wo as readbackPathFor, ws as describeRegionValueKind, wt as withNestedRevertRun, xa as refuseMalformedState, xc as Synthesizer, xi as STATE_RESOURCES_MALFORMED, xn as collectDeclaredOutputNames, xo as noEchoLeavesOf, xr as UNSPECIFIED_SKIP_REASON, xs as isNotImplemented, xt as recordDisplacedSkips, ya as refuseMalformedResourcesForDestroy, yc as AssetManifestLoader, yi as JSON_LISTING_HOLE_VALUE, yn as isWholeDynamicReferenceValue, yo as maskedLeafCoordinatesOf, yr as slowCcOperationTimeoutMs, ys as crossPrefixDeniedWarning, za as shownType, zc as findLargeInlineResources, zi as malformedOrphanRecordsWarning, zn as effectiveDeletionPolicy, zo as maskSecretsInError, zr as regionLessSecretName, zs as buildAssetRedirectMap, zt as withStackRecords } from "./deploy-engine-Bt-8KvUj.js";
-import { t as getCdkdVersion } from "./version-DyV_xwRX.js";
+import { $c as processStackMessages, $i as malformedScrubResourceEntriesRefusalMessage, $o as inheritNestedStackParameterAssociations, $r as envCredentialsAreAssumedRole, $s as parseBootstrapMarker, $t as orphanDeleteNeedsIdentity, A as noEchoExactEchoLeavesOf, Aa as repairMalformedResourcePropertiesForReadOnly, Ac as resolveApp, Ai as displayLogicalId, An as maskEventTextWithBoundBags, Ao as valueAtCoordinate, As as hasReadableExportSet, At as isHandledOrphan, Ba as NO_CC_HANDLERS_REASON, Bc as CFN_TEMPLATE_BODY_LIMIT, Bi as malformedLocalResourceEntriesWarning, Bn as ccRoutedFinalSnapshotError, Bo as shareLogOnlyValues, Br as poisonRenderedSpellingsCollidingIn, Bs as isSensitiveAttributeName, Bt as withStackRecords, C as recordRetainedForReadoption, Ca as refuseMalformedResourcesForDestroy, Cc as AssetManifestLoader, Ci as JSON_LISTING_HOLE_VALUE, Cn as collectPublishedOutputNames, Co as maskedLeafCoordinatesOf, Cs as crossPrefixDeniedWarning, Ct as revertedNestedRowIds, D as withResourceDeadline, Da as repairMalformedOrphansForReadOnly, Dc as getDefaultStateBucketName, Di as UNREADABLE_RESOURCES_MAP_ROW, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Dr as deleteSkipReason, Ds as acceptedCreateOnlyDropsOf, Dt as withNestedStackContext, E as serviceTokenBlockingReason, Ea as repairMalformedOrphanRecordsForReadOnly, Ec as synthesisStatusMessage, Ei as UNREADABLE_ORPHANS_CONTAINER_ROW, En as DEFAULT_RESOURCE_TIMEOUT_MS, Eo as noEchoOutputsComparison, Er as deleteLeftInPlace, Es as splitImportedOps, F as isProtectionValueActive, Fa as withheldAccountClause, Fc as resolveStateBucketWithDefaultAndSource, Fi as isReadableResourceEntry, Fn as storedSecretNameNeedles, Fo as literalSplitDelimitersOf, Fs as isReadableBag, Ft as replayFailedOperations, Ga as isStatefulRecreateTargetForReplace, Gc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Gi as malformedOrphansRefusalMessage, Gn as unsupportedFinalSnapshotError, Go as markSameGenerationBag, Gr as assertFlagRoleArn, Gs as loadPublishableAssetManifest, Gt as isReplacementOrphan, Ha as findReplacedReadersOfRecreateTargets, Hc as MIGRATE_TMP_PREFIX, Hi as malformedOrphanRecordsRefusalMessage, Hn as effectiveDeletionPolicy, Ho as errorCauseChain, Hr as producerRegionsFromState, Hs as WorkGraph, Ht as recordAfterRollbackUpdate, I as perType, Ia as findActionableSilentDrops, Ic as resolveUseCdkBootstrapAssets, Ii as malformedDriftResourcePropertiesWarning, In as extractDeploymentEventError, Io as logOnlyValueCount, Is as orphansAfterRollback, It as replayRollback, Jc as PARTITION_TABLE, Ji as malformedOutputsWarning, Jn as findDestructiveChanges, Jo as DYNAMIC_REFERENCE_TOKEN_SCAN, Jr as isIamRoleArn, Js as BOOTSTRAP_MARKER_PREFIX, Jt as recheckFailedPlan, Ka as isStatefulRecreateTargetSync, Kc as decodeListingKey, Ki as malformedOrphansWarning, Kn as maskingRetryLogger, Ko as redactSecretsForState, Kr as assertSendableRoleArn, Ks as rewriteTemplateAssetReferences, Kt as planFailedOps, L as readProtection, Lc as stateBucketExistenceConfirmed, Li as malformedExportNamesWarning, Ln as ATOMIC_FINAL_SNAPSHOT_TYPES, Lo as printingCorpusOf, Lr as DiffCalculator, Ls as orphansCarriedFrom, M as recordedProtectionEvidence, Ma as unpreviewableOrphanRecords, Mc as resolveCaptureObservedState, Mi as hasReadableOutputs, Mn as secretNamePrintingBag, Mo as carryLogOnlyValues, Ms as hasUnverifiableParameterRefusal, Mt as loadJournaledOrphans, N as recordedProtectionNote, Na as unreadableOrphanRecords, Nc as resolveSkipPrefix, Ni as hasReadableResources, Nn as secretNamedRecordNeedles, No as createUnionSecretMasker, Ns as importableOutputKeys, Nt as makeForeignHolderScan, O as noEchoAttributeNamesOf, Oa as repairMalformedOutputsForReadOnly, Oc as getLegacyStateBucketName, Oi as accountArgs, On as completedReplayEntries, Oo as readbackPathFor, Os as describeRegionValueKind, Ot as deleteJournaledOrphans, P as PROTECTION_PROPERTY_BY_TYPE, Pa as unreadableResourceEntries, Pc as resolveStateBucketWithDefault, Pi as isReadableOrphanRecord, Pn as stateSecretNameNeedles, Po as hasMaskableValues, Ps as importableOutputs, Pt as sameJournaledOrphans, Qc as StageLoadError, Qi as malformedResourcesWarning, Qn as ledgerForStack, Qo as identityKeyFor, Qr as callerEnvCredentials, Qs as isCrossRegionRedirect, Qt as seedsDeleteFirstGuard, Ra as unwrittenCreateOnlyReplacement, Rc as warnDeprecatedNoPrefixCliFlag, Ri as malformedExportSourceWarning, Rn as PRE_DELETE_SNAPSHOT_TYPES, Ro as recordLogOnlyParameterValue, Rr as INTRINSIC_KEYS, Rs as shouldRetainResource, Rt as destroyStackRecordsView, S as keptForReadoption, Sa as refuseMalformedResourcesForDeploy, Sc as stripControlChars, Sn as collectDeclaredOutputNames, So as maskWholeValue, Sr as slowCcOperationTimeoutMs, Ss as applyCrossPrefixScan, T as findServiceTokenRefusals, Ta as refuseMalformedState, Tc as Synthesizer, Ti as STATE_RESOURCES_MALFORMED, Tn as bindingSkippedOutputs, To as noEchoLeavesOf, Tr as deleteIndeterminateGuards, Ts as isNotImplemented, Tt as collectNestedChildUnaddressed, Ua as shownType, Uc as findLargeInlineResources, Ui as malformedOrphanRecordsWarning, Un as isFinalSnapshotError, Uo as maskSecretsInError, Ur as regionLessSecretName, Us as buildAssetRedirectMap, Ut as demoteSupersededOrphans, Va as hasNoCloudControlHandlers, Vc as CFN_TEMPLATE_URL_LIMIT, Vi as malformedLocalResourcesWarning, Vn as createPreDeleteFinalSnapshot, Vo as createSecretMasker, Vr as classifyReplaySecretRegion, Vs as stringifyValue, Vt as removeProtectionTypeList, Wa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Wc as uploadCfnTemplate, Wi as malformedOrphanRowsKeptWarning, Wn as refusesFinalSnapshot, Wo as maskSecretsInText, Wr as applyRoleArnIfSet, Ws as createAssetRedirectResolver, Wt as isJournaledOrphan, Xc as derivePartitionAndUrlSuffix, Xi as malformedResourceEntriesWarning, Xn as RollbackInlinePolicyWriters, Xo as isUncertifiedBaselineMaskPosition, Xr as AWS_CREDENTIAL_ENV_KEYS, Xs as ensureAssetStorage, Xt as replacementNeverSwapped, Yc as canonicalizeRegion, Yi as malformedRenderedContainersWarning, Yn as formatDestructiveChange, Yo as dynamicReferenceTokens, Yr as sendableAssumeRoleCommand, Ys as assertAssetBucketRegion, Yt as recordUnderIdIsNotOwn, Zc as AssemblyReader, Zi as malformedResourcePropertiesWarning, Zo as pathCrossesDottedKey, Zr as applyCallerIdentityCredentials, Zs as getBootstrapMarkerKey, Zt as resolveReplacementOldType, _ as makeCanonicalizePropertiesFn, _a as refuseMalformedResourceEntriesForOrphan, _c as redactedDockerCause, _i as isStalePlaceholderArnAttribute, _n as carriedExportAliasExposure, _o as TemplateParser, _r as readsNoEchoDeleteValues, _s as isLockInfoExpired, _t as displacedPhysicalIdShown, a as findNestedTemplateTreeDefect, aa as refuseMalformedOrphanRecordsForDestroy, ac as resolveDockerContextDirectory, al as absoluteAssemblyPathEscape, as as recordMaskOnlyValuesIn, at as gray, ba as refuseMalformedResourcePropertiesForExport, bc as warnFinchArgvExposure, bi as withSharedDrainBudget, bn as isWholeDynamicReferenceValue, bo as maskAtCoordinates, br as withPrintingSecrets, bs as CrossPrefixReadError, bt as nestedChildStackName$1, c as renderNestedTemplateTreeDefect, ca as refuseMalformedOrphansForOrphan, cc as describeDockerFailure, ci as parameterTypeMayLoseSecretIdentity, cl as renderAssemblyPathEscape, cn as updatePartialReason, cs as recordProvenPublicExpression, ct as yellow, d as conditionInputsFrom, da as refuseMalformedResourceAttributesForOrphan, dc as formatDockerLoginError, di as carriesDynamicReference, dl as resolveBucketRegion, dn as WITHHELD_NAME_DISPLAY, do as describeTypeWithThrottleRetry, dr as CC_BROKEN_REASON, ds as STATE_SOURCED_CROSS_GENERATION_RULES, dt as reachableDivergentParameters, ea as malformedStateRefusalMessage, ec as readBootstrapMarkerBody, el as defineOwnKey, en as findNestedStackTypeChanges, er as withCreateTokenLedger, es as recordNestedStackParameterExpressions, f as parentSuppliedValues, fa as refuseMalformedResourceEntries, fc as getDockerCmd, fi as carriesFetchableDynamicReference, fn as displayTextOrWithheld, fo as withRetry, fr as ProviderRegistry, fs as STATE_SOURCED_READBACK_RULES, ft as resourcesNamingDeclaredParameter, g as mergeNoChangeOutputs, ga as refuseMalformedResourceEntriesForImportSave, gc as redactDockerArgvValues, gi as cfnRefValueFromPhysicalId, gn as secretSafeKeyDisplay, go as DagBuilder, gr as TemplateNoEchoReresolver, gs as LockManager, gt as displacedOpClause, h as keptWholeReasonText, ha as refuseMalformedResourceEntriesForImport, hc as partitionSensitiveEnv, hi as AWS_NO_VALUE, hn as secretBearingStateKeyWarning, hr as wouldReturnToSdkProvider, hs as isSingleDynamicReferenceToken, ht as NESTED_PENDING_PARENT_REASON, i as childTemplateLoader, ia as refuseMalformedOrphanRecords, ic as buildDockerImage, il as ownValue, is as recordMaskOnlyValue, it as cyan, j as noEchoParameterNamesOf, ja as repairMalformedResourcesForReadOnly, jc as resolveAutoAssetStorage, ji as hasReadableOrphans, jn as orphanRecordsPrintingBag, jo as liveMatchesUnresolvedTokenFrame, js as hasReasonlessBaselineRefusal, jt as journaledOrphanLines, k as noEchoComparisonForTemplate, ka as repairMalformedResourceEntriesForReadOnly, kc as loadCdkJson, ki as deployRefusesOrphanRowsReason, kn as journaledOrphanPrintingBag, ko as readsNoEchoSource, kr as isWaitAbandonedError, ks as exportNamesCarriedFrom, kt as dropFailedHint, l as templateIdentity, la as refuseMalformedOutputs, lc as dockerSpawnEnvWithSensitive, li as getAccountInfo, ll as resolveAssemblyPath, ln as DeploymentEventsReader, lo as prefetchCreateOnlyPropertyPaths, ls as wholeStringLeavesOf, lt as computeParameterTaint, m as isSecretBearingReferenceString, ma as refuseMalformedResourceEntriesForDestroy, mc as isMalformedEnvKey, mi as keepsSecretReferenceToken, mn as secretBearing, mr as isCustomResource, ms as WHOLE_DYNAMIC_REFERENCE_PATTERN, mt as planOrphanAdoption, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseDivergentRecordRegionForDestroy, nc as validateContainerRepoName, nl as hasPlainPrototype, nn as inheritProducerRegions, ns as carriesSecretMask, nt as createReadOnlyAttributeHealerFactory, o as isAbsoluteAssetPath, oa as refuseMalformedOrphans, oc as describeDockerCapturedOutput, oi as coerceParameterTypedValue, ol as describeFileReadFailure, os as recordNoEchoAttributeValues, ot as green, p as readRecordedConditionVerdicts, pa as refuseMalformedResourceEntriesForDeploy, pc as isDockerClientEnvKey, pi as isNamelessDynamicReferenceError, pn as exportAliasCollisionScrubWarning, pr as ccBrokenReason, ps as TEMPLATE_SOURCED_RULES, pt as makeSiblingClaimReader, qa as renderStatefulReason, qc as expectedOwnerParam, qi as malformedOutputsRefusalMessage, qn as constructPathOf, qo as scrubResourceRecord, qr as explicitRoleArnOrThrow, qs as AssetModeResolver, qt as planRollback, r as computeImplicitDeleteEdges, rc as buildDenyExternalAccessPolicy, rl as nullPrototypeRecord, rs as provenPublicValue, rt as bold, s as listNestedTemplateRows, sa as refuseMalformedOrphansForDestroy, sc as describeDockerExecFailure, si as isUnboundTemplateParameter, sl as displayAssemblyPath, sn as updatePartialMessage, ss as recordNoEchoParameterFreshValue, st as red, t as DeployEngine, ta as previewableOrphanRecords, tc as validateAssetBucketName, tl as hasOwnKey, tt as formatResourceLine, u as conditionFingerprint, ua as refuseMalformedOutputsForDestroy, uc as finchSecretArgvRefusal, ui as isImpossibleEmptyStoredAttribute, un as DeploymentEventsStore, uo as templateResourceTypes, us as STATE_SOURCED_BASELINE_RULES, ut as namesAnyDeclaredParameter, va as refuseMalformedResourcePropertiesForDestroy, vc as runDockerForeground, vi as refStateLookupFromResource, vn as exportNameNoEchoParameters, vo as canonicalCoordinates, vr as isCustomResourceType$1, vs as S3StateBackend, vt as dropSettledNestedJournals, w as deferredServiceTokenWarning, wa as refuseMalformedResourcesForExport, wc as getDockerImageBySourceHash, wi as STATE_REGION_DIVERGED, wn as isExportAliasCollision, wo as noEchoCoordinatesOf, wr as UNSPECIFIED_SKIP_REASON, ws as isAccessDenied, wt as withNestedRevertRun, xa as refuseMalformedResourcePropertiesForOrphan, xc as escapeRegExp, xi as parameterInputsFor, xn as noEchoParameterValueSeed, xo as maskReadbackAtCoordinates, xr as CloudControlProvider, xs as CrossPrefixScanCache, xt as recordDisplacedSkips, ya as refuseMalformedResourcePropertiesForDrift, yc as runDockerStreaming, yn as exportNameSecretExposure, yo as isMarkedCoordinate, ys as rebuildClientForBucketRegion, zc as ssmResolvedValueType, zi as malformedLocalOutputsWarning, zn as buildFinalSnapshotIdentifier, zo as recordLogOnlyValue, zr as IntrinsicFunctionResolver, zs as AssetPublisher } from "./deploy-engine-5FFXg6ih.js";
+import { t as getCdkdVersion } from "./version-D0cK9V1A.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2404,7 +2404,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-eEgFT-Vt.js");
+	providerClasses ??= import("./provider-classes-B7Z4-Zsc.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -4782,6 +4782,9 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		recordLogOnlyParameterValue(diffSecrets, mergedParameters[name]);
 		recordLogOnlyParameterValue(splitPieces, mergedParameters[name], splitDelimiters);
 	}
+	const noEchoJudge = new Map(diffSecrets);
+	carryLogOnlyValues(diffSecrets, noEchoJudge);
+	const stateNames = storedSecretNameNeedles(currentState.resources ?? {}, noEchoJudge, /* @__PURE__ */ new Map(), currentState.outputs);
 	const outputsPassSecrets = /* @__PURE__ */ new Map();
 	const printing = createDiffPrintingMasker([
 		diffSecrets,
@@ -4790,6 +4793,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	], [
 		splitPieces,
 		derivedNames,
+		stateNames,
 		...inheritedDerivedNames ? [inheritedDerivedNames] : []
 	]);
 	const maskForLog = printing.mask;
@@ -4846,6 +4850,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
+			storedSecretNameNeedles(stateForDiff.resources, noEchoJudge, stateNames, currentState.outputs);
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
@@ -4996,6 +5001,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		effectiveTemplate,
 		printingSecrets,
 		derivedNames: diffPrintingSecrets([derivedNames, inheritedDerivedNames]),
+		secretNamedRecords: secretNamedRecordNeedles(stateForDiff.resources, noEchoJudge),
 		resolvedParameters: mergedParameters,
 		conditions,
 		knownConditions: conditions === void 0 ? void 0 : Object.fromEntries(Object.entries(conditions).filter(([name]) => !stillUnknown.includes(name))),
@@ -5234,7 +5240,7 @@ async function buildDiffTree(args) {
 	} finally {
 		createOnlyPrefetch.cancel();
 	}
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals, effectiveTemplate, printingSecrets, derivedNames: nodeDerivedNames, secretNamedRecords: nodeStateNames, resolvedParameters, conditions, knownConditions, trust } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -5285,7 +5291,11 @@ async function buildDiffTree(args) {
 		]), void 0, stateAfterAdoption.resources);
 		const rowDerivedNames = /* @__PURE__ */ new Map();
 		const childParameters = await resolveChildStackParameters(resource, effectiveTemplate, stateAfterAdoption, region, stackName, stateBackend, resolvedParameters, conditions, cfnFallback, printingSecrets, attributeHealer, childUnresolvedParameters, trust, rowDerivedNames);
-		const childDerivedNames = diffPrintingSecrets([inheritedDerivedNames, rowDerivedNames]);
+		const childDerivedNames = diffPrintingSecrets([
+			inheritedDerivedNames,
+			rowDerivedNames,
+			nodeStateNames
+		]);
 		const buildChild = () => buildDiffTree({
 			stackName: childStackName,
 			displayName: childStackName,
@@ -5320,7 +5330,7 @@ async function buildDiffTree(args) {
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery, diffPrintingSecrets([nodeDerivedNames, stateDerivedNames(state.resources ?? {})])));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery, diffPrintingSecrets([nodeDerivedNames, nodeStateNames])));
 	}
 	return node;
 }
@@ -5355,10 +5365,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	return node;
 }
 function stateDerivedNames(resources) {
-	const bag = /* @__PURE__ */ new Map();
-	const needlesOf = stateSecretNameNeedles(resources);
-	for (const logicalId of Object.keys(resources)) for (const needle of needlesOf(logicalId) ?? []) recordLogOnlyValue(bag, needle);
-	return bag;
+	return secretNamedRecordNeedles(resources, void 0);
 }
 const EMPTY_ALLOW_SET = /* @__PURE__ */ new Set();
 function diffReplaces(change, record) {
@@ -11191,6 +11198,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 		retainedCount: 0,
 		skippedCount: 0,
 		guardIndeterminateCount: 0,
+		journaledOrphanSkips: 0,
+		stateDeleted: false,
 		errorCount: 0,
 		interrupted: false
 	};
@@ -11252,6 +11261,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (recheckJournaled > 0) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but its rollback journal now records ${recheckJournaled} resource(s) a failed deploy created — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack ${displayStackName(stackName)} (${displaySafe(regionForState, { asciiOnly: true })}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
+			result.stateDeleted = true;
 			logger.info(`${green("✓")} State deleted`);
 			await Promise.all([recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, [], logger), releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger)]);
 		} finally {
@@ -11344,7 +11354,6 @@ async function runDestroyForStack(stackName, state, ctx) {
 	let heldTail;
 	let stackFinished = false;
 	let journaledOrphanFailures = 0;
-	let journaledOrphanSkips = 0;
 	const lock = await acquireStackLock({
 		...stackLockBase,
 		onFirstSignal: () => {
@@ -11446,7 +11455,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			result.errorCount += orphanOutcome.failures;
 			journaledOrphanFailures = orphanOutcome.failures;
 			result.skippedCount += orphanOutcome.skipped;
-			journaledOrphanSkips = orphanOutcome.skipped;
+			result.journaledOrphanSkips += orphanOutcome.skipped;
 			if (orphanOutcome.handled.length > 0) try {
 				await ctx.stateBackend.dropRollbackJournalFailedOperations(stackName, regionForState, (op, segment) => isHandledOrphan(orphanOutcome.handled, segment, op));
 			} catch (stripError) {
@@ -11590,6 +11599,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
 					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					let deleteResult;
+					let childLeftInAws = 0;
 					const secretPrincipalOptIn = secretPrincipalRegions !== void 0 ? {
 						importedProducerRegions: secretPrincipalRegions,
 						retryMemo: { detached: /* @__PURE__ */ new Set() }
@@ -11599,7 +11609,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 						const noEchoDeleteValues = readsNoEchoDeleteValues(resource.resourceType) ? await ctx.noEchoReresolver?.valuesFor(logicalId, resource) : void 0;
 						let lastDeleteError;
 						for (let attempt = 0; attempt <= maxAttempts; attempt++) try {
-							deleteResult = await runDeleteAttempt(attempt >= maxAttempts, () => withStackRecords(destroyStackRecordsView(state.resources), () => provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
+							const { value: outcome, unaddressed } = await runDeleteAttempt(attempt >= maxAttempts, () => collectNestedChildUnaddressed(() => withStackRecords(destroyStackRecordsView(state.resources), () => provider.delete(logicalId, resource.physicalId, resource.resourceType, resource.properties, {
 								...state.region !== void 0 && { expectedRegion: state.region },
 								...ctx.removeProtection === true && { removeProtection: true },
 								...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
@@ -11611,7 +11621,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 								...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
 								...ctx.noEchoReresolver !== void 0 && { noEchoReresolver: ctx.noEchoReresolver },
 								...ctx.stackDestroy === true && { stackDestroy: true }
-							}))) ?? void 0;
+							}))));
+							deleteResult = outcome ?? void 0;
+							childLeftInAws = unaddressed?.deleteSkipped ?? 0;
 							lastDeleteError = null;
 							break;
 						} catch (retryError) {
@@ -11669,7 +11681,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 						});
 						return;
 					}
-					logger.info(`  ${formatResourceLine("deleted", logicalId, resource.resourceType)}`);
+					const leftInAws = childLeftInAws > 0 ? deleteLeftInPlace(deleteResult) ?? `${childLeftInAws} resource(s) a failed deploy created were left in AWS` : void 0;
+					const deletedLine = leftInAws !== void 0 ? formatResourceLine("skipped", logicalId, resource.resourceType, `deleted (${leftInAws})`) : formatResourceLine("deleted", logicalId, resource.resourceType);
+					logger.info(`  ${deletedLine}`);
+					result.skippedCount += childLeftInAws;
+					result.journaledOrphanSkips += childLeftInAws;
 					result.deletedCount++;
 					recordDestroyEvent(ctx.eventRecorder, {
 						eventType: "RESOURCE_SUCCEEDED",
@@ -11681,6 +11697,16 @@ async function runDestroyForStack(stackName, state, ctx) {
 						...resource.physicalId && { physicalId: resource.physicalId },
 						durationMs: Date.now() - resourceStartedAt
 					});
+					if (leftInAws !== void 0) recordDestroyEvent(ctx.eventRecorder, {
+						eventType: "RESOURCE_SKIPPED",
+						stackName,
+						operation: "DELETE",
+						logicalId,
+						resourceType: resource.resourceType,
+						...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
+						reason: leftInAws,
+						durationMs: Date.now() - resourceStartedAt
+					});
 					delete remainingResources[logicalId];
 					persistStateAfterDelete(logicalId);
 				} catch (error) {
@@ -11739,10 +11765,11 @@ async function runDestroyForStack(stackName, state, ctx) {
 		}
 		result.interrupted = lock.interrupted;
 		await saveChain;
-		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > journaledOrphanSkips;
+		const preserveState = result.errorCount > 0 || result.interrupted || result.skippedCount > result.journaledOrphanSkips;
 		statePreserved = preserveState;
 		if (!preserveState) {
 			await ctx.stateBackend.deleteState(stackName, regionForState);
+			result.stateDeleted = true;
 			logger.debug("State deleted");
 			const writeKept = () => recordRetainedForReadoption(ctx.stateBackend, stackName, regionForState, retainedForReadoption, logger, retainedEarlier);
 			const releaseMarker = () => releaseRegistryMarkerAfterDestroy(ctx, stackName, regionForState, logger);
@@ -11762,7 +11789,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
 			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete` + (journaledOrphanFailures > 0 ? ` (${journaledOrphanFailures} of them recorded only in the rollback journal)` : "") + `. State preserved.`);
-			else logger.warn(`${result.skippedCount} resource(s) skipped — cdkd did not confirm they were deleted, so they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
+			else logger.warn(`${result.skippedCount - result.journaledOrphanSkips} resource(s) skipped — cdkd did not confirm they were deleted, so they may still exist in AWS. State preserved (the records are kept so the resources stay traceable).`);
 		}
 		const retainedSuffix = result.retainedCount > 0 ? `, ${result.retainedCount} retained` : "";
 		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
@@ -11776,9 +11803,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, because it destroyed a nested-stack child, which threads no event recorder." : "The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run." + withheldTargetClause(eventsCommand, "stack", "cdkd events", "This stack's name") + `\nRead them with: ${eventsCommand.command}`;
 			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].map((t) => plainOrDescribed(t, "logical id")).join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
 		}
-		if (journaledOrphanSkips > 0) logger.warn(safeMsg`${journaledOrphanSkips} resource(s) a failed deploy created were left in AWS (each named in a ` + "warning above, which says what to do with it). This stack no longer records them.");
+		if (result.journaledOrphanSkips > 0) logger.warn(safeMsg`${result.journaledOrphanSkips} resource(s) a failed deploy created were left in AWS (each named in a ` + "warning above, which says what to do with it). This stack no longer records them.");
 		if (!preserveState) {
-			const leftInAws = journaledOrphanSkips > 0;
+			const leftInAws = result.journaledOrphanSkips > 0;
 			logger.info(`\n${leftInAws ? yellow("⚠") : green("✓")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} ${leftInAws ? "destroyed, with resources left in AWS" : "destroyed"}`)} (${green(result.deletedCount)} deleted${retainedSuffix}${leftInAws ? skippedSuffix : ""}${guardSuffix}, ${result.errorCount} errors)`);
 		} else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
 		else if (result.errorCount === 0) {
@@ -11843,6 +11870,15 @@ async function scanActiveConsumers(producerStack, producerRegion, ctx) {
 	}))).filter((r) => r !== null).flat();
 }
 
+//#endregion
+//#region src/cli/commands/destroy-skip-message.ts
+function skippedDestroyMessage(totalSkipped, totalOrphanSkips, rerunCommand) {
+	const recordSkips = totalSkipped - totalOrphanSkips;
+	const orphanSentence = `${totalOrphanSkips} resource(s) a failed deploy created were left in AWS, and no state records them any more. The warning naming each says what to do with it.`;
+	if (recordSkips <= 0) return `Destroy finished, but ${orphanSentence}`;
+	return `Destroy skipped ${recordSkips} entr${recordSkips === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run '${rerunCommand}'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.` + (totalOrphanSkips > 0 ? ` Separately, ${orphanSentence}` : "");
+}
+
 //#endregion
 //#region src/cli/commands/destroy.ts
 function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
@@ -12015,6 +12051,7 @@ async function destroyCommand(stackArgs, options) {
 		} else throw new CdkdError("Could not determine which stacks belong to this app. Specify stack names explicitly, or ensure --app / cdk.json is configured.", "DESTROY_NO_STACK_SELECTED", synthError);
 		let totalErrors = 0;
 		let totalSkipped = 0;
+		let totalOrphanSkips = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stoppedEarly = false;
@@ -12207,6 +12244,7 @@ async function destroyCommand(stackArgs, options) {
 				})));
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
+				totalOrphanSkips += result.journaledOrphanSkips;
 				stackInterrupted = result.interrupted;
 				stackCancelled = result.cancelled === true;
 				if (result.interrupted) interrupted = true;
@@ -12242,7 +12280,7 @@ async function destroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack> --stack-region <region>' removes the stack's state in that region (every resource's record) without deleting AWS resources.`);
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd destroy' to finish.`);
-		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
+		if (totalSkipped > 0) throw new PartialFailureError(skippedDestroyMessage(totalSkipped, totalOrphanSkips, "cdkd destroy"));
 	} finally {
 		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
@@ -17342,6 +17380,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		logger.info(safeMsg`Found ${stackNames.length} stack(s) to destroy: ${stackNames.map(listedStackName).join(", ")}`);
 		let totalErrors = 0;
 		let totalSkipped = 0;
+		let totalOrphanSkips = 0;
 		let interrupted = false;
 		const runInterrupted = () => interrupted || interruptWatch.interrupted();
 		let stoppedEarly = false;
@@ -17450,6 +17489,7 @@ async function stateDestroyCommand(stackArgs, options) {
 				}
 				totalErrors += result.errorCount;
 				totalSkipped += result.skippedCount;
+				totalOrphanSkips += result.journaledOrphanSkips;
 				if (result.interrupted) interrupted = true;
 				if (runInterrupted()) {
 					if (refIndex < targets.length - 1) stoppedEarly = true;
@@ -17463,7 +17503,7 @@ async function stateDestroyCommand(stackArgs, options) {
 		}
 		if (totalErrors > 0) throw new PartialFailureError(`Destroy completed with ${totalErrors} resource error(s). State preserved — inspect 'cdkd state show <stack>' and re-run 'cdkd state destroy' to retry. If the same resource keeps failing, 'cdkd state orphan <stack> --stack-region <region>' removes the stack's state in that region (every resource's record) without deleting AWS resources.`);
 		if (interrupted || interruptWatch.interrupted() && stoppedEarly) throw new PartialFailureError(`Destroy interrupted by Ctrl-C. State preserved — re-run 'cdkd state destroy' to finish.`);
-		if (totalSkipped > 0) throw new PartialFailureError(`Destroy skipped ${totalSkipped} entr${totalSkipped === 1 ? "y" : "ies"} whose delete cdkd did not confirm, so the underlying resources may still exist in AWS. A skipped nested stack counts as ONE entry and may cover several of its own resources — the per-stack summaries above give the exact breakdown. State preserved (the records are kept). The per-resource 'skipped (...)' lines and their warnings name each cause and whether repairing the record in state.json helps: where it does, repair it and re-run 'cdkd state destroy'; otherwise (for example a custom-resource Delete handler that reported FAILED), delete the resources by hand and drop the records with 'cdkd state orphan <stack> --stack-region <region>'.`);
+		if (totalSkipped > 0) throw new PartialFailureError(skippedDestroyMessage(totalSkipped, totalOrphanSkips, "cdkd state destroy"));
 	} finally {
 		await Promise.allSettled(deferredTails);
 		unforwardSigterm();
@@ -28249,4 +28289,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CN7Dqb3j.js.map
+//# sourceMappingURL=program-Db1eBDeq.js.map