@cdkd/cli 0.0.1 → 0.324.0

package/dist/created-resource-sink-CmrPwGge.js

@@ -0,0 +1,2343 @@
+import { r as getAwsClients } from "./aws-clients-DWpHZk2l.js";
+import { $ as safeMsg, H as STACK_REF_MAX_CODE_POINTS, J as displaySafe, K as displayAwsMessage, Q as plainIdentOr, U as UNRENDERABLE, V as SECRET_REF_MAX_CODE_POINTS, X as isPasteableIdent, Y as displayStackName, Z as isPlainIdent, a as safeStringify, i as isAwsAuthoredFailure, k as getCurrentStackName, n as describeAwsFailure, nt as truncateCodePoints, q as displayIdent, s as getLogger, t as VERBOSE_POINTER } from "./aws-failure-text-DiHodi76.js";
+import { c as ambientRegion, n as awsClientDefaults, r as getAssumedRoleCredentials } from "./aws-client-defaults-BLXFsfMa.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/deployment/retryable-errors/patterns.ts
+const IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"is unable to assume the role",
+	"security token included in the request is invalid. (Service:",
+	"Received Exception while reading from provided stream. The security token included in the request is invalid",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"Invalid principal in policy",
+	"Verify in IAM that the role has adequate trust relationships",
+	"The user with name",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"The operator role is invalid or doesn't have sufficient permissions",
+	"doesn't have permission to perform ec2:DescribeSecurityGroups",
+	"One or more security group IDs are invalid",
+	"permissions required to assume the role",
+	"does not have a trust relationship allowing",
+	"authorized to assume the provided role",
+	"not authorized to access the Log Destination",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"is not a valid role to allow SNS",
+	"Could not assume the infrastructure role",
+	"AWS was not able to validate the provided access credentials (Service: Ecs,"
+];
+const OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS = [
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"scheduled for deletion",
+	"Could not deliver test message",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded",
+	"is marked disabled for mutation",
+	"There is an operation running on the Cluster",
+	"Unable to complete operation due to concurrent modification"
+];
+const NAME_COOLDOWN_ERROR_MESSAGE_PATTERNS = [
+	"QueueDeletedRecently",
+	"wait 60 seconds",
+	"StateMachineDeleting",
+	"State Machine is being deleted",
+	"conflicting conditional operation"
+];
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	...IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS,
+	...OTHER_TRANSIENT_ERROR_MESSAGE_PATTERNS,
+	...NAME_COOLDOWN_ERROR_MESSAGE_PATTERNS
+];
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+
+// src/deployment/retryable-errors/marks.ts
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+const REDACTED_CAUSE_MARKER = Symbol.for("cdkd.redactedCause");
+function markRedactedCause(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, REDACTED_CAUSE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+function wrapMaskedAwsError(mask, error, build) {
+	const raw = describeAwsFailure(error).detail;
+	const masked = mask(raw);
+	const wrapped = build(masked);
+	return masked === raw ? wrapped : markRedactedCause(wrapped);
+}
+function hasRedactedCause(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[REDACTED_CAUSE_MARKER] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+function markNonRetryable(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, NON_RETRYABLE_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+function isMarkedNonRetryable(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current[NON_RETRYABLE_MARKER] === true) return true;
+		}
+		current = current.cause;
+	}
+	return false;
+}
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+
+// src/deployment/retryable-errors/transient.ts
+const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
+	500,
+	502,
+	503,
+	504
+]);
+function isTransientServerError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+const AMBIGUOUS_SOCKET_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"EPIPE",
+	"ETIMEDOUT",
+	"EADDRNOTAVAIL"
+]);
+const AMBIGUOUS_CC_HANDLER_ERROR_CODES = /* @__PURE__ */ new Set([
+	"InternalFailure",
+	"HandlerInternalFailure",
+	"ServiceInternalError",
+	"NetworkFailure",
+	"NotStabilized",
+	"ServiceTimeout",
+	"GeneralServiceException",
+	"Throttling"
+]);
+function isAmbiguousCcHandlerErrorCode(code) {
+	return code !== void 0 && AMBIGUOUS_CC_HANDLER_ERROR_CODES.has(code);
+}
+function isAmbiguousOutcomeError(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 5 && typeof current === "object" && current !== null; depth++) {
+			const link = current;
+			if (typeof link.name === "string" && THROTTLING_ERROR_NAMES.has(link.name)) return false;
+			if (link.$retryable?.throttling === true) return false;
+			const status = link.$metadata?.httpStatusCode;
+			if (typeof status === "number" && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
+			if (typeof link.code === "string" && AMBIGUOUS_SOCKET_ERROR_CODES.has(link.code)) return true;
+			if (link.name === "TimeoutError") return true;
+			if (typeof link.ccErrorCode === "string" && AMBIGUOUS_CC_HANDLER_ERROR_CODES.has(link.ccErrorCode)) return true;
+			current = link.cause;
+		}
+	} catch {}
+	return false;
+}
+function describeRetryClassificationSignals(error) {
+	let current = error;
+	let deepestName;
+	let sawMetadata = false;
+	let metadataName;
+	let metadataRequestId;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
+		const metadata = current.$metadata;
+		if (metadata != null && typeof metadata === "object" && !Array.isArray(metadata)) {
+			const { httpStatusCode, requestId } = metadata;
+			const linkName = typeof name === "string" && name !== "" ? name : void 0;
+			if (!sawMetadata) {
+				sawMetadata = true;
+				metadataName = linkName;
+				metadataRequestId = typeof requestId === "string" && requestId !== "" ? requestId : void 0;
+			}
+			if (typeof httpStatusCode === "number") return {
+				name: linkName ?? deepestName,
+				httpStatusCode,
+				requestId: (typeof requestId === "string" && requestId !== "" ? requestId : void 0) ?? metadataRequestId,
+				noMetadata: false
+			};
+		}
+		current = current.cause;
+	}
+	return {
+		name: metadataName ?? deepestName,
+		requestId: metadataRequestId,
+		noMetadata: !sawMetadata
+	};
+}
+function formatRetryClassificationSignals(error) {
+	const signals = describeRetryClassificationSignals(error);
+	if (signals.name === void 0 && signals.httpStatusCode === void 0 && signals.requestId === void 0) return "";
+	const parts = [];
+	if (signals.name !== void 0) parts.push(`name=${signals.name}`);
+	if (signals.httpStatusCode !== void 0) parts.push(`http=${signals.httpStatusCode}`);
+	if (signals.requestId !== void 0) parts.push(`requestId=${signals.requestId}`);
+	if (signals.noMetadata) parts.push("no-$metadata");
+	return ` [${parts.join(" ")}]`;
+}
+function isRetryableTransientError(error, message) {
+	if (isMarkedNonRetryable(error)) return false;
+	if (isExplicitDenyError(message)) return false;
+	if (isThrottlingError(error)) return true;
+	if (isTransientServerError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+function retryClassificationText(error) {
+	const top = describeAwsFailure(error).detail;
+	if (!hasRedactedCause(error)) return top;
+	const parts = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null && !seen.has(current); depth++) {
+		seen.add(current);
+		if (current instanceof Error) {
+			if (current.message) parts.push(current.message);
+		} else try {
+			parts.push(String(current));
+		} catch {}
+		current = current?.cause;
+	}
+	return parts.join("\n");
+}
+function isIamPropagationError(message) {
+	if (isExplicitDenyError(message)) return false;
+	return IAM_PROPAGATION_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+const EXPLICIT_DENY_PHRASE = "with an explicit deny";
+const EXPLICIT_DENY_POLICY_KINDS = [
+	"service control policy",
+	"resource control policy",
+	"identity-based policy",
+	"resource-based policy",
+	"permissions boundary",
+	"session policy",
+	"VPC endpoint policy",
+	"role trust policy"
+];
+function isExplicitDenyError(message) {
+	return message.includes(EXPLICIT_DENY_PHRASE);
+}
+function explicitDenyPolicyKind(message) {
+	const at = message.indexOf(EXPLICIT_DENY_PHRASE);
+	if (at < 0) return void 0;
+	const rest = message.slice(at + 21);
+	const article = /^ in (?:a|an|the) /.exec(rest);
+	if (article === null) return void 0;
+	const tail = rest.slice(article[0].length);
+	return EXPLICIT_DENY_POLICY_KINDS.find((kind) => tail.startsWith(kind));
+}
+
+// src/utils/regexp.ts
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+function stripForDisplay(value) {
+	return displaySafe(stripControlChars(value));
+}
+
+// src/deployment/retryable-errors/name-collision.ts
+const ALREADY_EXISTS_CODE = /(?<![-:/])\b[A-Za-z0-9]*AlreadyExists(?:Exception|Fault)?\b(?!-)/;
+function isNameCollisionError(message) {
+	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || ALREADY_EXISTS_CODE.test(message);
+}
+function relayedNameCollision(withheldText) {
+	return isNameCollisionError(withheldText) ? " AWS reports that it already exists." : "";
+}
+const NAME_COLLISION_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"DuplicateTargetGroupNameException",
+	"DuplicateLoadBalancerNameException",
+	"DuplicateTrustStoreNameException"
+]);
+const NAME_COLLISION_MARKER = Symbol.for("cdkd.nameCollision");
+function markNameCollision(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, NAME_COLLISION_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true
+	});
+	return error;
+}
+const REPLAY_MAY_COLLIDE_MARKER = Symbol.for("cdkd.replayMayCollide");
+function markReplayMayCollide(error) {
+	try {
+		if (typeof error !== "object" && typeof error !== "function" || error === null || !Object.isExtensible(error)) return error;
+		Object.defineProperty(error, REPLAY_MAY_COLLIDE_MARKER, {
+			value: true,
+			enumerable: false,
+			configurable: true,
+			writable: false
+		});
+	} catch {}
+	return error;
+}
+function hasReplayMayCollide(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 5 && (typeof current === "object" || typeof current === "function") && current !== null; depth++) {
+			if (Object.getOwnPropertyDescriptor(current, REPLAY_MAY_COLLIDE_MARKER)?.value === true) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+function isNameCollisionErrorFrom(error, logicalId) {
+	if (hasReplayMayCollide(error)) return false;
+	return relaysNameCollision(error, logicalId, () => false);
+}
+function isReplayedNameCollisionFrom(error, logicalId, isRetryAnchor) {
+	if (!hasReplayMayCollide(error)) return false;
+	return relaysNameCollision(error, logicalId, isRetryAnchor);
+}
+function relaysNameCollision(error, logicalId, isRetryAnchor) {
+	const topRelaysIt = error instanceof Error && typeof error.message === "string" && isNameCollisionError(error.message);
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const link = current;
+		if (typeof link.logicalId === "string" && link.logicalId !== logicalId && !isRetryAnchor(current)) return false;
+		if (typeof link.name === "string" && NAME_COLLISION_ERROR_NAMES.has(link.name)) return true;
+		if (link.ccErrorCode === "AlreadyExists") return true;
+		if (link[NAME_COLLISION_MARKER] === true) return true;
+		if (topRelaysIt && current instanceof Error && isAwsAuthoredFailure(current) && typeof link.message === "string" && isNameCollisionError(link.message)) return true;
+		current = link.cause;
+	}
+	return false;
+}
+function isNameCooldownError(message) {
+	return NAME_COOLDOWN_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
+}
+const REDACTED_ALREADY_EXISTS_CLASS = new RegExp(`\\b[A-Za-z0-9]*AlreadyExists(?:Exception|Fault)?(?=\\. ${escapeRegExp(VERBOSE_POINTER)})`, "g");
+function isRecreateRetryableError(message, error) {
+	return isNameCollisionError(error !== void 0 && hasRedactedCause(error) ? message.replace(REDACTED_ALREADY_EXISTS_CLASS, "") : message) || isNameCooldownError(message);
+}
+
+// src/deployment/retryable-errors/update-unsupported.ts
+const CC_UNSUPPORTED_ACTION_ERROR_NAME = "UnsupportedActionException";
+function isUpdateUnsupportedError(error, logicalId) {
+	if (error?.name === "ResourceUpdateNotSupportedError") return false;
+	let current = error;
+	for (let depth = 0; current !== null && current !== void 0 && depth < 5; depth++) {
+		const link = current;
+		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
+		if (link.name === "UnsupportedActionException") return true;
+		if (link.ccErrorCode === "UnsupportedActionException" && link.ccOperation === "UPDATE") return true;
+		current = link.cause;
+	}
+	return false;
+}
+
+// src/utils/pasteable-run-context.ts
+let runFlags = {};
+let verbFlags;
+function setPasteableRunFlags(flags) {
+	runFlags = { ...flags };
+}
+function pasteableRunFlags() {
+	return runFlags;
+}
+function setPasteableVerbFlags(map) {
+	verbFlags = map;
+}
+function pasteableVerbFlags(verb) {
+	return verbFlags?.get(verb);
+}
+
+// src/utils/pasteable-command.ts
+const SHELL_ACTIVE = /[\s'"`$;&|<>()*?[\]{}!#~\\^=%,]/;
+const PASTE_ARG_UNSAFE = /[\s'"`$;&|<>()\\*?[\]{}!]|^[#=]|(?:^|[=:])~/;
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+const CLAUSE_BREAK = /: | -- | — |[.!?]\s/;
+function hasClauseBreak(text) {
+	return CLAUSE_BREAK.test(text);
+}
+const UNSHOWABLE_VALUE = "a value that cannot be shown safely here";
+function shellBoundedDisplay(shown) {
+	if (hasClauseBreak(shown)) return UNSHOWABLE_VALUE;
+	return shown.startsWith("\"") || shown === "<unrenderable>" ? shellQuote(shown) : shown;
+}
+function commandHole(name) {
+	return `'<${name}>'`;
+}
+const SHELL_ACTIVE_WHY = "holds whitespace or a character a shell treats specially, and only a value that stays inert without its quotes is named in a command here, since text pasted before the command can undo the quotes and leave it to run as shell";
+function plainOrDescribed(value, what) {
+	return isPasteableIdent(value) ? value : `a ${what} that is not a plain identifier`;
+}
+function quotedOrDescribed(value, what) {
+	return isPasteableIdent(value) ? `'${value}'` : plainOrDescribed(value, what);
+}
+function physicalIdShownBesideCommand(value, opts) {
+	if (typeof value !== "string" || value.startsWith("-")) return void 0;
+	const plain = (text) => isInertUnquoted(text) && displayIdent(text, { maxCodePoints: 613 }) === text;
+	if (plain(value)) return value;
+	const token = opts?.maskToken;
+	if (token === void 0 || token === "" || !value.includes(token)) return void 0;
+	const rendered = displayIdent(value, { maxCodePoints: 613 });
+	return value.split(token).every((part) => part === "" || plain(part)) && rendered === JSON.stringify(value) ? rendered : void 0;
+}
+function isInertUnquoted(value) {
+	return !PASTE_ARG_UNSAFE.test(value);
+}
+function withholdReason(value, opts) {
+	if (value === "") return "empty";
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (safe !== value) return "altered";
+	const cap = opts?.maxCodePoints !== void 0 && Number.isFinite(opts.maxCodePoints) ? Math.max(1, opts.maxCodePoints) : STACK_REF_MAX_CODE_POINTS;
+	if (truncateCodePoints(safe, cap).truncated) return "too-long";
+	if (value.startsWith("-")) return "option-shaped";
+	if (opts?.patternMatched === true && (value.includes("*") || value.includes("/"))) return "pattern-shaped";
+	if (opts?.plainIdent === true) return isPasteableIdent(value) ? void 0 : "not-plain";
+	if (!isInertUnquoted(value)) return "shell-active";
+}
+function pasteableCommand(verb, args = [], extraFlags = []) {
+	let exact = true;
+	const withheld = [];
+	const parts = [verb];
+	for (const arg of args) {
+		if ("literal" in arg) {
+			parts.push(arg.literal);
+			continue;
+		}
+		if (!("value" in arg)) {
+			if ("flag" in arg) parts.push(arg.flag);
+			parts.push(commandHole(arg.hole));
+			exact = false;
+			continue;
+		}
+		const reason = withholdReason(arg.value, arg.opts);
+		let rendered;
+		if (reason === void 0) rendered = shellQuote(arg.value);
+		else {
+			rendered = commandHole(arg.hole);
+			exact = false;
+			withheld.push({
+				hole: arg.hole,
+				reason
+			});
+		}
+		if ("flag" in arg) parts.push(arg.flag);
+		parts.push(rendered);
+	}
+	parts.push(...extraFlags);
+	parts.push(...runFlagWords(verb, args, extraFlags));
+	return {
+		command: parts.join(" "),
+		exact,
+		withheld
+	};
+}
+function runFlagWords(verb, args, extraFlags) {
+	const accepted = pasteableVerbFlags(verb);
+	if (accepted === void 0) return [];
+	const present = /* @__PURE__ */ new Set();
+	for (const arg of args) if ("flag" in arg) present.add(arg.flag);
+	else if ("literal" in arg) present.add(arg.literal.split(" ")[0]);
+	for (const f of extraFlags) present.add(f.split(" ")[0]);
+	const run = pasteableRunFlags();
+	const out = [];
+	const add = (flag, value, hole, allowEmpty) => {
+		if (value === void 0 || value === "" && !allowEmpty) return;
+		if (!accepted.has(flag) || present.has(flag)) return;
+		const inert = displaySafe(value) === value && !value.startsWith("-") && !SHELL_ACTIVE.test(value) && !/\p{Cf}/u.test(value) && !truncateCodePoints(value, 1152).truncated;
+		out.push(`${flag} ${value === "" || inert ? shellQuote(value) : commandHole(hole)}`);
+	};
+	add("--profile", run.profile, "profile", false);
+	add("--state-bucket", run.stateBucket, "bucket", false);
+	add("--state-prefix", run.statePrefix, "prefix", true);
+	if (run.roleArn === true && accepted.has("--role-arn") && !present.has("--role-arn")) out.push(`--role-arn ${commandHole("role-arn")}`);
+	return out;
+}
+function withheldTargetClause(built, hole, verb, subject = "This record's name") {
+	const reason = built.withheld.find((w) => w.hole === hole)?.reason;
+	if (reason === void 0) return "";
+	let why;
+	switch (reason) {
+		case "altered":
+			why = `does NOT render exactly, so another record may render identically`;
+			break;
+		case "empty":
+			why = `is empty`;
+			break;
+		case "too-long":
+			why = `is too long to print`;
+			break;
+		case "option-shaped":
+			why = `begins with a '-', so it is not safe to print as an argument to '${verb}' — a name like '--all' is parsed as the FLAG and targets every stack`;
+			break;
+		case "pattern-shaped":
+			why = `would be read as a PATTERN by '${verb}', which can match other stacks`;
+			break;
+		case "shell-active":
+			why = SHELL_ACTIVE_WHY;
+			break;
+		case "not-plain":
+			why = "is not a plain identifier (a letter or digit, then letters, digits, '~', '_', '.' or '-'), the only shape named in a command here, since a name outside it can run as shell or read as a line of this message once the terminal wraps";
+			break;
+		default: throw new Error(`withheldTargetClause: unhandled WithholdReason ${String(reason)}`);
+	}
+	return ` ${subject} ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
+}
+
+// src/utils/resource-type-shape.ts
+const TIMEOUT_FLAG_RESOURCE_TYPE = /^[A-Z][A-Za-z0-9]+::[A-Z][A-Za-z0-9]+::[A-Z][A-Za-z0-9]+$/;
+const RESOURCE_TYPE_MAX_LENGTH = 204;
+const RESOURCE_TYPE_SHAPE$1 = /^(?:[A-Z][A-Za-z0-9]+(?:::[A-Z][A-Za-z0-9]+)+|Custom::[A-Za-z0-9_@-]+)$/;
+function hasResourceTypeShape(value) {
+	return value.length <= 204 && RESOURCE_TYPE_SHAPE$1.test(value);
+}
+
+// src/utils/error-handler.ts
+var CdkdError = class CdkdError extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.code = code;
+		this.cause = cause;
+		this.name = "CdkdError";
+		Object.setPrototypeOf(this, CdkdError.prototype);
+	}
+};
+var AccountIdUnavailableError = class AccountIdUnavailableError extends CdkdError {
+	constructor(message) {
+		super(message, "ACCOUNT_ID_UNAVAILABLE");
+		this.name = "AccountIdUnavailableError";
+		Object.setPrototypeOf(this, AccountIdUnavailableError.prototype);
+	}
+};
+var StateError = class StateError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "STATE_ERROR", cause);
+		this.name = "StateError";
+		Object.setPrototypeOf(this, StateError.prototype);
+	}
+};
+var LockError = class LockError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCK_ERROR", cause);
+		this.name = "LockError";
+		Object.setPrototypeOf(this, LockError.prototype);
+	}
+};
+var SynthesisError = class SynthesisError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "SYNTHESIS_ERROR", cause);
+		this.name = "SynthesisError";
+		Object.setPrototypeOf(this, SynthesisError.prototype);
+	}
+};
+var DeployCancelledError = class DeployCancelledError extends CdkdError {
+	constructor(message = "Deployment cancelled by user") {
+		super(message, "DEPLOY_CANCELLED");
+		this.name = "DeployCancelledError";
+		Object.setPrototypeOf(this, DeployCancelledError.prototype);
+	}
+};
+var DeploymentNotApprovedError = class DeploymentNotApprovedError extends CdkdError {
+	softAbort = true;
+	constructor(message) {
+		super(message, "DEPLOY_NOT_APPROVED");
+		this.name = "DeploymentNotApprovedError";
+		Object.setPrototypeOf(this, DeploymentNotApprovedError.prototype);
+	}
+};
+function isSoftAbort(error) {
+	return error instanceof Error && error.softAbort === true;
+}
+var AssetError = class AssetError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "ASSET_ERROR", cause);
+		this.name = "AssetError";
+		Object.setPrototypeOf(this, AssetError.prototype);
+	}
+};
+var LocalInvokeBuildError = class LocalInvokeBuildError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_INVOKE_BUILD_ERROR", cause);
+		this.name = "LocalInvokeBuildError";
+		Object.setPrototypeOf(this, LocalInvokeBuildError.prototype);
+	}
+};
+var ProvisioningError = class ProvisioningError extends CdkdError {
+	resourceType;
+	logicalId;
+	physicalId;
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, "PROVISIONING_ERROR", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.physicalId = physicalId;
+		this.name = "ProvisioningError";
+		Object.setPrototypeOf(this, ProvisioningError.prototype);
+	}
+};
+var ResourceTimeoutError = class ResourceTimeoutError extends CdkdError {
+	logicalId;
+	resourceType;
+	region;
+	elapsedMs;
+	operation;
+	timeoutMs;
+	constructor(logicalId, resourceType, region, elapsedMs, operation, timeoutMs) {
+		const elapsedLabel = formatDuration$1(elapsedMs);
+		const timeoutLabel = formatDuration$1(timeoutMs);
+		const shownId = plainOrDescribed(logicalId, "logical id");
+		const shownType = hasResourceTypeShape(resourceType) ? resourceType : "a resource type that is not printable as typed";
+		const remedy = hasResourceTypeShape(resourceType) && TIMEOUT_FLAG_RESOURCE_TYPE.test(resourceType) ? safeMsg`slow ENI provisioning. Re-run with --resource-timeout ${resourceType}='<DURATION>'\n` + "to bump the budget for this resource type only, or --verbose to see the\n" : "slow ENI provisioning. Re-run with a larger --resource-timeout '<DURATION>',\nor --verbose to see the\n";
+		super(safeMsg`Resource ${shownId} (${shownType}) in ${region} timed out after ${timeoutLabel} during ${operation} (elapsed ${elapsedLabel}).\n` + "This may indicate a stuck Cloud Control polling loop, hung Custom Resource, or\n" + remedy + "underlying provider activity.", "RESOURCE_TIMEOUT");
+		this.logicalId = logicalId;
+		this.resourceType = resourceType;
+		this.region = region;
+		this.elapsedMs = elapsedMs;
+		this.operation = operation;
+		this.timeoutMs = timeoutMs;
+		this.name = "ResourceTimeoutError";
+		Object.setPrototypeOf(this, ResourceTimeoutError.prototype);
+	}
+};
+function formatDuration$1(ms) {
+	if (ms < 6e4) return `${Math.round(ms / 1e3)}s`;
+	const totalMinutes = Math.round(ms / 6e4);
+	if (totalMinutes < 60) return `${totalMinutes}m`;
+	const hours = Math.floor(totalMinutes / 60);
+	const minutes = totalMinutes % 60;
+	return minutes === 0 ? `${hours}h` : `${hours}h${minutes}m`;
+}
+var IntrinsicResolutionRefusalError = class IntrinsicResolutionRefusalError extends CdkdError {
+	constructor(message, cause, code = "INTRINSIC_RESOLUTION_REFUSAL") {
+		super(message, code, cause);
+		this.name = "IntrinsicResolutionRefusalError";
+		Object.setPrototypeOf(this, IntrinsicResolutionRefusalError.prototype);
+	}
+};
+var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_CROSS_ACCOUNT_SECRET");
+		this.name = "CrossAccountSecretRefusalError";
+		Object.setPrototypeOf(this, CrossAccountSecretRefusalError.prototype);
+	}
+};
+var MalformedProducerRecordRefusalError = class MalformedProducerRecordRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_MALFORMED_PRODUCER_RECORD");
+		this.name = "MalformedProducerRecordRefusalError";
+		Object.setPrototypeOf(this, MalformedProducerRecordRefusalError.prototype);
+	}
+};
+var DynamicReferenceRegionAmbiguousError = class DynamicReferenceRegionAmbiguousError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "DYNAMIC_REFERENCE_REGION_AMBIGUOUS");
+		this.name = "DynamicReferenceRegionAmbiguousError";
+		Object.setPrototypeOf(this, DynamicReferenceRegionAmbiguousError.prototype);
+	}
+};
+var DependencyError = class DependencyError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "DEPENDENCY_ERROR", cause);
+		this.name = "DependencyError";
+		Object.setPrototypeOf(this, DependencyError.prototype);
+	}
+};
+var ConfigError = class ConfigError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "CONFIG_ERROR", cause);
+		this.name = "ConfigError";
+		Object.setPrototypeOf(this, ConfigError.prototype);
+	}
+};
+var PartialFailureError = class PartialFailureError extends CdkdError {
+	exitCode = 2;
+	constructor(message, cause) {
+		super(message, "PARTIAL_FAILURE", cause);
+		this.name = "PartialFailureError";
+		Object.setPrototypeOf(this, PartialFailureError.prototype);
+	}
+};
+var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError extends CdkdError {
+	exitCode = 2;
+	resourceType;
+	logicalId;
+	suggestion;
+	constructor(resourceType, logicalId, suggestion, cause) {
+		super(`${resourceType} (${logicalId}) cannot be updated in place: ${suggestion ? suggestion : "use cdkd deploy with --replace, or change the resource definition to create a new version"}.`, "RESOURCE_UPDATE_NOT_SUPPORTED", cause);
+		this.resourceType = resourceType;
+		this.logicalId = logicalId;
+		this.suggestion = suggestion;
+		this.name = "ResourceUpdateNotSupportedError";
+		Object.setPrototypeOf(this, ResourceUpdateNotSupportedError.prototype);
+		markNonRetryable(this);
+	}
+};
+var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
+	stackName;
+	constructor(stackName, cause, account, recorded) {
+		if (recorded !== void 0) {
+			const { command, root, stackRegion } = recorded;
+			const bypass = pasteableCommand(command, [
+				{
+					value: stackName,
+					hole: "stack",
+					opts: {
+						plainIdent: true,
+						...command === "cdkd destroy" && { patternMatched: true }
+					}
+				},
+				...stackRegion !== void 0 && command === "cdkd state destroy" ? [{
+					flag: "--stack-region",
+					value: stackRegion,
+					hole: "region",
+					opts: { plainIdent: true }
+				}] : [],
+				{ literal: "--remove-protection" },
+				...account?.args ?? []
+			]);
+			super((root === void 0 ? `Stack ${quotedOrDescribed(stackName, "stack name")} was last deployed with terminationProtection: true and cannot be destroyed.` : `Stack ${quotedOrDescribed(stackName, "stack name")} is nested under ${quotedOrDescribed(root, "stack name")}, which was last deployed with terminationProtection: true, so it cannot be destroyed.`) + (command === "cdkd destroy" ? ` Redeploy it with the protection off, or pass --remove-protection to destroy it anyway;` : ` To destroy it anyway, pass --remove-protection;`) + ` the flag also turns off the deletion protection of each resource it deletes.` + withheldTargetClause(bypass, "stack", command, "This stack's name") + (account?.clause ? ` ${account.clause.trimEnd()}` : "") + `\nDestroy it with: ${bypass.command}`, "STACK_TERMINATION_PROTECTION", cause);
+			this.stackName = stackName;
+			this.name = "StackTerminationProtectionError";
+			Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
+			return;
+		}
+		const retry = pasteableCommand("cdkd destroy", [{
+			value: stackName,
+			hole: "stack",
+			opts: {
+				patternMatched: true,
+				plainIdent: true
+			}
+		}, ...account?.args ?? []]);
+		super(`Stack ${quotedOrDescribed(stackName, "stack name")} has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry the destroy.` + withheldTargetClause(retry, "stack", "cdkd destroy", "This stack's name") + (account?.clause ? ` ${account.clause.trimEnd()}` : "") + `\nRetry with: ${retry.command}`, "STACK_TERMINATION_PROTECTION", cause);
+		this.stackName = stackName;
+		this.name = "StackTerminationProtectionError";
+		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
+	}
+};
+var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyError extends CdkdError {
+	stackName;
+	parentStack;
+	parentLogicalId;
+	constructor(stackName, parentStack, parentLogicalId, cause, account) {
+		const accountArgs = account?.args ?? [];
+		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${plainOrDescribed(parentLogicalId, "logical id")})` : "";
+		const cascade = pasteableCommand("cdkd destroy", [{
+			value: parentStack,
+			hole: "parent",
+			opts: {
+				patternMatched: true,
+				plainIdent: true
+			}
+		}, ...accountArgs]);
+		const childDestroy = pasteableCommand("cdkd state destroy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { plainIdent: true }
+		}, ...accountArgs]);
+		const withheld = withheldTargetClause(cascade, "parent", "cdkd destroy", "The parent stack's name") + withheldTargetClause(childDestroy, "stack", "cdkd state destroy", "The child stack's name") + (account?.clause ? ` ${account.clause.trimEnd()}` : "");
+		const child = quotedOrDescribed(stackName, "stack name");
+		const parent = quotedOrDescribed(parentStack, "stack name");
+		super(`Stack ${child} is a nested child of ${parent}${logicalIdSuffix}; directly destroying a nested stack is not supported. Either cascade-delete this child along with its parent, or destroy the child on its own — which deletes its AWS resources and its record, and leaves the parent's reference dangling (the synth-free escape hatch).${withheld}\nCascade-delete with: ${cascade.command}\nDestroy the child alone with: ${childDestroy.command}`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
+		this.stackName = stackName;
+		this.parentStack = parentStack;
+		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
+		this.name = "NestedStackChildDirectDestroyError";
+		Object.setPrototypeOf(this, NestedStackChildDirectDestroyError.prototype);
+	}
+};
+function exportNamePhrase(exportName) {
+	const shown = plainIdentOr(exportName, "");
+	return shown ? `export '${shown}'` : "an export whose name is not a plain identifier";
+}
+var StackHasActiveImportsError = class StackHasActiveImportsError extends CdkdError {
+	exitCode = 2;
+	producerStack;
+	producerRegion;
+	consumers;
+	constructor(producerStack, producerRegion, consumers, cause) {
+		const lines = consumers.map((c) => `  - ${plainOrDescribed(c.consumerStack, "stack name")} (${plainOrDescribed(c.consumerRegion, "region")}): imports ${exportNamePhrase(c.exportName)}`);
+		super(`Cannot destroy stack ${quotedOrDescribed(producerStack, "stack name")} (${plainOrDescribed(producerRegion, "region")}): the following stacks still import its outputs via Fn::ImportValue:\n${lines.join("\n")}\n\nThis matches CloudFormation's strong-reference semantics — exports are\nprotected as long as a consumer references them.\n\nTo proceed:\n  1. Destroy the consumer first: cdkd destroy <consumer-stack>\n  2. Or remove the Fn::ImportValue from the consumer's template\n     (e.g. inline the value, or refactor) and re-deploy the consumer,\n     then retry this destroy.\n\nNote: cdkd's Fn::GetStackOutput intrinsic is a weak alternative that\ndoes NOT protect the producer — use it when you intentionally want\nthe producer to be deletable independently of consumers.`, "STACK_HAS_ACTIVE_IMPORTS", cause);
+		this.producerStack = producerStack;
+		this.producerRegion = producerRegion;
+		this.consumers = consumers;
+		this.name = "StackHasActiveImportsError";
+		Object.setPrototypeOf(this, StackHasActiveImportsError.prototype);
+	}
+};
+var LocalStartServiceError = class LocalStartServiceError extends CdkdError {
+	constructor(message, cause) {
+		super(message, "LOCAL_START_SERVICE_ERROR", cause);
+		this.name = "LocalStartServiceError";
+		Object.setPrototypeOf(this, LocalStartServiceError.prototype);
+	}
+};
+var MacroExpansionError = class MacroExpansionError extends CdkdError {
+	exitCode = 2;
+	constructor(message, cause) {
+		super(message, "MACRO_EXPANSION_ERROR", cause);
+		this.name = "MacroExpansionError";
+		Object.setPrototypeOf(this, MacroExpansionError.prototype);
+	}
+};
+function isCdkdError(error) {
+	return error instanceof CdkdError;
+}
+function formatError(error) {
+	if (isCdkdError(error)) {
+		let message = `${error.name}: ${error.message}`;
+		if (error.cause) {
+			const cause = displayAwsMessage(error.cause.message);
+			if (cause) message += `\nCaused by: ${cause}`;
+		}
+		return message;
+	}
+	if (error instanceof Error) return `${error.name}: ${error.message}`;
+	return safeStringify(error);
+}
+function handleError(error) {
+	const logger = getLogger();
+	const silent = error instanceof CdkdError && error.silent;
+	if (isSoftAbort(error)) logger.warn(error.message);
+	else if (!silent) logger.error(formatError(error));
+	if (error instanceof Error && error.stack) logger.debug("Stack trace:", error.stack);
+	const customExitCode = error instanceof CdkdError ? error.exitCode : void 0;
+	const exitCode = typeof customExitCode === "number" ? customExitCode : 1;
+	process.exit(exitCode);
+}
+function withErrorHandling(fn) {
+	return async (...args) => {
+		try {
+			await fn(...args);
+		} catch (error) {
+			handleError(error);
+		}
+	};
+}
+function bucketNames(bucket) {
+	if (bucket === void 0) return {
+		subject: "Bucket '<unknown bucket>'",
+		object: "bucket '<unknown bucket>'",
+		quoted: "'<unknown bucket>'"
+	};
+	if (isPasteableIdent(bucket)) return {
+		subject: `Bucket '${bucket}'`,
+		object: `bucket '${bucket}'`,
+		quoted: `'${bucket}'`
+	};
+	const described = "a bucket whose name is not a plain identifier";
+	return {
+		subject: "A bucket whose name is not a plain identifier",
+		object: described,
+		quoted: described
+	};
+}
+function normalizeAwsError(err, context = {}) {
+	if (!(err instanceof Error)) return new Error(safeStringify(err), { cause: err });
+	if (!(err.name === "Unknown" || err.message === "UnknownError")) return err;
+	const status = err.$metadata?.httpStatusCode;
+	const bucket = bucketNames(context.bucket);
+	const operation = context.operation ?? "operation";
+	switch (status) {
+		case 301: {
+			const responseHeaders = err.$response?.headers;
+			const region = responseHeaders?.["x-amz-bucket-region"] ?? responseHeaders?.["X-Amz-Bucket-Region"];
+			const where = region ? ` (in ${region})` : "";
+			return new Error(`${bucket.subject}${where} is in a different region than the client. cdkd resolves this automatically; if you see this message, please report it.`, { cause: err });
+		}
+		case 403: return new Error(`Access denied to ${bucket.object}. Verify credentials and bucket policy.`, { cause: err });
+		case 404: return new Error(`${bucket.subject} does not exist.`, { cause: err });
+		default: {
+			const statusStr = status !== void 0 ? `HTTP ${status}` : "unknown HTTP status";
+			return new Error(`S3 error during ${operation} on ${bucket.quoted} (${statusStr}). See CloudTrail for details.`, { cause: err });
+		}
+	}
+}
+
+// src/utils/ambient-client-defaults.ts
+function ambientCredentialConfig() {
+	return getAwsClients()?.credentialConfig ?? {};
+}
+function clientDefaultsFor(credentialConfig, ignoreAssumedRole) {
+	return {
+		...awsClientDefaults({
+			profile: credentialConfig.profile,
+			...ignoreAssumedRole !== void 0 && { ignoreAssumedRole }
+		}),
+		...credentialConfig.profile && { profile: credentialConfig.profile },
+		...credentialConfig.credentials && { credentials: { ...credentialConfig.credentials } }
+	};
+}
+function ambientClientDefaults() {
+	return clientDefaultsFor(ambientCredentialConfig());
+}
+function credentialFingerprint(credentialConfig) {
+	return JSON.stringify([credentialConfig.profile ?? null, credentialConfig.credentials?.accessKeyId ?? null]);
+}
+
+// src/utils/pasteable-aws-profile.ts
+let explicitProfile;
+function setPasteableAwsProfile(profile) {
+	explicitProfile = profile;
+}
+function pasteableAwsProfileFlag() {
+	if (getAssumedRoleCredentials() !== void 0) return `--profile ${commandHole("role-profile")}`;
+	const profile = explicitProfile;
+	if (profile === void 0 || profile === "") return "";
+	if (displaySafe(profile) !== profile || profile.startsWith("-") || SHELL_ACTIVE.test(profile)) return `--profile ${commandHole("profile")}`;
+	return `--profile ${shellQuote(profile)}`;
+}
+function withPasteableAwsProfile(literal) {
+	const flag = pasteableAwsProfileFlag();
+	if (flag === "") return literal;
+	return literal.replace(/(^|[\s;&|(])aws (?=[a-z]|$)/g, (_m, pre) => `${pre}aws ${flag} `);
+}
+
+// src/state/record-keys.ts
+function injectivePairKey(first, second) {
+	return JSON.stringify([first, second]);
+}
+function injectiveKey(...parts) {
+	return JSON.stringify(parts);
+}
+function injectiveKeyPrefix(first) {
+	return JSON.stringify([first]).slice(0, -1) + ",";
+}
+function producerRecordKey(stackName, region) {
+	return injectivePairKey(stackName, region);
+}
+function producerCoordinateKey(stackName, exportOrOutputName) {
+	return injectivePairKey(stackName, exportOrOutputName);
+}
+
+// src/state/state-prefix.ts
+const DEFAULT_STATE_PREFIX = "cdkd";
+const CUSTOM_RESOURCE_RESPONSE_PREFIX = "custom-resource-responses";
+
+// src/state/lock-contention-message.ts
+function formatLockExpiry(expiresAt) {
+	if (!Number.isFinite(expiresAt)) return "expires at an unknown time";
+	const remainingMs = expiresAt - Date.now();
+	return remainingMs > 0 ? `expires in ${formatDuration(remainingMs)}` : `expired ${formatDuration(-remainingMs)} ago`;
+}
+const LOCK_OWNER_DESCRIBED = "a lock owner that is not a plain identifier";
+const LOCK_OPERATION_DESCRIBED = "a lock operation that is not a plain identifier";
+function formatLockOwner(owner) {
+	if (owner === "") return "an unnamed holder";
+	return owner.includes(",") ? LOCK_OWNER_DESCRIBED : plainIdentOr(owner, LOCK_OWNER_DESCRIBED);
+}
+function formatLockOperation(operation) {
+	return operation.includes(",") ? LOCK_OPERATION_DESCRIBED : plainIdentOr(operation, LOCK_OPERATION_DESCRIBED);
+}
+function formatDuration(ms) {
+	const seconds = Math.floor(ms / 1e3);
+	if (seconds < 60) return `${seconds}s`;
+	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
+}
+function buildForceUnlockCommand(stackName, region, recovery) {
+	const recoveryFlags = recoveryCommandFlags(recovery);
+	const built = pasteableCommand("cdkd force-unlock", region === void 0 ? [{
+		value: stackName,
+		hole: "stack",
+		opts: { plainIdent: true }
+	}] : [{
+		value: stackName,
+		hole: "stack",
+		opts: { plainIdent: true }
+	}, {
+		flag: "--stack-region",
+		value: region,
+		hole: "region",
+		opts: { plainIdent: true }
+	}], recoveryFlags.flags);
+	if (!built.exact || !recoveryFlags.exact) return "";
+	return built.command;
+}
+function recoveryCommandFlags(recovery) {
+	const gated = (value) => {
+		const v = sanitizeRecoveryValue(value);
+		return {
+			text: v.text,
+			exact: v.exact && isInertUnquoted(v.text)
+		};
+	};
+	const profile = gated(recovery?.profile);
+	const stateBucket = gated(recovery?.stateBucket);
+	const statePrefix = gated(recovery?.statePrefix);
+	const flags = [];
+	if (profile.text || !profile.exact) flags.push(profile.exact ? `--profile ${shellQuote(profile.text)}` : `--profile ${commandHole("profile")}`);
+	if (stateBucket.text || !stateBucket.exact) flags.push(stateBucket.exact ? `--state-bucket ${shellQuote(stateBucket.text)}` : `--state-bucket ${commandHole("bucket")}`);
+	const prefix = recovery?.statePrefix;
+	if (prefix !== void 0 && prefix !== "cdkd") flags.push(statePrefix.exact ? `--state-prefix ${shellQuote(statePrefix.text)}` : `--state-prefix ${commandHole("prefix")}`);
+	return {
+		flags,
+		exact: profile.exact && stateBucket.exact && statePrefix.exact
+	};
+}
+function sanitizeRecoveryValue(value) {
+	if (value === void 0) return {
+		text: "",
+		exact: true
+	};
+	const text = displaySafe(value);
+	return {
+		text,
+		exact: text === value
+	};
+}
+const UNREPRODUCIBLE_LOCK_VALUES = "the name, region, profile, state bucket or state prefix";
+const UNREPRODUCIBLE_LOCK_CLAUSE = `Inspect the lock object directly: ${UNREPRODUCIBLE_LOCK_VALUES} recorded for this stack cannot be reproduced safely on a command line (changed by sanitizing, unrenderable, empty, too long, not a plain identifier, beginning with '-', which cdkd refuses rather than risk it parsing as an option, or holding whitespace or a character a shell treats specially), so no command is shown: one built from it could address a different lock or run part of it as shell.`;
+function forceQuitRecoveryClause(stackName, region, recovery) {
+	const command = buildForceUnlockCommand(stackName, region, recovery);
+	return command ? ` If the next run reports a lock, run: ${command}` : ` ${UNREPRODUCIBLE_LOCK_CLAUSE}`;
+}
+async function buildLockContentionMessage(args) {
+	const { lockManager, stackName, region, subject = "stack", recovery, heldClause, suffix } = args;
+	let held = heldClause ?? "another cdkd process holds it";
+	let sawHolder = false;
+	try {
+		const info = await lockManager.getLockInfo(stackName, region);
+		if (info) {
+			const operation = info.operation ? `, operation: ${formatLockOperation(info.operation)}` : "";
+			const expires = formatLockExpiry(info.expiresAt);
+			const owner = displaySafe(info.owner);
+			const holder = owner ? `held by ${formatLockOwner(owner)}${operation}` : `held by an unnamed holder`;
+			held = `${heldClause ? `${heldClause} — ` : ""}${holder}, ${expires}`;
+			if (owner) sawHolder = true;
+		}
+	} catch {}
+	const advice = sawHolder ? `That process is still running — wait for it to finish. Only if you are certain it is gone` : `Wait for it to finish, or if you are certain no other process is active`;
+	const recoveryCommand = buildForceUnlockCommand(stackName, region, recovery);
+	const safeRegion = displaySafe(region, { asciiOnly: true }) || "<unrenderable>";
+	const head = `Could not acquire lock for ${subject} ${displayStackName(stackName)} (${safeRegion}) — ${held}.` + (suffix ? ` ${suffix}` : "");
+	if (!recoveryCommand) return `${head} ${advice}. No recovery command can be shown: ${UNREPRODUCIBLE_LOCK_VALUES} recorded for this lock cannot be reproduced safely on a command line (changed by sanitizing, unrenderable, empty, too long, not a plain identifier, beginning with '-', which cdkd refuses rather than risk it parsing as an option, or holding whitespace or a character a shell treats specially), so no command is shown: one built from it could address a different lock or run part of it as shell — inspect the lock object directly.`;
+	return `${head} ${advice}, run: ${recoveryCommand}`;
+}
+
+// src/provisioning/auxiliary-failure.ts
+const AUXILIARY_LOGICAL_ID_SUFFIX = "/auxiliary";
+const MAX_DEPTH$1 = 5;
+function auxiliaryLogicalId(ownerLogicalId) {
+	return `${ownerLogicalId}${AUXILIARY_LOGICAL_ID_SUFFIX}`;
+}
+const RETRY_AUXILIARY_OWNER = "withRetry";
+function isAuxiliaryMarkOf(link, ownerLogicalId) {
+	try {
+		if (typeof link !== "object" && typeof link !== "function" || link === null) return false;
+		const own = Object.getOwnPropertyDescriptor(link, "logicalId");
+		return isAuxiliaryMark(own) && own?.value === auxiliaryLogicalId(ownerLogicalId);
+	} catch {
+		return false;
+	}
+}
+function isAuxiliaryMark(descriptor) {
+	return descriptor !== void 0 && descriptor.enumerable === false && descriptor.writable === false && typeof descriptor.value === "string" && descriptor.value.endsWith(AUXILIARY_LOGICAL_ID_SUFFIX);
+}
+function isAuxiliaryFailure(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH$1 && typeof current === "object" && current !== null; depth++) {
+			if (isAuxiliaryMark(Object.getOwnPropertyDescriptor(current, "logicalId"))) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+const CREATED_BEFORE_FAILURE = Symbol.for("cdkd.createdBeforeFailure");
+function markCreatedBeforeFailure(error, ownerLogicalId, resourceType, physicalId, createdResourceIdentity) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		if (physicalId === "") return error;
+		Object.defineProperty(error, CREATED_BEFORE_FAILURE, {
+			value: Object.freeze({
+				logicalId: ownerLogicalId,
+				resourceType,
+				physicalId,
+				...typeof createdResourceIdentity === "string" && createdResourceIdentity !== "" && { createdResourceIdentity }
+			}),
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function createdMarkOn(link) {
+	const value = link[CREATED_BEFORE_FAILURE];
+	if (typeof value !== "object" || value === null) return void 0;
+	const { logicalId, resourceType, physicalId, createdResourceIdentity } = value;
+	if (typeof logicalId !== "string" || typeof resourceType !== "string" || typeof physicalId !== "string" || physicalId === "") return;
+	return typeof createdResourceIdentity === "string" && createdResourceIdentity !== "" ? {
+		logicalId,
+		resourceType,
+		physicalId,
+		createdResourceIdentity
+	} : {
+		logicalId,
+		resourceType,
+		physicalId
+	};
+}
+function createdBeforeFailure(error, logicalId, resourceType) {
+	return anchoredCreatedMark(error, logicalId, resourceType)?.physicalId;
+}
+function createdResourceIdentityBeforeFailure(error, logicalId, resourceType) {
+	return anchoredCreatedMark(error, logicalId, resourceType)?.createdResourceIdentity;
+}
+function anchoredCreatedMark(error, logicalId, resourceType) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+			const mark = createdMarkOn(current);
+			if (mark) return mark.logicalId === logicalId && mark.resourceType === resourceType ? mark : void 0;
+			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
+			if (typeof own?.value === "string" && own.value !== logicalId && !isAuxiliaryMarkOf(current, logicalId)) return;
+			current = current.cause;
+		}
+	} catch {}
+}
+function clearCreatedBeforeFailure(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+			if (Object.getOwnPropertyDescriptor(current, CREATED_BEFORE_FAILURE)?.configurable) delete current[CREATED_BEFORE_FAILURE];
+			current = current.cause;
+		}
+	} catch {}
+	return error;
+}
+function hasCreatedBeforeFailure(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+			if (createdMarkOn(current)) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+function firstCreatedMark(error) {
+	let current = error;
+	for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+		const mark = createdMarkOn(current);
+		if (mark) return mark;
+		current = current.cause;
+	}
+}
+const SUPERSEDES_EARLIER_CREATE = Symbol.for("cdkd.supersedesEarlierCreate");
+function markSupersedesEarlierCreate(error) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		Object.defineProperty(error, SUPERSEDES_EARLIER_CREATE, {
+			value: true,
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function supersedesEarlierCreate(error) {
+	let current = error;
+	for (let depth = 0; depth < 10 && typeof current === "object" && current !== null; depth++) {
+		if (current[SUPERSEDES_EARLIER_CREATE] === true) return true;
+		current = current.cause;
+	}
+	return false;
+}
+function replayMadeAnotherResource(earlier, later) {
+	try {
+		const before = firstCreatedMark(earlier);
+		const after = firstCreatedMark(later);
+		if (before === void 0 || after === void 0 || before.logicalId !== after.logicalId || before.resourceType !== after.resourceType || supersedesEarlierCreate(later)) return false;
+		const members = (id) => id.split(",").filter((member) => member !== "");
+		const earlierMembers = new Set(members(before.physicalId));
+		return !members(after.physicalId).some((member) => earlierMembers.has(member));
+	} catch {
+		return false;
+	}
+}
+function carryCreatedBeforeFailure(from, to) {
+	try {
+		if (typeof to !== "object" || to === null) return to;
+		let current = from;
+		let mark;
+		for (let depth = 0; depth < 10 && typeof current === "object" && current !== null && !mark; depth++) {
+			mark = createdMarkOn(current);
+			current = current.cause;
+		}
+		if (!mark) return to;
+		let probe = to;
+		for (let depth = 0; depth < 10 && typeof probe === "object" && probe !== null; depth++) {
+			if (createdMarkOn(probe)) return to;
+			probe = probe.cause;
+		}
+		return markCreatedBeforeFailure(to, mark.logicalId, mark.resourceType, mark.physicalId, mark.createdResourceIdentity);
+	} catch {
+		return to;
+	}
+}
+function markAuxiliaryFailure(error, ownerLogicalId) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH$1 && typeof current === "object" && current !== null; depth++) {
+			const own = Object.getOwnPropertyDescriptor(current, "logicalId");
+			if (typeof own?.value === "string") {
+				if (isAuxiliaryMark(own)) return error;
+			} else {
+				if (Object.isExtensible(current) && own?.configurable !== false) Object.defineProperty(current, "logicalId", {
+					value: auxiliaryLogicalId(ownerLogicalId),
+					enumerable: false,
+					writable: false,
+					configurable: true
+				});
+				return error;
+			}
+			current = current.cause;
+		}
+	} catch {}
+	return error;
+}
+
+// src/provisioning/masked-retry-logger.ts
+function maskerOrIdentity(maskSecrets) {
+	return maskSecrets ?? ((text) => text);
+}
+function createMaskedRetryLogger(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+function createMaskedLogSinks(logger, maskSecrets) {
+	const mask = maskerOrIdentity(maskSecrets);
+	return {
+		mask,
+		value: (value) => mask(String(value)),
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+function isSecretDerivedValue(raw, mask) {
+	return typeof raw === "string" && raw !== "" && (mask(raw) !== raw || raw.includes("{{resolve:") || raw === "***");
+}
+function withDerivedNameMasks(logger, sinks, pairs) {
+	const base = sinks.mask;
+	const derivedNames = pairs.filter((pair) => typeof pair[0] === "string" && pair[0] !== "" && typeof pair[1] === "string" && pair[1] !== "" && isSecretDerivedValue(pair[0], base)).map(([, derived]) => derived);
+	if (derivedNames.length === 0) return sinks;
+	const mask = (text) => {
+		const masked = base(text);
+		const needles = [];
+		for (const derived of new Set(derivedNames)) {
+			if (derived.length < 4) {
+				needles.push(derived);
+				continue;
+			}
+			const rendered = base(derived);
+			if (rendered === "***") continue;
+			for (let i = text.indexOf(derived); i !== -1;) {
+				const j = i + derived.length;
+				if (masked !== base(text.slice(0, i)) + rendered + base(text.slice(j))) return "***";
+				i = text.indexOf(derived, i + 1);
+			}
+			needles.push(rendered);
+		}
+		let out = masked;
+		for (const needle of needles.sort((a, b) => b.length - a.length)) out = out.split(needle).join("***");
+		return out;
+	};
+	return {
+		mask,
+		value: (value) => mask(String(value)),
+		debug: (message) => logger.debug(mask(message)),
+		warn: (message) => logger.warn(mask(message))
+	};
+}
+const MASK_WALK_MAX_DEPTH = 8;
+const MASK_WALK_DEPTH_CAP_MARKER = "***";
+const BASE_MASKER_SUBSTRING_FLOOR = 4;
+function maskDeep(value, mask, depth = 0) {
+	if (typeof value === "string") return mask(value);
+	if (depth >= 8) return "***";
+	if (Array.isArray(value)) return value.map((entry) => maskDeep(entry, mask, depth + 1));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [mask(k), maskDeep(v, mask, depth + 1)]));
+	return value;
+}
+
+// src/provisioning/state-orphan-remedy.ts
+function stateOrphanRecordRemedy(context, logicalId) {
+	const resourceArg = `--resource ${isPasteableIdent(logicalId) ? logicalId : "<logicalId>"}`;
+	if (context?.stackDestroy === true) return `'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack still has in that region, not just this one (add '${resourceArg}' to drop only this one)`;
+	return `'cdkd state orphan <stack> --stack-region <region> ${resourceArg}', which drops only this record — never run it without --resource on a stack that is still deployed, where that drops every resource's record and the next deploy re-creates or collides with all of them`;
+}
+
+// src/provisioning/composite-id.ts
+const COMPOSITE_ID_SEPARATOR = "|";
+function canonicalizeRoute53QueryName(name) {
+	const lowered = name.toLowerCase().replaceAll("*", "\\052").replaceAll("|", "\\174");
+	return lowered.endsWith(".") ? lowered : `${lowered}.`;
+}
+function segmentAfterAnchor(physicalId, anchor) {
+	if (typeof anchor !== "string" || anchor === "") return void 0;
+	const prefix = `${anchor}${"|"}`;
+	if (!physicalId.startsWith(prefix)) return void 0;
+	const rest = physicalId.slice(prefix.length);
+	return rest === "" ? void 0 : rest;
+}
+const QUOTABLE_VALUE = /^(?:[A-Za-z0-9:_@./+=,~|*-]+| *)$/;
+function quotedOr(value, quote, description) {
+	return QUOTABLE_VALUE.test(value) ? `${quote}${value}${quote}` : description;
+}
+function logicalIdShown(logicalId) {
+	return plainOrDescribed(logicalId, "logical id");
+}
+const RESOURCE_TYPE_SHAPE = /^[A-Za-z0-9]+(?:::[A-Za-z0-9_@-]+)+$/;
+function resourceTypeShown(resourceType) {
+	return RESOURCE_TYPE_SHAPE.test(resourceType) && plainIdentOr(resourceType, "") === resourceType ? resourceType : "a resource type that is not a plain identifier";
+}
+function idShape(segments) {
+	return segments.map((segment) => `<${segment.name}>`).join("|");
+}
+function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecrets) {
+	const offending = segments.filter((segment) => String(segment.value).includes("|"));
+	if (offending.length === 0) return void 0;
+	const mask = maskerOrIdentity(maskSecrets);
+	const named = offending.map((segment) => `${segment.name} ${quotedOr(mask(String(segment.value)), "'", "(its value is not shown: it is not a plain identifier)")}`).join(" and ");
+	return `${resourceTypeShown(resourceType)} ${logicalIdShown(logicalId)}: ${named} contains '${"|"}', which cdkd uses as the separator in this type's physical id (${idShape(segments)}). Recording it would produce an id that decodes back to a DIFFERENT resource, so a later cdkd destroy / drift / update would target the wrong one — or silently skip it while the real resource stays alive. cdkd cannot record a value containing '${"|"}' in this position. Change the named value so it does not contain '${"|"}', or manage the resource outside cdkd.`;
+}
+function packCompositeId(resourceType, logicalId, segments, options) {
+	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
+	if (refusal !== void 0) {
+		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
+		else throw new ProvisioningError(refusal, resourceType, logicalId);
+	}
+	return segments.map((segment) => String(segment.value)).join("|");
+}
+function formatShape(segments) {
+	return segments.map((segment) => `<${segment}>`).join("|");
+}
+function compositeIdFormatMessage(format, logicalId, physicalId, options) {
+	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
+	const head = `Invalid physicalId format for ${format.label} ${logicalIdShown(logicalId)}: expected ${accepted}, got ${quotedOr(physicalId, "\"", "an id that is not a plain identifier")}`;
+	if (!options?.skipping) return head;
+	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy (which re-attempts it on the next deploy). So repair the id in state.json and re-run, or delete the resource by hand and drop the record with ${stateOrphanRecordRemedy(options.context, logicalId)}. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so delete it by hand.`;
+}
+const COMPOSITE_ID_SKIP_REASON = "malformed physicalId in state — no delete issued";
+function compositeIdSkipResult() {
+	return {
+		outcome: "skipped",
+		reason: COMPOSITE_ID_SKIP_REASON
+	};
+}
+
+// src/provisioning/interrupt-watch.ts
+var InterruptedWaitError = class InterruptedWaitError extends Error {
+	constructor(what) {
+		super(`${what} interrupted by user (SIGINT)`);
+		this.name = "InterruptedWaitError";
+		Object.setPrototypeOf(this, InterruptedWaitError.prototype);
+	}
+};
+function isInterruptedWaitError(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	while (current !== void 0 && current !== null) {
+		if (current instanceof InterruptedWaitError) return true;
+		if (!(current instanceof Error)) return false;
+		if (seen.has(current)) return false;
+		seen.add(current);
+		current = current.cause;
+	}
+	return false;
+}
+const liveWatches = /* @__PURE__ */ new Set();
+let sharedSigintHandler;
+let sigintLatched = false;
+const interruptWatchTestSeam = {};
+let commandInterruptScopeDepth = 0;
+function commandOwnsInterrupts() {
+	const override = interruptWatchTestSeam.commandOwnsInterrupts;
+	if (override !== void 0) return override();
+	return commandInterruptScopeDepth > 0;
+}
+function armSharedSigintHandler() {
+	if (sharedSigintHandler !== void 0) return;
+	if (!commandOwnsInterrupts()) return;
+	const handler = () => {
+		sigintLatched = true;
+		for (const live of liveWatches) live.interrupted = true;
+		if (process.listeners("SIGINT").filter((l) => l !== handler).length === 0) {
+			process.stderr.write("\nInterrupted.\nIf the next run reports a stack lock, release it with: cdkd force-unlock <stack-name>\n");
+			(interruptWatchTestSeam.forceQuit ?? ((code) => process.exit(code)))(130);
+		}
+	};
+	sharedSigintHandler = handler;
+	process.on("SIGINT", handler);
+}
+function startInterruptWatch(what) {
+	armSharedSigintHandler();
+	const state = { interrupted: sigintLatched };
+	liveWatches.add(state);
+	let disposed = false;
+	return {
+		isInterrupted: () => state.interrupted,
+		onInterrupted: () => new InterruptedWaitError(what),
+		dispose: () => {
+			if (disposed) return;
+			disposed = true;
+			liveWatches.delete(state);
+		}
+	};
+}
+function resetInterruptWatchLatch() {
+	sigintLatched = false;
+	for (const live of liveWatches) live.interrupted = false;
+}
+function beginCommandInterruptScope() {
+	commandInterruptScopeDepth += 1;
+	if (commandInterruptScopeDepth === 1) resetInterruptWatchLatch();
+}
+function endCommandInterruptScope() {
+	commandInterruptScopeDepth = Math.max(0, commandInterruptScopeDepth - 1);
+	if (commandInterruptScopeDepth > 0) return;
+	if (sharedSigintHandler !== void 0) {
+		process.removeListener("SIGINT", sharedSigintHandler);
+		sharedSigintHandler = void 0;
+	}
+	resetInterruptWatchLatch();
+}
+function interruptWatchListenerCount() {
+	return sharedSigintHandler === void 0 ? 0 : 1;
+}
+
+// src/utils/elapsed-budget.ts
+const monotonicNowMs = typeof globalThis.performance?.now === "function" ? () => globalThis.performance.now() : () => Date.now();
+var ElapsedBudget = class {
+	totalMs;
+	clock;
+	startedAt;
+	constructor(totalMs, clock = monotonicNowMs) {
+		if (!Number.isFinite(totalMs) || totalMs <= 0) throw new RangeError(`ElapsedBudget: totalMs must be a positive finite number (got ${totalMs})`);
+		this.totalMs = totalMs;
+		this.clock = clock;
+		this.startedAt = clock();
+	}
+	elapsedMs() {
+		return Math.max(0, this.clock() - this.startedAt);
+	}
+	remainingMs() {
+		return Math.max(0, this.totalMs - this.elapsedMs());
+	}
+	isExhausted() {
+		return this.remainingMs() <= 0;
+	}
+	attemptsWithin(cap, perAttemptMs, minAttempts = 1) {
+		if (!Number.isFinite(cap) || cap <= 0) return 0;
+		if (!Number.isFinite(perAttemptMs) || perAttemptMs <= 0) return Math.min(minAttempts, cap);
+		const affordable = Math.floor(this.remainingMs() / perAttemptMs);
+		return Math.max(Math.min(minAttempts, cap), Math.min(cap, affordable));
+	}
+};
+var ElapsedBudgetRegistry = class {
+	budgets = /* @__PURE__ */ new Map();
+	acquire(key, totalMs, clock = monotonicNowMs, reuseWithinMs) {
+		const existing = this.budgets.get(key);
+		if (existing) {
+			if (!(reuseWithinMs !== void 0 && existing.elapsedMs() > reuseWithinMs)) return existing;
+			this.budgets.delete(key);
+		}
+		const created = new ElapsedBudget(totalMs, clock);
+		this.budgets.set(key, created);
+		return created;
+	}
+	release(key) {
+		this.budgets.delete(key);
+	}
+	get size() {
+		return this.budgets.size;
+	}
+	clear() {
+		this.budgets.clear();
+	}
+};
+
+// src/provisioning/replacement-protection-advice.ts
+const DELETION_PROTECTION_DOC_POINTER = "\"Deletion protection blocks a replacement, and deploy cannot clear it\" at https://cdkd.dev/cli-deploy-safety/#deletion-protection-blocks-a-replacement-and-deploy-cannot-clear-it";
+const UNNAMEABLE_ID_CLAUSE = "Then disable protection out of band, via the console: the physical id cdkd recorded for this resource cannot be reproduced safely on a command line (sanitizing would change it, so a command would act on a different resource, or it holds a character or prefix a pasted shell line, or the AWS CLI itself, would act on, or it is derived from a secret, which a pasted command would print).";
+const AWS_CLI_ACTIVE_ARG = /^-|^(?:fileb?|https?):\/\/|@=/i;
+function isAwsCliLiteral(value) {
+	return !AWS_CLI_ACTIVE_ARG.test(value);
+}
+function renderDisableCommand(disable) {
+	const resolved = disable;
+	const quoted = pasteableArg(resolved.identifier, resolved.maskSecrets);
+	if (quoted === void 0) return "";
+	const tail = resolved.after ? ` ${resolved.after}` : "";
+	return `${withPasteableAwsProfile(resolved.before)} ${quoted}${tail}`;
+}
+function pasteableArg(value, maskSecrets) {
+	if (typeof value !== "string") return void 0;
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe || safe !== value) return void 0;
+	if (maskSecrets && maskSecrets(safe) !== safe) return void 0;
+	if (!isInertUnquoted(safe)) return void 0;
+	if (!isAwsCliLiteral(safe)) return void 0;
+	return shellQuote(safe);
+}
+var PasteableAwsCommand = class {
+	text;
+	#origin;
+	constructor(text, origin) {
+		this.text = text;
+		this.#origin = origin;
+	}
+	builtBy(tag) {
+		return this.#origin === tag;
+	}
+	render() {
+		return this.text ?? "[command withheld: a name or id it would carry cannot be printed safely on a command line (inexact, so a pasted copy could act on a different resource, or holding a character or prefix a pasted shell line, or the AWS CLI itself, would act on); use the console]";
+	}
+};
+const WITHHELD_AWS_COMMAND = "[command withheld: a name or id it would carry cannot be printed safely on a command line (inexact, so a pasted copy could act on a different resource, or holding a character or prefix a pasted shell line, or the AWS CLI itself, would act on); use the console]";
+function pasteableAwsCommand(maskSecrets) {
+	const tag = (strings, ...values) => {
+		let text = withPasteableAwsProfile(strings[0] ?? "");
+		for (let i = 0; i < values.length; i++) {
+			const value = values[i];
+			const rendered = value instanceof PasteableAwsCommand ? value.builtBy(tag) ? value.text : void 0 : pasteableArg(value, maskSecrets);
+			if (rendered === void 0) return new PasteableAwsCommand(void 0, tag);
+			text += rendered + withPasteableAwsProfile(strings[i + 1] ?? "");
+		}
+		return new PasteableAwsCommand(text, tag);
+	};
+	return tag;
+}
+function protectedReplacementAdvice(args) {
+	const { evidence, replaceFlags } = args;
+	const command = renderDisableCommand(args.disable);
+	const disable = args.disable;
+	const head = `${evidence}, so ${replaceFlags} alone will NOT succeed while AWS still has protection on: the replacement DELETES the resource, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read ${DELETION_PROTECTION_DOC_POINTER} BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see.`;
+	if (!command) return `${head} ${UNNAMEABLE_ID_CLAUSE} Then re-run with ${replaceFlags}.`;
+	return `${head} Then disable protection out of band — \`${command}\`, or via the console.${disable.caveat ? ` ${disable.caveat}` : ""} Then re-run with ${replaceFlags}.`;
+}
+
+// src/provisioning/providers/deletion-protection-compensation.ts
+var ProtectionFlipRegistry = class {
+	records = /* @__PURE__ */ new Map();
+	acquire(key, reuseWithinMs, clock = monotonicNowMs) {
+		const existing = this.records.get(key);
+		if (existing) {
+			if (existing.idle.elapsedMs() <= reuseWithinMs) {
+				existing.idle = new ElapsedBudget(reuseWithinMs, clock);
+				return existing.record;
+			}
+			this.records.delete(key);
+		}
+		const created = {
+			record: {
+				flippedOffByThisRun: false,
+				deleteAccepted: false
+			},
+			idle: new ElapsedBudget(reuseWithinMs, clock)
+		};
+		this.records.set(key, created);
+		return created.record;
+	}
+	release(key) {
+		this.records.delete(key);
+	}
+	get size() {
+		return this.records.size;
+	}
+	clear() {
+		this.records.clear();
+	}
+};
+function protectionFlipKey(resourceType, physicalId, region) {
+	return injectiveKey(resourceType, region ?? "", physicalId);
+}
+const PROTECTION_FLIP_REUSE_WINDOW_MS = 18e5;
+const finalDeleteAttempt = new AsyncLocalStorage();
+function runDeleteAttempt(isFinal, attempt) {
+	return finalDeleteAttempt.run(isFinal, attempt);
+}
+function isTerminalDeleteFailure(error) {
+	if (isInterruptedWaitError(error)) return true;
+	if (finalDeleteAttempt.getStore() === true) return true;
+	if (isMarkedNonRetryable(error)) return true;
+	const classify = retryClassificationText(error);
+	return !(isRetryableTransientError(error, classify) || classify.includes("Too Many Requests"));
+}
+function rdsFamilyProtectionSite(opts) {
+	return {
+		subject: `${opts.serviceLabel} ${opts.kind === "cluster" ? "DBCluster" : "DBInstance"}`,
+		guardName: "DeletionProtection",
+		noun: opts.kind,
+		isNotFound: opts.isNotFound,
+		notFoundMeaning: `${opts.serviceLabel} answered ${opts.notFoundFault}. That most commonly means the ${opts.kind} is gone, and it can also mean it is not in this region or account.`,
+		commands: () => {
+			const aws = pasteableAwsCommand();
+			const regionArg = opts.region ? aws` --region ${opts.region}` : aws``;
+			const id = opts.physicalId;
+			const svc = opts.cliService;
+			const service = svc === "rds" ? aws`rds` : svc === "docdb" ? aws`docdb` : aws`neptune`;
+			const check = opts.kind === "cluster" ? aws`aws ${service} describe-db-clusters --db-cluster-identifier ${id}${regionArg}` : aws`aws ${service} describe-db-instances --db-instance-identifier ${id}${regionArg}`;
+			const restore = opts.kind === "cluster" ? aws`aws ${service} modify-db-cluster --db-cluster-identifier ${id}${regionArg} --deletion-protection --apply-immediately` : aws`aws ${service} modify-db-instance --db-instance-identifier ${id}${regionArg} --deletion-protection --apply-immediately`;
+			return {
+				check: check.render(),
+				restoreAfterNotFound: restore.render(),
+				restoreLive: restore.render()
+			};
+		}
+	};
+}
+function isResourceNotFoundException(error) {
+	return typeof error === "object" && error !== null && error.name === "ResourceNotFoundException";
+}
+function logGroupProtectionSite(physicalId, region) {
+	return {
+		subject: "Log group",
+		guardName: "DeletionProtectionEnabled",
+		noun: "log group",
+		isNotFound: isResourceNotFoundException,
+		notFoundMeaning: "CloudWatch Logs answered ResourceNotFoundException. That most commonly means the log group is gone, and it can also mean it is not in this region or account.",
+		commands: () => {
+			const aws = pasteableAwsCommand();
+			const regionArg = region ? aws` --region ${region}` : aws``;
+			const restore = aws`aws logs put-log-group-deletion-protection --log-group-identifier ${physicalId}${regionArg} --deletion-protection-enabled`;
+			return {
+				check: aws`aws logs describe-log-groups --log-group-identifiers ${physicalId}${regionArg}`.render(),
+				restoreAfterNotFound: restore.render(),
+				restoreLive: restore.render()
+			};
+		}
+	};
+}
+function userPoolProtectionSite(physicalId, region) {
+	return {
+		subject: "Cognito User Pool",
+		guardName: "DeletionProtection",
+		noun: "user pool",
+		isNotFound: isResourceNotFoundException,
+		notFoundMeaning: "Cognito answered ResourceNotFoundException. That most commonly means the user pool is gone, and it can also mean it is not in this region or account.",
+		commands: () => {
+			const aws = pasteableAwsCommand();
+			const regionArg = region ? aws` --region ${region}` : aws``;
+			const restore = aws`aws cognito-idp update-user-pool --user-pool-id ${physicalId}${regionArg} --deletion-protection ACTIVE`;
+			return {
+				check: aws`aws cognito-idp describe-user-pool --user-pool-id ${physicalId}${regionArg}`.render(),
+				restoreAfterNotFound: restore.render(),
+				restoreLive: restore.render()
+			};
+		},
+		restoreCaveat: "Note UpdateUserPool resets some members a call omits (self sign-up, Lambda triggers, advanced security, AutoVerifiedAttributes and a customer-managed KeyConfiguration among them), so send your complete pool configuration alongside that flag rather than the flag alone."
+	};
+}
+async function compensateProtectionFlip(opts) {
+	if (!opts.flip.flippedOffByThisRun) return "not-applicable";
+	if (opts.flip.deleteAccepted) return "not-applicable";
+	if (!isTerminalDeleteFailure(opts.error)) return "not-applicable";
+	const { site } = opts;
+	try {
+		const result = await opts.reEnable();
+		if (result === "read-on-write-failed") {
+			opts.logger.warn(safeMsg`${site.subject} ${opts.logicalId}: the delete failed after ` + safeMsg`--remove-protection tried to turn ${site.guardName} off; ${opts.physicalId} ` + safeMsg`read it on afterwards, but writing it back failed, so cdkd cannot confirm ` + safeMsg`it. Check with: ${site.commands().check}. The delete failure below is the outcome.`);
+			return "failed";
+		}
+		opts.logger.warn(result === "already-on" ? safeMsg`${site.subject} ${opts.logicalId}: the delete failed after ` + safeMsg`--remove-protection tried to turn ${site.guardName} off; ${opts.physicalId} ` + safeMsg`already read it on, and cdkd wrote it back (AWS accepted the write). The ` + safeMsg`delete failure below is the outcome.` : safeMsg`${site.subject} ${opts.logicalId}: the delete failed after ` + safeMsg`--remove-protection had turned ${site.guardName} off, so it was ` + safeMsg`re-enabled on ${opts.physicalId}. The delete failure below is the outcome.`);
+		return "restored";
+	} catch (reEnableError) {
+		const mask = maskerOrIdentity(opts.mask);
+		const failure = describeAwsFailure(reEnableError);
+		const detail = mask(failure.summary);
+		if (failure.redacted) opts.logger.debug(mask(safeMsg`${site.subject} ${opts.logicalId}: re-enabling ${site.guardName} on ` + safeMsg`${opts.physicalId} failed: ${mask(failure.detail)}`));
+		const commands = site.commands();
+		const caveat = site.restoreCaveat ? ` ${site.restoreCaveat}` : "";
+		if (site.isNotFound(reEnableError)) {
+			opts.logger.warn(safeMsg`${site.subject} ${opts.logicalId}: could not re-enable ` + safeMsg`${site.guardName} on ${opts.physicalId} after the delete failed — ` + safeMsg`${site.notFoundMeaning} If it still exists, its deletion protection is OFF. ` + safeMsg`Check with: ${commands.check} and if it is there, restore it with: ` + safeMsg`${commands.restoreAfterNotFound}.${caveat} (${detail})`);
+			return "failed";
+		}
+		opts.logger.error(safeMsg`${site.subject} ${opts.logicalId}: could NOT re-enable ` + safeMsg`${site.guardName} on ${opts.physicalId} after the delete failed — ` + safeMsg`that ${site.noun} is LIVE with its deletion protection still off. Restore it with: ` + safeMsg`${commands.restoreLive}.${caveat} (${detail})`);
+		return "failed";
+	}
+}
+async function observeThenDisableProtection(opts) {
+	let observedOn = false;
+	try {
+		observedOn = await opts.observe();
+	} catch (observeError) {
+		const mask = maskerOrIdentity(opts.mask);
+		opts.logger.debug(mask(safeMsg`Could not read ${opts.guardName} on ${mask(opts.physicalId)} before disabling it: ${mask(describeAwsFailure(observeError).detail)}`));
+	}
+	await opts.disable();
+	if (observedOn) opts.flip.flippedOffByThisRun = true;
+}
+async function deleteWithProtectionCompensation(opts) {
+	const flip = opts.registry.acquire(opts.key, opts.reuseWithinMs ?? 18e5, opts.clock);
+	try {
+		await opts.run(flip);
+	} catch (error) {
+		await settleProtectionFlip({
+			registry: opts.registry,
+			key: opts.key,
+			flip,
+			error,
+			compensation: opts.compensation
+		});
+		throw error;
+	}
+	opts.registry.release(opts.key);
+}
+async function settleProtectionFlip(opts) {
+	let outcome = "failed";
+	try {
+		outcome = await compensateProtectionFlip({
+			...opts.compensation,
+			flip: opts.flip,
+			error: opts.error
+		});
+	} catch {}
+	if (isTerminalDeleteFailure(opts.error) && outcome !== "failed") {
+		opts.registry.release(opts.key);
+		return true;
+	}
+	return false;
+}
+const FINAL_SNAPSHOT_SETTLE_WAIT_MS = 9e5;
+const FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS = 6e4;
+const FLIP_TRANSITION_GRACE_MS = 3e4;
+function finalSnapshotWaitBudgetMs(opts) {
+	const budgetMs = Math.min(opts.maxWaitMs ?? 9e5, opts.remainingMs - FINAL_SNAPSHOT_COMPENSATION_MARGIN_MS);
+	if (budgetMs <= 0) throw new Error(`--remove-protection turned DeletionProtection off, but the resource timeout leaves no time to wait for the ${opts.noun} to return to 'available', which the final snapshot its DeletionPolicy asks for needs. The delete was not sent and the guard is put back; re-run the destroy with a longer --resource-timeout`);
+	return budgetMs;
+}
+const TERMINAL_DB_STATUSES = /* @__PURE__ */ new Set([
+	"deleting",
+	"failed",
+	"stopped",
+	"storage-full",
+	"insufficient-capacity",
+	"restore-error"
+]);
+const PROCEED_DB_STATUSES = /* @__PURE__ */ new Set(["storage-optimization", "storage-initialization"]);
+function isProceedDbStatus(status) {
+	return status === "available" || status !== void 0 && PROCEED_DB_STATUSES.has(status);
+}
+function isTerminalDbStatus(status) {
+	if (status === void 0) return false;
+	return TERMINAL_DB_STATUSES.has(status) || status.startsWith("inaccessible-") || status.startsWith("incompatible-") || status.endsWith("-failed");
+}
+function isTerminalDbWaitStatus(status) {
+	return status !== "inaccessible-encryption-credentials-recoverable" && isTerminalDbStatus(status);
+}
+async function settleBeforeFinalSnapshot(opts, startTime, budgetMs) {
+	const { noun, label, logicalId } = opts;
+	let delay = 5e3;
+	let graceSleptMs = 0;
+	let sawOff = false;
+	let sawTransitional = false;
+	for (;;) {
+		const current = await opts.read();
+		if (current === void 0) return;
+		const terminal = isTerminalDbStatus(current.status);
+		const operational = current.status !== "available" && isProceedDbStatus(current.status);
+		if (!isProceedDbStatus(current.status) && !terminal) sawTransitional = true;
+		if (current.deletionProtection === false) sawOff = true;
+		if (current.deletionProtection === false && (terminal || operational)) return;
+		if (current.deletionProtection === true && terminal) throw new Error(`--remove-protection turned DeletionProtection off, but the ${noun} still reads it ON in status '${current.status ?? "unknown"}', which does not change on its own, and the final snapshot its DeletionPolicy asks for needs it 'available'. The delete was not sent and the guard is put back; re-run the destroy once the ${noun} is 'available'`);
+		const settled = current.deletionProtection === false && current.status === "available";
+		const inGrace = !sawTransitional && graceSleptMs < 3e4;
+		if (settled && !inGrace) return;
+		const step = inGrace ? Math.min(delay, FLIP_TRANSITION_GRACE_MS - graceSleptMs) : delay;
+		if (Date.now() - startTime + step >= budgetMs) {
+			if (settled) return;
+			if (current.deletionProtection === false && current.status !== void 0 && current.status !== "modifying") return;
+			break;
+		}
+		opts.logger.debug(safeMsg`${label} ${logicalId}: waiting for the DeletionProtection change to settle before the final snapshot (status ${current.status ?? "unknown"})`);
+		await opts.sleep(step);
+		if (sawOff) graceSleptMs += step;
+		delay = Math.min(delay * 2, 1e4);
+	}
+	throw new Error(`--remove-protection turned DeletionProtection off, but the ${noun} did not return to 'available' within ${Math.max(1, Math.round(budgetMs / 6e4))} minutes, and the final snapshot its DeletionPolicy asks for needs it. The delete was not sent and the guard is put back; re-run the destroy once the ${noun} is 'available'`);
+}
+function isFinalSnapshotNotAvailableRefusal(error, stateFault) {
+	if (!(error instanceof Error) || error.name !== stateFault) return false;
+	return /(?:isn't|is not|isn’t) (?:currently )?in (?:the )?available state/i.test(error.message);
+}
+async function deleteAfterProtectionFlipWithFinalSnapshot(opts) {
+	const budgetMs = finalSnapshotWaitBudgetMs(opts);
+	const startTime = Date.now();
+	await settleBeforeFinalSnapshot(opts, startTime, budgetMs);
+	let delay = 5e3;
+	let refusals = 0;
+	for (;;) try {
+		await opts.send();
+		return;
+	} catch (error) {
+		if (!isFinalSnapshotNotAvailableRefusal(error, opts.stateFault)) throw error;
+		refusals += 1;
+		opts.logger.debug(safeMsg`${opts.label} ${opts.logicalId}: final-snapshot delete refused as not 'available' (refusal ${String(refusals)}); waiting for it to return to 'available' before retrying`);
+		for (;;) {
+			if (Date.now() - startTime + delay >= budgetMs) throw error;
+			await opts.sleep(delay);
+			delay = Math.min(delay * 2, 1e4);
+			const current = await opts.read();
+			if (current === void 0) break;
+			if (current.deletionProtection === false && isProceedDbStatus(current.status)) break;
+			if (current.deletionProtection === true || isTerminalDbStatus(current.status)) throw error;
+		}
+	}
+}
+
+// src/provisioning/import-helpers.ts
+function remedyLogicalId(logicalId) {
+	return isPasteableIdent(logicalId) ? logicalId : commandHole("logicalId");
+}
+function isPlainImportValue(value) {
+	return isPlainIdent(value, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS });
+}
+function isQuotableImportValue(value) {
+	return value.split("|").every((segment) => segment === "" || isPlainImportValue(segment));
+}
+function quotedRemedyLogicalId(logicalId) {
+	return isPasteableIdent(logicalId) ? logicalId : "<logicalId>";
+}
+function refusalTypeShown(resourceType) {
+	return resourceTypeShown(resourceType) === resourceType ? resourceType : "(resource type not shown: it is not a plain identifier)";
+}
+const VALUE_NOT_SHOWN = "(not shown: it is not a plain identifier)";
+const PLAIN_JSON = /^[A-Za-z0-9"{}[\]:,._@/+=~-]+$/;
+function isPlainImportJson(value) {
+	const json = JSON.stringify(value);
+	return typeof json === "string" && json.length <= 2048 && PLAIN_JSON.test(json);
+}
+function readNameProperty(input, propertyName) {
+	const value = input.properties?.[propertyName];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function resolveExplicitPhysicalId(input, nameProperty) {
+	if (input.knownPhysicalId) return input.knownPhysicalId;
+	if (nameProperty) {
+		const name = readNameProperty(input, nameProperty);
+		if (name) return name;
+	}
+}
+function normalizeAwsTagsToCfn(tags) {
+	if (!tags) return [];
+	const out = [];
+	if (Array.isArray(tags)) for (const t of tags) {
+		const obj = t;
+		const k = (typeof obj["Key"] === "string" ? obj["Key"] : void 0) ?? (typeof obj["TagKey"] === "string" ? obj["TagKey"] : void 0) ?? (typeof obj["key"] === "string" ? obj["key"] : void 0);
+		const v = (typeof obj["Value"] === "string" ? obj["Value"] : void 0) ?? (typeof obj["TagValue"] === "string" ? obj["TagValue"] : void 0) ?? (typeof obj["value"] === "string" ? obj["value"] : void 0);
+		if (typeof k !== "string" || k.length === 0) continue;
+		if (k.startsWith("aws:")) continue;
+		out.push({
+			Key: k,
+			Value: typeof v === "string" ? v : ""
+		});
+	}
+	else for (const [k, v] of Object.entries(tags)) {
+		if (!k || k.startsWith("aws:")) continue;
+		out.push({
+			Key: k,
+			Value: typeof v === "string" ? v : ""
+		});
+	}
+	out.sort((a, b) => a.Key < b.Key ? -1 : a.Key > b.Key ? 1 : 0);
+	return out;
+}
+
+// src/provisioning/region-check.ts
+function assertRegionMatch(clientRegion, expectedRegion, resourceType, logicalId, physicalId, phase = "not-found", endpoint = "regional") {
+	if (!expectedRegion) return;
+	if (!clientRegion) throw new ProvisioningError(phase === "not-found" ? `Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region is unknown but stack state expects ${expectedRegion}. The resource may exist in ${expectedRegion} and would be silently removed from state if this NotFound were trusted.` : `Refusing to ${phaseVerb(phase)} ${logicalId} (${resourceType}): AWS client region is unknown but stack state records the resource in ${expectedRegion}. ` + (endpoint === "global" ? `cdkd cannot confirm that this client was built for the stack this record belongs to, so the ${phaseVerb(phase)} is not issued. Point the ` : `cdkd cannot confirm that the physical id recorded in state names the resource this client would act on, so the ${phaseVerb(phase)} is not issued. Point the `) + `AWS client at ${expectedRegion} (AWS_REGION or your AWS profile) and re-run.`, resourceType, logicalId, physicalId);
+	if (clientRegion !== expectedRegion) throw new ProvisioningError(phase === "not-found" ? `Refusing to treat NotFound as idempotent delete success for ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. The resource likely still exists in ${expectedRegion}; rerun the destroy with the correct region (e.g. --region ${expectedRegion}).` : `Refusing to ${phaseVerb(phase)} ${logicalId} (${resourceType}): AWS client region ${clientRegion} does not match stack state region ${expectedRegion}. ` + (endpoint === "global" ? `This service has one global endpoint, so the call would reach the same resource, but a client in ${clientRegion} was not built for the stack this ${expectedRegion} record belongs to, so the ${phaseVerb(phase)} is not issued. ` : `The physical id recorded in cdkd state names a resource in ${expectedRegion}, so this ${phaseVerb(phase)} would act on whatever carries that id in ${clientRegion} instead — which for a name-shaped physical id is a different resource that usually exists. `) + `Point the AWS client at ${expectedRegion} (AWS_REGION or your AWS profile) and re-run; when the run spans several regions at once (cdkd drift --all), select the stacks in one region per run, because no single client region is correct for all of them. If the recorded region is the wrong one, correct the state record (cdkd state show).`, resourceType, logicalId, physicalId);
+}
+function phaseVerb(phase) {
+	return phase === "pre-update" ? "update" : "delete";
+}
+
+// src/provisioning/not-gone.ts
+const NOT_GONE = Symbol.for("cdkd.notGone");
+const MAX_DEPTH = 10;
+function markNotGone(error) {
+	try {
+		if (typeof error !== "object" || error === null || !Object.isExtensible(error)) return error;
+		Object.defineProperty(error, NOT_GONE, {
+			value: true,
+			enumerable: false,
+			writable: false,
+			configurable: true
+		});
+	} catch {}
+	return error;
+}
+function isMarkedNotGone(error) {
+	try {
+		let current = error;
+		for (let depth = 0; depth < MAX_DEPTH && typeof current === "object" && current !== null; depth++) {
+			if (Object.prototype.hasOwnProperty.call(current, NOT_GONE)) return true;
+			current = current.cause;
+		}
+	} catch {}
+	return false;
+}
+
+// src/types/resource.ts
+const RESOURCE_NOT_FOUND = Symbol("cdkd.resourceNotFound");
+
+// src/provisioning/providers/ambiguous-create.ts
+const CREATION_DATE_SKEW_MARGIN_MS = 5e3;
+const AMBIGUOUS_LATCH_TTL_MS = 18e5;
+const MAX_TRACKED = 1e4;
+const createAttemptKey = (scope, logicalId) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId);
+const setBounded = (map, key, value) => {
+	if (!map.has(key) && map.size >= MAX_TRACKED) {
+		const oldest = map.keys().next();
+		if (!oldest.done) map.delete(oldest.value);
+	}
+	map.set(key, value);
+};
+const replayedInSend = (output) => {
+	const attempts = output?.$metadata?.attempts;
+	return typeof attempts === "number" && attempts > 1;
+};
+const isObject = (value) => typeof value === "object" && value !== null;
+const sendsAfterAmbiguous = /* @__PURE__ */ new WeakSet();
+const outputsAfterAmbiguous = /* @__PURE__ */ new WeakSet();
+const markReplayFollowedAmbiguous = (output) => {
+	if (isObject(output)) outputsAfterAmbiguous.add(output);
+};
+const replayFollowedAmbiguousAttempt = (output) => isObject(output) && outputsAfterAmbiguous.has(output);
+const AMBIGUOUS_REPLAY_MIDDLEWARE = "cdkdAmbiguousReplayMiddleware";
+const trackAmbiguousReplays = (client) => {
+	const stack = client.middlewareStack;
+	if (typeof stack?.addRelativeTo !== "function") return;
+	stack.addRelativeTo((next) => async (args) => {
+		try {
+			const result = await next(args);
+			if (sendsAfterAmbiguous.has(args)) markReplayFollowedAmbiguous(result.output);
+			return result;
+		} catch (error) {
+			if (isAmbiguousOutcomeError(error)) sendsAfterAmbiguous.add(args);
+			throw error;
+		}
+	}, {
+		name: AMBIGUOUS_REPLAY_MIDDLEWARE,
+		relation: "after",
+		toMiddleware: "retryMiddleware",
+		override: true
+	});
+};
+const replayedSendWindow = (output, attemptStartMs) => replayedInSend(output) ? {
+	floorMs: attemptStartMs - CREATION_DATE_SKEW_MARGIN_MS,
+	ceilingMs: Date.now() + CREATION_DATE_SKEW_MARGIN_MS,
+	replayedInSend: true
+} : void 0;
+const ambiguousAttemptLead = (action, logicalId, window) => window.replayedInSend === true ? `The ${action} call for ${logicalId} succeeded only after the AWS SDK sent it again, following an attempt that failed without a definite answer` : `An earlier ${action} attempt for ${logicalId} failed without a definite answer`;
+const mergeWindow = (existing, next, armedAtMs) => existing === void 0 ? {
+	floorMs: next.floorMs,
+	ceilingMs: next.ceilingMs,
+	armedAtMs
+} : {
+	floorMs: Math.min(existing.floorMs, next.floorMs),
+	ceilingMs: Math.max(existing.ceilingMs, next.ceilingMs),
+	armedAtMs: Math.max(existing.armedAtMs, armedAtMs)
+};
+var AmbiguousCreateLatch = class {
+	entries = /* @__PURE__ */ new Map();
+	scope;
+	constructor(scope) {
+		this.scope = scope;
+	}
+	noteFailure(logicalId, error, attemptStartMs, carried) {
+		if (!isAmbiguousOutcomeError(error) && !hasReplayMayCollide(error)) return;
+		const key = createAttemptKey(this.scope, logicalId);
+		const now = Date.now();
+		let entry = mergeWindow(this.entries.get(key), {
+			floorMs: attemptStartMs - CREATION_DATE_SKEW_MARGIN_MS,
+			ceilingMs: now + CREATION_DATE_SKEW_MARGIN_MS
+		}, now);
+		if (carried !== void 0) entry = mergeWindow(entry, carried, now);
+		setBounded(this.entries, key, entry);
+	}
+	take(logicalId) {
+		const key = createAttemptKey(this.scope, logicalId);
+		const entry = this.entries.get(key);
+		this.entries.delete(key);
+		if (entry === void 0 || Date.now() - entry.armedAtMs > 18e5) return;
+		return {
+			floorMs: entry.floorMs,
+			ceilingMs: entry.ceilingMs
+		};
+	}
+	resetForTests() {
+		this.entries.clear();
+	}
+};
+const isInsideWindow = (date, window) => date !== void 0 && date.getTime() >= window.floorMs && date.getTime() <= window.ceilingMs;
+var RecentIdSet = class {
+	ids = /* @__PURE__ */ new Map();
+	add(id) {
+		setBounded(this.ids, id, true);
+	}
+	has(id) {
+		return this.ids.has(id);
+	}
+	resetForTests() {
+		this.ids.clear();
+	}
+};
+const isRetryStrategyV2 = (value) => typeof value === "object" && value !== null && typeof value.acquireInitialRetryToken === "function" && typeof value.refreshRetryTokenForRetry === "function" && typeof value.recordSuccess === "function";
+function withoutServerErrorRetries(client) {
+	const config = client.config;
+	const base = config?.retryStrategy;
+	if (config === void 0 || typeof base !== "function") return client;
+	trackAmbiguousReplays(client);
+	const resolveBase = base;
+	const afterAmbiguous = /* @__PURE__ */ new WeakSet();
+	config.retryStrategy = async () => {
+		const strategy = await resolveBase();
+		if (!isRetryStrategyV2(strategy)) return strategy;
+		return {
+			acquireInitialRetryToken: (scope) => strategy.acquireInitialRetryToken(scope),
+			refreshRetryTokenForRetry: async (token, errorInfo) => {
+				const ambiguous = isAmbiguousOutcomeError(errorInfo.error);
+				const replayed = isObject(token) && afterAmbiguous.has(token);
+				if (replayed) markReplayMayCollide(errorInfo.error);
+				if (ambiguous && isTransientServerError(errorInfo.error)) throw new Error("cdkd: no SDK retry of a 5xx on a tokenless create");
+				const next = await strategy.refreshRetryTokenForRetry(token, errorInfo);
+				if ((ambiguous || replayed) && isObject(next)) afterAmbiguous.add(next);
+				return next;
+			},
+			recordSuccess: (token) => strategy.recordSuccess(token)
+		};
+	};
+	return client;
+}
+
+// src/provisioning/update-removal.ts
+function clearOnUpdateRemoval(newValue, previousValue, clearValue) {
+	if (newValue !== void 0) return newValue;
+	if (previousValue !== void 0) return clearValue;
+}
+const NONE = Object.freeze([]);
+const NONE_REMOVED = /* @__PURE__ */ new Set();
+function removedTemplateKeys(baseline, desired) {
+	if (typeof baseline !== "object" || baseline === null || Array.isArray(baseline)) return NONE;
+	let removed;
+	for (const key of Object.keys(baseline)) if (baseline[key] !== void 0 && desired[key] === void 0) (removed ??= []).push(key);
+	return removed ?? NONE;
+}
+function copyDeclared(value) {
+	if (Array.isArray(value)) return value.map(copyDeclared);
+	if (typeof value !== "object" || value === null) return value;
+	const out = {};
+	for (const [key, member] of Object.entries(value)) out[key] = copyDeclared(member);
+	return out;
+}
+function injectDeclared(declared, removed, properties) {
+	if (declared === void 0) return properties;
+	let out;
+	for (const key of removed) {
+		if (!declared.has(key)) continue;
+		out ??= { ...properties };
+		out[key] = copyDeclared(declared.get(key));
+	}
+	return out ?? properties;
+}
+function withoutInjectedRemovals(result, injected) {
+	const effective = result.effectiveProperties;
+	if (effective === void 0 || !injected.some((key) => Object.hasOwn(effective, key))) return result;
+	const recorded = { ...effective };
+	for (const key of injected) delete recorded[key];
+	return {
+		...result,
+		effectiveProperties: recorded
+	};
+}
+function prepareRemovalForUpdate(provider, resourceType, desired, baseline) {
+	const removed = removedTemplateKeys(baseline, desired);
+	const context = { removedProperties: removed.length === 0 ? NONE_REMOVED : new Set(removed) };
+	if (removed.length === 0) return {
+		properties: desired,
+		injected: NONE,
+		context,
+		unhandled: NONE
+	};
+	const declared = provider.removalDefaults?.get(resourceType);
+	const handled = provider.removalHandledInUpdate?.get(resourceType);
+	const properties = injectDeclared(declared, removed, desired);
+	const injected = declared === void 0 ? NONE : removed.filter((key) => declared.has(key));
+	if (handled === void 0) return {
+		properties,
+		injected,
+		context,
+		unhandled: NONE
+	};
+	return {
+		properties,
+		injected,
+		context,
+		unhandled: removed.filter((key) => !declared?.has(key) && !handled.has(key))
+	};
+}
+function withRemovalDefaults(declarations, resourceType, properties, previousProperties, context) {
+	if (context?.removedProperties !== void 0) return properties;
+	const declared = declarations?.get(resourceType);
+	if (declared === void 0) return properties;
+	return injectDeclared(declared, removedTemplateKeys(previousProperties, properties), properties);
+}
+function removalWarning(logicalId, resourceType, unhandled, caller = "deploy") {
+	const one = unhandled.length === 1;
+	const names = `${one ? "property" : "properties"} ${unhandled.join(", ")}`;
+	return caller === "rollback" ? safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "is" : "are"} absent from the state being restored; the rollback leaves the value the failed deploy applied in place (CloudFormation would reset it to its default).` : safeMsg`${logicalId} (${resourceType}): ${names} ${one ? "was" : "were"} removed from the template; cdkd leaves the current AWS value in place (CloudFormation would reset it to its default).`;
+}
+
+// src/provisioning/iam-policy-targets.ts
+const IAM_PRINCIPAL_NAME = /^[\w+=,.@-]{1,128}$/;
+function readRecordedPrincipals(value) {
+	if (value === void 0 || value === null) return { kind: "absent" };
+	if (!Array.isArray(value)) return {
+		kind: "malformed",
+		detail: `found ${typeof value}`
+	};
+	if (!value.every((v) => typeof v === "string" && IAM_PRINCIPAL_NAME.test(v))) return {
+		kind: "malformed",
+		detail: `a ${value.length}-element list holding a non-name entry`
+	};
+	return {
+		kind: "names",
+		names: value
+	};
+}
+function readPrincipalLists(values) {
+	const lists = {};
+	const malformed = [];
+	const secretDerived = [];
+	for (const key of Object.keys(values)) {
+		const value = values[key];
+		const recorded = readRecordedPrincipals(value);
+		if (recorded.kind === "malformed") {
+			malformed.push(key);
+			if (holdsSecretDerivedEntry(value)) secretDerived.push(key);
+		} else lists[key] = recorded.kind === "names" ? recorded.names : void 0;
+	}
+	return malformed.length > 0 ? {
+		lists,
+		malformed,
+		secretDerived
+	} : { lists };
+}
+const SECRET_MASK = "***";
+function holdsSecretDerivedEntry(value) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (v, depth) => {
+		if (typeof v === "string") return v === SECRET_MASK || v.includes("{{resolve:");
+		if (typeof v !== "object" || v === null || depth > 64 || seen.has(v)) return false;
+		seen.add(v);
+		if (Array.isArray(v)) return v.some((e) => walk(e, depth + 1));
+		return Object.entries(v).some(([k, e]) => walk(k, depth + 1) || walk(e, depth + 1));
+	};
+	return walk(value, 0);
+}
+function onlySecretDerived(read) {
+	return "malformed" in read && read.malformed.every((k) => read.secretDerived.includes(k));
+}
+function recordedPrincipalsRepair(malformed, secretDerived, what, secretDerivedRepair) {
+	const plain = malformed.filter((k) => !secretDerived.includes(k));
+	const parts = [];
+	if (plain.length > 0) parts.push(`repair the recorded ${plain.join(" / ")} in state.json to a list of ${what} and re-run`);
+	if (secretDerived.length > 0) parts.push(`the recorded ${secretDerived.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json; ` + secretDerivedRepair);
+	return parts.join("; ");
+}
+const SECRET_DERIVED_READ_LIVE = "cdkd reads it from IAM instead once every other list is well-formed";
+const RESOLVED_PREVIOUS_PRINCIPAL_KEYS = {
+	"AWS::IAM::Policy": [
+		"Roles",
+		"Groups",
+		"Users"
+	],
+	"AWS::IAM::UserToGroupAddition": ["Users"]
+};
+const ATTACHMENT_TARGET_KEY = {
+	"AWS::IAM::Policy": "PolicyName",
+	"AWS::IAM::UserToGroupAddition": "GroupName"
+};
+function holdsMask(value) {
+	if (typeof value === "string") return value === SECRET_MASK;
+	if (Array.isArray(value)) return value.some(holdsMask);
+	if (typeof value === "object" && value !== null) return Object.values(value).some(holdsMask);
+	return false;
+}
+function providerRecordedTarget(resourceType, physicalId) {
+	if (resourceType !== "AWS::IAM::Policy") return void 0;
+	return physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
+}
+function withUnchangedSecretPrincipalLists(resourceType, physicalId, previous, desiredRedacted) {
+	const untouched = {
+		previous,
+		dropped: []
+	};
+	const keys = Object.prototype.hasOwnProperty.call(RESOLVED_PREVIOUS_PRINCIPAL_KEYS, resourceType) ? RESOLVED_PREVIOUS_PRINCIPAL_KEYS[resourceType] : [];
+	if (keys.length === 0) return untouched;
+	const target = ATTACHMENT_TARGET_KEY[resourceType];
+	const recordedTarget = previous[target];
+	const derivedTarget = providerRecordedTarget(resourceType, physicalId);
+	if (holdsSecretDerivedEntry(recordedTarget) || JSON.stringify(recordedTarget) !== JSON.stringify(desiredRedacted[target]) || derivedTarget !== void 0 && recordedTarget !== derivedTarget) return untouched;
+	const rewritten = [];
+	for (const key of keys) {
+		if (!Object.prototype.hasOwnProperty.call(previous, key)) continue;
+		const recorded = previous[key];
+		if (!holdsSecretDerivedEntry(recorded)) continue;
+		const redacted = desiredRedacted[key];
+		if (!Array.isArray(recorded) || !Array.isArray(redacted) || holdsMask(recorded)) return untouched;
+		const kept = [];
+		for (const entry of recorded) {
+			if (!holdsSecretDerivedEntry(entry)) {
+				kept.push(entry);
+				continue;
+			}
+			if (typeof entry !== "string" || !redacted.includes(entry)) return untouched;
+		}
+		rewritten.push([key, kept]);
+	}
+	if (rewritten.length === 0) return untouched;
+	const out = { ...previous };
+	for (const [key, kept] of rewritten) out[key] = kept;
+	return {
+		previous: out,
+		dropped: rewritten.map(([key]) => key)
+	};
+}
+
+// src/provisioning/created-resource-sink.ts
+var CreatedResourceSink = class {
+	logicalId;
+	resourceType;
+	reports = [];
+	constructor(logicalId, resourceType) {
+		this.logicalId = logicalId;
+		this.resourceType = resourceType;
+	}
+	get report() {
+		return this.reports.at(-1);
+	}
+	record(report) {
+		this.reports.push(report);
+	}
+	clear() {
+		this.reports.length = 0;
+	}
+	retract(physicalId) {
+		for (let i = this.reports.length - 1; i >= 0; i--) if (this.reports[i].physicalId === physicalId) this.reports.splice(i, 1);
+	}
+};
+const storage = new AsyncLocalStorage();
+function collectCreatedResources(sink, fn) {
+	return storage.run(sink, fn);
+}
+function clearCreatedReport() {
+	storage.getStore()?.clear();
+}
+function anchoredSink(ownerLogicalId, resourceType) {
+	const sink = storage.getStore();
+	return sink !== void 0 && sink.logicalId === ownerLogicalId && sink.resourceType === resourceType ? sink : void 0;
+}
+function reportCreatedResource(ownerLogicalId, resourceType, physicalId, createdResourceIdentity) {
+	try {
+		if (typeof physicalId !== "string" || physicalId === "") return;
+		anchoredSink(ownerLogicalId, resourceType)?.record({
+			physicalId,
+			...typeof createdResourceIdentity === "string" && createdResourceIdentity !== "" && { createdResourceIdentity }
+		});
+	} catch {}
+}
+function reportedCreatedResource(ownerLogicalId, resourceType) {
+	try {
+		return anchoredSink(ownerLogicalId, resourceType)?.report;
+	} catch {
+		return;
+	}
+}
+function retractCreatedResource(ownerLogicalId, resourceType, physicalId) {
+	try {
+		anchoredSink(ownerLogicalId, resourceType)?.retract(physicalId);
+	} catch {}
+}
+
+export { isTerminalDeleteFailure as $, physicalIdShownBesideCommand as $n, formatLockExpiry as $t, setBounded as A, MalformedProducerRecordRefusalError as An, isThrottlingError as Ar, stateOrphanRecordRemedy as At, normalizeAwsTagsToCfn as B, formatError as Bn, createdBeforeFailure as Bt, AmbiguousCreateLatch as C, DeploymentNotApprovedError as Cn, isExplicitDenyError as Cr, compositeIdFormatMessage as Ct, isInsideWindow as D, LocalStartServiceError as Dn, retryClassificationText as Dr, packCompositeId as Dt, createAttemptKey as E, LocalInvokeBuildError as En, isTransientServerError as Er, logicalIdShown as Et, assertRegionMatch as F, ResourceUpdateNotSupportedError as Fn, maskerOrIdentity as Ft, PROTECTION_FLIP_REUSE_WINDOW_MS as G, TIMEOUT_FLAG_RESOURCE_TYPE as Gn, markAuxiliaryFailure as Gt, refusalTypeShown as H, isSoftAbort as Hn, hasCreatedBeforeFailure as Ht, VALUE_NOT_SHOWN as I, StackHasActiveImportsError as In, withDerivedNameMasks as It, deleteAfterProtectionFlipWithFinalSnapshot as J, UNSHOWABLE_VALUE as Jn, replayMadeAnotherResource as Jt, ProtectionFlipRegistry as K, SHELL_ACTIVE as Kn, markCreatedBeforeFailure as Kt, isPlainImportJson as L, StackTerminationProtectionError as Ln, RETRY_AUXILIARY_OWNER as Lt, RESOURCE_NOT_FOUND as M, PartialFailureError as Mn, markRedactedCause as Mr, createMaskedRetryLogger as Mt, isMarkedNotGone as N, ProvisioningError as Nn, wrapMaskedAwsError as Nr, isSecretDerivedValue as Nt, replayFollowedAmbiguousAttempt as O, LockError as On, THROTTLING_ERROR_NAMES as Or, resourceTypeShown as Ot, markNotGone as P, ResourceTimeoutError as Pn, maskDeep as Pt, isTerminalDbWaitStatus as Q, pasteableCommand as Qn, forceQuitRecoveryClause as Qt, isPlainImportValue as R, StateError as Rn, carryCreatedBeforeFailure as Rt, AMBIGUOUS_LATCH_TTL_MS as S, DeployCancelledError as Sn, isAmbiguousOutcomeError as Sr, canonicalizeRoute53QueryName as St, ambiguousAttemptLead as T, IntrinsicResolutionRefusalError as Tn, isRetryableTransientError as Tr, compositeIdSkipResult as Tt, remedyLogicalId as U, normalizeAwsError as Un, isAuxiliaryFailure as Ut, quotedRemedyLogicalId as V, isCdkdError as Vn, createdResourceIdentityBeforeFailure as Vt, resolveExplicitPhysicalId as W, withErrorHandling as Wn, isAuxiliaryMarkOf as Wt, isFinalSnapshotNotAvailableRefusal as X, hasClauseBreak as Xn, buildForceUnlockCommand as Xt, deleteWithProtectionCompensation as Y, commandHole as Yn, UNREPRODUCIBLE_LOCK_CLAUSE as Yt, isProceedDbStatus as Z, isInertUnquoted as Zn, buildLockContentionMessage as Zt, prepareRemovalForUpdate as _, AssetError as _n, stripControlChars as _r, beginCommandInterruptScope as _t, reportedCreatedResource as a, DEFAULT_STATE_PREFIX as an, setPasteableRunFlags as ar, settleProtectionFlip as at, withRemovalDefaults as b, CrossAccountSecretRefusalError as bn, formatRetryClassificationSignals as br, isInterruptedWaitError as bt, RESOLVED_PREVIOUS_PRINCIPAL_KEYS as c, producerCoordinateKey as cn, hasReplayMayCollide as cr, UNNAMEABLE_ID_CLAUSE as ct, onlySecretDerived as d, withPasteableAwsProfile as dn, isRecreateRetryableError as dr, pasteableAwsCommand as dt, formatLockOperation as en, plainOrDescribed as er, logGroupProtectionSite as et, readPrincipalLists as f, ambientClientDefaults as fn, isReplayedNameCollisionFrom as fr, protectedReplacementAdvice as ft, clearOnUpdateRemoval as g, AccountIdUnavailableError as gn, escapeRegExp as gr, monotonicNowMs as gt, withUnchangedSecretPrincipalLists as h, credentialFingerprint as hn, relayedNameCollision as hr, ElapsedBudgetRegistry as ht, reportCreatedResource as i, CUSTOM_RESOURCE_RESPONSE_PREFIX as in, withheldTargetClause as ir, runDeleteAttempt as it, withoutServerErrorRetries as j, NestedStackChildDirectDestroyError as jn, markNonRetryable as jr, createMaskedLogSinks as jt, replayedSendWindow as k, MacroExpansionError as kn, isMarkedNonRetryable as kr, segmentAfterAnchor as kt, SECRET_DERIVED_READ_LIVE as l, producerRecordKey as ln, isNameCollisionErrorFrom as lr, WITHHELD_AWS_COMMAND as lt, recordedPrincipalsRepair as m, clientDefaultsFor as mn, markReplayMayCollide as mr, ElapsedBudget as mt, clearCreatedReport as n, recoveryCommandFlags as nn, shellBoundedDisplay as nr, protectionFlipKey as nt, retractCreatedResource as o, injectiveKey as on, setPasteableVerbFlags as or, userPoolProtectionSite as ot, readRecordedPrincipals as p, ambientCredentialConfig as pn, markNameCollision as pr, renderDisableCommand as pt, compensateProtectionFlip as q, SHELL_ACTIVE_WHY as qn, markSupersedesEarlierCreate as qt, collectCreatedResources as r, sanitizeRecoveryValue as rn, shellQuote as rr, rdsFamilyProtectionSite as rt, IAM_PRINCIPAL_NAME as s, injectiveKeyPrefix as sn, isUpdateUnsupportedError as sr, DELETION_PROTECTION_DOC_POINTER as st, CreatedResourceSink as t, formatLockOwner as tn, quotedOrDescribed as tr, observeThenDisableProtection as tt, holdsSecretDerivedEntry as u, setPasteableAwsProfile as un, isNameCooldownError as ur, isAwsCliLiteral as ut, removalWarning as v, CdkdError as vn, stripForDisplay as vr, endCommandInterruptScope as vt, RecentIdSet as w, DynamicReferenceRegionAmbiguousError as wn, isIamPropagationError as wr, compositeIdSeparatorRefusal as wt, withoutInjectedRemovals as x, DependencyError as xn, isAmbiguousCcHandlerErrorCode as xr, startInterruptWatch as xt, removedTemplateKeys as y, ConfigError as yn, explicitDenyPolicyKind as yr, interruptWatchListenerCount as yt, isQuotableImportValue as z, SynthesisError as zn, clearCreatedBeforeFailure as zt };
+//# sourceMappingURL=created-resource-sink-CmrPwGge.js.map