@go-to-k/cdkd 0.285.16 → 0.286.0

package/dist/{program-C-xfsrSP.js → program-BXXm1RTv.js}

@@ -1,8 +1,8 @@
-import { $ as endCommandInterruptScope, $n as resolveCaptureObservedState, $r as isThrottlingError, $t as maskSecretsInText, A as bold, An as getBootstrapMarkerKey, Ar as DeployCancelledError, At as classifyReplaySecretRegion, B as secretBearingStateKeyWarning, Bn as formatDockerLoginError, Br as ProvisioningError, Bt as describeTypeWithThrottleRetry, C as unsupportedFinalSnapshotError, Cn as rewriteTemplateAssetReferences, Cr as resetAwsClients, Ct as configBooleanRefusal, D as isStatefulRecreateTargetSync, Dn as BOOTSTRAP_MARKER_PREFIX, Dt as requireConfigArray, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as AssetModeResolver, Er as CdkdError, Et as replayWarn, F as yellow, Fn as validateContainerRepoName, Fr as LocalStartServiceError, Ft as s3BucketRegionalDomainName, G as clearOnUpdateRemoval, Gn as AssetManifestLoader, Gt as STATE_SOURCED_READBACK_RULES, H as getCurrentResourceSecrets, Hn as partitionSensitiveEnv, Hr as ResourceUpdateNotSupportedError, Ht as DagBuilder, I as collectDeclaredOutputNames, In as buildDenyExternalAccessPolicy, It as s3BucketWebsiteUrl, J as findSilentDropProperties, Jn as synthesisStatusMessage, Jt as createSecretMasker, K as ProviderRegistry, Kn as getDockerImageBySourceHash, Kt as TEMPLATE_SOURCED_RULES, L as collectPublishedOutputNames, Ln as describeAwsFailure, Lr as MissingCdkCliError, Lt as applyRoleArnIfSet, M as gray, Mn as parseBootstrapMarker, Mr as IntrinsicResolutionRefusalError, Mt as s3BucketArn, N as green, Nn as readBootstrapMarkerBody, Nr as LocalInvokeBuildError$1, Nt as s3BucketDomainName, O as renderStatefulReason, On as assertAssetBucketRegion, Or as CrossAccountSecretRefusalError, Ot as requireConfigObject, P as red, Pn as validateAssetBucketName, Pr as LocalMigrateError, Pt as s3BucketDualStackDomainName, Q as beginCommandInterruptScope, Qn as resolveAutoAssetStorage, Qr as isRetryableTransientError, Qt as maskSecretsInError, R as exportAliasCollisionScrubWarning, Rn as buildDockerImage, Rr as NestedStackChildDirectDestroyError, Rt as DiffCalculator, S as refusesFinalSnapshot, Sn as loadPublishableAssetManifest, Sr as getAwsClients, St as coerceCfnBoolean, T as extractDeploymentEventError, Tn as stripControlChars, Tt as readConfigString, U as IAMRoleProvider, Un as runDockerForeground, Ur as StackHasActiveImportsError, Ut as TemplateParser, V as stateKeySecretExposure, Vn as getDockerCmd, Vr as ResourceTimeoutError, Vt as withRetry, W as collectInlinePolicyNamesManagedBySiblings, Wn as runDockerStreaming, Wr as StackTerminationProtectionError, Wt as STATE_SOURCED_CROSS_GENERATION_RULES, X as maskDeep, Xn as getLegacyStateBucketName, Xr as withErrorHandling, Xt as errorCauseChain, Y as createMaskedRetryLogger, Yn as getDefaultStateBucketName, Yr as normalizeAwsError, Yt as dynamicReferenceTokens, Z as maskerOrIdentity, Zn as resolveApp, Zr as isMarkedNonRetryable, Zt as isSingleDynamicReferenceToken, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as AssetPublisher, _r as AssemblyReader, _t as refStateLookupFromResource, a as DeploymentEventsStore, an as S3StateBackend, ar as warnDeprecatedNoPrefixCliFlag, at as UNSPECIFIED_SKIP_REASON, b as createPreDeleteFinalSnapshot, bn as buildAssetRedirectMap, br as resolveBucketRegion, bt as resolveExplicitPhysicalId, c as replayFailedOperations, cn as buildForceUnlockCommand, cr as MIGRATE_TMP_PREFIX, ct as disableInstanceApiTermination, d as updatePartialReason, dn as CUSTOM_RESOURCE_RESPONSE_PREFIX, dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, dt as carriesDynamicReference, ei as isTransientServerError, en as recordMaskOnlyValue, er as resolveSkipPrefix, et as interruptWatchListenerCount, f as withResourceDeadline, fn as DEFAULT_STATE_PREFIX, fr as displaySafe, ft as cfnRefValueFromPhysicalId, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as shouldRetainResource, gr as derivePartitionAndUrlSuffix, gt as parameterTypeMayLoseSecretIdentity, h as computeImplicitDeleteEdges, hn as importableOutputs, hr as canonicalizeRegion, ht as isUnboundTemplateParameter, i as DeploymentEventsReader, in as LockManager, ir as stateBucketExistenceConfirmed, it as slowCcOperationTimeoutMs, j as cyan, jn as isCrossRegionRedirect, jr as DynamicReferenceRegionAmbiguousError, jt as producerRegionsFromState, k as formatResourceLine, kn as ensureAssetStorage, kt as requireConfigString, l as replayRollback, ln as buildLockContentionMessage, lr as findLargeInlineResources, lt as isTerminationProtectionPropagationError, m as IMPLICIT_DELETE_DEPENDENCIES, mn as importableOutputKeys, mr as PARTITION_TABLE, mt as getAccountInfo, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as markRedactedCause, nn as redactSecretsForState, nr as resolveStateBucketWithDefaultAndSource, nt as startInterruptWatch, o as planFailedOps, on as rebuildClientForBucketRegion, or as CFN_TEMPLATE_BODY_LIMIT, ot as deleteIndeterminateGuards, p as maskingRetryLogger, pn as exportNamesCarriedFrom, pr as expectedOwnerParam, pt as coerceParameterTypedValue, q as findActionableSilentDrops, qn as Synthesizer, qt as carriesSecretMask, r as DeployEngine, ri as retryClassificationText, rn as scrubResourceRecord, rr as resolveUseCdkBootstrapAssets, rt as CloudControlProvider, s as planRollback, sn as UNRENDERABLE, sr as CFN_TEMPLATE_URL_LIMIT, st as deleteSkipReason, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as markNonRetryable, tn as recoverMaskedOutput, tr as resolveStateBucketWithDefault, tt as isInterruptedWaitError, u as updatePartialMessage, un as forceQuitRecoveryClause, ur as uploadCfnTemplate, ut as IntrinsicFunctionResolver, v as buildFinalSnapshotIdentifier, vn as stringifyValue, vr as processStackMessages, vt as WAFv2WebACLProvider, w as makeCanonicalizePropertiesFn, wn as escapeRegExp, wr as setAwsClients, wt as configStringRefusal, x as isFinalSnapshotError, xn as createAssetRedirectResolver, xr as AwsClients, xt as assertRegionMatch, y as ccRoutedFinalSnapshotError, yn as WorkGraph, yt as normalizeAwsTagsToCfn, z as isExportAliasCollision, zn as dockerSpawnEnvWithSensitive, zr as PartialFailureError, zt as INTRINSIC_KEYS } from "./deploy-engine-DuFUy9D0.js";
+import { $ as beginCommandInterruptScope, $n as resolveAutoAssetStorage, $r as isTransientServerError, $t as maskSecretsInError, A as formatResourceLine, An as ensureAssetStorage, At as requireConfigString, B as isExportAliasCollision, Bn as dockerSpawnEnvWithSensitive, Br as ResourceTimeoutError, Bt as INTRINSIC_KEYS, C as unsupportedFinalSnapshotError, Cn as loadPublishableAssetManifest, Cr as getAwsClients, Ct as coerceCfnBoolean, D as isStatefulRecreateTargetForReplace, Dn as AssetModeResolver, Dr as CdkdError, Dt as replayWarn, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as stripControlChars, Et as readConfigString, F as red, Fn as validateAssetBucketName, Fr as LocalStartServiceError, Ft as s3BucketDualStackDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as runDockerStreaming, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as stateKeySecretExposure, Hn as getDockerCmd, Hr as StackHasActiveImportsError, Ht as withRetry, I as yellow, In as validateContainerRepoName, It as s3BucketRegionalDomainName, J as findActionableSilentDrops, Jn as Synthesizer, Jr as normalizeAwsError, Jt as carriesSecretMask, K as clearOnUpdateRemoval, Kn as AssetManifestLoader, Kt as STATE_SOURCED_READBACK_RULES, L as collectDeclaredOutputNames, Ln as buildDenyExternalAccessPolicy, Lr as NestedStackChildDirectDestroyError, Lt as s3BucketWebsiteUrl, M as cyan, Mn as isCrossRegionRedirect, Mr as DynamicReferenceRegionAmbiguousError, Mt as producerRegionsFromState, N as gray, Nn as parseBootstrapMarker, Nr as IntrinsicResolutionRefusalError, Nt as s3BucketArn, O as isStatefulRecreateTargetSync, On as BOOTSTRAP_MARKER_PREFIX, Ot as requireConfigArray, P as green, Pn as readBootstrapMarkerBody, Pr as LocalInvokeBuildError$1, Pt as s3BucketDomainName, Q as maskerOrIdentity, Qn as resolveApp, Qr as isThrottlingError, Qt as isSingleDynamicReferenceToken, R as collectPublishedOutputNames, Rn as describeAwsFailure, Rr as PartialFailureError, Rt as applyRoleArnIfSet, S as refusesFinalSnapshot, Sn as createAssetRedirectResolver, Sr as AwsClients, St as assertRegionMatch, T as extractDeploymentEventError, Tn as escapeRegExp, Tr as setAwsClients, Tt as configStringRefusal, U as getCurrentResourceSecrets, Un as partitionSensitiveEnv, Ur as StackTerminationProtectionError, Ut as DagBuilder, V as secretBearingStateKeyWarning, Vn as formatDockerLoginError, Vr as ResourceUpdateNotSupportedError, Vt as describeTypeWithThrottleRetry, W as IAMRoleProvider, Wn as runDockerForeground, Wt as TemplateParser, X as createMaskedRetryLogger, Xn as getDefaultStateBucketName, Xr as isMarkedNonRetryable, Xt as dynamicReferenceTokens, Y as findSilentDropProperties, Yn as synthesisStatusMessage, Yr as withErrorHandling, Yt as createSecretMasker, Z as maskDeep, Zn as getLegacyStateBucketName, Zr as isRetryableTransientError, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shouldRetainResource, _r as derivePartitionAndUrlSuffix, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as LockManager, ar as stateBucketExistenceConfirmed, at as slowCcOperationTimeoutMs, b as createPreDeleteFinalSnapshot, bn as WorkGraph, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as UNRENDERABLE, cr as CFN_TEMPLATE_URL_LIMIT, ct as deleteSkipReason, d as updatePartialReason, dn as forceQuitRecoveryClause, dr as uploadCfnTemplate, dt as IntrinsicFunctionResolver, ei as markNonRetryable, en as maskSecretsInText, er as resolveCaptureObservedState, et as endCommandInterruptScope, f as withResourceDeadline, fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, fr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ft as carriesDynamicReference, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as importableOutputs, gr as canonicalizeRegion, gt as isUnboundTemplateParameter, h as computeImplicitDeleteEdges, hn as importableOutputKeys, hr as PARTITION_TABLE, ht as getAccountInfo, i as DeploymentEventsReader, in as scrubResourceRecord, ir as resolveUseCdkBootstrapAssets, it as CloudControlProvider, j as bold, jn as getBootstrapMarkerKey, jr as DeployCancelledError, jt as classifyReplaySecretRegion, k as renderStatefulReason, kn as assertAssetBucketRegion, kr as CrossAccountSecretRefusalError, kt as requireConfigObject, l as replayRollback, ln as buildForceUnlockCommand, lr as MIGRATE_TMP_PREFIX, lt as disableInstanceApiTermination, m as IMPLICIT_DELETE_DEPENDENCIES, mn as exportNamesCarriedFrom, mr as expectedOwnerParam, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as retryClassificationText, nn as recoverMaskedOutput, nr as resolveStateBucketWithDefault, nt as isInterruptedWaitError, o as planFailedOps, on as S3StateBackend, or as warnDeprecatedNoPrefixCliFlag, ot as UNSPECIFIED_SKIP_REASON, p as maskingRetryLogger, pn as DEFAULT_STATE_PREFIX, pr as displaySafe, pt as cfnRefValueFromPhysicalId, q as ProviderRegistry, qn as getDockerImageBySourceHash, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as redactSecretsForState, rr as resolveStateBucketWithDefaultAndSource, rt as startInterruptWatch, s as planRollback, sn as rebuildClientForBucketRegion, sr as CFN_TEMPLATE_BODY_LIMIT, st as deleteIndeterminateGuards, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as markRedactedCause, tn as recordMaskOnlyValue, tr as resolveSkipPrefix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as buildLockContentionMessage, ur as findLargeInlineResources, ut as isTerminationProtectionPropagationError, v as buildFinalSnapshotIdentifier, vn as AssetPublisher, vr as AssemblyReader, vt as refStateLookupFromResource, w as makeCanonicalizePropertiesFn, wn as rewriteTemplateAssetReferences, wr as resetAwsClients, wt as configBooleanRefusal, x as isFinalSnapshotError, xn as buildAssetRedirectMap, xr as resolveBucketRegion, xt as resolveExplicitPhysicalId, y as ccRoutedFinalSnapshotError, yn as stringifyValue, yr as processStackMessages, yt as WAFv2WebACLProvider, z as exportAliasCollisionScrubWarning, zn as buildDockerImage, zr as ProvisioningError, zt as DiffCalculator } from "./deploy-engine-DYYs56Gt.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-C_ZRHikq.js";
-import { t as ASGProvider } from "./asg-provider-DoP-32eU.js";
+import { t as getCdkdVersion } from "./version-Dkd6KwPz.js";
+import { t as ASGProvider } from "./asg-provider-D9Lc_ngz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -20,15 +20,15 @@ import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSec
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
 import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, CreateOriginAccessControlCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, DeleteOriginAccessControlCommand, DistributionAlreadyExists, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, GetOriginAccessControlCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, NoSuchOriginAccessControl, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand, UpdateOriginAccessControlCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DeleteAnomalyDetectorCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutAnomalyDetectorCommand, PutMetricAlarmCommand, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
-import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
+import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DescribeLogStreamsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$6, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$7, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-elasticache";
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -779,8 +779,8 @@ const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <lo
 * force would create a false sense of granularity (the user is opting
 * into a footgun; pretending to scope it per-resource is misleading).
 */
-const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Confirm a data-losing destroy + recreate of a stateful resource. Required whenever a replacement target is a stateful type — databases, filesystems, KMS keys, table / vector storage, source repositories, log groups with retention, and more; docs/cli-deploy-safety.md carries the full list, and S3 is the special case (a non-empty bucket at pre-flight, ANY bucket mid-deploy, where the emptiness probe cannot run) — on the --recreate-via-cc-api / --recreate-via-sdk-provider pre-flight, with --replace, AND on the paths a plain deploy reaches with no flag: a template immutable-property change, and an in-place update the provisioning layer rejects. Destroy + recreate loses ALL data in the resource — no automatic data migration. Full opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
-const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / S3 with data / Logs with retention / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE.").default(false);
+const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Confirm a data-losing destroy + recreate of a stateful resource. Required whenever a replacement target is a stateful type on the --recreate-via-cc-api / --recreate-via-sdk-provider pre-flight, with --replace, AND on the paths a plain deploy reaches with no flag: a template immutable-property change, and an in-place update the provisioning layer rejects. Stateful types are databases, filesystems, KMS keys, table / vector storage, source repositories, and more; docs/cli-deploy-safety.md carries the full list. S3 buckets and log groups are the conditional cases: at pre-flight, a non-empty bucket, or a log group with retention, with log streams, or whose emptiness the probe could not settle; mid-deploy, ANY bucket or log group, because the emptiness probe cannot run there. The two probes differ on failure — the bucket fails open, the log group closed. Destroy + recreate loses ALL data in the resource — no automatic data migration. Full opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
+const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / any S3 bucket / any Logs log group / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE — mid-deploy neither emptiness probe can run, so both conditional types count as stateful there.").default(false);
 /**
 * Issue #1002 PR 2 — per-invocation legacy pin for asset destinations
 * (design §4.2). Shared by `deploy`, `diff`, `import`, and `publish-assets`
@@ -2495,12 +2495,15 @@ function isPromptAbortError(error) {
 *      no-op for fresh deploys and should error out with a clear
 *      message rather than silently apply.
 *   3. Stateful-resource guard: every named target whose resource type
-*      is in {@link STATEFUL_TYPES} (or conditionally stateful — S3
-*      bucket with objects, LogGroup with retention) MUST be matched
-*      by an explicit `--force-stateful-recreation` flag. The sync
-*      first-cut runs from the recorded properties alone; the live
-*      `s3:ListObjectVersions` probe (issue [#648]) promotes a `null`
-*      reason to `'has-objects'` when a bucket actually contains data.
+*      is in {@link STATEFUL_TYPES} (or conditionally stateful — an S3
+*      bucket holding objects, a LogGroup with retention or with log
+*      streams) MUST be matched by an explicit
+*      `--force-stateful-recreation` flag. The sync first-cut runs from
+*      the recorded properties alone; the live probes promote a `null`
+*      reason afterwards — `s3:ListObjectVersions` to `'has-objects'`
+*      when a bucket actually contains data (issue [#648]), and
+*      `logs:DescribeLogStreams` to `'has-log-events'` when a log group
+*      is not provably empty (issue [#2558]).
 *   4. Multi-region refusal: every named target whose resource type
 *      is in {@link MULTI_REGION_RECREATE_BLOCKED_TYPES} (e.g.
 *      `AWS::DynamoDB::GlobalTable`) is refused outright. Out of
@@ -2516,11 +2519,12 @@ function isPromptAbortError(error) {
 /**
 * Plan-time validation of the user's recreate-via-cc-api list.
 *
-* Pure with respect to AWS — does NOT probe S3 bucket emptiness. Wrap
-* the result with {@link probeAndRevalidateStateful} to promote S3
-* targets' `statefulReason` via a live `s3:ListObjectVersions` round-trip
-* before rendering errors. The deploy command does this; the validator
-* itself stays sync so unit tests don't need an S3 mock.
+* Pure with respect to AWS — does NOT probe S3 bucket emptiness, nor
+* log-group emptiness. Wrap the result with
+* {@link probeAndRevalidateStateful} to promote deferred targets'
+* `statefulReason` via a live round-trip before rendering errors. The
+* deploy command does this; the validator itself stays sync so unit tests
+* don't need AWS mocks.
 *
 * Input order is preserved; duplicate logical ids in the user's input
 * are deduplicated.
@@ -2681,63 +2685,162 @@ function renderRecreateTargetsErrors(validation) {
 	return lines.length > 0 ? lines.join("\n") : null;
 }
 /**
-* Async S3 object probe (issue [#648]).
-*
-* For every `AWS::S3::Bucket` target whose sync {@link StatefulReason}
-* is `null` (the sync map defers — see {@link isStatefulRecreateTargetSync}),
-* issues a single-page `ListObjectVersions(MaxKeys=1)` against the
-* bucket's recorded physical id. When the bucket has at least one
-* current object, prior version, OR delete-marker, promotes the
-* target's `statefulReason` to `'has-objects'`.
-*
-* Uses `ListObjectVersions` rather than `ListObjectsV2` so the probe
-* mirrors the s3-bucket-provider's `emptyBucket` view: a versioned
-* bucket whose current keys have all been soft-deleted (so
-* `ListObjectsV2.KeyCount === 0`) still holds prior versions +
-* delete-markers that the destroy + recreate cycle would lose. Using
-* the same listing API as the provider ensures the probe and the
-* destroy path agree on "empty".
-*
-* **Soft-fail on probe errors**: if `ListObjectVersions` throws
-* (permission denied, bucket-not-found mid-flight, transient network
-* error), logs a warn and leaves the target's `statefulReason` at the
-* sync result (`null`). The user can decide to proceed without the
-* probe by passing `--force-stateful-recreation`.
-*
-* Returns a NEW array of targets; the input is not mutated. Non-S3
-* targets and S3 targets whose sync reason is already non-null are
-* passed through unchanged.
-*/
-async function probeStatefulRecreateTargetsAsync(targets, s3Client, logger = getLogger().child("recreate-targets")) {
+* Trim-then-lower-case, the pair `CloudControlProvider` applies to both sides
+* of its own region assert. `canonicalizeRegion` only lower-cases, so a state
+* record carrying stray whitespace would still fail a `!==` compare.
+*/
+function foldRegion(region) {
+	return canonicalizeRegion(region?.trim());
+}
+/**
+* Async emptiness probes for the two conditionally stateful types
+* (issues [#648] / [#2558]).
+*
+* For every target whose sync {@link StatefulReason} is `null` — which for
+* these two types means DEFER, not "not stateful" (see
+* {@link isStatefulRecreateTargetSync}) — issues one single-page listing and
+* promotes the reason when the resource is not provably empty:
+*
+*   - `AWS::S3::Bucket` → `ListObjectVersions(MaxKeys=1)` against the
+*     bucket's recorded physical id, promoting to `'has-objects'` when the
+*     bucket has at least one current object, prior version, OR
+*     delete-marker. `ListObjectVersions` rather than `ListObjectsV2` so the
+*     probe mirrors the s3-bucket-provider's `emptyBucket` view: a versioned
+*     bucket whose current keys have all been soft-deleted (so
+*     `ListObjectsV2.KeyCount === 0`) still holds prior versions +
+*     delete-markers that the destroy + recreate cycle would lose. Using the
+*     same listing API as the provider ensures the probe and the destroy path
+*     agree on "empty".
+*   - `AWS::Logs::LogGroup` → `DescribeLogStreams(limit=1)` against the log
+*     group's recorded name. Only ONE response shape leaves the target
+*     un-promoted: a PRESENT, zero-length `logStreams` with no `nextToken`.
+*     A page with a stream, an ABSENT `logStreams` (the SDK types it
+*     optional), and a zero-length page carrying a continuation token all
+*     promote to `'has-log-events'` — the last two are non-answers, and an
+*     unprovable emptiness must not read as empty. **Stream presence, not
+*     `storedBytes`,** and the choice is load-bearing in both directions:
+*       * Every log event belongs to a log stream, so ZERO streams is a
+*         structural proof that the group holds no events — the only kind of
+*         "empty" this guard may act on.
+*       * `LogStream.storedBytes` cannot be used at all: the SDK still
+*         declares the field, and the AWS API reference says "As of June 17,
+*         2019, this parameter is no longer supported for log streams, and is
+*         always reported as zero" (quoted verbatim in
+*         `@aws-sdk/client-cloudwatch-logs`'s own `LogStream.storedBytes`
+*         JSDoc, which also marks it `@deprecated`). A probe reading it would
+*         report EVERY log group empty.
+*       * The same SDK note says the log GROUP's own `storedBytes` is "not
+*         affected", so that field is not ruled out the way the stream's is —
+*         but cdkd does not read it either, and the ground is not a claim
+*         about how fresh it is (this repo has measured nothing about that).
+*         Stream presence needs no size semantics at all: zero streams is a
+*         STRUCTURAL proof, and it over-blocks rather than under-blocks (a
+*         group holding only empty streams counts as non-empty), which is the
+*         side this guard must err on.
+*
+* **Probe failures fail CLOSED for the log group, OPEN for the bucket**, and
+* the divergence is deliberate rather than an oversight. The bucket's
+* soft-fail is pre-existing shipped behaviour (issue [#648]) documented on
+* `docs/cli-deploy-safety.md`; the log group's arm is new with issue [#2558],
+* whose whole subject is that an unprovable emptiness must not read as empty.
+* So a failed `DescribeLogStreams` (permission denied, throttling) warns AND
+* promotes to `'has-log-events'`: the user gets a refusal naming the remedies,
+* not a silent recreate. The ONE carve-out is a typed
+* `ResourceNotFoundException`, which is an ANSWER rather than a failure to get
+* one — a log group AWS says does not exist provably holds no events.
+*
+* Returns a NEW array of targets; the input is not mutated. Targets of other
+* types, and targets whose sync reason is already non-null, are passed through
+* unchanged — including a `'has-retention'` log group, whose verdict the bag
+* already settled and no probe may weaken.
+*/
+async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getLogger().child("recreate-targets")) {
 	const promoted = [];
 	for (const target of targets) {
-		if (target.resourceType !== "AWS::S3::Bucket" || target.statefulReason !== null) {
+		if (target.statefulReason !== null) {
 			promoted.push({ ...target });
 			continue;
 		}
-		try {
-			const result = await s3Client.send(new ListObjectVersionsCommand({
-				Bucket: target.physicalId,
-				MaxKeys: 1
-			}));
-			const hasVersions = (result.Versions?.length ?? 0) > 0;
-			const hasDeleteMarkers = (result.DeleteMarkers?.length ?? 0) > 0;
-			if (hasVersions || hasDeleteMarkers) promoted.push({
-				...target,
-				statefulReason: "has-objects"
-			});
-			else promoted.push({ ...target });
-		} catch (e) {
-			logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live S3 probe failed for ${target.logicalId} (bucket ${target.physicalId}); leaving stateful guard at the sync result. If the bucket might be non-empty, re-run with --force-stateful-recreation. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
-			promoted.push({ ...target });
+		if (target.resourceType === "AWS::S3::Bucket") {
+			try {
+				const result = await clients.s3.send(new ListObjectVersionsCommand({
+					Bucket: target.physicalId,
+					MaxKeys: 1
+				}));
+				const hasVersions = (result.Versions?.length ?? 0) > 0;
+				const hasDeleteMarkers = (result.DeleteMarkers?.length ?? 0) > 0;
+				if (hasVersions || hasDeleteMarkers) promoted.push({
+					...target,
+					statefulReason: "has-objects"
+				});
+				else promoted.push({ ...target });
+			} catch (e) {
+				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live S3 probe failed for ${target.logicalId} (bucket ${target.physicalId}); leaving stateful guard at the sync result. If the bucket might be non-empty, re-run with --force-stateful-recreation. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
+				promoted.push({ ...target });
+			}
+			continue;
 		}
+		if (target.resourceType === "AWS::Logs::LogGroup") {
+			try {
+				const result = await clients.cloudWatchLogs.send(new DescribeLogStreamsCommand({
+					logGroupName: target.physicalId,
+					limit: 1
+				}));
+				const streams = result.logStreams;
+				if (streams !== void 0 && streams.length === 0 && !result.nextToken) promoted.push({ ...target });
+				else if (streams !== void 0 && streams.length > 0) promoted.push({
+					...target,
+					statefulReason: "has-log-events"
+				});
+				else {
+					logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: CloudWatch Logs answered the emptiness probe for ${target.logicalId} (log group ${target.physicalId}) without settling it (${streams === void 0 ? "no logStreams field in the response" : "an empty page carrying a continuation token"}); treating the log group as NOT provably empty. An unset or zero RetentionInDays is CloudWatch Logs' "never expire", so an unprovable emptiness must not read as empty. Re-run to retry the probe, or — only if the log group really is disposable — re-run with --force-stateful-recreation (that flag has NO per-resource granularity and clears the guard for every target in the run).`);
+					promoted.push({
+						...target,
+						statefulReason: "has-log-events"
+					});
+				}
+			} catch (e) {
+				if (e instanceof ResourceNotFoundException$5) {
+					let regionVerified = true;
+					const recordedRegion = foldRegion(clients.expectedRegion);
+					if (recordedRegion) {
+						let clientRegion;
+						try {
+							clientRegion = foldRegion(await clients.cloudWatchLogs.config.region());
+							assertRegionMatch(clientRegion, recordedRegion, target.resourceType, target.logicalId, target.physicalId);
+						} catch {
+							regionVerified = false;
+							const cause = clientRegion ? `the client region (${clientRegion}) does not match the region cdkd state records for it (${recordedRegion}) — a not-found from the wrong region says nothing about the log group. Fix the region mismatch, or` : `the CloudWatch Logs client's own region could not be resolved, so the not-found cannot be attributed to the region cdkd state records (${recordedRegion}). Fix the client's region configuration, or`;
+							logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: CloudWatch Logs reported ${target.logicalId} (log group ${target.physicalId}) missing, but ${cause} re-run with --force-stateful-recreation if the log group really is disposable (that flag clears the data guard for every target in the run). Until then it is treated as NOT provably empty.`);
+						}
+					}
+					if (regionVerified) {
+						logger.debug(`--recreate-via-cc-api / --recreate-via-sdk-provider: log group ${target.physicalId} (${target.logicalId}) does not exist, so it holds no events — not stateful.`);
+						promoted.push({ ...target });
+						continue;
+					}
+					promoted.push({
+						...target,
+						statefulReason: "has-log-events"
+					});
+					continue;
+				}
+				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live CloudWatch Logs probe failed for ${target.logicalId} (log group ${target.physicalId}); treating the log group as NOT provably empty. An unset or zero RetentionInDays is CloudWatch Logs' "never expire", so an unprovable emptiness must not read as empty. Fixes, cheapest first: grant logs:DescribeLogStreams and re-run, or re-run as-is if this was transient (CloudWatch Logs throttles this API aggressively). Only if the log group really is disposable, re-run with --force-stateful-recreation — that flag has NO per-resource granularity and clears the guard for every target in the run. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
+				promoted.push({
+					...target,
+					statefulReason: "has-log-events"
+				});
+			}
+			continue;
+		}
+		promoted.push({ ...target });
 	}
 	return promoted;
 }
 /**
 * Async re-validation of the stateful-guard slice of a
-* {@link RecreateTargetsValidation}, after promoting S3 bucket reasons
-* via {@link probeStatefulRecreateTargetsAsync}.
+* {@link RecreateTargetsValidation}, after promoting the deferred S3 bucket
+* and log group reasons via {@link probeStatefulRecreateTargetsAsync}.
 *
 * Skips the probe entirely when `forceStatefulRecreation: true` — the
 * sync validation already omits the blocked list in that case, and
@@ -2750,7 +2853,7 @@ async function probeStatefulRecreateTargetsAsync(targets, s3Client, logger = get
 */
 async function probeAndRevalidateStateful(input) {
 	if (input.forceStatefulRecreation) return input.validation;
-	const promoted = await probeStatefulRecreateTargetsAsync(input.validation.targets, input.s3Client);
+	const promoted = await probeStatefulRecreateTargetsAsync(input.validation.targets, input.clients);
 	const blockedStatefulTargets = promoted.filter((t) => t.statefulReason !== null);
 	return {
 		...input.validation,
@@ -2853,11 +2956,27 @@ function renderDownstreamConsumers(producerStack, consumers) {
 *     like a successful skipped-deploy.
 *
 * The per-target plan surfaces a **DATA LOSS** prefix for stateful
-* targets (those with a non-null `statefulReason` after the live
-* `s3:ListObjectVersions` probe — see issue [#648]); these reached pre-flight
-* only because the user opted in with `--force-stateful-recreation`,
-* so the prompt's **DATA LOSS** wording is the third "stop and think"
-* moment.
+* targets; a target reaches this prompt still carrying a stateful reason only
+* because the user opted in with `--force-stateful-recreation`, so the
+* **DATA LOSS** wording is the third "stop and think" moment.
+*
+* **The prefix is NOT read off `statefulReason` alone**, and the reason is the
+* flag that makes the prompt reachable in the first place (issue [#2558]'s
+* review round). `probeAndRevalidateStateful` returns EARLY under
+* `--force-stateful-recreation` — it never issues the live
+* `s3:ListObjectVersions` / `logs:DescribeLogStreams` probes — so under that
+* flag every target still carries the SYNC verdict, and for the two
+* CONDITIONAL types the sync verdict of a deferral is `null`. `null` there
+* does not mean "holds nothing": an `AWS::S3::Bucket` always defers, and an
+* `AWS::Logs::LogGroup` with no recorded retention is CloudWatch Logs'
+* NEVER EXPIRE. Rendering that as "not stateful" is precisely the reading
+* issue [#2558] exists to retire, and it was already wrong for a non-empty
+* bucket before that. So when the probe did not run, a `null` reason is
+* re-derived through {@link isStatefulRecreateTargetForReplace} — the
+* conservative mid-deploy predicate, a pure function of the type with no AWS
+* call, chosen over re-running the probe because re-running it under the force
+* flag would repopulate `blockedStatefulTargets` and turn the opt-in into a
+* refusal.
 */
 async function promptRecreateConfirm(input) {
 	if (input.targets.length === 0) return true;
@@ -2869,10 +2988,13 @@ async function promptRecreateConfirm(input) {
 	else if (toCcCount > 0) logger.warn(`--recreate-via-cc-api will destroy + recreate ${toCcCount} resource(s) via Cloud Control API on stack ${input.stackName}:`);
 	else logger.warn(`--recreate-via-sdk-provider will destroy + recreate ${toSdkCount} resource(s) via SDK Provider on stack ${input.stackName}:`);
 	for (const t of input.targets) {
-		const stateful = t.statefulReason !== null;
+		const rederivedReason = t.statefulReason === null && input.forceStatefulRecreation ? isStatefulRecreateTargetForReplace(t.resourceType, void 0) : null;
+		const rederived = rederivedReason !== null;
+		const reason = t.statefulReason ?? rederivedReason;
+		const stateful = reason !== null;
 		const dataLossPrefix = stateful ? "**DATA LOSS** " : "";
 		const directionTag = t.direction === "to-cc-api" ? " [SDK → CC]" : " [CC → SDK]";
-		const stateNote = stateful ? ` — stateful (${t.statefulReason}); --force-stateful-recreation acknowledged` : "";
+		const stateNote = stateful ? ` — stateful (${rederived ? "emptiness not established — --force-stateful-recreation skips the probe" : renderStatefulReason(reason)}); --force-stateful-recreation acknowledged` : "";
 		logger.warn(`  - ${dataLossPrefix}${t.logicalId} (${t.resourceType})${directionTag}${stateNote}`);
 		if (stateful) logger.warn(`    DATA: all data in ${t.logicalId} will be lost (no automatic data migration)`);
 	}
@@ -2950,12 +3072,13 @@ const DEFAULT_CONFIRM_SUFFIX = " [y/N] ";
 * `printf 'y' |` (a real answer with no trailing newline) and `< /dev/null`
 * stay pending indefinitely.
 *
-* REFUSE rather than auto-confirm, at every one of the nine sites this helper
-* replaced. Every one of them guards a MUTATION — a rollback replay, a state
-* record removal, an observed-property refresh, an orphan, an import, an
-* export-then-delete-state, a drift accept/revert, a CloudFormation stack
-* retirement, a state-bucket migration — so silently answering "yes" on
-* behalf of an absent operator is never the safe reading. `deploy.ts`'s
+* REFUSE rather than auto-confirm, at every one of the TEN sites that route
+* through this helper. Every one of them guards a MUTATION — a rollback
+* replay, a state record removal, an observed-property refresh, an orphan, an
+* import, an export-then-delete-state, a drift accept/revert, a
+* CloudFormation stack retirement, a state-bucket migration, an event-history
+* prune — so silently answering "yes" on behalf of an absent operator is never
+* the safe reading. `deploy.ts`'s
 * auto-confirm (`options.yes || !process.stdin.isTTY` -> proceed) stays the
 * deliberate exception, because a deploy that assumes "yes" is recoverable.
 *
@@ -2974,10 +3097,12 @@ const DEFAULT_CONFIRM_SUFFIX = " [y/N] ";
 * `--yes` refuse instead of proceed, which is the inverse bug.
 *
 * Throws {@link CdkdError} with the `NON_INTERACTIVE_CONFIRM` code, matching
-* `gc.ts` and `bootstrap-destroy.ts` — the only two of the five originally
-* guarded prompts that carry a code (the other three throw a bare `Error` or
-* a `LocalMigrateError`). `handleError` maps it to exit 1, so CI can branch on
-* it.
+* `gc.ts` and `bootstrap-destroy.ts` — the only two of the four originally
+* guarded prompts that carry a code (the other two throw a bare `Error`).
+* `handleError` maps it to exit 1, so CI can branch on it.
+*
+* There were FIVE until `cdkd migrate` was removed (issue #2572); its prompt
+* threw a `LocalMigrateError`, and that class went with it.
 *
 * TWO GUARDED PROMPTS DELIBERATELY DO NOT ROUTE THROUGH HERE:
 * `destroy-runner.ts`'s per-stack prompt (the issue #2259 fix) and
@@ -2988,10 +3113,10 @@ const DEFAULT_CONFIRM_SUFFIX = " [y/N] ";
 * passes an abort `signal` for the issue #2117 Ctrl-C handling. Folding them
 * in would also drag `destroy-runner.ts` (in the `integ-destroy` AND
 * `integ-broad` gate scopes) into a pure refactor's blast radius, buying a
-* real-AWS run for no behaviour change. The other five pre-existing guarded
+* real-AWS run for no behaviour change. The other four pre-existing guarded
 * prompts (`gc.ts`, `bootstrap-destroy.ts`, `recreate-confirm-prompt.ts`,
-* `prefix-migration-check.ts`, `migrate-command.ts`) stay put for the same
-* reason: each guards its own flow with its own error type.
+* `prefix-migration-check.ts`) stay put for the same reason: each guards its
+* own flow with its own error type.
 *
 * @param prompt the question, WITHOUT its trailing `[y/N]` marker
 * @returns `true` only for `y` / `yes` (any case, trimmed)
@@ -21731,9 +21856,8 @@ function warmThroughputDiagnostic(raw, coercion, indexName) {
 * The CFn schema forbids `ProvisionedThroughput` / `OnDemandThroughput` /
 * `*ThroughputOverride` on `AWS::DynamoDB::GlobalTable`, so this only fires
 * for pre-#1387 cdkd state and hand-authored templates — but those ARE a
-* first-class cdkd surface (`cdkd import --migrate-from-cloudformation`,
-* `cdkd migrate --from-cfn-stack`), and the pre-fix code forwarded such a
-* block VERBATIM. Three defects followed, and fixing any subset leaves a
+* first-class cdkd surface (`cdkd import --migrate-from-cloudformation`), and
+* the pre-fix code forwarded such a block VERBATIM. Three defects followed, and fixing any subset leaves a
 * live one, which is why this helper does all three at once:
 *
 *  1. **Coercion.** The verbatim forward was the ONE path that skipped
@@ -22937,7 +23061,7 @@ var LogsLogGroupProvider = class {
 		const normalizeClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 		const prevClass = normalizeClass(previousProperties["LogGroupClass"]);
 		const nextClass = normalizeClass(properties["LogGroupClass"]);
-		if (prevClass !== nextClass) throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. Re-deploy with ${properties["RetentionInDays"] ? "--replace --force-stateful-recreation" : "--replace"} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change`);
+		if (prevClass !== nextClass) throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. Re-deploy with --replace --force-stateful-recreation to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change. Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -47289,9 +47413,32 @@ function isAccountIdPseudoParameter(value) {
 * [#1675](https://github.com/go-to-k/cdkd/issues/1675)).
 *
 * This is {@link importableString} plus a NUMBER arm, and the number arm is
-* load-bearing rather than defensive: `cdkd import --migrate-from-cloudformation`
-* reads the stack's ORIGINAL template (`cfn-stack-prefetch.ts`), where an
-* unquoted YAML `CatalogId: 123456789012` parses as a JSON number. Rejecting it
+* load-bearing rather than defensive, and the reason is NOT the one this
+* comment gave for three revisions. It claimed
+* `cdkd import --migrate-from-cloudformation` (earlier: `cdkd migrate`) read
+* the source stack's ORIGINAL CloudFormation template and handed those raw
+* properties to providers. It never did. Both commands take properties from
+* the SYNTH assembly; `cdkd migrate` reached `runImport` with
+* `app: <assemblyDir>` plus a logical-id mapping, and the ORIGINAL template it
+* fetched was consumed only by transform detection and by the Pass-2
+* property-equality MATCH, never forwarded. The `GetTemplate` that survives in
+* `retire-cfn-stack.ts` feeds Retain injection and the re-upload, and reaches
+* no properties bag either. Do not restore any of that.
+*
+* The two producers that ARE real, both current:
+*
+*  1. A numeric literal in the synth template itself — `new CfnResource({
+*     properties: { CatalogId: 123456789012 } })`, or an
+*     `addPropertyOverride`. CDK emits the number verbatim; nothing between
+*     synth and this provider stringifies it.
+*  2. The macro-expanded deploy template. `src/synthesis/macro-expander.ts`
+*     fetches `GetTemplate` at `TemplateStage: 'Processed'` and parses the
+*     JSON body as the template deploy / diff / import then use, so a macro
+*     that emits an unquoted number lands here as a number.
+*
+* The DELETE path reaches it too, from the other side: `destroy-runner.ts`
+* hands the recorded `resource.properties` straight to `provider.delete`, so a
+* state row holding either shape above replays it at teardown. Rejecting it
 * as "not a string" would drop the field and silently retarget the call at the
 * account's DEFAULT catalog — which on a DELETE can destroy a same-named
 * resource that happens to live there. `Number.isFinite` keeps `NaN` /
@@ -49041,9 +49188,12 @@ const TARGET_DATABASE_MEMBERS = [
 const FEDERATED_DATABASE_MEMBERS = ["ConnectionName", "Identifier"];
 /**
 * Is this leaf value one cdkd can put on the wire? A STRING or a NUMBER — CFn
-* is stringly typed and an unquoted YAML account id arrives as a number (the
-* reason `catalogIdForApi` exists) — and nothing else, so an unresolved
-* intrinsic cannot ride an unchecked cast into the request.
+* is stringly typed, and an account id can reach a provider as a JSON number
+* (the reason {@link catalogIdForApi} exists; that function's note carries the
+* two producers, neither of which is a YAML read — an earlier version of this
+* sentence said "an unquoted YAML account id" and was wrong the same way) —
+* and nothing else, so an unresolved intrinsic cannot ride an unchecked cast
+* into the request.
 */
 const isSendableLeaf = (value) => typeof value === "string" || typeof value === "number" && Number.isFinite(value);
 /**
@@ -62468,7 +62618,11 @@ async function deployCommand(stacks, options) {
 							forceStatefulRecreation: options.forceStatefulRecreation ?? false,
 							hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
 						}),
-						s3Client: stackAwsClients.s3,
+						clients: {
+							s3: stackAwsClients.s3,
+							cloudWatchLogs: stackAwsClients.cloudWatchLogs,
+							expectedRegion: stateForRecreateCheck?.state.region
+						},
 						forceStatefulRecreation: options.forceStatefulRecreation ?? false
 					});
 					const errorBlock = renderRecreateTargetsErrors(validation);
@@ -62486,6 +62640,7 @@ async function deployCommand(stacks, options) {
 							stackName: stackInfo.stackName,
 							targets: validation.targets,
 							yes: options.yes ?? false,
+							forceStatefulRecreation: options.forceStatefulRecreation ?? false,
 							downstreamConsumers
 						})) return;
 					}
@@ -63040,10 +63195,11 @@ function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /*
 * unhealthy state — callers gate AWS-side mutations behind this set so
 * the user can settle the source before paying for further work.
 *
-* Single source of truth — consumed by both `cdkd migrate`'s pre-flight
-* check (`src/cli/commands/migrate/cfn-stack-prefetch.ts`) and the
-* `cdkd import --migrate-from-cloudformation` retirement flow
-* (`src/cli/commands/retire-cfn-stack.ts`).
+* Consumed by the `cdkd import --migrate-from-cloudformation` retirement
+* flow (`src/cli/commands/retire-cfn-stack.ts`). It had a second consumer,
+* `cdkd migrate`'s pre-flight check, until that command was removed (issue
+* #2572); the module stays separate so the next CloudFormation-reading
+* surface shares the set instead of re-spelling it.
 */
 const STABLE_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"CREATE_COMPLETE",
@@ -63857,20 +64013,20 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 }
 /**
 * The CloudFormation-stack retirement confirmation prompt, reached from
-* `cdkd import --migrate-from-cloudformation` and `cdkd migrate
-* --retire-cfn-stack` (both spell the skip flag `-y` / `--yes`). Its only call
-* site is inside the `if (!yes)` block above, which is what keeps
+* `cdkd import --migrate-from-cloudformation` (skip flag `-y` / `--yes`). Its
+* only call site is inside the `if (!yes)` block above, which is what keeps
 * `confirmOrRefuse`'s non-interactive refusal (issue #2275) from firing on a
 * `--yes` run.
 *
-* TWO commands reach it, so the refusal NAMES BOTH. Every other site names one
-* command because it has one; a refusal that named neither would leave a CI
-* user knowing a flag is missing without knowing which invocation to put it
-* on, and `confirmOrRefuse`'s own contract is that the refusal is the only
-* thing that user sees.
+* The refusal NAMES that command, as every other site does, because
+* `confirmOrRefuse`'s contract is that the refusal is the only thing a CI user
+* sees: it has to say which invocation the missing flag belongs on. It named
+* TWO commands until `cdkd migrate --retire-cfn-stack` was removed with the
+* command itself (issue #2572); `cdkd import --migrate-from-cloudformation` is
+* now the sole way to reach this prompt.
 *
 * It also states that cdkd state has ALREADY been written. This prompt is the
-* only one of the nine that fires AFTER its command's state write, so a
+* only one of the ten that fires AFTER its command's state write, so a
 * refusal here leaves a genuine split brain — cdkd claims the resources while
 * the CloudFormation stack is still live — and the operator has to know that
 * before deciding whether to re-run or finish by hand.
@@ -63878,7 +64034,7 @@ async function walkCfnStackTree(stackName, physicalId, cfnClient) {
 * Exported for unit testing — internal to the command flow otherwise.
 */
 async function confirmPrompt$6(prompt) {
-	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on whichever command you ran — cdkd import --migrate-from-cloudformation or cdkd migrate --retire-cfn-stack — or run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
+	return confirmOrRefuse(prompt, { refusal: "The CloudFormation stack retirement confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes on cdkd import --migrate-from-cloudformation. Alternatively, run it from a real terminal. NOTE cdkd state has already been written: the resources are recorded in cdkd state while the CloudFormation stack is still live, so re-run with -y / --yes (or retire the stack by hand) to finish the migration." });
 }
 /**
 * Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
@@ -78732,6 +78888,7 @@ async function forceUnlockCommand(stackArgs, options) {
 	setAwsClients(awsClients);
 	const region = namedCliRegion(options.region) ?? "us-east-1";
 	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+	const failures = [];
 	try {
 		const stateConfig = {
 			bucket: stateBucket,
@@ -78756,13 +78913,17 @@ async function forceUnlockCommand(stackArgs, options) {
 				} catch (error) {
 					const message = error instanceof Error ? error.message : String(error);
 					if (message.includes("No lock found") || message.includes("NoSuchKey")) logger.info(`No lock found for stack: ${where}`);
-					else logger.error(`Failed to unlock stack ${where}: ${message}`);
+					else {
+						logger.error(`Failed to unlock stack ${where}: ${message}`);
+						failures.push(`${where}: ${message}`);
+					}
 				}
 			}
 		}
 	} finally {
 		awsClients.destroy();
 	}
+	if (failures.length > 0) throw new CdkdError(`Failed to release ${failures.length} lock(s):\n` + failures.map((f) => `  - ${f}`).join("\n"), "FORCE_UNLOCK_FAILED");
 }
 /**
 * Create force-unlock command
@@ -78780,9 +78941,6 @@ function createForceUnlockCommand() {
 
 //#endregion
 //#region src/cli/commands/import.ts
-async function runImport(stackArg, options) {
-	return importCommand(stackArg, options);
-}
 async function importCommand(stackArg, options) {
 	const logger = getLogger();
 	if (options.verbose) {
@@ -79667,7 +79825,7 @@ function validateNestedStackShape(template, tree, parentStackName, nestedTemplat
 *      **parent-first acquire, leaves-first release** (each level's
 *      `finally` releases its child lock before sibling iteration
 *      continues, and the root lock is the outermost — held by
-*      `runImport`'s `try` / `finally`). This is the conventional
+*      `importCommand`'s `try` / `finally`). This is the conventional
 *      hierarchical lock pattern: parent-first acquire prevents a
 *      second cdkd import from racing past the root lock; leaves-first
 *      release on success/failure means a mid-walk error never strands
@@ -81890,7 +82048,7 @@ async function applyCrossStackResolverToTask(task, context) {
 
 //#endregion
 //#region src/local/docker-runner.ts
-const execFileAsync$4 = promisify(execFile);
+const execFileAsync$3 = promisify(execFile);
 /**
 * Wraps `docker pull` / `docker run` / `docker rm` for `cdkd local invoke`.
 *
@@ -81994,7 +82152,7 @@ async function runDetached(opts) {
 	logger.debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
 	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
-		const { stdout } = await execFileAsync$4(getDockerCmd(), args, {
+		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
 			maxBuffer: 10 * 1024 * 1024,
 			env: dockerSpawnEnvWithSensitive(passthroughEnv)
 		});
@@ -82034,7 +82192,7 @@ async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
 	try {
-		await execFileAsync$4(getDockerCmd(), [
+		await execFileAsync$3(getDockerCmd(), [
 			"rm",
 			"-f",
 			containerId
@@ -82053,7 +82211,7 @@ async function removeContainer(containerId) {
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
 	try {
-		await execFileAsync$4(cmd, [
+		await execFileAsync$3(cmd, [
 			"version",
 			"--format",
 			"{{.Server.Version}}"
@@ -85067,7 +85225,7 @@ function createLocalStartApiCommand() {
 
 //#endregion
 //#region src/local/ecs-network.ts
-const execFileAsync$3 = promisify(execFile);
+const execFileAsync$2 = promisify(execFile);
 /**
 * Docker network + AWS-published metadata-endpoints sidecar lifecycle for
 * `cdkd local run-task`. The sidecar (a small Go binary maintained by
@@ -85120,7 +85278,7 @@ async function createNetworkAndSidecar(args) {
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$2(getDockerCmd(), [
 			"network",
 			"create",
 			"--driver",
@@ -85157,7 +85315,7 @@ async function createNetworkAndSidecar(args) {
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
-		const { stdout } = await execFileAsync$3(getDockerCmd(), sidecarArgs, {
+		const { stdout } = await execFileAsync$2(getDockerCmd(), sidecarArgs, {
 			maxBuffer: 10 * 1024 * 1024,
 			env: dockerSpawnEnvWithSensitive(sidecarSensitiveEnv)
 		});
@@ -85228,7 +85386,7 @@ async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
 	try {
-		await execFileAsync$3(getDockerCmd(), [
+		await execFileAsync$2(getDockerCmd(), [
 			"network",
 			"rm",
 			networkName
@@ -85368,7 +85526,7 @@ async function resolveSsm(entry, shape, client) {
 
 //#endregion
 //#region src/local/ecs-task-runner.ts
-const execFileAsync$2 = promisify(execFile);
+const execFileAsync$1 = promisify(execFile);
 /**
 * Top-level orchestrator for `cdkd local run-task`. Coordinates image
 * preparation, secret resolution, docker-network bring-up, container
@@ -85428,7 +85586,7 @@ async function cleanupEcsRun(state, options) {
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
 	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$1(getDockerCmd(), [
 			"volume",
 			"rm",
 			v
@@ -85523,7 +85681,7 @@ async function runEcsTask(task, options, state) {
 		let id;
 		try {
 			const sensitiveEnv = dockerEnvs.get(container.name);
-			const { stdout } = await execFileAsync$2(getDockerCmd(), args, {
+			const { stdout } = await execFileAsync$1(getDockerCmd(), args, {
 				maxBuffer: 10 * 1024 * 1024,
 				env: dockerSpawnEnvWithSensitive(sensitiveEnv)
 			});
@@ -85635,7 +85793,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 	let lastStatus = "";
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$2(getDockerCmd(), [
+			const { stdout } = await execFileAsync$1(getDockerCmd(), [
 				"inspect",
 				"--format",
 				"{{.State.Health.Status}}",
@@ -85658,7 +85816,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 }
 async function waitForContainerExit(containerId) {
 	try {
-		const { stdout } = await execFileAsync$2(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$1(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -85668,7 +85826,7 @@ async function waitForContainerExit(containerId) {
 }
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$2(getDockerCmd(), [
+		await execFileAsync$1(getDockerCmd(), [
 			"stop",
 			"-t",
 			String(graceSeconds),
@@ -85793,7 +85951,7 @@ async function realizeDockerVolumes(volumes, state) {
 		const dockerVolumeName = `cdkd-local-${v.name}-${randHex(4)}`;
 		args.push(dockerVolumeName);
 		try {
-			await execFileAsync$2(getDockerCmd(), args);
+			await execFileAsync$1(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${dockerVolumeName} for task volume '${v.name}'`);
 		} catch (err) {
@@ -86374,7 +86532,7 @@ function createLocalStartServiceCommand() {
 *     after each reload (cdkd-specific — cdk-local treats single-shot as a
 *     no-op WARN).
 */
-const execFileAsync$1 = promisify(execFile);
+const execFileAsync = promisify(execFile);
 /**
 * Run the `--watch` reload loop. Returns when the invocation closes naturally
 * with no pending reload (one-shot finished, or `--ws` agent closed), or when
@@ -86525,7 +86683,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const dockerCmd = getDockerCmd();
 	let workdir;
 	try {
-		const { stdout } = await execFileAsync$1(dockerCmd, [
+		const { stdout } = await execFileAsync(dockerCmd, [
 			"inspect",
 			"--format",
 			"{{.Config.WorkingDir}}",
@@ -86538,7 +86696,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${newAssetSourceDir} -> ${containerId}:${workdirDest}; restart.`);
 	try {
-		await execFileAsync$1(dockerCmd, [
+		await execFileAsync(dockerCmd, [
 			"cp",
 			`${newAssetSourceDir}/.`,
 			`${containerId}:${workdirDest}`
@@ -86547,7 +86705,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		throw new CdkdError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
 	try {
-		await execFileAsync$1(dockerCmd, ["restart", containerId]);
+		await execFileAsync(dockerCmd, ["restart", containerId]);
 	} catch (err) {
 		throw new CdkdError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
@@ -88733,1076 +88891,6 @@ function createLocalCommand() {
 	return local;
 }
 
-//#endregion
-//#region src/cli/commands/migrate/cdk-cli-check.ts
-const execFileAsync = promisify(execFile);
-/**
-* Minimum aws-cdk CLI version where `cdk migrate --from-stack` is
-* considered stable (per the design doc at docs/design/465-cfn-migrate.md
-* §4 — "Version requirement"). Below this we WARN but do not block,
-* because users may have a working older release and a hard rejection
-* would be more disruptive than a warning.
-*/
-const RECOMMENDED_MIN_VERSION = "2.124.0";
-/**
-* Verify that the upstream `cdk` CLI is available on PATH (or at the
-* override path passed via `--cdk-bin`) and report its version.
-*
-* Hard-errors with {@link MissingCdkCliError} when `cdk` cannot be
-* spawned (ENOENT, permission denied, etc.). Emits a `warn` field on
-* the result when the version string is below the recommended minimum
-* — the caller decides how to surface it.
-*
-* `cdk --version` output format empirically (verified 2026-05-22
-* against cdk@2.1112.0): `<MAJOR.MINOR.PATCH> (build <id>)`. The
-* version is the first whitespace-separated token; the trailing
-* `(build <id>)` is informational and ignored.
-*
-* @param cdkBinPath - Path to the `cdk` binary. Defaults to `'cdk'`
-*   which uses the system PATH for resolution.
-*/
-async function verifyCdkCliAvailable(cdkBinPath = "cdk") {
-	let stdout;
-	try {
-		stdout = (await execFileAsync(cdkBinPath, ["--version"])).stdout ?? "";
-	} catch (err) {
-		throw new MissingCdkCliError(`Failed to run '${cdkBinPath} --version': ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
-	}
-	const version = parseCdkVersion(stdout);
-	if (!version) throw new MissingCdkCliError(`'${cdkBinPath} --version' produced unexpected output: ${JSON.stringify(stdout.trim())}`);
-	if (compareSemver(version, RECOMMENDED_MIN_VERSION) < 0) return {
-		version,
-		warn: `cdk CLI version ${version} is older than the recommended minimum ${RECOMMENDED_MIN_VERSION}. 'cdkd migrate' relies on the stabilized 'cdk migrate --from-stack' flag; upgrade with 'npm install -g aws-cdk@latest' if you hit codegen issues.`
-	};
-	return { version };
-}
-/**
-* Parse the first semver-shaped token (`<MAJOR>.<MINOR>.<PATCH>`) out of
-* `cdk --version` stdout. Tolerates a trailing `(build <id>)` suffix.
-*
-* Returns `undefined` when no semver-shaped token is present so the
-* caller can surface the raw stdout in the error message.
-*/
-function parseCdkVersion(stdout) {
-	const match = stdout.match(/(\d+)\.(\d+)\.(\d+)/);
-	if (!match) return void 0;
-	return `${match[1]}.${match[2]}.${match[3]}`;
-}
-/**
-* Compare two semver strings (`MAJOR.MINOR.PATCH`). Returns a negative
-* number when `a < b`, zero when `a === b`, positive when `a > b`.
-*
-* Strictly numeric comparison per component — no pre-release / build
-* suffix handling needed for this use case (`cdk --version` always
-* emits a stable `X.Y.Z` triple).
-*/
-function compareSemver(a, b) {
-	const aParts = a.split(".").map((n) => Number.parseInt(n, 10));
-	const bParts = b.split(".").map((n) => Number.parseInt(n, 10));
-	for (let i = 0; i < 3; i++) {
-		const aN = aParts[i] ?? 0;
-		const bN = bParts[i] ?? 0;
-		if (aN !== bN) return aN - bN;
-	}
-	return 0;
-}
-
-//#endregion
-//#region src/cli/commands/migrate/cfn-stack-prefetch.ts
-/**
-* Resource types that `cdkd migrate` refuses to adopt under any
-* circumstances. The rationale per type:
-*
-*  - `AWS::CloudFormation::CustomResource` — Lambda-backed Custom
-*    Resources whose response protocol (cfn-response over a
-*    pre-signed S3 URL) is incompatible with cdkd's import flow. The
-*    backing Lambda's onCreate handler would need to be re-invoked
-*    for a cdkd-side adoption to make sense, and that's structurally
-*    different from the metadata-transfer migration this command
-*    provides.
-*
-*  - `AWS::CloudFormation::Stack` — nested stacks. cdkd's recursive
-*    `NestedStackProvider` handles fresh `cdkd deploy` (#459), but
-*    `cdk migrate` flattens nested stacks into separate generated apps
-*    in a way that doesn't round-trip cleanly into cdkd's parent~child
-*    state-key layout, so the migrate command keeps rejecting them.
-*    Adopting an existing CFn-managed nested-stack hierarchy is
-*    deferred to issue
-*    [#464](https://github.com/go-to-k/cdkd/issues/464).
-*
-*  - `Custom::*` — any user-defined Custom Resource type prefix.
-*    Same rationale as `AWS::CloudFormation::CustomResource`.
-*/
-const HARD_REJECT_RESOURCE_TYPES = /* @__PURE__ */ new Set(["AWS::CloudFormation::CustomResource", "AWS::CloudFormation::Stack"]);
-/**
-* Fetch the source CFn stack's current state + resources + transform
-* info. Issues 3 read-only AWS API calls (`DescribeStacks`,
-* `DescribeStackResources`, `GetTemplate(Stage=Original)`); none of
-* them mutate AWS state. The result is fed into
-* {@link validatePrefetchResult} for the hard-reject check and
-* surfaced to {@link runMigrateLibrary}'s caller (PR B) as part of
-* `RunMigrateLibraryResult`.
-*
-* `DescribeStackResources` is preferred over `ListStackResources`
-* because the response is unpaginated up to 500 resources (CFn's hard
-* stack cap) — no pagination loop needed for the migration use case.
-*/
-async function prefetchCfnStack(stackName, cfnClient) {
-	const stack = (await cfnClient.send(new DescribeStacksCommand({ StackName: stackName }))).Stacks?.[0];
-	if (!stack) throw new LocalMigrateError(`CloudFormation stack '${stackName}' not found.`);
-	const stackStatus = stack.StackStatus ?? "";
-	const resourcesResp = await cfnClient.send(new DescribeStackResourcesCommand({ StackName: stackName }));
-	const resources = [];
-	for (const r of resourcesResp.StackResources ?? []) {
-		if (!r.LogicalResourceId || !r.PhysicalResourceId || !r.ResourceType) continue;
-		resources.push({
-			LogicalResourceId: r.LogicalResourceId,
-			PhysicalResourceId: r.PhysicalResourceId,
-			ResourceType: r.ResourceType
-		});
-	}
-	let transformInfo = {
-		hasSamTransform: false,
-		hasIncludeTransform: false
-	};
-	let sourceCfnTemplate = null;
-	try {
-		const tplResp = await cfnClient.send(new GetTemplateCommand({
-			StackName: stackName,
-			TemplateStage: "Original"
-		}));
-		if (tplResp.TemplateBody) {
-			try {
-				sourceCfnTemplate = parseCfnTemplate(tplResp.TemplateBody);
-			} catch {
-				sourceCfnTemplate = null;
-			}
-			transformInfo = detectTransformsFromParsed(sourceCfnTemplate);
-		}
-	} catch (err) {
-		const detail = err instanceof Error ? err.message : String(err);
-		getLogger().warn(`[migrate] GetTemplate failed for '${stackName}': ${detail}. Skipping transform detection.`);
-	}
-	return {
-		stackStatus,
-		resources,
-		transformInfo,
-		sourceCfnTemplate
-	};
-}
-/**
-* Pre-flight reject when the source CFn stack contains any
-* un-migratable resource type OR is in a non-terminal state. Surfaces
-* SAM / Include transforms via the result's `transformInfo` instead —
-* the caller is responsible for emitting INFO logs.
-*
-* Per #465 Q2 (parent-session decision): every hard-reject case
-* routes the user to the standalone `cdk migrate --from-stack <name>
-* --output-dir ./tmp` flow so they can manually inspect the generated
-* code and decide how to proceed (e.g. delete the Custom Resource
-* from the source CFn stack before re-running cdkd migrate).
-*/
-function validatePrefetchResult(result) {
-	if (!STABLE_TERMINAL_STATUSES.has(result.stackStatus)) throw new LocalMigrateError(`CloudFormation stack is in status '${result.stackStatus}', which is not a stable terminal state. Wait for the stack to settle (or roll back) before running 'cdkd migrate'.`);
-	const offenders = [];
-	for (const r of result.resources) if (isHardRejectType(r.ResourceType)) offenders.push({
-		LogicalResourceId: r.LogicalResourceId,
-		ResourceType: r.ResourceType
-	});
-	if (offenders.length === 0) return;
-	throw new LocalMigrateError(`Source CloudFormation stack contains resource types that 'cdkd migrate' cannot adopt:\n${offenders.map((o) => `  - ${o.LogicalResourceId} (${o.ResourceType})`).join("\n")}\n\nLambda-backed Custom Resources and nested CloudFormation stacks are out of scope for #465.\nTo migrate the rest of the stack, either:\n  1. Delete the unsupported resources from the source CFn stack first, OR\n  2. Run upstream 'cdk migrate' standalone to inspect the generated code:\n       cdk migrate --from-stack --stack-name <source-stack> --output-path ./tmp\n     then hand-author CDK constructs to replace the Custom Resource semantics.`);
-}
-/**
-* Whether the given resource type is in the hard-reject set. Matches
-* literal types from {@link HARD_REJECT_RESOURCE_TYPES} AND the
-* `Custom::*` prefix pattern (user-defined Custom Resource types).
-*/
-function isHardRejectType(resourceType) {
-	if (HARD_REJECT_RESOURCE_TYPES.has(resourceType)) return true;
-	if (resourceType.startsWith("Custom::")) return true;
-	return false;
-}
-/**
-* Scan an already-parsed CFn template object for stack-level
-* Transform blocks. Accepts both the scalar form (`Transform:
-* AWS::Serverless-2016-10-31`) and the array form (`Transform:
-* [AWS::Serverless-2016-10-31, ...]`).
-*
-* The caller is responsible for parsing the raw template body via the
-* CFn-aware codec; this helper operates on the parsed object so the
-* `GetTemplate` response can be parsed once and reused.
-*/
-function detectTransformsFromParsed(parsed) {
-	if (!parsed || typeof parsed !== "object") return {
-		hasSamTransform: false,
-		hasIncludeTransform: false
-	};
-	const transformRaw = parsed["Transform"];
-	const transforms = Array.isArray(transformRaw) ? transformRaw.map((t) => String(t)) : typeof transformRaw === "string" ? [transformRaw] : [];
-	return {
-		hasSamTransform: transforms.some((t) => t.startsWith("AWS::Serverless")),
-		hasIncludeTransform: transforms.some((t) => t === "AWS::Include" || t.startsWith("AWS::Include"))
-	};
-}
-
-//#endregion
-//#region src/cli/commands/migrate/output-dir-guard.ts
-/**
-* Refuse to run `cdkd migrate` when the upstream `cdk migrate` would
-* write its output into an existing non-empty directory. `cdk migrate`
-* itself silently overwrites in that case; cdkd surfaces the collision
-* up-front with the exact recovery command so the user is not left
-* with a half-overwritten CDK app.
-*
-* Behavior matrix (`outputPath = <user-supplied dir>`, `stackName =
-* <CFn stack name>`; cdk writes to `<outputPath>/<stackName>`):
-*  - target dir does not exist                      → OK
-*  - target dir exists but is empty                 → OK (treated as fresh)
-*  - target path is a file, not a directory         → typed error
-*  - target dir exists and contains entries         → typed error with
-*                                                    the canonical
-*                                                    `rm -rf` recovery
-*                                                    command in the
-*                                                    message
-*
-* The parent `outputPath` is NOT checked — `cdk migrate` creates
-* `<outputPath>` itself if missing, so a non-existent parent is fine.
-*/
-function assertOutputDirAvailable(outputPath, stackName) {
-	const targetDir = resolve(outputPath, stackName);
-	if (!existsSync(targetDir)) return;
-	if (!statSync(targetDir).isDirectory()) throw new LocalMigrateError(`Output path '${targetDir}' exists but is not a directory. Remove it (or pass --output-dir <NEW_PATH>) and retry:\n  rm -f ${targetDir} && cdkd migrate --from-cfn-stack ${stackName}`);
-	const entries = readdirSync(targetDir);
-	if (entries.length === 0) return;
-	throw new LocalMigrateError(`Output dir '${targetDir}' already exists and is non-empty (e.g. '${join(targetDir, entries[0])}'); remove it or pass --output-dir <NEW_PATH>:\n  rm -rf ${targetDir} && cdkd migrate --from-cfn-stack ${stackName}`);
-}
-
-//#endregion
-//#region src/cli/commands/migrate/cdk-migrate-spawn.ts
-/**
-* Spawn `cdk migrate --from-stack` as a subprocess and stream its
-* output through cdkd's logger.
-*
-* Why subprocess (not Node module import): the upstream `cdk` CLI is
-* a bundled CommonJS app with no stable public API; pinning a
-* runtime-injected `aws-cdk-lib` from cdkd is impractical. Subprocess
-* isolation also gives us a clean failure boundary — non-zero exit
-* surfaces as {@link LocalMigrateError} with the captured streams
-* folded into the error message.
-*
-* Streaming is preferred over a buffered `execFile` because `cdk
-* migrate` emits progress lines (downloading the resource schema,
-* synthesizing the L1 code for each resource) that users expect to
-* see in real time. Captured streams are still returned for caller
-* inspection.
-*/
-async function spawnCdkMigrate(opts) {
-	const logger = getLogger();
-	const cdkBin = opts.cdkBinPath ?? "cdk";
-	const language = opts.language ?? "typescript";
-	const outputDir = resolve(opts.outputPath, opts.stackName);
-	const args = [
-		"migrate",
-		"--from-stack",
-		"--stack-name",
-		opts.fromStackName,
-		"--output-path",
-		opts.outputPath,
-		"--language",
-		language
-	];
-	if (opts.region) args.push("--region", opts.region);
-	if (opts.account) args.push("--account", opts.account);
-	if (opts.profile) args.push("--profile", opts.profile);
-	for (const filter of opts.filters ?? []) args.push("--filter", filter);
-	const env = {
-		...process.env,
-		...opts.extraEnv ?? {}
-	};
-	logger.info(`[cdk-migrate] ${cdkBin} ${args.join(" ")}`);
-	return await new Promise((resolvePromise, rejectPromise) => {
-		let stdout = "";
-		let stderr = "";
-		let child;
-		try {
-			child = spawn(cdkBin, args, {
-				env,
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				]
-			});
-		} catch (err) {
-			const detail = err instanceof Error ? err.message : String(err);
-			rejectPromise(new LocalMigrateError(`Failed to spawn '${cdkBin} migrate': ${detail}`, err instanceof Error ? err : void 0));
-			return;
-		}
-		child.stdout?.on("data", (chunk) => {
-			const text = chunk.toString("utf-8");
-			stdout += text;
-			const trimmed = text.replace(/\n$/, "");
-			if (trimmed) logger.info(`[cdk-migrate] ${trimmed}`);
-		});
-		child.stderr?.on("data", (chunk) => {
-			const text = chunk.toString("utf-8");
-			stderr += text;
-			const trimmed = text.replace(/\n$/, "");
-			if (trimmed) logger.warn(`[cdk-migrate] ${trimmed}`);
-		});
-		child.on("error", (err) => {
-			rejectPromise(new LocalMigrateError(`'${cdkBin} migrate' subprocess error: ${err.message}`, err));
-		});
-		child.on("close", (code, signal) => {
-			if (code === 0) {
-				resolvePromise({
-					outputDir,
-					stdout,
-					stderr
-				});
-				return;
-			}
-			const exitDetail = signal !== null ? `killed by signal ${signal}` : code !== null ? `exited with code ${code}` : "process closed without a code or signal";
-			rejectPromise(new LocalMigrateError(`'${cdkBin} migrate' ${exitDetail}.\n--- stdout ---\n${stdout || "(empty)"}\n--- stderr ---\n${stderr || "(empty)"}\n`));
-		});
-	});
-}
-
-//#endregion
-//#region src/cli/commands/migrate/synth-after-migrate.ts
-/**
-* Run `npm install` inside the generated CDK app directory so the
-* `cdk synth` step (which dynamically loads `aws-cdk-lib`) has its
-* dependencies in place.
-*
-* Skippable via `skipInstall: true` — CI users with a pre-populated
-* node_modules cache can save the ~30s `npm install` round-trip.
-*
-* Streams stdout / stderr through cdkd's logger so users see progress
-* for the often-slow npm step. Non-zero exit surfaces as a typed
-* {@link LocalMigrateError} with the captured streams folded into
-* the error message.
-*/
-async function installGeneratedAppDeps(outputDir, opts) {
-	const logger = getLogger();
-	if (opts.skipInstall) {
-		logger.info(`[cdk-migrate] Skipping 'npm install' (--skip-install).`);
-		return;
-	}
-	const absDir = resolve(outputDir);
-	if (!existsSync(absDir)) throw new LocalMigrateError(`Generated app directory '${absDir}' does not exist; cannot run 'npm install'.`);
-	logger.info(`[cdk-migrate] Running 'npm install' in ${absDir}...`);
-	await runStreamingCommand("npm", ["install"], absDir, opts.extraEnv ? {
-		...process.env,
-		...opts.extraEnv
-	} : void 0, "npm install");
-}
-/**
-* Run `cdk synth --quiet` inside the generated CDK app directory and
-* return both the assembly dir path and the parsed root-stack
-* template.
-*
-* `--quiet` suppresses the noisy template echo that `cdk synth`
-* defaults to on stdout — we read the template from disk
-* (`cdk.out/<StackName>.template.json`) instead.
-*
-* Skippable via `skipSynth: true` — useful when PR B's orchestrator
-* needs the codegen output without running synth (e.g. preview /
-* dry-run modes).
-*/
-async function synthGeneratedApp(outputDir, opts) {
-	const logger = getLogger();
-	const absDir = resolve(outputDir);
-	const assemblyDir = join(absDir, "cdk.out");
-	if (opts.skipSynth) {
-		logger.info(`[cdk-migrate] Skipping 'cdk synth' (--skip-synth).`);
-		return {
-			assemblyDir,
-			templateBody: null
-		};
-	}
-	if (!existsSync(absDir)) throw new LocalMigrateError(`Generated app directory '${absDir}' does not exist; cannot run 'cdk synth'.`);
-	const cdkBin = opts.cdkBinPath ?? "cdk";
-	const env = {
-		...process.env,
-		...opts.extraEnv ?? {}
-	};
-	logger.info(`[cdk-migrate] Running '${cdkBin} synth --quiet' in ${absDir}...`);
-	await runStreamingCommand(cdkBin, ["synth", "--quiet"], absDir, env, `${cdkBin} synth`);
-	if (!existsSync(assemblyDir)) throw new LocalMigrateError(`'cdk synth' completed but produced no '${assemblyDir}' directory.`);
-	const templates = readdirSync(assemblyDir).filter((f) => f.endsWith(".template.json"));
-	if (templates.length === 0) return {
-		assemblyDir,
-		templateBody: null
-	};
-	const templatePath = join(assemblyDir, templates[0]);
-	let templateBody;
-	try {
-		const raw = readFileSync(templatePath, "utf-8");
-		templateBody = JSON.parse(raw);
-	} catch (err) {
-		throw new LocalMigrateError(`Failed to parse generated template '${templatePath}': ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
-	}
-	return {
-		assemblyDir,
-		templateBody
-	};
-}
-/**
-* Helper — spawn a subprocess in the given working directory, stream
-* its output through cdkd's logger, and reject with a typed
-* {@link LocalMigrateError} on non-zero exit.
-*
-* Factored out so the `npm install` and `cdk synth` call sites use the
-* same shape; both expose progress to the user and surface failures
-* with the captured streams.
-*/
-async function runStreamingCommand(bin, args, cwd, env, label) {
-	const logger = getLogger();
-	return await new Promise((resolvePromise, rejectPromise) => {
-		let stdout = "";
-		let stderr = "";
-		let child;
-		try {
-			child = spawn(bin, args, {
-				cwd,
-				env: env ?? process.env,
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				]
-			});
-		} catch (err) {
-			rejectPromise(new LocalMigrateError(`Failed to spawn ${label}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0));
-			return;
-		}
-		child.stdout?.on("data", (chunk) => {
-			const text = chunk.toString("utf-8");
-			stdout += text;
-			const trimmed = text.replace(/\n$/, "");
-			if (trimmed) logger.info(`[${label}] ${trimmed}`);
-		});
-		child.stderr?.on("data", (chunk) => {
-			const text = chunk.toString("utf-8");
-			stderr += text;
-			const trimmed = text.replace(/\n$/, "");
-			if (trimmed) logger.warn(`[${label}] ${trimmed}`);
-		});
-		child.on("error", (err) => {
-			rejectPromise(new LocalMigrateError(`${label} subprocess error: ${err.message}`, err));
-		});
-		child.on("close", (code, signal) => {
-			if (code === 0) {
-				resolvePromise();
-				return;
-			}
-			rejectPromise(new LocalMigrateError(`${label} ${signal !== null ? `killed by signal ${signal}` : code !== null ? `exited with code ${code}` : "process closed without a code or signal"}.\n--- stdout ---\n${stdout || "(empty)"}\n--- stderr ---\n${stderr || "(empty)"}\n`));
-		});
-	});
-}
-
-//#endregion
-//#region src/cli/commands/migrate/index.ts
-/**
-* Build an extra-env bag for subprocesses (`npm install`, `cdk synth`)
-* so they inherit the AWS profile the caller selected via `--profile`.
-*
-* Without this, `cdk synth` falls back to the SDK default credential
-* chain (or no credentials at all) when the user runs cdkd under a
-* non-default profile — which silently produces a template synthesized
-* against the wrong account / region context.
-*/
-function buildAwsEnv(opts) {
-	return opts.profile ? { AWS_PROFILE: opts.profile } : {};
-}
-/**
-* PR A library entry point — orchestrates the codegen + synth half of
-* `cdkd migrate --from-cfn-stack` without writing cdkd state, running
-* import, or touching the source CFn stack.
-*
-* Flow:
-*   1. `verifyCdkCliAvailable` — hard-fail if `cdk` is missing.
-*   2. `prefetchCfnStack` — read source stack state + resources +
-*      transform info.
-*   3. `validatePrefetchResult` — reject CR / nested-stack / non-
-*      terminal state; INFO log SAM / Include transforms.
-*   4. `assertOutputDirAvailable` — refuse pre-existing non-empty
-*      output dir.
-*   5. `spawnCdkMigrate` — run `cdk migrate --from-stack` subprocess.
-*   6. `installGeneratedAppDeps` (gated by `skipInstall`).
-*   7. `synthGeneratedApp` (gated by `skipSynth`).
-*   8. Return every artifact PR B will consume.
-*
-* Per #465 Q4 (parent-session decision): PR A is library-only. The CLI
-* command (`cdkd migrate`), state writes, retire flow, and resource-
-* mapping algorithm all live in PR B.
-*/
-async function runMigrateLibrary(opts) {
-	const logger = getLogger();
-	const stackName = opts.fromCfnStack;
-	const outputPath = opts.outputDir ?? resolve(process.cwd(), stackName);
-	logger.info(`[migrate] Verifying upstream 'cdk' CLI...`);
-	const cliCheck = await verifyCdkCliAvailable(opts.cdkBinPath);
-	logger.info(`[migrate] Using cdk CLI v${cliCheck.version}`);
-	if (cliCheck.warn) logger.warn(`[migrate] ${cliCheck.warn}`);
-	logger.info(`[migrate] Pre-fetching CloudFormation stack '${stackName}'...`);
-	const cfnClient = buildCfnClient(opts);
-	let prefetch;
-	try {
-		prefetch = await prefetchCfnStack(stackName, cfnClient);
-	} finally {
-		cfnClient.destroy?.();
-	}
-	validatePrefetchResult(prefetch);
-	if (prefetch.transformInfo.hasSamTransform) logger.info("[migrate] INFO: source CFn stack uses 'AWS::Serverless' transform; cdk migrate will expand it client-side and the generated CDK code will use plain Lambda + API Gateway L1 constructs (not SAM).");
-	if (prefetch.transformInfo.hasIncludeTransform) logger.info("[migrate] INFO: source CFn stack uses 'AWS::Include' transform; cdk migrate will expand it client-side and the generated CDK code will inline the included template content.");
-	assertOutputDirAvailable(outputPath, stackName);
-	const spawnResult = await spawnCdkMigrate({
-		stackName,
-		fromStackName: stackName,
-		outputPath,
-		...opts.language && { language: opts.language },
-		...opts.region && { region: opts.region },
-		...opts.account && { account: opts.account },
-		...opts.filters && { filters: opts.filters },
-		...opts.profile && { profile: opts.profile },
-		...opts.cdkBinPath && { cdkBinPath: opts.cdkBinPath }
-	});
-	await installGeneratedAppDeps(spawnResult.outputDir, {
-		skipInstall: opts.skipInstall ?? false,
-		extraEnv: buildAwsEnv(opts)
-	});
-	const synthResult = await synthGeneratedApp(spawnResult.outputDir, {
-		skipSynth: opts.skipSynth ?? false,
-		...opts.cdkBinPath && { cdkBinPath: opts.cdkBinPath },
-		extraEnv: buildAwsEnv(opts)
-	});
-	if (prefetch.sourceCfnTemplate === null) throw new LocalMigrateError(`Could not read the source CloudFormation template for '${stackName}' (GetTemplate failed during pre-flight). Re-run after granting cloudformation:GetTemplate on the stack, or check the earlier warning for details.`);
-	return {
-		outputDir: spawnResult.outputDir,
-		assemblyDir: synthResult.assemblyDir,
-		templateBody: synthResult.templateBody,
-		sourceCfnTemplate: prefetch.sourceCfnTemplate,
-		sourceResources: prefetch.resources
-	};
-}
-/**
-* Build a CloudFormation client using cdkd's shared {@link AwsClients}
-* factory so the credential chain matches every other cdkd command.
-*
-* Keeping the construction in one place makes the per-command CFn-
-* client recipe a single readable hook for future plumbing (e.g.
-* threading PR B's `--role-arn` STS-assume).
-*/
-function buildCfnClient(opts) {
-	const config = {};
-	if (opts.region) config.region = opts.region;
-	if (opts.profile) config.profile = opts.profile;
-	return new AwsClients(config).getCloudFormationClient();
-}
-
-//#endregion
-//#region src/cli/commands/migrate/resource-mapper.ts
-/**
-* Run the 2-pass mapping algorithm against `(sourceCfnTemplate,
-* synthTemplate, sourceResources)` and return the resolved mapping plus
-* any unmatched entries.
-*
-* Pure-functional: no AWS calls, no I/O, no mutation of inputs. Safe to
-* call repeatedly in tests against shared fixtures.
-*
-* Throws when an override references a synth id that does not exist —
-* this is a user error in the hand-edited mapping JSON and surfacing
-* the available synth ids in the message is the path back to a working
-* config.
-*/
-function buildResourceMapping(opts) {
-	const sourceEntries = extractSourceResources(opts.sourceCfnTemplate);
-	const synthEntries = extractSynthResources(opts.synthTemplate);
-	const physicalIdByLogicalId = /* @__PURE__ */ new Map();
-	for (const r of opts.sourceResources) physicalIdByLogicalId.set(r.LogicalResourceId, r.PhysicalResourceId);
-	const overrides = opts.overrides ?? {};
-	const synthLogicalIds = new Set(synthEntries.map((s) => s.logicalId));
-	for (const [srcId, synthId] of Object.entries(overrides)) if (!synthLogicalIds.has(synthId)) throw new Error(`Resource-mapping override targets synth logical id '${synthId}' (for source id '${srcId}'), but that id is not in the synthesized template. Available synth ids: ${[...synthLogicalIds].sort().join(", ")}`);
-	const missingPhysicalIds = [];
-	for (const src of sourceEntries) if (!physicalIdByLogicalId.has(src.logicalId)) missingPhysicalIds.push(`  - ${src.logicalId} (${src.type})`);
-	if (missingPhysicalIds.length > 0) throw new Error(`Source CFn resource(s) not returned by DescribeStackResources — cannot migrate:\n${missingPhysicalIds.join("\n")}\n\nThe stack may have been mid-operation; wait for it to settle (CREATE_COMPLETE / UPDATE_COMPLETE / etc.) and retry.`);
-	const synthByLastPathSegment = indexSynthByLastPathSegment(synthEntries);
-	const synthByLogicalId = new Map(synthEntries.map((s) => [s.logicalId, s]));
-	const claimedSynthIds = /* @__PURE__ */ new Set();
-	const pairs = [];
-	const unmatched = [];
-	const sourcesHandledByOverride = /* @__PURE__ */ new Set();
-	for (const [srcId, synthId] of Object.entries(overrides)) {
-		const src = sourceEntries.find((e) => e.logicalId === srcId);
-		if (!src) {
-			const availableSrc = sourceEntries.map((e) => e.logicalId).sort();
-			throw new Error(`Resource-mapping override references source logical id '${srcId}', but no resource with that id exists in the source CloudFormation template. Available source ids: ${availableSrc.join(", ")}`);
-		}
-		const synth = synthByLogicalId.get(synthId);
-		if (!synth) continue;
-		const physicalId = physicalIdByLogicalId.get(src.logicalId);
-		pairs.push({
-			sourceLogicalId: src.logicalId,
-			synthLogicalId: synth.logicalId,
-			physicalId,
-			resourceType: src.type
-		});
-		claimedSynthIds.add(synth.logicalId);
-		sourcesHandledByOverride.add(src.logicalId);
-	}
-	const passOnePending = [];
-	for (const src of sourceEntries) {
-		if (sourcesHandledByOverride.has(src.logicalId)) continue;
-		const candidatesForLastSegment = synthByLastPathSegment.get(src.logicalId) ?? [];
-		const rawCandidateCount = candidatesForLastSegment.length;
-		const availableCandidates = candidatesForLastSegment.filter((c) => !claimedSynthIds.has(c.logicalId));
-		if (rawCandidateCount === 1 && availableCandidates.length === 1) {
-			const synth = availableCandidates[0];
-			pairs.push({
-				sourceLogicalId: src.logicalId,
-				synthLogicalId: synth.logicalId,
-				physicalId: physicalIdByLogicalId.get(src.logicalId),
-				resourceType: src.type
-			});
-			claimedSynthIds.add(synth.logicalId);
-		} else passOnePending.push(src);
-	}
-	for (const src of passOnePending) {
-		const candidatesSameType = synthEntries.filter((s) => s.type === src.type && !claimedSynthIds.has(s.logicalId));
-		const propertyMatches = candidatesSameType.filter((s) => deepEqualIgnoreNoValue(src.properties, s.properties));
-		if (propertyMatches.length === 1) {
-			const synth = propertyMatches[0];
-			pairs.push({
-				sourceLogicalId: src.logicalId,
-				synthLogicalId: synth.logicalId,
-				physicalId: physicalIdByLogicalId.get(src.logicalId),
-				resourceType: src.type
-			});
-			claimedSynthIds.add(synth.logicalId);
-		} else {
-			const isCollision = (synthByLastPathSegment.get(src.logicalId) ?? []).length >= 2;
-			unmatched.push({
-				sourceLogicalId: src.logicalId,
-				resourceType: src.type,
-				candidates: candidatesSameType.map((c) => c.logicalId).sort(),
-				reason: isCollision ? "logical-id-collision" : "no-match"
-			});
-		}
-	}
-	const mapping = {};
-	for (const p of pairs) mapping[p.sourceLogicalId] = p.synthLogicalId;
-	return {
-		mapping,
-		pairs,
-		unmatched
-	};
-}
-/**
-* Walk a parsed CFn template's `Resources` and return one entry per
-* resource. `Type` defaults to `''` and `Properties` to `{}` when the
-* template omits them (CFn allows resources with only `DeletionPolicy`
-* + `Type`); the mapper's downstream deep-equal handles `{}` cleanly.
-*
-* Top-level keys other than `Resources` (Conditions / Parameters /
-* Rules / Outputs / Mappings / Metadata) are NOT walked — the mapping
-* is resource-to-resource only, and §5.5 of the design doc spells out
-* the four CDK-synth injections that live in those sibling keys.
-*/
-function extractSourceResources(template) {
-	if (!template || typeof template !== "object") return [];
-	const resources = template["Resources"];
-	if (!resources || typeof resources !== "object") return [];
-	const out = [];
-	for (const [logicalId, raw] of Object.entries(resources)) {
-		if (!raw || typeof raw !== "object") continue;
-		const r = raw;
-		const type = typeof r["Type"] === "string" ? r["Type"] : "";
-		const props = r["Properties"] && typeof r["Properties"] === "object" ? r["Properties"] : {};
-		out.push({
-			logicalId,
-			type,
-			properties: props
-		});
-	}
-	return out;
-}
-/**
-* Walk the synth template's `Resources` and return one entry per
-* resource, EXCLUDING `AWS::CDK::Metadata` (synth-only sentinel that has
-* no source counterpart). Captures `Metadata['aws:cdk:path']` so Pass 1
-* can match against the last `/`-separated segment.
-*
-* The four other CDK-synth injections (CDKMetadataAvailable Condition,
-* BootstrapVersion Parameter, CheckBootstrapVersion Rule) live outside
-* `Resources` and are structurally excluded by this function.
-*/
-function extractSynthResources(template) {
-	if (!template || typeof template !== "object") return [];
-	const resources = template["Resources"];
-	if (!resources || typeof resources !== "object") return [];
-	const out = [];
-	for (const [logicalId, raw] of Object.entries(resources)) {
-		if (!raw || typeof raw !== "object") continue;
-		const r = raw;
-		const type = typeof r["Type"] === "string" ? r["Type"] : "";
-		if (type === "AWS::CDK::Metadata") continue;
-		const props = r["Properties"] && typeof r["Properties"] === "object" ? r["Properties"] : {};
-		const meta = r["Metadata"] && typeof r["Metadata"] === "object" ? r["Metadata"] : {};
-		const path = typeof meta["aws:cdk:path"] === "string" ? meta["aws:cdk:path"] : "";
-		out.push({
-			logicalId,
-			type,
-			properties: props,
-			awsCdkPath: path
-		});
-	}
-	return out;
-}
-/**
-* Group synth entries by the LAST `/`-separated segment of their
-* `aws:cdk:path` metadata so Pass 1 can look up the source logical id
-* directly. Per [docs/design/465-cfn-migrate.md](../../../../docs/design/465-cfn-migrate.md) §5.5:
-* `cdk migrate` emits `<StackName>/<LogicalId>` as the metadata value,
-* so the last segment IS the source logical id in the typical case.
-*
-* Entries without an `aws:cdk:path` are silently skipped — they cannot
-* be addressed by source logical id and will only be reachable via
-* Pass 2's Properties match.
-*/
-function indexSynthByLastPathSegment(entries) {
-	const out = /* @__PURE__ */ new Map();
-	for (const e of entries) {
-		if (!e.awsCdkPath) continue;
-		const lastSegment = e.awsCdkPath.split("/").pop() ?? "";
-		if (!lastSegment) continue;
-		const bucket = out.get(lastSegment);
-		if (bucket) bucket.push(e);
-		else out.set(lastSegment, [e]);
-	}
-	return out;
-}
-/**
-* Recursive deep equality between two values, with two CFn-specific
-* accommodations:
-*
-*  1. Object key order is NOT significant — `JSON.stringify` would
-*     diverge on the canonical-source-vs-synth-alphabetized case
-*     (verified by PR A's empirical run, §5.5 point 3) so we walk the
-*     keys explicitly.
-*  2. `AWS::NoValue` placeholder values are stripped before compare —
-*     `cdk migrate`'s codegen sometimes emits the placeholder for a
-*     property the source template simply omitted, and the structural
-*     intent matches. Source side never has the placeholder; synth side
-*     can on either side of a nested object.
-*
-* Arrays are compared positionally (order IS significant — Tags arrays
-* and similar carry ordering semantics).
-*/
-function deepEqualIgnoreNoValue(a, b) {
-	if (a === b) return true;
-	if (isAwsNoValue(a) !== isAwsNoValue(b)) return false;
-	if (isAwsNoValue(a) && isAwsNoValue(b)) return true;
-	if (typeof a !== typeof b) return false;
-	if (a === null || b === null) return a === b;
-	if (typeof a !== "object") return a === b;
-	if (Array.isArray(a) !== Array.isArray(b)) return false;
-	if (Array.isArray(a) && Array.isArray(b)) {
-		if (a.length !== b.length) return false;
-		for (let i = 0; i < a.length; i++) if (!deepEqualIgnoreNoValue(a[i], b[i])) return false;
-		return true;
-	}
-	const aObj = a;
-	const bObj = b;
-	const aKeys = Object.keys(aObj).filter((k) => !isAwsNoValue(aObj[k]) && aObj[k] !== void 0);
-	const bKeys = Object.keys(bObj).filter((k) => !isAwsNoValue(bObj[k]) && bObj[k] !== void 0);
-	if (aKeys.length !== bKeys.length) return false;
-	const aKeySet = new Set(aKeys);
-	for (const k of bKeys) {
-		if (!aKeySet.has(k)) return false;
-		if (!deepEqualIgnoreNoValue(aObj[k], bObj[k])) return false;
-	}
-	return true;
-}
-/**
-* True when the value is the CFn `AWS::NoValue` placeholder
-* (`{Ref: 'AWS::NoValue'}`). `cdk migrate`'s codegen emits this for
-* conditional properties the source template omitted; the structural
-* intent matches and deep-equal must treat them as absent.
-*/
-function isAwsNoValue(v) {
-	if (!v || typeof v !== "object") return false;
-	const obj = v;
-	const keys = Object.keys(obj);
-	return keys.length === 1 && keys[0] === "Ref" && obj["Ref"] === "AWS::NoValue";
-}
-
-//#endregion
-//#region src/cli/commands/migrate/resource-mapping-file.ts
-/** Conventional filename inside the migrate output dir. */
-const RESOURCE_MAPPING_FILENAME = "cdkd-resource-mapping.json";
-/**
-* Build the on-disk file shape from a {@link ResourceMappingResult} +
-* the source / output stack names, then write it to
-* `<outputDir>/cdkd-resource-mapping.json` (overwriting any prior file
-* on the same path — same idempotency contract as `cdk migrate`'s own
-* codegen, and the user expects a re-run to refresh stale data).
-*
-* Returns the absolute on-disk path so the orchestrator can name it in
-* the error message when the mapping is incomplete.
-*/
-function writeMappingFile(outputDir, args) {
-	const path = join(outputDir, RESOURCE_MAPPING_FILENAME);
-	const file = {
-		version: 1,
-		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		sourceStack: args.sourceStack,
-		outputStack: args.outputStack,
-		mapping: args.result.mapping
-	};
-	if (args.result.unmatched.length > 0) file._unmatched = args.result.unmatched;
-	writeFileSync(path, JSON.stringify(file, null, 2) + "\n", "utf-8");
-	return path;
-}
-/**
-* Read a user-supplied resource-mapping file from disk and return the
-* `{<srcLogicalId>: <synthLogicalId>}` overrides for the mapper.
-*
-* Tolerates `_unmatched` on input (a user that re-runs against a
-* partial-failure file without editing should hit the same failure on
-* the resolution side — not a parse error here). Hard-errors on
-* structurally invalid input (missing `mapping`, non-object root,
-* non-string values, wrong `version`).
-*
-* Surfaces every shape error as `LocalMigrateError` (exit code 2) so
-* the CLI handler routes it through the normal error path.
-*/
-function readMappingFile(path) {
-	if (!existsSync(path)) throw new LocalMigrateError(`Resource-mapping file not found: ${path}. Drop the --resource-mapping flag or supply a valid path.`);
-	let raw;
-	try {
-		raw = JSON.parse(readFileSync(path, "utf-8"));
-	} catch (err) {
-		throw new LocalMigrateError(`Resource-mapping file '${path}' is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new LocalMigrateError(`Resource-mapping file '${path}' must contain a JSON object at the top level.`);
-	const obj = raw;
-	if (obj["version"] !== 1) throw new LocalMigrateError(`Resource-mapping file '${path}' has unsupported version '${String(obj["version"])}'. Expected version 1.`);
-	if (typeof obj["sourceStack"] !== "string" || obj["sourceStack"].length === 0) throw new LocalMigrateError(`Resource-mapping file '${path}' is missing the required 'sourceStack' field.`);
-	if (typeof obj["outputStack"] !== "string" || obj["outputStack"].length === 0) throw new LocalMigrateError(`Resource-mapping file '${path}' is missing the required 'outputStack' field.`);
-	if (typeof obj["generatedAt"] !== "string") throw new LocalMigrateError(`Resource-mapping file '${path}' is missing the required 'generatedAt' field.`);
-	const mappingRaw = obj["mapping"];
-	if (!mappingRaw || typeof mappingRaw !== "object" || Array.isArray(mappingRaw)) throw new LocalMigrateError(`Resource-mapping file '${path}' is missing the required 'mapping' object.`);
-	const mapping = {};
-	for (const [k, v] of Object.entries(mappingRaw)) {
-		if (typeof v !== "string") throw new LocalMigrateError(`Resource-mapping file '${path}' has a non-string value for key '${k}'.`);
-		mapping[k] = v;
-	}
-	const result = {
-		version: 1,
-		generatedAt: obj["generatedAt"],
-		sourceStack: obj["sourceStack"],
-		outputStack: obj["outputStack"],
-		mapping
-	};
-	if (Array.isArray(obj["_unmatched"])) {
-		const cleaned = [];
-		for (const entry of obj["_unmatched"]) {
-			if (!entry || typeof entry !== "object") continue;
-			const e = entry;
-			if (typeof e["sourceLogicalId"] !== "string" || typeof e["resourceType"] !== "string" || !Array.isArray(e["candidates"]) || e["reason"] !== "no-match" && e["reason"] !== "logical-id-collision") continue;
-			cleaned.push({
-				sourceLogicalId: e["sourceLogicalId"],
-				resourceType: e["resourceType"],
-				candidates: e["candidates"].filter((c) => typeof c === "string"),
-				reason: e["reason"]
-			});
-		}
-		if (cleaned.length > 0) result._unmatched = cleaned;
-	}
-	return result;
-}
-
-//#endregion
-//#region src/cli/commands/migrate-command.ts
-/**
-* `cdkd migrate --from-cfn-stack <name>` end-to-end orchestrator.
-*
-* Closes the CLI half of [#465](https://github.com/go-to-k/cdkd/issues/465).
-* Reads the source CFn stack, runs upstream `cdk migrate` via the PR A
-* library, builds the source → synth logical-ID mapping with the 2-pass
-* algorithm, writes a `cdkd-resource-mapping.json` audit file, prompts
-* for confirmation, invokes `cdkd import` to write state under the
-* synth logical IDs, and (when `--retire-cfn-stack` is set) finally
-* retires the source CFn stack so management responsibility transfers
-* fully to cdkd.
-*
-* AWS resources are never modified — the migration is a metadata
-* transfer only. See [docs/design/465-cfn-migrate.md](../../../docs/design/465-cfn-migrate.md) §7
-* for the post-migration state matrix.
-*/
-async function migrateCommandAction(positionalStack, options) {
-	const logger = getLogger();
-	if (options.verbose) {
-		logger.setLevel("debug");
-		process.env["CDKD_NO_LIVE"] = "1";
-	}
-	const sourceCfnStackName = options.fromCfnStack ?? positionalStack;
-	if (!sourceCfnStackName) throw new LocalMigrateError("Missing required argument: --from-cfn-stack <name> (or pass the stack name positionally).");
-	if (options.retireCfnStack && options.skipSynth) throw new LocalMigrateError("--retire-cfn-stack is incompatible with --skip-synth: the post-state-write retirement (UpdateStack + DeleteStack) cannot run without a synthesized template + cdkd state.");
-	if (options.retireCfnStack && options.dryRun) throw new LocalMigrateError("--retire-cfn-stack is incompatible with --dry-run: retirement issues real AWS calls (UpdateStack injects Retain policies, then DeleteStack).");
-	if (options.retireCfnStack && options.filter && options.filter.length > 0) throw new LocalMigrateError("--retire-cfn-stack is incompatible with --filter: a partial migration that retires the whole source CFn stack would strand the un-migrated resources. Drop one of the flags or migrate the rest of the stack first.");
-	foldRegionOption(options);
-	await applyRoleArnIfSet({
-		roleArn: options.roleArn,
-		region: options.region
-	});
-	const region = namedCliRegion(options.region) ?? "us-east-1";
-	const outputDir = resolve(options.outputDir ?? sourceCfnStackName);
-	logger.info(`[migrate] Source CFn stack: ${sourceCfnStackName}`);
-	logger.info(`[migrate] Output directory: ${outputDir}`);
-	const libResult = await runMigrateLibrary({
-		fromCfnStack: sourceCfnStackName,
-		outputDir,
-		language: options.language ?? "typescript",
-		...options.region && { region: options.region },
-		...options.account && { account: options.account },
-		...options.filter && options.filter.length > 0 && { filters: options.filter },
-		...options.profile && { profile: options.profile },
-		...options.cdkBin && { cdkBinPath: options.cdkBin },
-		skipInstall: options.skipInstall ?? false,
-		skipSynth: options.skipSynth ?? false
-	});
-	if (options.skipSynth || !libResult.templateBody) {
-		logger.info(`[migrate] --skip-synth: generated CDK app at ${libResult.outputDir}. Re-run without --skip-synth to write cdkd state.`);
-		return;
-	}
-	let overrides;
-	if (options.resourceMapping) {
-		const mappingPath = resolve(options.resourceMapping);
-		logger.info(`[migrate] Loading user-supplied resource mapping from ${mappingPath}`);
-		overrides = readMappingFile(mappingPath).mapping;
-	}
-	let mappingResult;
-	try {
-		mappingResult = buildResourceMapping({
-			sourceCfnTemplate: libResult.sourceCfnTemplate,
-			synthTemplate: libResult.templateBody,
-			sourceResources: libResult.sourceResources,
-			...overrides && { overrides }
-		});
-	} catch (err) {
-		throw new LocalMigrateError(err instanceof Error ? err.message : String(err));
-	}
-	const outputStack = sourceCfnStackName;
-	const mappingFilePath = writeMappingFile(libResult.outputDir, {
-		sourceStack: sourceCfnStackName,
-		outputStack,
-		result: mappingResult
-	});
-	logger.info(`[migrate] Resource mapping written to ${mappingFilePath}`);
-	if (mappingResult.unmatched.length > 0) {
-		const lines = mappingResult.unmatched.map((u) => {
-			const candidatesStr = u.candidates.length > 0 ? ` (synth candidates of same Type: ${u.candidates.join(", ")})` : " (no synth resource has the same Type)";
-			return `  - ${u.sourceLogicalId} (${u.resourceType}) [${u.reason}]${candidatesStr}`;
-		});
-		throw new LocalMigrateError(`Could not auto-map ${mappingResult.unmatched.length} of ${mappingResult.unmatched.length + mappingResult.pairs.length} source resource(s) to the synthesized CDK template:\n${lines.join("\n")}\n\nEdit '${mappingFilePath}'\nto add the correct '<sourceLogicalId>: <synthLogicalId>' pairs under "mapping", then re-run:\n  cdkd migrate --from-cfn-stack ${sourceCfnStackName} --resource-mapping ${mappingFilePath} --output-dir ${libResult.outputDir}\n(The --output-dir override re-uses the already-generated CDK code; drop it if you let the default location be used.)`);
-	}
-	printMappingTable(mappingResult, sourceCfnStackName, outputStack);
-	if (options.dryRun) {
-		logger.info(`[migrate] --dry-run: would import ${mappingResult.pairs.length} resource(s) into cdkd state under stack '${outputStack}' (region '${region}'). State NOT written.`);
-		return;
-	}
-	if (!options.yes) {
-		if (!await promptConfirm(`Import ${mappingResult.pairs.length} resource(s) into cdkd state for stack '${outputStack}' (${region})?`)) {
-			logger.info("[migrate] Cancelled by user. No state written.");
-			return;
-		}
-	}
-	const importMapping = {};
-	for (const p of mappingResult.pairs) importMapping[p.synthLogicalId] = p.physicalId;
-	const resolvedStateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
-	await runImport(outputStack, {
-		app: libResult.assemblyDir,
-		statePrefix: options.statePrefix ?? "cdkd",
-		resourceMappingInline: JSON.stringify(importMapping),
-		auto: false,
-		dryRun: false,
-		yes: true,
-		force: false,
-		verbose: options.verbose ?? false,
-		stateBucket: resolvedStateBucket,
-		...options.region && { region: options.region },
-		...options.profile && { profile: options.profile },
-		...options.roleArn && { roleArn: options.roleArn }
-	});
-	if (options.retireCfnStack) {
-		logger.info(`[migrate] Retiring source CloudFormation stack '${sourceCfnStackName}'...`);
-		const cfnConfig = {};
-		if (options.region) cfnConfig.region = options.region;
-		if (options.profile) cfnConfig.profile = options.profile;
-		const awsClients = new AwsClients(cfnConfig);
-		const cfnClient = awsClients.cloudFormation;
-		try {
-			await retireCloudFormationStack({
-				cfnStackName: sourceCfnStackName,
-				cfnClient,
-				yes: options.yes ?? false,
-				stateBucket: resolvedStateBucket,
-				...options.profile && { s3ClientOpts: { profile: options.profile } }
-			});
-		} finally {
-			awsClients.destroy();
-		}
-	}
-	logger.info(`[migrate] Migrated ${mappingResult.pairs.length} resource(s) from CloudFormation stack '${sourceCfnStackName}' to cdkd state for stack '${outputStack}'.`);
-	logger.info(`[migrate] Generated CDK app at ${libResult.outputDir}`);
-	if (!options.retireCfnStack) logger.info(`[migrate] Source CloudFormation stack '${sourceCfnStackName}' is unchanged. Re-run with --retire-cfn-stack to retire it (or do so manually later).`);
-}
-/**
-* Print a tabular `(sourceLogicalId → synthLogicalId  physicalId)`
-* summary so users can see what's about to be imported before the
-* confirmation prompt. Matches the visual shape of `cdkd import`'s
-* summary table for consistency.
-*/
-function printMappingTable(result, sourceStack, outputStack) {
-	const logger = getLogger();
-	logger.info("");
-	logger.info(`[migrate] Resolved mapping (${sourceStack} → ${outputStack}):`);
-	for (const p of result.pairs) logger.info(`  ${p.sourceLogicalId} → ${p.synthLogicalId}  [${p.resourceType}]  ${p.physicalId}`);
-	logger.info("");
-}
-/**
-* Minimal `(y/N)` confirmation prompt using `node:readline`. Mirrors
-* the shape of [src/cli/commands/import.ts](import.ts)'s `confirmPrompt`
-* so the user UX is consistent across the import + migrate surfaces.
-* Non-TTY callers (CI) should pass `--yes` to skip this entirely.
-*/
-async function promptConfirm(message) {
-	if (!process.stdin.isTTY) throw new LocalMigrateError(`Non-interactive shell detected and --yes was not supplied. Re-run with --yes to confirm: "${message}"`);
-	const rl = (await import("node:readline/promises")).createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const v = (await rl.question(`${message} (y/N) `)).trim().toLowerCase();
-		return v === "y" || v === "yes";
-	} finally {
-		rl.close();
-	}
-}
-/**
-* Commander factory for `cdkd migrate`. Registered in `src/cli/index.ts`
-* alongside the existing top-level commands. Matches the design doc §3
-* flag set; the action handler routes through {@link migrateCommandAction}
-* via `withErrorHandling` so library callers see exceptions but CLI
-* callers get the standard exit-code-2 routing.
-*/
-function createMigrateCommand() {
-	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default(DEFAULT_STATE_PREFIX)).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
-}
-
 //#endregion
 //#region src/cli/program.ts
 /**
@@ -89846,11 +88934,10 @@ function buildProgram() {
 	program.addCommand(createStateCommand());
 	program.addCommand(createLocalCommand());
 	program.addCommand(createExportCommand());
-	program.addCommand(createMigrateCommand());
 	guardStackRegionOptions(program);
 	return program;
 }
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-C-xfsrSP.js.map
+//# sourceMappingURL=program-BXXm1RTv.js.map