@go-to-k/cdkd 0.286.2 → 0.286.4

package/dist/{deploy-engine-BoSlW08T.js → deploy-engine-DylsbAdu.js}

@@ -1,9 +1,9 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Crg_SdRh.js";
+import { t as getCdkdVersion } from "./version-CKOnsgg1.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
-import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { SQSClient } from "@aws-sdk/client-sqs";
@@ -35,6 +35,7 @@ import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
 import { join as join$1 } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
+import { inspect } from "node:util";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -4027,16 +4028,402 @@ function displaySafe(value, opts) {
 }
 
 //#endregion
-//#region src/state/s3-noncurrent-version-purge.ts
+//#region src/state/s3-replication-purge-gap.ts
+/**
+* Tell the user when S3 REPLICATION has silently kept the bodies that
+* {@link ../state/s3-noncurrent-version-purge.js | the noncurrent-version
+* purge} just removed (issue
+* [#2447](https://github.com/go-to-k/cdkd/issues/2447)).
+*
+* ## The hole this closes
+*
+* `purgeNoncurrentKeyVersions` exists so that "cdkd deleted the object" means
+* the body is no longer retrievable. It reaches that by issuing
+* `DeleteObjects` entries that name a specific `VersionId`.
+*
+* **S3 never replicates a version-id delete.** Replication propagates PUTs
+* and — only when `DeleteMarkerReplication` is enabled — delete markers; a
+* delete naming a version id is deliberately not replicated, so that a delete
+* on the source cannot destroy data on the destination. On a state bucket
+* with Cross-Region (CRR) or Same-Region (SRR) replication the purge is
+* therefore SOURCE-ONLY: the replica keeps its own copy of every version,
+* `GetObject` with a `VersionId` still returns the secret, and cdkd reports
+* the purge as complete because on the only bucket it knows about, it was.
+*
+* That is exactly the shape the purge was built to remove — an operation that
+* reports success while the value stays readable — reproduced one bucket over
+* and invisible from every signal cdkd emitted. The user is not merely
+* unprotected, they are REASSURED, which is the direction this repo treats as
+* a defect rather than a gap.
+*
+* ## Why a probe and not only a doc line
+*
+* Documentation reaches the reader who goes looking. This reaches the one who
+* does not, at the moment the false belief would be formed. The whole cost is
+* one bucket-metadata call per process (see the cache below) and one IAM
+* action the caller may well not hold.
+*
+* ## Degrading is the DEFAULT, not the failure
+*
+* The purge's contract is that a missing permission produces a warning and
+* never an abort, and a detector bolted onto it must not be able to break
+* that. So this module NEVER THROWS, and treats every non-answer as "we do
+* not know" rather than as either polarity:
+*
+* - `ReplicationConfigurationNotFoundError` — the answer "no replication
+*   configuration exists". S3 reports the ABSENCE of a configuration as an
+*   ERROR, not as an empty response body, so this arm is the ordinary case
+*   for almost every bucket and must not read as a failure.
+*   `ReplicationConfiguration` ABSENT from a 200 response is treated the same
+*   way: the SDK models the field as optional, and a modelled field is not a
+*   promise that the API populates it.
+* - `AccessDenied` and friends — the caller lacks
+*   `s3:GetReplicationConfiguration`. Logged at DEBUG and never at `warn`:
+*   the overwhelming majority of buckets are not replicated, so warning here
+*   would tell almost every user to grant a permission in order to be told
+*   nothing. The doc names the action for the user who wants the check.
+* - anything else (throttle, 5xx, network) — DEBUG, and deliberately NOT
+*   cached, so the next purge in the same process retries.
+*
+* ## What is cached, what is deduped, and why they are different keys
+*
+* The PROBE is cached per (bucket, asserted owner) for the process lifetime, as
+* the sibling `src/provisioning/create-only-properties.ts` caches its
+* `DescribeType` lookups and for the same reason: the answer cannot change
+* mid-run, the value stored is the in-flight PROMISE so concurrent purges share
+* one call, and only non-transient outcomes are kept. Without it a stack with
+* thirty custom resources would issue thirty identical `GetBucketReplication`
+* calls.
+*
+* The WARNING is deduped too, but on a DIFFERENT and deliberately wider key —
+* (bucket, object description, destinations) — with the repeats sent to
+* `debug`. The two keys answer two questions and must not be merged:
+*
+* - the bucket alone is not enough, because `lock-manager.ts` routes this
+*   module's `warn` sink to `debug` on the ordinary release path (it purges a
+*   heartbeat record on every command and must not warn about it). Keyed on the
+*   bucket, that demoted line would consume the one warning the rollback
+*   journal or the response sidecar needed;
+* - adding the description is still not enough, because two rules covering
+*   different prefixes can name DIFFERENT destinations. Purging a `cdkd/dev/…`
+*   key can match only the first rule; a later `cdkd/prod/…` purge under the
+*   same description matches both, and without the destinations in the key the
+*   user would clean the first replica and never learn the second one holds the
+*   production journal.
+*
+* Deduping at all is a departure from the sibling purge module, which
+* deliberately repeats its own failure warning. The difference is that a
+* failure RECURS — each one is another object cdkd could not remove — while
+* this is a fact about a BUCKET, identical every time it is re-derived.
+* Repeating it thirty times in a deploy adds nothing and erodes the failure
+* warning standing next to it.
+*/
 /**
 * Parenthetical used when a caller names nothing.
 *
-* True of ANY object this function is pointed at, which is the bar for a
-* default here: a caller that forgets to describe its object must still emit a
-* warning that is correct, just less specific. It deliberately does not guess
-* at content.
+* True of ANY object the purge is pointed at, which is the bar for a default
+* here: a caller that forgets to describe its object must still emit a warning
+* that is correct, just less specific. It deliberately does not guess at
+* content.
+*
+* Lives HERE rather than in `s3-noncurrent-version-purge.ts` only to keep the
+* import one-directional — the purge imports this module, so a shared constant
+* defined there and read here would be a cycle. It is the same sentence both
+* warnings fall back to, and one definition is what stops the two drifting.
+*/
+const DEFAULT_PURGED_OBJECT_DESCRIPTION = "the body of an object cdkd has just reported as removed";
+/**
+* Cache of the replication probe, holding the in-flight promise.
+*
+* Keyed on the bucket AND the `ExpectedBucketOwner` the caller asserts. The
+* SUCCESS answer does not depend on the owner assertion — two callers
+* differing only in whether they assert it read the same configuration — but
+* the FAILURE does: a mismatched-owner 403 is an answer about that caller's
+* request, and caching it under the bare bucket name silenced the detector for
+* every correctly-scoped caller in the process. cdkd has two shapes today (the
+* provider probes without an owner, the state backend and lock manager with
+* one), so the two are distinguishable in practice.
+*/
+const replicationProbeCache = /* @__PURE__ */ new Map();
+/**
+* (bucket, object description, destinations) triples already warned about.
+*
+* The one thing the warning says that VARIES is `objectDescription`; the rest
+* is a fact about the bucket, identical every time. So a stack with thirty
+* custom resources repeated a ~600-character warning thirty times while adding
+* no information after the first — and warning fatigue erodes the purge's own
+* failure warning standing next to it.
+*
+* Keyed on all three precisely so this cannot become a silence hole; the
+* module doc above gives the two failures a narrower key produces. Entries are
+* added only after the warning is actually emitted, so a throwing sink does
+* not burn a slot.
+*
+* RESIDUAL, bounded and recorded: cdkd cannot see whether the caller's sink
+* DEMOTED the line, so a `lock-manager.ts` release (which routes `warn` to
+* `debug`) claims the lock's slot and a later reap of a stale lock — which
+* would have warned — is suppressed. It is bounded to the LOCK description,
+* whose object the docs describe as carrying no secret, and to one process.
+*/
+const warnedWarnings = /* @__PURE__ */ new Set();
+/** How many destinations the warning names before it truncates. */
+const MAX_NAMED_DESTINATIONS = 3;
+/** Shown when a rule carries no `Destination.Bucket` for us to name. */
+const UNNAMED_DESTINATION = "<destination not named by the replication rule>";
+/**
+* Error codes meaning "this principal will never get an answer here".
+*
+* Cached like a real answer, because unlike a throttle they do not clear
+* within the process: retrying on every purge would spend one denied API call
+* per custom resource for a result that cannot change.
+*/
+const PERMANENT_DENIALS = /* @__PURE__ */ new Set([
+	"AccessDenied",
+	"AccessDeniedException",
+	"AllAccessDisabled",
+	"MethodNotAllowed",
+	"NotImplemented"
+]);
+/**
+* Credential-shaped failures that ARRIVE AS 403 and are nonetheless transient.
+*
+* Checked BEFORE the blanket 403 rule, which is the only way they can win:
+* `InvalidAccessKeyId` is the classic blip while an IAM principal or an
+* assumed-role credential propagates — this repo retries that whole class over
+* a 47.75 s schedule elsewhere — and an expired or skewed token clears on
+* refresh. Cached as permanent, ONE such blip on the first purge of a long
+* deploy would silence the detector for the rest of the process, which is the
+* "false silence leaves them believing a secret is gone" direction this module
+* forbids.
+*/
+const TRANSIENT_CREDENTIAL_CODES = /* @__PURE__ */ new Set([
+	"InvalidAccessKeyId",
+	"ExpiredToken",
+	"ExpiredTokenException",
+	"InvalidToken",
+	"TokenRefreshRequired",
+	"RequestTimeTooSkewed",
+	"RequestExpired"
+]);
+const describe$2 = (error) => error instanceof Error ? error.message : String(error);
+/**
+* Every wire error code the value offers, `name` and `Code` alike.
+*
+* NO PRECEDENCE, deliberately. An earlier revision collapsed the two to one
+* string and preferred a specific `name`, which had two failure modes in
+* opposite directions: preferring `name` unconditionally made the `Code`
+* fallback dead (`{ name: 'Error', Code: 'AccessDenied' }` classified as
+* retryable, so a denied principal re-probed on every purge), while
+* preferring a SPECIFIC `name` let a wrapper's own name hide
+* `Code: 'InvalidAccessKeyId'` and cache a credential blip as a permanent
+* denial. Membership is tested against every code the error carries, so
+* neither field can mask the other. (Verified against real S3: a missing
+* replication configuration arrives with that string on BOTH fields.)
+*
+* Null-safe because a `send` that rejects with `null` used to throw a
+* TypeError INSIDE the probe's own catch, leaving a REJECTED promise in the
+* cache forever: every later purge on that bucket then fell into the outer
+* `catch {}` with no warning and no debug line — a silently dead detector,
+* which is the worst possible failure for this module.
+*
+* This guard and `probe`'s rejection arm both serve one invariant — **no
+* rejection ever reaches the cache** — and the honest statement of their
+* relationship, measured one mutation at a time on 2026-09-05, is:
+*
+* - removing the ARM alone REDS a case (a rejection whose own `toString`
+*   throws: the guards pass that value through and `describe()` is what
+*   raises), so the arm is independently fenced;
+* - removing these GUARDS alone leaves the CACHING behaviour identical:
+*   `errorCodes` runs inside `runProbe`'s own catch, so a TypeError here is
+*   caught by the arm and produces the same `unknown` / `retry: true` /
+*   evicted outcome. What DOES change is the debug line's reason — guarded it
+*   reports the rejection (`: null`), unguarded it reports the classifier's
+*   own crash — and that difference is what the `throw null` case asserts, so
+*   the guards are fenced after all.
+*
+* They also earn their place structurally: classification is inside the catch
+* TODAY. An edit that hoists it out — or that adds a caller of `errorCodes`
+* outside a try — reinstates the original defect, in which a `null` rejection
+* crashed the classifier and left a REJECTED promise cached for the process,
+* so every later purge on that bucket fell into the outer `catch {}` with no
+* warning and no debug line: a silently dead detector.
+*/
+const errorCodes = (error) => {
+	if (error === null || typeof error !== "object" && typeof error !== "function") return [];
+	const e = error;
+	const codes = [];
+	if (typeof e.name === "string" && e.name.length > 0) codes.push(e.name);
+	if (typeof e.Code === "string" && e.Code.length > 0) codes.push(e.Code);
+	return codes;
+};
+/** True when ANY code the error carries is in `set`. */
+const hasCode = (error, set) => errorCodes(error).some((code) => set.has(code));
+const httpStatus = (error) => {
+	if (error === null || typeof error !== "object" && typeof error !== "function") return void 0;
+	const meta = error.$metadata;
+	return typeof meta?.httpStatusCode === "number" ? meta.httpStatusCode : void 0;
+};
+/**
+* Strip the ARN wrapper off `Destination.Bucket`, which S3 returns as
+* `arn:<partition>:s3:::<name>`.
+*
+* Partition-agnostic on purpose: `aws-cn` and `aws-us-gov` produce a
+* different second segment, and a hard-coded `arn:aws:s3:::` would leave the
+* whole ARN in the message there rather than mis-parse it — survivable, but
+* the regex costs nothing. A value that is not ARN-shaped is passed through
+* unchanged rather than rejected; the field is only ever displayed.
+*/
+function destinationName(bucketArn, account) {
+	if (bucketArn === void 0 || bucketArn === "") return UNNAMED_DESTINATION;
+	const name = bucketArn.replace(/^arn:[^:]*:s3:::/, "");
+	return account !== void 0 && account !== "" ? `${name} (account ${account})` : name;
+}
+/**
+* Reduce a `ReplicationConfiguration` to the ENABLED rules and their effective
+* prefixes.
+*
+* Exported for its own unit tests: the mapping from the four filter shapes S3
+* accepts onto one prefix string is the part with real cases in it, and
+* pinning it through a stubbed client would test the plumbing instead.
+*
+* Over-approximates DELIBERATELY, in the direction of warning:
+*
+* - a rule filtering on a TAG (`Filter.Tag`, or `Filter.And.Tags` with no
+*   `Prefix`) cannot be evaluated without reading each object's tag set, so
+*   its prefix reduces to `''` and it covers everything. A false warning
+*   sends the reader to look at a replica; a false silence leaves them
+*   believing a secret is gone.
+* - a `Disabled` rule is KEPT, flagged rather than dropped. Disabling a rule
+*   stops FUTURE replication; it does not remove what the rule already
+*   copied, so a bucket whose rule covered `cdkd/` last month and is disabled
+*   today still holds every body ever purged. Dropping it was the first cut
+*   and is the reassured-user failure this module exists to remove, arriving
+*   inside the module that removes it. A rule with no `Status` at all is kept
+*   as ENABLED: `Status` is required by the model, so an absent one means the
+*   response was not what we assumed — the same reason the sibling purge
+*   treats an absent `IsLatest` as "assume the unsafe thing is true".
+*
+* Pure: it reads only its argument, so no ambient locale, clock or
+* environment can change the answer.
+*/
+function normalizeReplicationRules(config) {
+	const targets = [];
+	for (const rule of config.Rules ?? []) {
+		const prefix = rule.Filter !== void 0 ? rule.Filter.Prefix ?? rule.Filter.And?.Prefix ?? "" : rule.Prefix ?? "";
+		targets.push({
+			prefix,
+			destination: destinationName(rule.Destination?.Bucket, rule.Destination?.Account),
+			enabled: rule.Status !== "Disabled"
+		});
+	}
+	return targets;
+}
+async function runProbe(s3Client, bucket, requestFields) {
+	try {
+		const config = (await s3Client.send(new GetBucketReplicationCommand({
+			Bucket: bucket,
+			...requestFields
+		}))).ReplicationConfiguration;
+		if (config === void 0) return { kind: "none" };
+		const rules = normalizeReplicationRules(config);
+		return rules.length === 0 ? { kind: "none" } : {
+			kind: "rules",
+			rules
+		};
+	} catch (error) {
+		if (errorCodes(error).includes("ReplicationConfigurationNotFoundError")) return { kind: "none" };
+		if (hasCode(error, TRANSIENT_CREDENTIAL_CODES)) return {
+			kind: "unknown",
+			reason: describe$2(error),
+			retry: true
+		};
+		const permanent = hasCode(error, PERMANENT_DENIALS) || httpStatus(error) === 403;
+		return {
+			kind: "unknown",
+			reason: describe$2(error),
+			retry: !permanent
+		};
+	}
+}
+function probe(s3Client, bucket, requestFields) {
+	const key = `${bucket}\u0000${requestFields.ExpectedBucketOwner ?? ""}`;
+	const cached = replicationProbeCache.get(key);
+	if (cached) return cached;
+	const pending = runProbe(s3Client, bucket, requestFields).then((result) => {
+		if (result.kind === "unknown" && result.retry) evictIfOwn(key, pending);
+		return result;
+	}, (error) => {
+		evictIfOwn(key, pending);
+		return {
+			kind: "unknown",
+			reason: describe$2(error),
+			retry: true
+		};
+	});
+	replicationProbeCache.set(key, pending);
+	return pending;
+}
+/**
+* Remove a cache entry only when it is still the one we put there.
+*
+* The identity check is UNFENCED by a test, deliberately and stated rather
+* than left to be discovered: the only way a stale probe can settle against a
+* newer entry under the same key is for something to have cleared the cache
+* mid-flight, and the sole clearer is `clearReplicationProbeCache()`, a
+* test-only helper. Writing a test for it would be writing a test for the test
+* helper. It is kept because the alternative is an unconditional `delete` that
+* is wrong the moment a non-test clearer appears.
 */
-const DEFAULT_OBJECT_DESCRIPTION = "the body of an object cdkd has just reported as removed";
+function evictIfOwn(key, own) {
+	if (replicationProbeCache.get(key) === own) replicationProbeCache.delete(key);
+}
+/**
+* Warn if replication on `bucket` covers any of `keys`.
+*
+* `keys` are the keys whose bodies were actually removed (or could not be
+* settled) — NOT everything the caller asked about. The purge scopes them; see
+* its call site for why announcing a survival that never happened is worse
+* than saying nothing.
+*
+* NEVER THROWS and never rejects: the caller runs on a cleanup path that must
+* not abort, and this is a diagnostic bolted onto it.
+*/
+async function warnIfPurgeIsReplicated(s3Client, bucket, keys, options = {}) {
+	if (keys.length === 0) return;
+	const emitDebug = (message) => {
+		const sink = options.logger;
+		if (sink?.debug) sink.debug(message);
+		else getLogger().child("s3-replication-check").debug(message);
+	};
+	try {
+		const safeBucket = displaySafe(bucket, { asciiOnly: true });
+		const result = await probe(s3Client, bucket, options.requestFields ?? {});
+		if (result.kind === "none") return;
+		if (result.kind === "unknown") {
+			emitDebug(`Could not determine whether s3://${safeBucket} is replicated (grant s3:GetReplicationConfiguration to enable the check): ${displaySafe(result.reason)}`);
+			return;
+		}
+		const covered = result.rules.filter((rule) => keys.some((key) => key.startsWith(rule.prefix)));
+		if (covered.length === 0) return;
+		const destinations = [...new Set(covered.map((rule) => rule.enabled ? rule.destination : `${rule.destination} (rule currently Disabled -- it stops FUTURE replication, not what it already copied)`))].sort();
+		const warnKey = [
+			bucket,
+			options.objectDescription ?? "",
+			...destinations
+		].join("\0");
+		if (warnedWarnings.has(warnKey)) {
+			emitDebug(`S3 replication on s3://${safeBucket} still covers purged keys (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}); already reported once this run for ${destinations.map((d) => displaySafe(d, { asciiOnly: true })).join(", ")}.`);
+			return;
+		}
+		const named = destinations.slice(0, MAX_NAMED_DESTINATIONS).map((d) => displaySafe(d, { asciiOnly: true }));
+		const elided = destinations.length - named.length;
+		(options.logger ?? getLogger().child("s3-replication-check")).warn(`S3 replication is enabled on s3://${safeBucket} and covers the key(s) cdkd just purged. S3 NEVER replicates a version-id delete, so the purge removed those versions from THIS bucket only — the copies in the destination bucket survive and remain readable there via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). cdkd cannot delete them. Remove them in the destination bucket yourself (aws s3api list-object-versions, then delete-object --version-id), or narrow the replication rule so it excludes the prefixes cdkd purges under. Destination(s): ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more; aws s3api get-bucket-replication --bucket ${safeBucket} lists them all)` : ""));
+		warnedWarnings.add(warnKey);
+	} catch {}
+}
+
+//#endregion
+//#region src/state/s3-noncurrent-version-purge.ts
 /**
 * `objectDescription` for the custom-resource response sidecar.
 *
@@ -4110,17 +4497,27 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 	const prefixes = options.listPrefix !== void 0 ? [options.listPrefix] : keys;
 	const failed = /* @__PURE__ */ new Map();
 	const unknown = { n: 0 };
+	const purged = /* @__PURE__ */ new Set();
+	const unsettledBodies = /* @__PURE__ */ new Set();
 	for (const prefix of prefixes) try {
-		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown);
+		await purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown, purged, unsettledBodies);
 	} catch (error) {
 		const affected = options.listPrefix !== void 0 ? keys : [prefix];
-		for (const key of affected) recordFailure(failed, key, describe$1(error));
+		for (const key of affected) {
+			recordFailure(failed, key, describe$1(error));
+			unsettledBodies.add(key);
+		}
 	}
 	if (failed.size > 0) {
 		const named = [...failed.entries()].slice(0, MAX_NAMED_FAILURES).map(([key, reasons]) => displaySafe(`${key} (${reasons.join("; ")})`));
 		const elided = failed.size - named.length;
-		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${bucket}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? DEFAULT_OBJECT_DESCRIPTION}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
+		logger.warn(`Could not purge noncurrent versions of ${failed.size} key(s) in s3://${displaySafe(bucket, { asciiOnly: true })}. Their previous versions survive and remain readable via GetObject with a VersionId (${options.objectDescription ?? "the body of an object cdkd has just reported as removed"}). Grant s3:ListBucketVersions and s3:DeleteObjectVersion on the state bucket, or purge the key(s) by hand. Failures: ${named.join(", ")}` + (elided > 0 ? ` (and ${elided} more)` : ""));
 	}
+	await warnIfPurgeIsReplicated(s3Client, bucket, [.../* @__PURE__ */ new Set([...purged, ...unsettledBodies])], {
+		requestFields,
+		logger,
+		...options.objectDescription !== void 0 && { objectDescription: options.objectDescription }
+	});
 }
 /**
 * Paginate `ListObjectVersions` under one prefix and delete every returned
@@ -4135,7 +4532,7 @@ async function purgeNoncurrentKeyVersions(s3Client, bucket, keys, options = {})
 * id is NOT filtered out on its own, because a bucket whose versioning was
 * SUSPENDED can carry a genuine noncurrent `'null'` version holding the body.
 */
-async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown) {
+async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields, failed, unknown, purged, unsettledBodies) {
 	let keyMarker;
 	let versionIdMarker;
 	do {
@@ -4147,15 +4544,30 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 			...versionIdMarker !== void 0 && { VersionIdMarker: versionIdMarker }
 		}));
 		const stale = [];
-		for (const entry of [...resp.Versions ?? [], ...resp.DeleteMarkers ?? []]) {
+		const entries = [...(resp.Versions ?? []).map((entry) => ({
+			entry,
+			hasBody: true
+		})), ...(resp.DeleteMarkers ?? []).map((entry) => ({
+			entry,
+			hasBody: false
+		}))];
+		for (const { entry, hasBody } of entries) {
 			if (entry.Key === void 0 || !wanted.has(entry.Key)) continue;
-			if (entry.IsLatest === void 0) recordFailure(failed, entry.Key, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
+			if (entry.IsLatest === void 0) {
+				recordFailure(failed, entry.Key, `version ${entry.VersionId ?? "<unknown>"}: listing omitted IsLatest, so the entry was left alone rather than risk deleting a current version`);
+				if (hasBody) unsettledBodies.add(entry.Key);
+			}
 			if (entry.IsLatest !== false) continue;
-			if (!entry.VersionId) continue;
+			if (!entry.VersionId) {
+				recordFailure(failed, entry.Key, `listing returned a noncurrent entry with no VersionId, so it could not be deleted`);
+				if (hasBody) unsettledBodies.add(entry.Key);
+				continue;
+			}
 			stale.push({
 				Key: entry.Key,
 				VersionId: entry.VersionId
 			});
+			if (hasBody) purged.add(entry.Key);
 		}
 		for (let i = 0; i < stale.length; i += DELETE_BATCH_SIZE) {
 			const batch = stale.slice(i, i + DELETE_BATCH_SIZE);
@@ -4182,7 +4594,10 @@ async function purgeUnderPrefix(s3Client, bucket, prefix, wanted, requestFields,
 			}
 		}
 		if (resp.IsTruncated === true && resp.NextKeyMarker === void 0) {
-			for (const key of wanted) if (key.startsWith(prefix)) recordFailure(failed, key, TRUNCATED_NO_MARKER);
+			for (const key of wanted) if (key.startsWith(prefix)) {
+				recordFailure(failed, key, TRUNCATED_NO_MARKER);
+				unsettledBodies.add(key);
+			}
 		}
 		keyMarker = resp.IsTruncated === true ? resp.NextKeyMarker : void 0;
 		versionIdMarker = keyMarker !== void 0 ? resp.NextVersionIdMarker : void 0;
@@ -5670,6 +6085,49 @@ var FileAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/regexp.ts
+/**
+* Escape a literal string for embedding in a RegExp.
+*
+* Lives here because the same four-line helper was spelled THREE times — in
+* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
+* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
+* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
+* label) into a pattern. Copies of a security-shaped helper are exactly the
+* shape that drifts: the escaped set is what stops a `.` in an interpolated
+* literal matching ANY character, and in `gc.ts` a widened match decides which
+* live assets are treated as referenced.
+*
+* The character set is the union every JS engine treats as special in a
+* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
+* character class, and no caller embeds into one.
+*/
+function escapeRegExp$1(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Remove control characters from a value about to be PRINTED.
+*
+* Lives beside {@link escapeRegExp} for the reason that helper's own note
+* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
+* in `src/deployment/outputs-export-alias.ts` — and copies of a
+* security-shaped helper drift. Both print the same class of string: a
+* resolved CloudFormation Output / `Export.Name`, which passed no CFn
+* validator, so it can carry ANSI escapes or bidi overrides straight into a
+* terminal or a CI log.
+*
+* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
+* only: a `--json` payload is a machine interface where an export name is data
+* a consumer may match on, and mutating it there trades a correctness
+* regression for a display concern (see `stripDisplayOnlyChars`, which is the
+* narrower guard for an already-serialized payload and stays local to its
+* caller because its C0 exclusion is specific to that path).
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+
 //#endregion
 //#region src/utils/docker-cmd.ts
 /**
@@ -6073,6 +6531,717 @@ function mergeEnv(overrides) {
 	else merged[k] = v;
 	return merged;
 }
+/** Replaces a redacted argv VALUE wherever this module masks one. */
+const REDACTED_ARGV_VALUE = "***";
+/**
+* `docker` argv flags whose NEXT token is a `KEY=VALUE` pair built from
+* user-supplied template data, and whose VALUE therefore must not reach a
+* user-visible error string:
+*
+* - `-e` / `--env` — a container's `Environment.Variables` (Lambda) or
+*   `ContainerDefinition.Environment` (ECS), plus `--env-vars` overrides.
+*   Values that cdkd classifies as sensitive never get here at all
+*   ({@link partitionSensitiveEnv} emits those as a value-less `-e KEY`),
+*   but everything else does: connection strings, endpoints, API base URLs.
+* - `--opt` — `DockerVolumeConfiguration.DriverOpts`, which for the `local`
+*   driver carries mount options (`o=addr=…,username=…,password=…`).
+* - `--label` — `DockerVolumeConfiguration.Labels`, user-authored metadata.
+* - `--build-arg` — a `DockerImageAsset`'s `buildArgs`, forwarded by
+*   `src/assets/docker-build.ts` on BOTH the deploy-time ECR publish path and
+*   `cdkd local run-task`'s image build
+*   ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). The value is
+*   frequently NOT a secret and IS diagnostic (a version pin, a base-image
+*   tag), which is why this one needed arguing rather than assuming — the
+*   argument that settles it is RECOVERABILITY, not likelihood. The build-arg
+*   values sit unredacted in `cdk.out/*.assets.json` on the operator's own
+*   disk, so a masked `--verbose` line costs one `jq` against a file they
+*   already have; the log line is the copy that travels into a CI archive and
+*   a pasted issue, where a build-time registry / package token
+*   (`NPM_TOKEN`, `GITHUB_TOKEN` — a common, if discouraged, use of
+*   `buildArgs`) is disclosed irreversibly. The KEY survives, so "which build
+*   arg" — the half of the diagnostic that identifies the failure — is
+*   unaffected.
+*
+* A flag NOT in this list keeps its value. For most of the argv that is
+* because the value is cdkd-authored or infrastructure-shaped — a container
+* id, an image ref, a `--subnet` CIDR, a `--format` template — and is the
+* diagnostic.
+*
+* That is NOT true of the whole remainder, and the residual is recorded here
+* rather than quietly implied: `--health-cmd`, `--ulimit`, `--link`,
+* `--entrypoint`, `--workdir` and the positional image + container command are
+* all template-supplied and still echoed. They stay unmasked deliberately —
+* each is a COMMAND or a structural knob whose text IS what an operator reads
+* the failure for, and none is a documented place to put a secret, unlike
+* `Environment` / `Secrets` / `DriverOpts`. Revisit per flag if a real leak is
+* found through one; do not widen the set on suspicion, since every addition
+* trades away diagnostic text.
+*
+* Two `docker build` flags were considered WITH `--build-arg` and deliberately
+* left out, because both carry a LOCATOR rather than a value
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)):
+*
+* - `--secret id=<id>,src=<path>` (or `,env=<NAME>`) — BuildKit resolves the
+*   material itself at build time and docker has NO inline-value syntax, so
+*   cdkd never holds the secret to leak. Masking would also blank the `id`,
+*   since the mask keys on the first `=` and `id` is what sits there — trading
+*   the whole diagnostic ("which secret, sourced from where") for a path.
+* - `--build-context <name>=<path|image-ref|git-url>` — a path or a ref, like
+*   the positional image. A URL form CAN embed a credential, but so can the
+*   image ref; masking one of the two would be a guarantee this set does not
+*   make, and neither is a documented place to put one.
+*
+* `--cache-from` / `--cache-to` were in that second bullet for one review
+* round and the security reviewer was right to refuse it: their value is a
+* comma-separated PARAM LIST, and BuildKit's cache backends take real
+* credentials inline there — s3's `access_key_id` / `secret_access_key` /
+* `session_token`, azblob's `secret_access_key`, gha's `token`. Those are not
+* locators, so they get their own structural mask keyed on the PARAM name:
+* {@link ARGV_PARAM_LIST_FLAGS} / {@link ARGV_PARAM_LIST_LOCATOR_PARAMS}.
+*/
+const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
+	"-e",
+	"--env",
+	"--opt",
+	"--label",
+	"--build-arg"
+]);
+/**
+* `docker` argv flags whose NEXT token is a COMMA-SEPARATED `key=value` param
+* list rather than one `KEY=VALUE` pair ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* security review).
+*
+* Only the params in {@link ARGV_PARAM_LIST_LOCATOR_PARAMS} survive, and the
+* rest of the list is masked — `type=s3,region=us-east-1,bucket=b` IS the
+* diagnostic ("which backend, where"), and blanking the whole value would
+* destroy it to hide one field.
+*/
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+/**
+* Param names inside an {@link ARGV_PARAM_LIST_FLAGS} value that are LOCATORS
+* and therefore survive. **Everything else in the list is masked** — this is
+* an ALLOWLIST, and it is one deliberately.
+*
+* The first cut was a denylist of the credential params BuildKit's backends
+* spell (`secret_access_key`, `access_key_id`, `session_token`, `token`), and
+* both round-2 reviewers broke it the same way:
+* `DockerCacheOption.params` is an arbitrary user map that
+* `cacheOptionToFlag` joins with a bare `,` and no quoting, so a value
+* CONTAINING a comma (`token=aa,bb`, or BuildKit's own legal
+* `secret_access_key="ab,cd"`) split into a masked head and a bare tail that
+* printed verbatim — output that LOOKS redacted. Patching that one shape is
+* the enumerate-bad-shapes treadmill; inverting the test ends it, because a
+* CSV continuation fragment has no recognised param name and so masks by
+* construction.
+*
+* The trade is the right way round for a leak fix: a param missing from this
+* list costs one degraded diagnostic, a param missing from a denylist costs a
+* printed credential. The list covers every backend BuildKit ships —
+* `registry` (`ref`), `local` (`dest` / `src` / `digest` / `tag`), `s3`
+* (`region` / `bucket` / `name` / the prefixes / `use_path_style`), `azblob`
+* (`account_name` / `name` / `prefix`), `gha` (`scope` / `timeout`),
+* `inline` (none) — plus the shared export options, so the common case masks
+* nothing.
+*
+* The four URL-valued locators live in {@link ARGV_PARAM_LIST_URL_PARAMS}
+* instead: they survive only after their userinfo and query are stripped. An
+* earlier revision kept them HERE, whole, arguing the repo's locator policy;
+* that paragraph is gone rather than softened, because azblob makes it false.
+*
+* Matched case-INSENSITIVELY on the trimmed param name — the comparison is
+* over a user-supplied key and BuildKit's own option parsing is
+* case-insensitive, so a `Secret_Access_Key` spelling must not walk past.
+*/
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
+]);
+/**
+* Locator params whose value is a URL, and which therefore survive only after
+* their USERINFO, QUERY and FRAGMENT are stripped — and only when the value
+* parses at all
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623) round-3 security
+* review).
+*
+* These were plain allowlist entries for one round, on the reasoning that a
+* credential-in-URL is an incidental hazard shared with `--build-context` and
+* the positional image ref. That reasoning does not survive contact with
+* azblob: BuildKit builds an UNAUTHENTICATED client from `account_url` when
+* `secret_access_key` is absent, so a SAS token in its query string is that
+* backend's SUPPORTED auth path, not an accident. With every other param now
+* fail-closed, leaving the whole URL was the one entry carrying credential
+* material by design.
+*
+* Scheme and host survive, which is what "which endpoint" needs — on the
+* ordinary path. FOUR things mask more than that, and every one of them also
+* masks each param after it in the same value, because they all set `masked`.
+* Three take the value WHOLE: no recognisable `//` authority; a host that is
+* really `user:password` with its `@` cut away; and a later param carrying
+* this URL's severed `@` (the caller's rule, since only it still holds the
+* parts). The fourth is milder in what it keeps, not in what it cascades — a
+* `@` in the PATH costs the host but keeps scheme and tail (`https://h/x@y`
+* -> `https://***@y`). Over-masking is the deliberate direction: see
+* {@link redactUrlLocator} for what each boundary rule leaked before this one.
+*/
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
+]);
+/**
+* A URL locator with its credential-bearing parts removed: `userinfo@`, and
+* everything from `?` or `#` on.
+*
+* Returns the input UNCHANGED when there was nothing to strip, which is the
+* signal the caller keys "was this masked?" on — so every other branch must
+* differ from its input. An unparseable or implausible value returns `***`
+* rather than itself: these four params are the only ones exempt from the
+* allowlist's mask-by-default rule, so this function is their whole
+* protection and it fails CLOSED.
+*/
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+/**
+* The masked rendering of `value` for `flag`, or `undefined` when this flag
+* carries nothing to mask.
+*
+* The single place every argv spelling converges — `--flag VALUE` (two
+* tokens), `--flag=VALUE` (one), and pflag's shorthand cluster in both forms,
+* which reach it through {@link maskAttachedShortFlag} and through
+* {@link trailingShortFlagOfCluster} in {@link redactDockerArgvValues}.
+*
+* The joined form is valid docker syntax for every long flag here, and it was
+* UNMASKED until the [#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* review: harmless while every argv this repo builds emits two tokens, but
+* `src/assets/docker-build.ts`'s `executable` source mode renders a
+* USER-AUTHORED command line, and a wrapper script spelling
+* `--build-arg=NPM_TOKEN=…` leaked it verbatim into both the `--verbose` log
+* and a thrown error.
+*/
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+/**
+* The masked rendering of an ATTACHED short-flag element (`-eKEY=VALUE`), or
+* `undefined` when this element is not one.
+*
+* pflag — which docker uses — accepts a short flag's value glued to it, so
+* `-eNPM_TOKEN=secret` is `-e NPM_TOKEN=secret`, and neither the two-token nor
+* the `--flag=VALUE` branch can see it ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* round-2 security review). No argv this repo BUILDS uses the form, but
+* `src/assets/docker-build.ts`'s `executable` source mode hands a user's own
+* command line straight to `spawn`, which is the whole reason the joined form
+* is masked too.
+*
+* This OVER-MASKS relative to pflag, and the earlier claim that it "follows
+* docker's own parse" was wrong: pflag stops at the first cluster letter that
+* consumes a value, so it reads `-file=a=b` as `-f` taking `ile=a=b` while
+* this masks at the `e`. Every such divergence costs a diagnostic and hides
+* nothing that was not already a `KEY=VALUE` pair, so the direction is the
+* safe one — but it is a divergence, not parity.
+*/
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+/**
+* The value-bearing short flag a shorthand CLUSTER ENDS in, if any — the form
+* that takes its value from the NEXT argv element.
+*
+* pflag's `parseSingleShortArg` falls through to `value = args[0]` when the
+* cluster runs out, so `-itde K=v` is `-i -t -d -e K=v` with the value in a
+* separate token. {@link maskAttachedShortFlag} bails on a flag letter in last
+* position (there is nothing attached to mask) and the two-token branch looked
+* `-itde` up as a whole flag and missed, so this spelling printed verbatim
+* until [#2623](https://github.com/go-to-k/cdkd/issues/2623)'s round-4 review
+* measured it. Pass 2 cannot rescue it either: its alternation needs a
+* whitespace-preceded `-e`.
+*/
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+/**
+* Structural, whitespace-delimited form of {@link ARGV_VALUE_BEARING_FLAGS}
+* for scanning a STRING that embeds a space-joined argv. Keyed on the FLAG's
+* position — never on the secret's value, so an unrelated literal that merely
+* coincides with a value is left alone.
+*
+* Covers the SEPARATED and JOINED spellings of
+* {@link ARGV_VALUE_BEARING_FLAGS} only. Two gaps, recorded rather than
+* implied. pflag's shorthand cluster is not modelled here in EITHER form —
+* attached (`-eKEY=VALUE` / `-itdeKEY=VALUE`) or separated (`-itde KEY=VALUE`,
+* which this pass's alternation cannot see because it needs a
+* whitespace-preceded `-e`) — this pass has no argv to resolve
+* the cluster against, and a bare `-e` prefix scan over free text would fire
+* on any word starting with `-e`; {@link redactDockerArgvValues} and passes 1
+* / 1b handle it wherever an argv IS available, which is every composer. And
+* {@link ARGV_PARAM_LIST_FLAGS}
+* is deliberately absent: this pass runs with NO argv to key on, and picking a
+* param name out of a free-text comma list is where a structural match stops
+* being structural. The param mask therefore rides passes 1 and 1b, both of
+* which derive from {@link redactDockerArgvValues} and so have the real argv —
+* i.e. a cache credential is masked in every text composed through a composer,
+* and not in a bare text handed to {@link redactDockerArgvInText} with no
+* `args`. Recorded rather than implied.
+*
+* DERIVED from the Set rather than re-spelled beside it
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). Until then this was
+* a hand-written literal listing the same four flags, i.e. the shape where
+* adding a flag to one spelling and not the other masks it on the argv pass
+* and leaks it on the text pass — a divergence no behavioural test of either
+* one can see. Deriving is stronger than fencing the pair: there is nothing
+* left to diverge.
+*
+* What each piece actually buys, since one of them was mis-credited in review:
+* the `(^|\s)` lead is what stops `-e` matching inside `--env` (there is no
+* `m` flag, so `^` is start-of-INPUT), NOT the alternation order — reordering
+* the branches leaves every test green. The order is kept as belt and braces
+* only, which is why the derivation sorts longest-first. The separator group
+* IS load-bearing: `\s+` is what stops `-easy` / `--environment` matching, and
+* the `=` alternative is the joined `--build-arg=KEY=VALUE` spelling
+* {@link maskArgvFlagValue} handles on the argv side (the group can never be
+* empty, so `--build-argument=X=y` still cannot match). The KEY is `[^\s=]*`
+* rather than `+` so an EMPTY key (`-e =value`) is masked too.
+*
+* The alternation is asserted NON-EMPTY at construction. An empty
+* {@link ARGV_VALUE_BEARING_FLAGS} would collapse it to `(^|\s)()(\s+|=)…`,
+* which masks EVERY whitespace-preceded `k=v` in any docker text — a
+* fail-OPEN that destroys the diagnostic wholesale, and the one failure mode
+* deriving from the Set introduced.
+*/
+const ARGV_VALUE_TOKEN_RE = (() => {
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$1).join("|");
+	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
+	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
+})();
+/**
+* Return a copy of `args` with the VALUE of every
+* {@link ARGV_VALUE_BEARING_FLAGS} pair replaced by `***`, and the credential
+* PARAMS of every {@link ARGV_PARAM_LIST_FLAGS} value replaced likewise. The
+* KEY survives — "which variable" is the diagnostic, "what it was set to" is
+* the disclosure.
+*
+* All FOUR argv spellings are handled: `--flag VALUE` (two tokens, what every
+* argv this repo builds emits), `--flag=VALUE`, and pflag's shorthand cluster
+* in both its forms — attached (`-itdeKEY=VALUE`) and separated
+* (`-itde KEY=VALUE`, where the cluster ends in the flag letter and pflag
+* takes the NEXT token). The last three are handled because a user's own
+* build script may spell them
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)).
+* A value-less `-e KEY` (the form {@link partitionSensitiveEnv} emits for a
+* sensitive key) has nothing to mask and is returned unchanged. `args` is
+* never mutated: the redacted copy is for DISPLAY only, never for `spawn`.
+*/
+function redactDockerArgvValues(args) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
+		const next = args[i + 1];
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
+				i++;
+				continue;
+			}
+		}
+		out.push(cur);
+	}
+	return out;
+}
+/**
+* Redact argv-borne values inside an error TEXT before it reaches the user.
+*
+* **Wrap EVERY `execFile`-derived docker failure text in this**, including one
+* whose argv carries no user data today — `execFile` puts the WHOLE command
+* line into `err.message` (`Command failed: <file> <args joined by ' '>\n<stderr>`,
+* measured on Node 24), so any argv that later gains a `-e` pair starts leaking
+* with no edit to the error site. That silent-gap shape is exactly what
+* [#2440](https://github.com/go-to-k/cdkd/issues/2440) reported: the debug log
+* one screen earlier redacted the same argv and the error path did not.
+*
+* Two passes, both structural (positional), never value-based — matching on a
+* secret's VALUE would also blank an unrelated string that happens to equal it:
+*
+* 1. **Exact command-line substitution** (only when `args` is given). The raw
+*    `args.join(' ')` is replaced by {@link redactDockerArgvValues}' rendering
+*    of the same array. This is the pass that matters, because it is the only
+*    one that can mask a value CONTAINING WHITESPACE (`-e CFG={"a": 1}`), which
+*    no token scan of a space-joined string can delimit.
+* 2. **Token scan** ({@link ARGV_VALUE_TOKEN_RE}) over the result. Catches an
+*    argv echoed in a shape pass 1 cannot see — a future Node message format,
+*    a docker stderr quoting the flag back, or a call site with no `args` to
+*    hand. Deliberately fail-loud rather than fail-open: a `-e X=y` occurring
+*    in unrelated stderr prose loses its value and keeps its key.
+*
+* Idempotent (`-e KEY=***` re-masks to itself), so double-wrapping is safe.
+*
+* **Call sites should use a composer** ({@link describeDockerFailure} and its
+* siblings) rather than this function: the composers take a REQUIRED `args`,
+* which is what makes the redaction impossible to forget. This is the
+* primitive they are built from, exported so the four passes can be tested
+* against Node's real message shapes directly — it has no other caller in
+* `src/`, and that is deliberate rather than an oversight.
+*/
+function redactDockerArgvInText(text, args) {
+	let out = text;
+	if (args && args.length > 0) {
+		const maskedArgs = redactDockerArgvValues(args);
+		const raw = args.join(" ");
+		const masked = maskedArgs.join(" ");
+		if (masked !== raw) out = out.split(raw).join(masked);
+		for (let i = 0; i < args.length; i++) {
+			const rawArg = args[i];
+			const maskedArg = maskedArgs[i];
+			if (maskedArg === rawArg) continue;
+			if (!isSubstitutableToken(rawArg)) continue;
+			out = out.split(rawArg).join(maskedArg);
+			const escapedRaw = nodeQuotedRendering(rawArg);
+			const escapedMasked = nodeQuotedRendering(maskedArg);
+			if (escapedRaw !== void 0 && escapedMasked !== void 0 && escapedRaw !== rawArg) out = out.split(escapedRaw).join(escapedMasked);
+		}
+		out = repairSpawnRefusal(out, args, maskedArgs);
+	}
+	return out.replace(ARGV_VALUE_TOKEN_RE, (_match, lead, flag, gap, key) => `${lead}${flag}${gap}${key}=${REDACTED_ARGV_VALUE}`);
+}
+/**
+* Shortest VALUE that pass 1b will substitute as a bare token.
+*
+* Pass 1b's needle is the whole `KEY=VALUE` element, and it is replaced
+* EVERYWHERE in the text — so a tiny needle is a liability rather than a
+* protection. The empty-key case makes that concrete: a non-sensitive
+* `{ Name: '', Value: '1' }` produces the two-character token `=1`, and
+* substituting that rewrites every `=1` in the message (`--cpus=1`,
+* `status=1`, a path segment). Below this floor the value is not worth
+* protecting by substring match, and passes 1 and 3 still cover it in the
+* message shapes that carry a `-e ` prefix or the joined command line.
+*/
+const MIN_SUBSTITUTABLE_VALUE_LENGTH = 4;
+/** Is this `KEY=VALUE` element long enough to substitute as a bare token? */
+function isSubstitutableToken(arg) {
+	const eqIdx = arg.indexOf("=");
+	if (eqIdx < 0) return false;
+	return arg.length - eqIdx - 1 >= MIN_SUBSTITUTABLE_VALUE_LENGTH;
+}
+/**
+* Render `value` the way Node renders an argv element it quotes back at you —
+* i.e. with the SAME function Node used, `util.inspect`, minus the quote
+* characters it chose.
+*
+* This started as a hand-rolled `\xNN` escaper and it was WRONG for 16 of the
+* first 128 code points. Measured against real `execFile` rejections on Node
+* 24.19.0 (this repo, 2026-09-05): hand-rolled matched 4 of 13 cases,
+* `inspect` matched 13 of 13.
+*
+*   input        Node emits          hand-rolled built
+*   LF           `K=a\nb\x00S`        `K=a\x0ab\x00S`   (Node uses a short escape)
+*   DEL          `K=a\x7Fb\x00S`      `K=a\x7fb\x00S`   (Node uses UPPERCASE hex)
+*   backslash    `K=a\\b\x00S`        `K=a\b\x00S`     (not escaped at all)
+*
+* Every miss printed the whole secret. The trigger for this path is a NUL in
+* a value — binary-ish data, which almost always carries a second control
+* byte or a backslash — so the table missed the REALISTIC case and hit only
+* the synthetic NUL-alone one its own fixture happened to use.
+*
+* `slice(1, -1)` is safe across the quote Node picks: `inspect` switches
+* between `'`, `"` and a backtick depending on content and escapes whichever
+* it chose; because this is the same call Node made, the rendering matches
+* whatever it picked (verified for a value containing a single quote, a
+* double quote, both, and a backtick).
+*
+* The general lesson, and why this is no longer a table: do not re-implement
+* another program's formatter — call it.
+*/
+function nodeQuotedRendering(value) {
+	const rendered = inspect(value);
+	const quote = rendered[0];
+	if (quote === void 0 || !`'"\``.includes(quote)) return void 0;
+	if (rendered.length < 2 || !rendered.endsWith(quote)) return void 0;
+	const inner = rendered.slice(1, -1);
+	return inner.includes(`${quote} +`) ? void 0 : inner;
+}
+/**
+* Node's refusal to spawn, which QUOTES ONE argv element and names its INDEX:
+*
+*   The argument 'args[2]' must be a string without null bytes. Received '…'
+*
+* The one message shape where the index tells us exactly which of OUR args is
+* being echoed — so the clause can be REWRITTEN from cdkd's own copy of the
+* element rather than searched for. That matters because Node does not print
+* the element whole: it truncates near 200 characters and renders a
+* newline-bearing value as concatenated chunks, so no needle can match it.
+*
+* Global, and scanned to exhaustion rather than bailing on the first match.
+* Anchoring at `^` was an earlier attempt at forgery resistance and it was
+* WORSE: it made a refusal anywhere but position 0 unrepairable, which is a
+* LEAK, and a leak beats a truncated message every time. Pinning Node's
+* literal prefix keeps the forgery bar high without that trade.
+*
+* Pinning the wording has its own cost: if Node rewords the message the repair
+* silently stops firing. That is why `tests/unit/utils/docker-cmd.test.ts`
+* drives this path from a REAL rejection — a reword turns CI red instead of
+* turning the redaction off.
+*/
+const SPAWN_REFUSAL_RE = /The argument 'args\[(\d+)\]'[^']*?Received /g;
+/**
+* The quoted element Node prints after `Received `.
+*
+* Three shapes, and the third is the one that matters. `inspect` renders a
+* newline-bearing value as chunks joined by ` +`, and Node then SLICES the
+* whole rendering at 128 characters and appends `...` — so the last chunk is
+* usually UNTERMINATED:
+*
+*   Received 'DB_URL=AAA…\n' +
+*     'hunter2SECRETCCC...
+*
+* A pattern that only accepts complete chunks stops after the second `'` and
+* leaves that tail in place. Measured on a real rejection: 272 of 288 probe
+* shapes leaked the secret verbatim, and the end-of-string version this
+* replaced did not — the bound was a regression, not a hardening, until the
+* trailing open chunk was admitted.
+*
+* The separator is Node's own (` +\n  `) with HORIZONTAL space only, and an
+* open chunk runs to end of LINE. Both are deliberate: `\s*\+\s*` and an
+* unbounded tail let a crafted value swallow the diagnostic lines that follow
+* the clause.
+*/
+const QUOTED_CHUNK = String.raw`'(?:[^'\\\n]|\\.)*'|"(?:[^"\\\n]|\\.)*"|\`(?:[^\`\\\n]|\\.)*\``;
+/** An opening quote whose closing one was truncated away; bounded to its line. */
+const OPEN_CHUNK = String.raw`['"\`](?:[^\\\n]|\\.)*`;
+/** Node's chunk join: horizontal space, `+`, at most one newline, horizontal space. */
+const CHUNK_SEPARATOR = String.raw`[^\S\n]*\+[^\S\n]*\n?[^\S\n]*`;
+const QUOTED_ELEMENT_RE = new RegExp(`^(?:(?:${QUOTED_CHUNK})(?:${CHUNK_SEPARATOR}(?:${QUOTED_CHUNK}))*(?:${CHUNK_SEPARATOR}(?:${OPEN_CHUNK}))?|(?:${OPEN_CHUNK}))`);
+/**
+* Replace the quoted argv element in a spawn-refusal message with the masked
+* rendering of the arg its OWN index names.
+*
+* Known cosmetic effect: the replacement prints the FULL key where Node had
+* truncated, so a pathologically long env-var NAME makes the message longer
+* than Node's ~200 characters. Keys are not secret, and the width is not worth
+* a second truncation rule with its own edge cases.
+*/
+function repairSpawnRefusal(text, args, maskedArgs) {
+	const scanner = new RegExp(SPAWN_REFUSAL_RE.source, "g");
+	let out = "";
+	let cursor = 0;
+	for (let match = scanner.exec(text); match !== null; match = scanner.exec(text)) {
+		if (match.index < cursor) continue;
+		const index = Number(match[1]);
+		const rawArg = args[index];
+		const maskedArg = maskedArgs[index];
+		if (rawArg !== void 0 && maskedArg === rawArg) continue;
+		const clauseEnd = match.index + match[0].length;
+		const quoted = QUOTED_ELEMENT_RE.exec(text.slice(clauseEnd));
+		if (quoted === null) continue;
+		const replacement = maskedArg === void 0 ? `'${REDACTED_ARGV_VALUE}'` : inspect(maskedArg);
+		out += text.slice(cursor, clauseEnd) + replacement;
+		cursor = clauseEnd + quoted[0].length;
+		scanner.lastIndex = cursor;
+	}
+	return out + text.slice(cursor);
+}
+/**
+* Compose a user-visible description of a `child_process` rejection from a
+* docker call, ALREADY REDACTED against that call's own argv.
+*
+* Moved here from `src/local/invoke-agentcore-watch-loop.ts` in issue #2440's
+* review round 3, and the move is the point: `args` is REQUIRED, so a call
+* site cannot obtain the text without handing over the argv to redact it
+* with. That is a stronger guarantee than any text fence over the call sites
+* — which is what the round-2 reviewers demonstrated, by writing four
+* spellings of an unredacted read that the fence could not see.
+*
+* Shape differs from the `stderr || message` composition the other sites use,
+* and deliberately so: `err.stderr` is where docker writes its actionable
+* diagnostics, while `err.message` carries the exit status, so the AgentCore
+* soft-reload path APPENDS rather than prefers — without stderr the wrapped
+* error would only say "Command failed with exit code N".
+*/
+function describeDockerExecFailure(error, args) {
+	const message = thrownMessageText(error) || safeStringify(error);
+	const stderrText = capturedStreamText(error, "stderr");
+	return redactDockerArgvInText(stderrText ? `${message}\n${stderrText}` : message, args);
+}
+/**
+* A captured stream of a `child_process` rejection as trimmed text, or `''`.
+*
+* Takes `unknown`, not `Error`, and duck-types the field. Every composer here
+* is called from a `catch`, where the value is whatever was thrown — and the
+* shapes the call sites actually see are plain objects
+* (`{ stderr, message }`), `SpawnError`, and cross-realm `Error`s that
+* `instanceof` misses. An earlier revision narrowed this to `Error` and the
+* standard composer then wrapped non-Errors in a FRESH `Error`, which has no
+* `.stderr` at all — so the whole diagnostic silently became
+* `'[object Object]'` for exactly the shape most of the call sites throw.
+*
+* `execFile` hands back a string under the default encoding and a `Buffer`
+* under `encoding: 'buffer'`; `ArrayBuffer.isView` covers a plain
+* `Uint8Array` too.
+*/
+function capturedStreamText(error, field) {
+	try {
+		const raw = error?.[field];
+		if (typeof raw === "string") return raw.trim();
+		if (ArrayBuffer.isView(raw)) return Buffer.from(raw.buffer, raw.byteOffset, raw.byteLength).toString("utf8").trim();
+	} catch {}
+	return "";
+}
+/** A thrown value's `message` as text, or `''`. Duck-typed, for the same reason. */
+function thrownMessageText(error) {
+	try {
+		const raw = error?.["message"];
+		return typeof raw === "string" ? raw : "";
+	} catch {
+		return "";
+	}
+}
+/**
+* `String(value)` that cannot itself throw. A rejection with a null prototype
+* (or a `toString` that throws) would otherwise blow up INSIDE a `catch` — and
+* two of these call sites are in `cleanupEcsRun`, where an exception aborts
+* the remaining volume / network teardown and leaks real Docker resources.
+*/
+function safeStringify(error) {
+	try {
+		return String(error);
+	} catch {
+		return "[unstringifiable rejection]";
+	}
+}
+/**
+* The STANDARD composer for a docker failure text: the captured stderr if
+* there is any, else the error's own message, else its string form —
+* ALREADY REDACTED against that call's argv.
+*
+* Use this at every site that wraps a docker `execFile` / spawn rejection.
+* `args` is REQUIRED, which is the whole point: a call site cannot obtain the
+* text without handing over the argv to redact it with, so the guarantee is
+* type-checked rather than fenced. Issue #2440's review spent three rounds
+* showing that a text fence over hand-composed sites is evadable — an
+* intermediate variable, an inline cast, a destructure, a computed member, a
+* concat — while this shape has nothing to evade.
+*
+* Prefer stderr over message because docker writes its actionable diagnostic
+* there, and `execFile`'s message is mostly the command line plus an exit
+* status. {@link describeDockerExecFailure} keeps BOTH, for a caller whose
+* wrapper text needs the status as well.
+*/
+function describeDockerFailure(error, args) {
+	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
+}
+/**
+* Composer for a captured-output failure where the diagnostic may be on
+* STDOUT rather than stderr (`runDockerStreaming`'s non-zero-exit path, whose
+* `SpawnError` carries both). `fallback` is used when neither stream said
+* anything. Redacted, and `args` is required, for the same reason as
+* {@link describeDockerFailure}.
+*/
+function describeDockerCapturedOutput(error, args, fallback) {
+	return redactDockerArgvInText(capturedStreamText(error, "stderr") || capturedStreamText(error, "stdout") || fallback, args);
+}
 
 //#endregion
 //#region src/assets/docker-build.ts
@@ -6098,32 +7267,39 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${source.executable.join(" ")} (cwd=${cwd})`);
+		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
+		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
 		try {
 			result = await spawnStreaming(cmd, args, { cwd });
 		} catch (err) {
-			const e = err;
-			throw options.wrapError(e.stderr || e.message || String(err));
+			throw options.wrapError(describeDockerFailure(err, args));
 		}
 		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${cmd} ${args.join(" ")}`);
+		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${shownExecutable}`);
 		return tag;
 	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
+	if (!source.directory) {
+		const carriesAValue = (v) => {
+			if (v === void 0 || v === null || v === "") return false;
+			if (typeof v !== "object") return true;
+			return (Array.isArray(v) ? v.length : Object.keys(v).length) > 0;
+		};
+		const present = Object.keys(source).filter((k) => carriesAValue(source[k])).map((k) => displaySafe(k, { asciiOnly: true })).filter((k) => k !== "").sort().join(", ") || "<no fields set>";
+		throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${present})`);
+	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = `${cdkOutDir}/${source.directory}`;
 	buildArgs.push(".");
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${contextDir})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
 			env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" }
 		});
 	} catch (err) {
-		const e = err;
-		throw options.wrapError(e.stderr || e.message || String(err));
+		throw options.wrapError(describeDockerFailure(err, buildArgs));
 	}
 	return options.tag;
 }
@@ -6291,8 +7467,9 @@ var DockerAssetPublisher = class {
 	}
 	/**
 	* Build Docker image — delegates to the shared `buildDockerImage`
-	* helper so this code path stays in sync with `cdkd local invoke`'s
-	* container-Lambda build path. `--platform` is read from the asset
+	* helper so this code path stays in sync with `cdkd local run-task`'s
+	* `ContainerImage.fromAsset` build path (the other caller; `cdkd local
+	* invoke` moved to `cdk-local`'s own builder). `--platform` is read from the asset
 	* manifest's `source.platform` (when set); cdkd does not currently
 	* inject a publish-side override.
 	*
@@ -6376,33 +7553,33 @@ var DockerAssetPublisher = class {
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
 		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+		const loginArgs = [
+			"login",
+			"--username",
+			username,
+			"--password-stdin",
+			endpoint
+		];
 		try {
-			await runDockerStreaming([
-				"login",
-				"--username",
-				username,
-				"--password-stdin",
-				endpoint
-			], { input: password });
+			await runDockerStreaming(loginArgs, { input: password });
 			loggedInRegistries.add(registryKey);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
 		}
 	}
 	/**
 	* Tag Docker image
 	*/
 	async tagImage(source, target) {
+		const tagArgs = [
+			"tag",
+			source,
+			target
+		];
 		try {
-			await runDockerStreaming([
-				"tag",
-				source,
-				target
-			]);
+			await runDockerStreaming(tagArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker tag failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`);
 		}
 	}
 	/**
@@ -6412,11 +7589,11 @@ var DockerAssetPublisher = class {
 	*/
 	async pushImage(uri) {
 		this.logger.debug(`Pushing: ${uri}`);
+		const pushArgs = ["push", uri];
 		try {
-			await runDockerStreaming(["push", uri]);
+			await runDockerStreaming(pushArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker push failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`);
 		}
 	}
 	/**
@@ -7154,49 +8331,6 @@ var AssetModeResolver = class {
 	}
 };
 
-//#endregion
-//#region src/utils/regexp.ts
-/**
-* Escape a literal string for embedding in a RegExp.
-*
-* Lives here because the same four-line helper was spelled THREE times — in
-* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
-* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
-* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
-* label) into a pattern. Copies of a security-shaped helper are exactly the
-* shape that drifts: the escaped set is what stops a `.` in an interpolated
-* literal matching ANY character, and in `gc.ts` a widened match decides which
-* live assets are treated as referenced.
-*
-* The character set is the union every JS engine treats as special in a
-* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
-* character class, and no caller embeds into one.
-*/
-function escapeRegExp$1(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
-* Remove control characters from a value about to be PRINTED.
-*
-* Lives beside {@link escapeRegExp} for the reason that helper's own note
-* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
-* in `src/deployment/outputs-export-alias.ts` — and copies of a
-* security-shaped helper drift. Both print the same class of string: a
-* resolved CloudFormation Output / `Export.Name`, which passed no CFn
-* validator, so it can carry ANSI escapes or bidi overrides straight into a
-* terminal or a CI log.
-*
-* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
-* only: a `--json` payload is a machine interface where an export name is data
-* a consumer may match on, and mutating it there trades a correctness
-* regression for a display concern (see `stripDisplayOnlyChars`, which is the
-* narrower guard for an already-serialized payload and stays local to its
-* caller because its C0 exclusion is specific to that path).
-*/
-function stripControlChars(value) {
-	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
-}
-
 //#endregion
 //#region src/assets/asset-redirect.ts
 /**
@@ -8078,6 +9212,16 @@ function formatRemaining(ms) {
 	if (minutes < 1) return "in under a minute";
 	return `in ~${minutes}m`;
 }
+/**
+* Quote a value for a pasteable shell command.
+*
+* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
+* prints `aws <service> ...` recovery commands naming a resource's physical id,
+* which is the same hazard one directory over. A second spelling of this
+* predicate is how the two would come to disagree about which values need
+* quoting -- the reason `display-safe.ts`'s header gives for not widening a
+* rule by hand. It is a pure function of its argument and imports nothing.
+*/
 function shellQuote(value) {
 	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -8097,6 +9241,18 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	return parts.join(" ");
 }
 /**
+* What to say INSTEAD of a `cdkd force-unlock ...` line when
+* {@link buildForceUnlockCommand} suppresses.
+*
+* Exported since issue [#2610]: `lock-manager.ts`'s exhausted-retry arm needed
+* the same branch, and it was the THIRD place to spell it. The module header's
+* point applies to the suppression sentence as much as to the command -- a
+* banner ending in a bare `run: ` is the shape the review found, and copies are
+* how the next one drifts. Byte-identical to what `forceQuitRecoveryClause`
+* emitted before the extraction; its callers see no change.
+*/
+const UNREPRODUCIBLE_LOCK_CLAUSE = "Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+/**
 * The force-quit banner's recovery sentence.
 *
 * Exported so the two `destroy-runner.ts` banners do not each decide what to
@@ -8107,7 +9263,7 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 */
 function forceQuitRecoveryClause(stackName, region, recovery) {
 	const command = buildForceUnlockCommand(stackName, region, recovery);
-	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+	return command ? ` If the next run reports a lock, run: ${command}` : ` ${UNREPRODUCIBLE_LOCK_CLAUSE}`;
 }
 /**
 * Build the contention message, reading the holder's identity best-effort.
@@ -9355,7 +10511,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}): ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -9579,8 +10735,11 @@ var LockManager = class {
 	/**
 	* Force release a lock regardless of owner or expiry status
 	*
-	* This is intended for CLI usage (e.g., --force-unlock flag) when a lock
-	* is stuck and needs manual intervention.
+	* This is intended for CLI usage -- it is what the `cdkd force-unlock
+	* <stack>` SUBCOMMAND calls -- when a lock is stuck and needs manual
+	* intervention. There is no `--force-unlock` FLAG anywhere in `src/`; this
+	* comment said there was, and issue [#2610] site 14 records that the message
+	* `acquireLockWithRetry` used to raise had inherited the same mistake.
 	*
 	* Pass `region: undefined` to operate on a legacy
 	* `{prefix}/{stackName}/lock.json` file.
@@ -9923,7 +11082,7 @@ var LockManager = class {
 			if (lockInfo) {
 				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${stackName}' (${region}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -9931,7 +11090,9 @@ var LockManager = class {
 		}
 		const lockInfo = await this.getLockInfo(stackName, region);
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
-		throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. Use --force-unlock to manually release the lock.` : "Lock exists but could not read lock info."));
+		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
+		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
+		throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 
@@ -10685,7 +11846,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 * matters: an AWS resource type string is fixed by AWS, and a typo in either
 * copy makes that copy's gate simply never fire (no-op), never fire wrongly.
 */
-const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
 /**
 * What a PARENT stack's resolution proved about each `Parameters` entry of an
 * `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
@@ -10792,7 +11953,7 @@ const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 *    `secret-redaction-nested-parameter-source.test.ts`.
 */
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$1) return;
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$2) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
@@ -15970,9 +17131,28 @@ function secretsManagerSecretId(inner) {
 *  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
 *    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
 *    a different thing in the refusal message than the one that would be read.
+*
+* A COLON-LESS body (`{{resolve:ssm}}` / `{{resolve:ssm-secure}}`) names no
+* parameter at all, and the empty string is what says so: the caller reads a
+* falsy name as `local`, which hands the reference on to the resolver's own
+* `PARAMETER_NAME is required` — thrown BEFORE any client is built, so no
+* `GetParameter` is ever issued for such a token. Without the guard
+* `indexOf(':')` is `-1` and `substring(0)` returns the SERVICE STRING as the
+* parameter name, so with a foreign producer region on record the same
+* malformed input drew the ambiguous-region refusal naming `'ssm-secure'` as
+* the secret. {@link secretsManagerSecretId} already answers `''` for its own
+* nameless body (a fixed-length `substring` past the end of the string), and a
+* sibling that answers something else is the kind of split a later reader has
+* to rediscover.
+*
+* The colon-less relaxation has a CONSUMER-VISIBLE consequence on a mixed
+* leaf, and it is recorded on {@link classifyReplaySecretRegion} rather than
+* here: this function produces a NAME, and the delta belongs beside the
+* VERDICT a reader arrives at it through.
 */
 function ssmParameterName(inner) {
-	return inner.substring(inner.indexOf(":") + 1);
+	const serviceEnd = inner.indexOf(":");
+	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
 }
 /**
 * The region an ARN names, or `undefined` for anything that is not an ARN with
@@ -16110,6 +17290,101 @@ function producerRegionsFromState(state) {
 * A same-region ARN answers `local` even when a foreign producer region IS on
 * record: the expression settles the question itself, so the weaker evidence
 * never gets consulted.
+*
+* ---
+*
+* WHO CONSUMES THIS VERDICT, and what the issue #2501 colon-less fix changed
+* for them. Recorded here because a reader arrives at the blast radius through
+* the verdict, not through {@link ssmParameterName}, which merely produces a
+* name.
+*
+* Three LEAF PRE-PASSES consume it — `rollback-executor.ts`'s
+* `resolveLeafByRegion`, `cdkd drift`'s `resolveDriftLeafByRegion` and `cdkd
+* scrub`'s — and each refuses the WHOLE leaf as soon as ONE token classifies
+* `ambiguous`, before any token is fetched. There is a FOURTH consumer, and it
+* is not a pre-pass: `resolveDynamicReferences` classifies token-by-token
+* INSIDE its substitution loop, so it already fetches earlier tokens before
+* refusing a later one. That is why the pre-fetch refusal was never a designed
+* property of this verdict.
+*
+* Before the fix, a colon-less `{{resolve:ssm-secure}}` produced the SERVICE
+* STRING as its name, so with a foreign producer region on record it drew an
+* `ambiguous` verdict and the pre-pass refused the whole leaf: for
+* `local=<same-region ARN>;secure={{resolve:ssm-secure}}`, nothing was
+* resolved. It now answers `local`, so the leaf IS resolved — by the primary
+* resolver when every other token is `local`, or through the segment-rebuild
+* path when one is `named-region` — and the ARN sibling's plaintext is fetched
+* and cached before the degenerate token throws `PARAMETER_NAME is required`.
+* Pinned by `rollback-executor-cross-region-secret.test.ts`'s "the MIXED-leaf
+* delta the colon-less guard accepts", so the trade is visible rather than
+* argued.
+*
+* Accepted on three grounds, the third being a LIMIT rather than a
+* reassurance:
+*
+*  1. The lost refusal was an ACCIDENT of the mis-parse, not a designed
+*     protection: with no foreign producer region on record — the
+*     overwhelmingly common case — the colon-less token classified `local`
+*     before the fix too, so the same sibling was already fetched.
+*  2. The sibling is fetched from the region its OWN verdict names, never a
+*     guessed one (a name-form sibling would itself be `ambiguous` and the
+*     pre-pass would still refuse), so nothing here weakens the issue #1957
+*     rule this module exists to enforce. Nothing fetched reaches a DURABLE
+*     sink — `state.json`, the rollback journal, the `deployments/` event
+*     store, a `--json` payload — and the reason is NOT "the op throws before
+*     any write", which is false for scrub (see 3: scrub swallows and keeps
+*     writing). It is that both places a fetched plaintext is retained are
+*     IN-PROCESS and neither is copied out: the resolver's own
+*     `cachedDynamicReferences` (instance-scoped since issue #1933, so it dies
+*     with the resolver) and `recordedSecretValues`, which every persist path
+*     consults as a redaction NEEDLE set — an entry there causes a value to be
+*     REPLACED BY its expression on the way out, never inserted.
+*
+*     ON THIS PATH one more needle can only redact more, which is why the
+*     direction is safe even though it fetches more — and the qualifier is
+*     load-bearing rather than hedging. It is NOT a general property of the
+*     needle machinery: `redactSecretsForState`'s own doc (see the
+*     `preferPositionDecisions` ordering note) records that a needle rewriting
+*     a FRAME ANCHOR can un-certify `unkeyedArrayPairsByAnchors`, refuse the
+*     array, and leave a sibling MIXED leaf in plaintext — "a regression of
+*     shipped redaction, in the GHSA disclosure direction". That is reachable
+*     with a NON-EMPTY map on a `STATE_SOURCED_READBACK_RULES` caller, e.g.
+*     `rollback-executor.ts`'s `redactRollbackRecord` ->
+*     `scrubResourceRecord`. It is not what fires here: the case this
+*     paragraph is about records FEWER needles, not more, so nothing new can
+*     rewrite an anchor.
+*  3. WHAT THE OP DOES NEXT IS NOT UNIFORM. The replay fails the op and `cdkd
+*     drift` reports the resource NOT compared — both loud. `cdkd scrub` is
+*     NOT: `isRegionAmbiguousRefusal` re-raises only a
+*     `DynamicReferenceRegionAmbiguousError`, and the resolver's replacement is
+*     a plain `Error`, so scrub swallows it to `debug` and the run reports
+*     clean. A LOUDNESS regression for that one command on this one input,
+*     bounded by the identical silent miss that already happens for the same
+*     leaf whenever no foreign producer region is on record.
+*
+*     Issue [#2692](https://github.com/go-to-k/cdkd/issues/2692) tracks it, and
+*     the remedy is NOT resolver-local. Two candidate fixes are wrong, each in
+*     its own way, and scrub has TWO predicates that must not be confused:
+*     `isRegionAmbiguousRefusal` decides RE-RAISE vs SWALLOW (its three call
+*     sites), while `isByDesignRefusal` — matching
+*     `CrossAccountSecretRefusalError` — decides FINDING vs REFUSE. They point
+*     in opposite directions, so a fix aimed at one must not be argued from
+*     the other's record.
+*
+*      - Throwing `IntrinsicResolutionRefusalError` and widening
+*        `isRegionAmbiguousRefusal` to match the BASE class would make every
+*        user-fixable refusal that class carries RE-RAISE and fail the whole
+*        stack — not the silent-downgrade hazard `isByDesignRefusal`'s doc
+*        records, but the opposite over-refusal, on a class with throw sites
+*        spread across the resolver.
+*      - Throwing the region-ambiguous SUBCLASS is wrong differently: scrub
+*        already re-raises it, but its message tells the user to spell the
+*        reference as a full ARN, which cannot fix a reference naming no
+*        parameter.
+*
+*     So #2692 needs a NEW sibling subclass AND a scrub-side predicate change,
+*     which makes it blocked on `src/cli/commands/scrub.ts` (held by PR
+*     #2562), not merely on the resolver's `integ-broad` cost.
 */
 function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
 	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
@@ -17803,7 +19078,7 @@ function carriesDynamicReference(value) {
 	return false;
 }
 /** The nested-stack resource type, whose `Outputs.<Name>` attributes are re-resolved (issue #2055). */
-const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /** Prefix `NestedStackProvider` records a child stack output under. */
 const NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX = "Outputs.";
 /**
@@ -19294,7 +20569,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -19311,7 +20586,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 			}
 		}
-		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
+		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
@@ -22525,7 +23800,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CSEPihOt.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-dBSdt3nB.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -24710,7 +25985,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					reuseClientCredentials: true,
 					tolerateNonStandardClient: true,
 					onRebuild: ({ bucketRegion, currentRegion }) => {
-						this.logger.debug(`Custom resource response bucket '${bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); building a region-corrected S3 client for response operations.`);
+						this.logger.debug(`Custom resource response bucket '${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}' is in '${displaySafe(bucketRegion, { asciiOnly: true }) || "<unrenderable>"}' (client was '${displaySafe(currentRegion, { asciiOnly: true }) || "<unrenderable>"}'); building a region-corrected S3 client for response operations.`);
 					}
 				});
 				if (generation !== this.responseClientGeneration) {
@@ -25387,7 +26662,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			Key: responseKey
 		});
 		const presignedUrl = await getSignedUrl(this.s3Client, command, { expiresIn: 7200 });
-		this.logger.debug(`Generated pre-signed URL for response: s3://${this.responseBucket}/${responseKey}`);
+		this.logger.debug(`Generated pre-signed URL for response: s3://${displaySafe(this.responseBucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}`);
 		return presignedUrl;
 	}
 	/**
@@ -25491,7 +26766,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				Key: responseKey
 			}));
 		} catch (error) {
-			this.logger.debug(`Failed to delete custom-resource response object s3://${bucket}/${responseKey}; it remains as a current object. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(error instanceof Error ? error.message : String(error)) || "<unrenderable>"}`);
 		}
 		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
 			logger: this.logger,
@@ -28988,6 +30263,70 @@ function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
 
+//#endregion
+//#region src/deployment/type-change-guard.ts
+/**
+* The CFn type of a nested stack's row in its PARENT's template.
+*
+* Spelled locally rather than imported, matching
+* `src/deployment/recreate-targets.ts`: the only exported copy lives in
+* `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
+* from the deployment layer would invert the dependency direction.
+*/
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+/**
+* Find every planned change whose recorded type and template type differ with
+* `AWS::CloudFormation::Stack` on one side.
+*
+* Reads exactly the two values the defect is made of: `change.resourceType`
+* (what `provisionResource` binds and routes BOTH replacement halves on) and
+* the state record's `resourceType` (the resource that actually exists). That
+* is deliberate — deriving the "desired" type from the template again would be
+* a second implementation of the diff's own Type-change rule (metadata skip,
+* condition pruning) which could drift away from the routing decision this
+* guards.
+*
+* `changeType` is not filtered on. A Type change surfaces as an `UPDATE`, but a
+* DELETE / NO_CHANGE row cannot diverge in the first place (the diff builds
+* both from the state record's own type), so filtering would only add a way for
+* a future change-shape to slip past.
+*/
+function findNestedStackTypeChanges(input) {
+	const found = [];
+	for (const [logicalId, change] of input.changes) {
+		if (!Object.hasOwn(input.stateResources, logicalId)) continue;
+		const currentResource = input.stateResources[logicalId];
+		if (!currentResource) continue;
+		const currentType = currentResource.resourceType;
+		const desiredType = change.resourceType;
+		if (currentType === desiredType) continue;
+		const intoNested = desiredType === NESTED_STACK_RESOURCE_TYPE;
+		if (!intoNested && !(currentType === NESTED_STACK_RESOURCE_TYPE)) continue;
+		found.push({
+			logicalId,
+			currentType,
+			desiredType,
+			physicalId: currentResource.physicalId,
+			direction: intoNested ? "into-nested-stack" : "out-of-nested-stack"
+		});
+	}
+	return found;
+}
+/**
+* Render the refusal. Names the logical id, BOTH types, the resource the
+* mis-routed delete would be aimed at, and what to do instead.
+*
+* `stackName` is the stack being deployed, so the into-nested arm can print the
+* child stack name `NestedStackProvider.delete` would derive and destroy — the
+* one piece of the damage the user cannot read off their own template.
+*/
+function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
+	const rows = typeChanges.map((tc) => {
+		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Both halves of the replacement would route on the TEMPLATE's type, so the existing resource's delete would be dispatched at the ${NESTED_STACK_RESOURCE_TYPE} provider — which ignores the physical id it is handed and instead destroys the nested child stack "${stackName}~${tc.logicalId}" and every resource that child owns. Where no such child exists the delete is a no-op and ${tc.physicalId} is silently leaked instead.` : `    Both halves of the replacement would route on the TEMPLATE's type, so the existing nested stack's delete would be dispatched at the ${tc.desiredType} provider, which cannot delete a nested stack — the child stack "${stackName}~${tc.logicalId}" and every resource it owns would be left behind, untracked.`}`;
+	});
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd cannot replace safely (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal: the delete's TARGET would be wrong, not merely its consequences.`;
+}
+
 //#endregion
 //#region src/deployment/outputs-export-alias.ts
 /**
@@ -29311,6 +30650,218 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-warm-throughput.ts
+/**
+* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* `WarmThroughput` is the same CloudFormation block on both types, and both
+* providers have to answer the same two questions about it before an
+* `UpdateTable` / `CreateTable` goes out:
+*
+*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
+*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
+*     came back from an `Fn::Sub` — arrives as a STRING and must not be
+*     forwarded verbatim into a numeric `Long` field.
+*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
+*     only ever rises with a table's traffic and AWS REJECTS a call that
+*     lowers it (`decreasing WarmThroughput is not supported`, measured live
+*     us-east-1 2026-08-13 for issue #1768).
+*
+* **Provenance, stated precisely because it is easy to over-claim.** Exactly
+* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
+* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
+* existed outside the change that created this file (issue #1857). So this is
+* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
+* behaviour changed for either type when it moved here.
+*
+* What WAS compared is the lifted rule against the GlobalTable spelling
+* drafted alongside it, over the shapes both had to answer (a quoted numeric
+* string, a partially usable block, a mixed decrease/increase, an absent live
+* value, a zero, a negative, a non-numeric string, a whitespace string, an
+* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
+* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
+* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
+* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
+* since `'   '` is not a capacity anyone declared and a warm throughput of 0
+* is not a request AWS can honour. That is a DRAFT reconciled against a
+* shipped rule, which is worth less than two shipped rules agreeing — the
+* reason to read the probe list as a design note rather than as field
+* evidence.
+*
+* Living here rather than in either provider is the point. A decrease guard is
+* three clauses that all FAIL OPEN for different reasons, and two files
+* spelling it independently is two chances for a later "fix" to change one of
+* them — at which point the sibling type silently keeps the old answer, and
+* nothing in the tree says which is intended. Same class as
+* `emr-configuration.ts`, and the same reason.
+*
+* Deliberately NOT here: everything only ONE provider has. The `Table` side's
+* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
+* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
+* and already-matches gates, which `GlobalTable` has no counterpart to (issue
+* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
+* comparison sides unconditionally, so drift never asks the question there);
+* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
+* `ThroughputDiagnostic` that only that provider's collector understands.
+* Moving a helper with one caller here would buy nothing and cost a hop.
+*
+* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
+*/
+/**
+* The two `WarmThroughput` members, in the ONE order every message, every
+* comparison and every emitted block uses. A shared order is what makes two
+* blocks carrying the same numbers compare equal by `deepEqual` and serialize
+* to the same wire bytes regardless of the order the template wrote them in.
+*/
+const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
+/**
+* A CloudFormation-borne numeric property, or `undefined` when the value is
+* not a usable number.
+*
+* Plain `Number()` coercion is NOT good enough and the tree learned it three
+* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
+* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
+* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
+* string would be forwarded as a request for zero units.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'12000'` genuinely means 12000.
+*
+* The accepted STRING set is `Number()`'s, which is WIDER than a decimal
+* integer: `'0x1e'`, `'0o36'`, `'1e3'`, `'30.5'` and `' 30 '` all coerce.
+* Whether CloudFormation accepts those for an `Integer`-typed property is
+* unmeasured, and issue [#2698](https://github.com/go-to-k/cdkd/issues/2698)
+* holds the live A/B that would settle it. It matters at the CALLERS that
+* FORWARD the result to AWS rather than merely compare it — narrowing this
+* shared helper would change the DynamoDB capacity readers too, so read that
+* issue before tightening anything here.
+*
+* EXPORTED, and not because warm throughput needs it exported. This exact rule
+* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
+* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
+* `toFiniteNumber` (a different spelling of the same total function) — which is
+* precisely the divergence this module exists to stop: the next "fix" to one of
+* them would have left the other two answering differently, with nothing in the
+* tree saying which was intended. It reads `ReadCapacityUnits` /
+* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
+* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
+* stringly-typed CFn value a number I can send?".
+*/
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
+* fields accept, PER MEMBER.
+*
+* PER MEMBER, not whole-block, and that distinction is the point: a block
+* whose write half is an unresolved intrinsic still has a perfectly good read
+* half, and dropping both would silently discard a value the template really
+* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
+* warning can say which half went missing instead of reporting the whole
+* property.
+*
+* A block with NO usable member yields `spec: undefined` — refused rather than
+* forwarded, because forwarding a malformed block surfaces as an opaque AWS
+* validation error naming neither cdkd nor the property. `droppedMembers` is
+* still populated in that case, so a REFUSAL message can name what it refused;
+* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
+* array) has no member to name and reports none, which is what lets a caller
+* word "one half went missing" differently from "the block is unusable".
+*
+* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
+* own message, so the wording stays consistent across that provider's send
+* sites without forcing one wording across both providers.
+*/
+function coerceWarmThroughput(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
+	const bag = raw;
+	const spec = {};
+	const droppedMembers = [];
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (bag[member] === void 0) continue;
+		const coerced = toFiniteNumber(bag[member]);
+		if (coerced === void 0) {
+			droppedMembers.push(member);
+			continue;
+		}
+		spec[member] = coerced;
+	}
+	if (Object.keys(spec).length === 0) return { droppedMembers };
+	return {
+		spec,
+		droppedMembers
+	};
+}
+/**
+* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
+* reports.
+*
+* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
+* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* had to be measured before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
+* makes the verdict describe a request that is not the one being sent (a
+* dropped member is not part of the call and must not be part of the
+* comparison).
+*
+* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
+* leave AWS as the authority — because a false positive here silently drops a
+* legitimate INCREASE, which is a real capacity change the user asked for,
+* while a false negative merely reproduces the pre-fix behaviour of an
+* AWS-side rejection that names the property:
+*  - DECLARED members only. An absent member is not a request to lower
+*    anything, so it takes no part in the verdict.
+*  - MIXED is not a decrease. One member below live and the other above means
+*    the call carries a genuine increase; AWS decides.
+*  - An absent or unusable LIVE counterpart is not a decrease. Without a
+*    number to compare against there is no evidence of one. Only the LIVE side
+*    can reach that arm: the desired side is a COERCED spec, so a malformed
+*    template value has already been dropped by {@link coerceWarmThroughput}.
+*
+* A decrease therefore requires every declared member to be at-or-below live
+* AND at least one to be strictly below.
+*
+* The skip this drives is right for EVERY `update()` caller — the deploy
+* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
+* because none of them can make AWS lower the value, so none loses anything a
+* doomed call would have achieved.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (desired === void 0 || live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (desired[member] === void 0) continue;
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+
 //#endregion
 //#region src/provisioning/stateful-types.ts
 /**
@@ -29357,9 +30908,12 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *     "never expire" — the most data-bearing configuration the type
 *     has, and what `LogsLogGroupProvider` records `0` for — so reading
 *     it as "holds nothing" destroyed years of events on a plain
-*     `cdkd deploy`. A recorded `RetentionInDays > 0` still answers
-*     `has-retention` from the bag alone (a cheap positive, never
-*     probed away); every other bag DEFERS, exactly as the bucket does.
+*     `cdkd deploy`. A `RetentionInDays > 0` recorded in EITHER of the
+*     state record's property bags still answers `has-retention` from
+*     the bags alone (a cheap positive, never probed away); every other
+*     bag DEFERS, exactly as the bucket does. Which bags, and why the
+*     value is coerced rather than type-tested, is issue [#2521] —
+*     see {@link logGroupHasPositiveRetention}.
 *     The pre-flight resolves the deferral with a live
 *     `logs:DescribeLogStreams` probe (a log group with no stream can
 *     hold no event, since every event belongs to a stream); mid-deploy,
@@ -29544,10 +31098,66 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 */
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
-* Cheap, synchronous read of the resource's recorded properties only.
+* Does either recorded bag prove this log group carries a POSITIVE
+* `RetentionInDays`? (issue [#2521])
+*
+* Two decisions, and both were defects before this function existed.
+*
+* **The value is COERCED, not type-tested.** The predicate used to gate on
+* `typeof retention === 'number' && retention > 0`, and CloudFormation is
+* stringly typed: a hand-written L1, an `Fn::Sub`-produced value, a
+* `Type: String` parameter's default, or a record imported by
+* `cdkd import --migrate-from-cloudformation` all put `'30'` into the bag,
+* where the type test answers "not a number". {@link toFiniteNumber} is the
+* repo's single answer to "is this stringly-typed CFn value a number?" —
+* imported rather than re-spelled here for the reason its own doc gives, that
+* the same rule hand-written twice diverges on the next fix to one copy. It
+* rejects `''`, `'   '`, `null`, `[]` and `false`, each of which a bare
+* `Number()` turns into a `0` that would read as never-expire.
+*
+* **BOTH bags are consulted, and a positive in EITHER wins.** The old read
+* saw `properties` alone, so a retention set OUT OF BAND (the console,
+* `aws logs put-retention-policy`, another tool) or one recorded only in
+* `observedProperties` — an imported record whose template never declared
+* the property — never produced `has-retention`.
+*
+* The rule is a plain OR, and the loop order below is INERT — a review round
+* caught an earlier version of this paragraph claiming `observedProperties`
+* is "read FIRST", a precedence the code does not implement and must not.
+* A strict "observed when present, else properties" rule — which is what
+* issue [#2521] literally prescribed — was tried and REJECTED:
+* `LogsLogGroupProvider.readCurrentState` writes `RetentionInDays: 0` for a
+* group with no retention policy, so the observed bag almost always CARRIES
+* the key, and precedence would make the recorded bag dead for every record
+* that has ever been captured and would DROP the `has-retention` verdict this
+* guard already produced. A test pins that rejection
+* (`tests/unit/provisioning/stateful-types.test.ts`, "reads a retention that
+* lives ONLY in properties, even against a ZERO observed one"). The OR is
+* also the strictly safer direction: it can only ADD refusals, never remove
+* one.
+*
+* What a `false` here means is DEFER, not "holds nothing" — see the callers.
+*/
+function logGroupHasPositiveRetention(recordedProperties, observedProperties) {
+	for (const bag of [observedProperties, recordedProperties]) {
+		const retention = toFiniteNumber(bag?.["RetentionInDays"]);
+		if (retention !== void 0 && retention > 0) return true;
+	}
+	return false;
+}
+/**
+* Cheap, synchronous read of the state record's own property bags only —
+* no AWS call. Both bags are parameters rather than one: `properties` is
+* what the last deploy applied, `observedProperties` what it read back,
+* and the log group's arm consults BOTH (issue [#2521]). Passing the
+* observed bag is REQUIRED, not optional, so a new call site has to
+* decide what it holds instead of silently repeating the omission that
+* issue records; `undefined` is the right answer where no record is in
+* hand (`recreate-confirm-prompt.ts`).
+*
 * TWO types return `null` meaning DEFER rather than "not stateful":
-* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever the
-* recorded bag does not already prove `has-retention`. The live probes
+* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever neither
+* bag already proves `has-retention`. The live probes
 * that resolve both deferrals (`ListObjectVersions` for the bucket,
 * `DescribeLogStreams` for the log group) live in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
@@ -29560,11 +31170,10 @@ const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::Dynam
 * Returns the {@link StatefulReason} when the type is stateful (or
 * `null` for non-stateful types).
 */
-function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
+function isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties) {
 	if (!STATEFUL_TYPES.has(resourceType)) return null;
 	if (resourceType === "AWS::Logs::LogGroup") {
-		const retention = recordedProperties?.["RetentionInDays"];
-		if (typeof retention === "number" && retention > 0) return "has-retention";
+		if (logGroupHasPositiveRetention(recordedProperties, observedProperties)) return "has-retention";
 		return null;
 	}
 	if (resourceType === "AWS::S3::Bucket") return null;
@@ -29591,16 +31200,38 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 * — be DELETE + CREATEd (data loss) without `--force-stateful-recreation`. To
 * stay fail-safe, both deferrals resolve to stateful here: the user must pass
 * `--force-stateful-recreation` to replace ANY S3 bucket, and any log group
-* whose recorded bag does not already prove `has-retention`, on any of those
-* paths — empty or not.
+* neither of whose recorded property bags already proves `has-retention`, on
+* any of those paths — empty or not.
+*
+* `UpdateReplacePolicy: Retain` is the standing EXEMPTION, and it covers all
+* three (issue [#2604]): the engine never consults this predicate under it —
+* the property-driven guard tests `updateReplacePolicy !== 'Retain'`
+* directly, and the fallback's two triggers short-circuit through
+* `retainOldOnReplace`, which issue [#2518] added. The old resource survives
+* the replacement, so there is no data loss to confirm, and the refusal's own
+* remedy would have destroyed exactly what the user asked to keep.
+* `Snapshot` is NOT exempt on any of them — a snapshot is a copy, not a
+* surviving resource. So read the paragraph above as scoped to a template
+* that is not retaining.
+*
+* The two engine sites are not the only callers: a THIRD sits outside those
+* paths and outside that exemption — `recreate-confirm-prompt.ts` re-derives
+* a `null` verdict for the `--recreate-via-*` pre-flight, where
+* `--force-stateful-recreation` is what skipped the probe.
+* `stateful-replace-message-doc-sync` pins the whole guard's reader list by
+* file, but the residuals comment above its own walk enumerates what that
+* cannot see — among them an ALIASED import, a `.mts` / `.cts` reader, and,
+* the one that bit, a NEW PATH routed through an existing call site, which
+* adds no file and reds nothing (issue [#2514]'s shape). So this enumeration
+* is maintained by hand.
 *
 * The log group's arm is the one issue [#2558] added, and the reason it is
 * needed is that the old predicate treated "no retention recorded" as "holds
 * nothing" when it is CloudWatch Logs' never-expire. Every other type matches
 * {@link isStatefulRecreateTargetSync} exactly.
 */
-function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
-	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties);
+function isStatefulRecreateTargetForReplace(resourceType, recordedProperties, observedProperties) {
+	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties);
 	if (sync) return sync;
 	if (resourceType === "AWS::S3::Bucket") return "has-objects";
 	if (resourceType === "AWS::Logs::LogGroup") return "has-log-events";
@@ -29614,7 +31245,7 @@ function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
 function renderStatefulReason(reason) {
 	switch (reason) {
 		case "always": return "destroy loses all data in the resource";
-		case "has-objects": return "S3 bucket is non-empty";
+		case "has-objects": return "S3 bucket is not provably empty";
 		case "has-retention": return "log group retains data (RetentionInDays > 0)";
 		case "has-log-events": return "log group is not provably empty";
 		case null: return "(not stateful)";
@@ -30762,6 +32393,84 @@ function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
 	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
 }
 /**
+* `UpdateReplacePolicy: Retain` on the resource a replacement CREATED — the
+* copy a rollback would otherwise destroy (issue
+* [#2598](https://github.com/go-to-k/cdkd/issues/2598)).
+*
+* Reads the CURRENT record, i.e. the one the replacing deploy wrote from the
+* template it was applying (`extractTemplateAttributes`), so the attribute
+* consulted is the one that was in force when the new copy was created. Its
+* `Snapshot` sibling, {@link rollbackFinalSnapshotId}, reads the same field of
+* the same record — `Retain` and `Snapshot` are alternative values of ONE
+* attribute, so the two can never both apply.
+*
+* **`UpdateReplacePolicy`, NOT `DeletionPolicy`, and that is measured, not
+* reasoned.** The repo refuses a CloudFormation-parity claim taken on
+* folklore, and the AWS documentation answers nothing here: every sentence on
+* both attribute pages, in the API reference and in the release notes
+* describes the OLD resource, never the new copy's fate during a rollback. A
+* live four-variant A/B (2026-09-05, us-east-1: a forced `AWS::SSM::Parameter`
+* replacement plus a deterministically failing sibling, rolled back) settled
+* it:
+*
+* | DeletionPolicy | UpdateReplacePolicy | new copy  | decisive event   |
+* | -------------- | ------------------- | --------- | ---------------- |
+* | (none)         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | Retain         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | (none)         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+* | Retain         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+*
+* Row 2 alone refutes "`DeletionPolicy` governs it"; row 3 alone refutes
+* "neither — always deleted". The old copy was restored intact in all four,
+* and both outcomes land in `UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS`.
+*
+* A retained new copy is ORPHANED OUT of the stack, not kept as a managed
+* resource — the A/B proved it by deleting the whole stack afterwards and
+* finding the retained parameter still alive. So every caller below leaves NO
+* state record naming the survivor: the two arms that can complete point state
+* at the old resource exactly as they already did, and the survivor becomes
+* untracked. That is the same disposition the deploy engine gives a
+* `Retain`-orphaned OLD resource, so the two directions agree.
+*
+* LIMIT OF THAT EVIDENCE, stated so a later reader does not over-read it: all
+* four variants carried the SAME policy in both template versions, so the A/B
+* pinned WHICH ATTRIBUTE wins and did NOT discriminate which template's copy
+* of it is read. This function reads the current record for the reasons above
+* (it is the one the new copy was created under, and it matches the
+* `Snapshot` sibling and both CREATE-rollback arms), not because the A/B
+* settled that question.
+*/
+function rollbackRetainsNewResource(record) {
+	return record?.updateReplacePolicy === "Retain";
+}
+/**
+* The two sentences a `UpdateReplacePolicy: Retain` survivor needs: the `⚠`
+* terminal warning and the compact `reason` that rides on the durable
+* `ROLLBACK_RESOURCE_SUCCEEDED` event.
+*
+* ONE function because the two must not drift apart. Both replacement-rollback
+* retain arms produced these by hand, four near-identical copies, and the
+* failure mode a reviewer named is precise: the warn and the DURABLE record
+* disagreeing about which id survived. Deriving both from one set of inputs
+* makes that unrepresentable. The shapes stay deliberately different -- the
+* warn carries the cost/`cdkd destroy` guidance a human reads once, the reason
+* stays compact for a `--json` consumer -- so this is one input set, not one
+* string.
+*
+* `stateClause` is the only thing that differs between the two arms (the
+* readopt arm restores the old id; the create-first arm records a re-created
+* one), so it is a parameter rather than a branch in here.
+*
+* NOT used by the delete-failed survivor a few lines down: that one is an
+* orphan by OUTCOME rather than by policy, and says so.
+*/
+function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause) {
+	return {
+		warn: `  ⚠ ${logicalId} (${resourceType}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${survivorPhysicalId}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need it. ${stateClause}`,
+		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorPhysicalId}); it is live, still billing, and no longer tracked by cdkd. ${stateClause}`
+	};
+}
+/**
 * `DeletionPolicy: Snapshot` on a rolled-back CREATE (issue #1358) — the
 * executor's copy of the deploy engine's `prepareFinalSnapshotForDelete`
 * mechanism matrix, run BEFORE the delete. Shared with the FAILED in-flight
@@ -30860,7 +32569,7 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
-		return op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
+		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
 	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
@@ -30900,12 +32609,16 @@ function planFailedOps(failedOps, stateResources) {
 */
 function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
 	const { createOps, otherOps } = partitionOps(operations);
-	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => ({
-		op,
-		action: classifyRollbackOp(op, stateResources, orphanLogicalIds),
-		replacement: isReplacementOp(op),
-		effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy)
-	}));
+	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => {
+		const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
+		return {
+			op,
+			action,
+			replacement: isReplacementOp(op),
+			effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy),
+			retainsNewResource: (action === "reverse-replacement" || action === "reverse-replacement-readopt") && rollbackRetainsNewResource(stateResources[op.logicalId])
+		};
+	});
 }
 function partitionOps(operations) {
 	const createOps = [];
@@ -31263,11 +32976,32 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 * writer is one of only two that can honestly claim it.
 *
 * Using `STATE_SOURCED_READBACK_RULES` here reads plausible and is wrong in the
-* quiet direction: it turns positional array descent off. Since issue #1915 a
-* `Tags[]` / ECS `Environment[]` element is reached by KEYED descent either
-* way, so the concrete loss is narrower than it was — it is a list whose
-* elements carry no `Name` / `Key` identity, which only positional descent can
-* walk.
+* quiet direction: it turns BLIND positional array descent off. BLIND is
+* load-bearing, and an earlier revision of this paragraph omitted it — the
+* concrete loss is narrower than "positional descent is off" makes it sound,
+* by TWO mechanisms rather than one:
+*
+*  - Since issue #1915 a `Tags[]` / ECS `Environment[]` element is reached by
+*    the order-independent KEYED descent either way.
+*  - Since issue #2012 an UNKEYED list is reached too, under corroboration.
+*    That is not a general relaxation: swapping this constant in would satisfy
+*    all three conjuncts of `isReadbackProjectedFromState`
+*    (`trustAnyExpression && !descendArrays && sourceIsSameGeneration`), which
+*    ARMS `refuseUncertifiedReadbackPositions`, and its unkeyed arm walks
+*    element i against element i whenever `unkeyedArrayPairsByAnchors`
+*    corroborates the alignment (index counts match; every position whose
+*    SOURCE subtree carries no dynamic reference is deep-equal on both sides;
+*    every reference-bearing element carries a distinguishing anchor of its own
+*    or, being a bare reference leaf, leans on the array's literal frame; and
+*    no two reference-bearing elements share an order-insensitive anchor
+*    signature).
+*
+* So the residual loss is narrower again: an unkeyed list whose positions ALSO
+* fail to corroborate. The CONCLUSION is unchanged — `STATE_DERIVED_RULES` is
+* still right here, for the reason one paragraph up (the bag was produced by
+* resolving the source, so the two correspond positionally by construction and
+* need no corroboration to say so). What changes is only how much a reader
+* should think the alternative costs (issue #2691).
 *
 * No-op when the op resolved no secret.
 */
@@ -31477,7 +33211,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				return;
 			case "orphan-flag":
 				if (op.changeType === "CREATE") {
-					const orphanFlagProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+					const record = stateResources[op.logicalId];
+					const orphanFlagProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 					createRollbackRoute = orphanFlagProvisionedBy;
 					delete stateResources[op.logicalId];
 					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
@@ -31488,12 +33223,17 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						operation: "CREATE",
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
-						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy }
+						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy },
+						...record?.physicalId && {
+							physicalId: record.physicalId,
+							reason: `--orphan left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+						}
 					});
 				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
 				return;
 			case "orphan-retain": {
-				const orphanProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+				const record = stateResources[op.logicalId];
+				const orphanProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 				createRollbackRoute = orphanProvisionedBy;
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
@@ -31504,7 +33244,11 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					operation: "CREATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy }
+					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy },
+					...record?.physicalId && {
+						physicalId: record.physicalId,
+						reason: `DeletionPolicy: Retain left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+					}
 				});
 				return;
 			}
@@ -31547,11 +33291,32 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
-					resourceType: op.resourceType,
-					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
-				{
+				/**
+				* Set when this arm ORPHANS the replacement's new copy. Read at the
+				* `ROLLBACK_RESOURCE_SUCCEEDED` event below, which is the only channel
+				* that OUTLIVES the terminal (security review of issue #2598): a
+				* rollback runs during an already-failing deploy, often non-TTY with
+				* the log truncated or discarded, so a `logger.warn` is the least
+				* likely thing the user still has. Without this the survivor's id dies
+				* with the terminal -- `cdkd events` shows a clean success and state
+				* names only the OLD resource, while a live, billing, untracked copy
+				* remains. `Retain` is precisely the marker users put on data-bearing
+				* resources, so that is the worst population to lose the id for.
+				*
+				* Same shape as the `rollbackPartial` survivor record ~700 lines down
+				* and as the deploy engine's `RESOURCE_SKIPPED` twin.
+				*/
+				let survivorReason;
+				if (rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State is restored to the old resource (${prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else {
+					const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: current.provisionedBy ?? op.provisionedBy
+					});
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
@@ -31561,13 +33326,19 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
 				await afterOp?.(op.logicalId);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -31583,10 +33354,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
 				});
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+				const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
+				}).provider;
 				let deletedNewFirst = false;
 				let createResult;
 				try {
@@ -31595,11 +33366,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
 				} catch (createError) {
-					if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+					const msg = createError instanceof Error ? createError.message : String(createError);
+					if (!isNameCollisionError(msg)) throw createError;
+					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${op.logicalId} (${op.resourceType}): the re-create of the old resource (${prev.physicalId}) collided with the name still held by the new one (${current.physicalId}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with \`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${msg}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-						throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 							expectedRegion: ctx.region,
 							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 						}), op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
@@ -31613,7 +33386,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
 					} catch (recreateError) {
-						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
@@ -31629,24 +33402,37 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
 				}, secrets, prevRecord.properties);
 				await afterOp?.(op.logicalId);
-				if (!deletedNewFirst && !adoptedLiveNewResource) try {
+				let survivorReason;
+				if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
 					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
+					survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 					result.warnings++;
 				}
 				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -32335,7 +34121,10 @@ var DeploymentEventsReader = class {
 	* window and rewrites (or removes) `index.json` to match.
 	*
 	* Retention semantics (see {@link DeploymentEventsPruneOptions}):
-	*   - `all`        — delete every run + the index (full purge).
+	*   - `all`        — delete every run + the index. Clears the LISTING only:
+	*                    this deletes by key with no `VersionId`, so on a
+	*                    versioned bucket every earlier version survives
+	*                    (issue #2624).
 	*   - `keep N`     — retain the newest N runs, delete the rest.
 	*   - `olderThanMs`— delete runs whose run-id timestamp is older than the
 	*                    cutoff; a run id with no parseable timestamp is kept.
@@ -32750,6 +34539,39 @@ var DeployEngine = class {
 	*/
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	/**
+	* Logical ids whose replacement this deploy DELIBERATELY left the old
+	* physical resource alive for — `UpdateReplacePolicy: Retain` (issue
+	* [#2603](https://github.com/go-to-k/cdkd/issues/2603)).
+	*
+	* Written by every engine path that skips the post-replacement delete, read
+	* once at the `completedOperations.push` site to stamp
+	* {@link CompletedOperation.oldResourceRetained}. It exists because the
+	* rollback classifier used to re-derive the verdict from
+	* `previousState.updateReplacePolicy` — a DIFFERENT source than the
+	* template read the engine decides from — so the two disagreed on exactly
+	* the deploy that changes the attribute, in both directions:
+	*
+	*   - ADDING `Retain`: the deploy orphans the old resource while the
+	*     previous state record carries no policy, so the rollback re-CREATED a
+	*     resource that is still alive (a duplicate for an auto-named type, an
+	*     `AlreadyExists` failure for a user-named one).
+	*   - DROPPING `Retain`: state still carries the stale `Retain`, the
+	*     template omits it so the deploy correctly DELETES the old resource,
+	*     and the rollback then re-adopted a physical id that no longer exists,
+	*     leaving state naming a deleted resource.
+	*
+	* Records only the DELIBERATE retention. A best-effort cleanup delete that
+	* FAILED, was SKIPPED, or was blocked by a failed final snapshot also leaves
+	* the old resource alive, but the deploy does not KNOW it survived — those
+	* stay `false` and keep today's `reverse-replacement` behaviour rather than
+	* having the rollback re-adopt an id it cannot vouch for (issue
+	* [#2631](https://github.com/go-to-k/cdkd/issues/2631)).
+	*
+	* Cleared per `deploy()` alongside the other per-run maps: a `false` here
+	* must mean "this deploy deleted it", never "a previous run said so".
+	*/
+	retainedOldOnReplacement = /* @__PURE__ */ new Set();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -32788,6 +34610,7 @@ var DeployEngine = class {
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
 		this.outputsSourceUsable = true;
+		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -33209,7 +35032,10 @@ var DeployEngine = class {
 		for (const { logicalId, resource } of candidates) {
 			let provider;
 			try {
-				provider = this.providerRegistry.getProvider(resource.resourceType);
+				provider = this.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
 			} catch {
 				continue;
 			}
@@ -33301,6 +35127,11 @@ var DeployEngine = class {
 			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry));
+			const nestedStackTypeChanges = findNestedStackTypeChanges({
+				changes,
+				stateResources: currentState.resources
+			});
+			if (nestedStackTypeChanges.length > 0) throw markNonRetryable(new CdkdError(renderNestedStackTypeChangeRefusal(nestedStackTypeChanges, stackName), "TYPE_CHANGE_NESTED_STACK"));
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
@@ -33510,7 +35341,8 @@ var DeployEngine = class {
 							provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 							previousState,
 							physicalId: newResources[logicalId]?.physicalId,
-							properties: newResources[logicalId]?.properties
+							properties: newResources[logicalId]?.properties,
+							...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) }
 						});
 						saveStateAfterResource(logicalId);
 					}, () => this.interrupted);
@@ -34037,7 +35869,7 @@ var DeployEngine = class {
 				isRetryable: isRecreateRetryableError
 			});
 		} catch (recreateError) {
-			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets));
+			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? recreateError : void 0 });
 		}
 	}
 	/**
@@ -34134,15 +35966,16 @@ var DeployEngine = class {
 					break;
 				}
 				const propertyDrivenReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
-				const recreateViaCcApi = this.options.recreateViaCcApiTargets?.has(logicalId) ?? false;
-				const recreateViaSdkProvider = this.options.recreateViaSdkProviderTargets?.has(logicalId) ?? false;
+				const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+				const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
+				const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
 				const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
 				const needsReplacement = propertyDrivenReplacement || recreateFlagged;
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 				if (needsReplacement) {
 					if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
-						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
 							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
 							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
@@ -34168,8 +36001,10 @@ var DeployEngine = class {
 					let createResult;
 					if (recreateFlagged) {
 						const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
-						if (updateReplacePolicy === "Retain") this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
-						else {
+						if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
+						} else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 							let recreateDeleteResult;
@@ -34220,8 +36055,10 @@ var DeployEngine = class {
 							deletedOldFirst = true;
 							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
-						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
-						else {
+						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+						} else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 							let cleanupFinalSnapshotId;
 							let snapshotBlockedDelete = false;
@@ -34278,6 +36115,7 @@ var DeployEngine = class {
 					const updateProps = updateDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
+					let captureProvider = updateProvider;
 					try {
 						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, {
 							maskSecrets: createSecretMasker(updateSecrets),
@@ -34288,7 +36126,7 @@ var DeployEngine = class {
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
 							const retainOldOnReplace = updateReplacePolicy === "Retain";
-							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 							if (statefulReason && this.options.forceStatefulRecreation !== true) throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 							this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							if (!retainOldOnReplace) {
@@ -34319,7 +36157,7 @@ var DeployEngine = class {
 							try {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
-								if (!retainOldOnReplace) throw createError;
+								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
 								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
@@ -34329,6 +36167,7 @@ var DeployEngine = class {
 									const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 									throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 								}
+								this.retainedOldOnReplacement.add(logicalId);
 								this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
 								retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 							}
@@ -34346,6 +36185,7 @@ var DeployEngine = class {
 							if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
 							result = replacementResult;
 							resultProvisionedBy = replDecision.provisionedBy;
+							captureProvider = replProvider;
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
@@ -34365,7 +36205,7 @@ var DeployEngine = class {
 						provisionedBy: resultProvisionedBy
 					};
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
+					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
 					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
 					else counts.updated++;
@@ -34818,5 +36658,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { beginCommandInterruptScope as $, resolveAutoAssetStorage as $n, isTransientServerError as $r, maskSecretsInError as $t, formatResourceLine as A, ensureAssetStorage as An, DependencyError as Ar, requireConfigString as At, isExportAliasCollision as B, dockerSpawnEnvWithSensitive as Bn, ResourceTimeoutError as Br, INTRINSIC_KEYS as Bt, unsupportedFinalSnapshotError as C, loadPublishableAssetManifest as Cn, getAwsClients as Cr, coerceCfnBoolean as Ct, isStatefulRecreateTargetForReplace as D, AssetModeResolver as Dn, CdkdError as Dr, replayWarn as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, stripControlChars as En, AssetError as Er, readConfigString as Et, red as F, validateAssetBucketName as Fn, LocalStartServiceError as Fr, s3BucketDualStackDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, runDockerStreaming as Gn, SynthesisError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, stateKeySecretExposure as H, getDockerCmd as Hn, StackHasActiveImportsError as Hr, withRetry as Ht, yellow as I, validateContainerRepoName as In, LockError as Ir, s3BucketRegionalDomainName as It, findActionableSilentDrops as J, Synthesizer as Jn, normalizeAwsError as Jr, carriesSecretMask as Jt, clearOnUpdateRemoval as K, AssetManifestLoader as Kn, formatError as Kr, STATE_SOURCED_READBACK_RULES as Kt, collectDeclaredOutputNames as L, buildDenyExternalAccessPolicy as Ln, NestedStackChildDirectDestroyError as Lr, s3BucketWebsiteUrl as Lt, cyan as M, isCrossRegionRedirect as Mn, DynamicReferenceRegionAmbiguousError as Mr, producerRegionsFromState as Mt, gray as N, parseBootstrapMarker as Nn, IntrinsicResolutionRefusalError as Nr, s3BucketArn as Nt, isStatefulRecreateTargetSync as O, BOOTSTRAP_MARKER_PREFIX as On, ConfigError as Or, requireConfigArray as Ot, green as P, readBootstrapMarkerBody as Pn, LocalInvokeBuildError as Pr, s3BucketDomainName as Pt, maskerOrIdentity as Q, resolveApp as Qn, isThrottlingError as Qr, isSingleDynamicReferenceToken as Qt, collectPublishedOutputNames as R, describeAwsFailure as Rn, PartialFailureError as Rr, applyRoleArnIfSet as Rt, refusesFinalSnapshot as S, createAssetRedirectResolver as Sn, AwsClients as Sr, assertRegionMatch as St, extractDeploymentEventError as T, escapeRegExp$1 as Tn, setAwsClients as Tr, configStringRefusal as Tt, getCurrentResourceSecrets as U, partitionSensitiveEnv as Un, StackTerminationProtectionError as Ur, DagBuilder as Ut, secretBearingStateKeyWarning as V, formatDockerLoginError as Vn, ResourceUpdateNotSupportedError as Vr, describeTypeWithThrottleRetry as Vt, IAMRoleProvider as W, runDockerForeground as Wn, StateError as Wr, TemplateParser as Wt, createMaskedRetryLogger as X, getDefaultStateBucketName as Xn, isMarkedNonRetryable as Xr, dynamicReferenceTokens as Xt, findSilentDropProperties as Y, synthesisStatusMessage as Yn, withErrorHandling as Yr, createSecretMasker as Yt, maskDeep as Z, getLegacyStateBucketName as Zn, isRetryableTransientError as Zr, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shouldRetainResource as _n, derivePartitionAndUrlSuffix as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, LockManager as an, stateBucketExistenceConfirmed as ar, slowCcOperationTimeoutMs as at, createPreDeleteFinalSnapshot as b, WorkGraph as bn, clearBucketRegionCache as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, UNRENDERABLE as cn, CFN_TEMPLATE_URL_LIMIT as cr, deleteSkipReason as ct, updatePartialReason as d, forceQuitRecoveryClause as dn, uploadCfnTemplate as dr, IntrinsicFunctionResolver as dt, markNonRetryable as ei, maskSecretsInText as en, resolveCaptureObservedState as er, endCommandInterruptScope as et, withResourceDeadline as f, CUSTOM_RESOURCE_RESPONSE_PREFIX as fn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as fr, carriesDynamicReference as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, importableOutputs as gn, canonicalizeRegion as gr, isUnboundTemplateParameter as gt, computeImplicitDeleteEdges as h, importableOutputKeys as hn, PARTITION_TABLE as hr, getAccountInfo as ht, DeploymentEventsReader as i, scrubResourceRecord as in, resolveUseCdkBootstrapAssets as ir, CloudControlProvider as it, bold as j, getBootstrapMarkerKey as jn, DeployCancelledError as jr, classifyReplaySecretRegion as jt, renderStatefulReason as k, assertAssetBucketRegion as kn, CrossAccountSecretRefusalError as kr, requireConfigObject as kt, replayRollback as l, buildForceUnlockCommand as ln, MIGRATE_TMP_PREFIX as lr, disableInstanceApiTermination as lt, IMPLICIT_DELETE_DEPENDENCIES as m, exportNamesCarriedFrom as mn, expectedOwnerParam as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, retryClassificationText as ni, recoverMaskedOutput as nn, resolveStateBucketWithDefault as nr, isInterruptedWaitError as nt, planFailedOps as o, S3StateBackend as on, warnDeprecatedNoPrefixCliFlag as or, UNSPECIFIED_SKIP_REASON as ot, maskingRetryLogger as p, DEFAULT_STATE_PREFIX as pn, displaySafe as pr, cfnRefValueFromPhysicalId as pt, ProviderRegistry as q, getDockerImageBySourceHash as qn, isCdkdError as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, __exportAll as ri, redactSecretsForState as rn, resolveStateBucketWithDefaultAndSource as rr, startInterruptWatch as rt, planRollback as s, rebuildClientForBucketRegion as sn, CFN_TEMPLATE_BODY_LIMIT as sr, deleteIndeterminateGuards as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markRedactedCause as ti, recordMaskOnlyValue as tn, resolveSkipPrefix as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, buildLockContentionMessage as un, findLargeInlineResources as ur, isTerminationProtectionPropagationError as ut, buildFinalSnapshotIdentifier as v, AssetPublisher as vn, AssemblyReader as vr, refStateLookupFromResource as vt, makeCanonicalizePropertiesFn as w, rewriteTemplateAssetReferences as wn, resetAwsClients as wr, configBooleanRefusal as wt, isFinalSnapshotError as x, buildAssetRedirectMap as xn, resolveBucketRegion as xr, resolveExplicitPhysicalId as xt, ccRoutedFinalSnapshotError as y, stringifyValue as yn, processStackMessages as yr, WAFv2WebACLProvider as yt, exportAliasCollisionScrubWarning as z, buildDockerImage as zn, ProvisioningError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-BoSlW08T.js.map
+export { findSilentDropProperties as $, escapeRegExp$1 as $n, StateError as $r, createSecretMasker as $t, WARM_THROUGHPUT_MEMBERS as A, AssetModeResolver as An, resolveBucketRegion as Ar, readConfigString as At, yellow as B, buildDenyExternalAccessPolicy as Bn, DeployCancelledError as Br, s3BucketRegionalDomainName as Bt, unsupportedFinalSnapshotError as C, AssetPublisher as Cn, expectedOwnerParam as Cr, WAFv2WebACLProvider as Ct, isStatefulRecreateTargetForReplace as D, createAssetRedirectResolver as Dn, AssemblyReader as Dr, coerceCfnBoolean as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, buildAssetRedirectMap as En, derivePartitionAndUrlSuffix as Er, assertRegionMatch as Et, bold as F, isCrossRegionRedirect as Fn, AssetError as Fr, classifyReplaySecretRegion as Ft, secretBearingStateKeyWarning as G, describeDockerFailure as Gn, LockError as Gr, describeTypeWithThrottleRetry as Gt, collectPublishedOutputNames as H, buildDockerImage as Hn, IntrinsicResolutionRefusalError as Hr, applyRoleArnIfSet as Ht, cyan as I, parseBootstrapMarker as In, CdkdError as Ir, producerRegionsFromState as It, IAMRoleProvider as J, getDockerCmd as Jn, ProvisioningError as Jr, TemplateParser as Jt, stateKeySecretExposure as K, dockerSpawnEnvWithSensitive as Kn, NestedStackChildDirectDestroyError as Kr, withRetry as Kt, gray as L, readBootstrapMarkerBody as Ln, ConfigError as Lr, s3BucketArn as Lt, isWarmThroughputDecrease as M, assertAssetBucketRegion as Mn, getAwsClients as Mr, requireConfigArray as Mt, toFiniteNumber as N, ensureAssetStorage as Nn, resetAwsClients as Nr, requireConfigObject as Nt, isStatefulRecreateTargetSync as O, loadPublishableAssetManifest as On, processStackMessages as Or, configBooleanRefusal as Ot, formatResourceLine as P, getBootstrapMarkerKey as Pn, setAwsClients as Pr, requireConfigString as Pt, findActionableSilentDrops as Q, runDockerStreaming as Qn, StackTerminationProtectionError as Qr, carriesSecretMask as Qt, green as R, validateAssetBucketName as Rn, CrossAccountSecretRefusalError as Rr, s3BucketDomainName as Rt, refusesFinalSnapshot as S, shouldRetainResource as Sn, displaySafe as Sr, refStateLookupFromResource as St, extractDeploymentEventError as T, WorkGraph as Tn, canonicalizeRegion as Tr, resolveExplicitPhysicalId as Tt, exportAliasCollisionScrubWarning as U, describeDockerCapturedOutput as Un, LocalInvokeBuildError as Ur, DiffCalculator as Ut, collectDeclaredOutputNames as V, describeAwsFailure as Vn, DynamicReferenceRegionAmbiguousError as Vr, s3BucketWebsiteUrl as Vt, isExportAliasCollision as W, describeDockerExecFailure as Wn, LocalStartServiceError as Wr, INTRINSIC_KEYS as Wt, clearOnUpdateRemoval as X, redactDockerArgvValues as Xn, ResourceUpdateNotSupportedError as Xr, STATE_SOURCED_READBACK_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, partitionSensitiveEnv as Yn, ResourceTimeoutError as Yr, STATE_SOURCED_CROSS_GENERATION_RULES as Yt, ProviderRegistry as Z, runDockerForeground as Zn, StackHasActiveImportsError as Zr, TEMPLATE_SOURCED_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, CUSTOM_RESOURCE_RESPONSE_PREFIX as _n, CFN_TEMPLATE_URL_LIMIT as _r, cfnRefValueFromPhysicalId as _t, DeploymentEventsStore as a, isMarkedNonRetryable as ai, recordMaskOnlyValue as an, getDefaultStateBucketName as ar, interruptWatchListenerCount as at, createPreDeleteFinalSnapshot as b, importableOutputKeys as bn, uploadCfnTemplate as br, isUnboundTemplateParameter as bt, replayFailedOperations as c, isTransientServerError as ci, scrubResourceRecord as cn, resolveAutoAssetStorage as cr, CloudControlProvider as ct, updatePartialReason as d, retryClassificationText as di, rebuildClientForBucketRegion as dn, resolveStateBucketWithDefault as dr, deleteIndeterminateGuards as dt, SynthesisError as ei, dynamicReferenceTokens as en, stripControlChars as er, createMaskedRetryLogger as et, withResourceDeadline as f, __exportAll as fi, UNRENDERABLE as fn, resolveStateBucketWithDefaultAndSource as fr, deleteSkipReason as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shellQuote as gn, CFN_TEMPLATE_BODY_LIMIT as gr, carriesDynamicReference as gt, computeImplicitDeleteEdges as h, forceQuitRecoveryClause as hn, warnDeprecatedNoPrefixCliFlag as hr, IntrinsicFunctionResolver as ht, DeploymentEventsReader as i, withErrorHandling as ii, maskSecretsInText as in, synthesisStatusMessage as ir, endCommandInterruptScope as it, coerceWarmThroughput as j, BOOTSTRAP_MARKER_PREFIX as jn, AwsClients as jr, replayWarn as jt, renderStatefulReason as k, rewriteTemplateAssetReferences as kn, clearBucketRegionCache as kr, configStringRefusal as kt, replayRollback as l, markNonRetryable as li, LockManager as ln, resolveCaptureObservedState as lr, slowCcOperationTimeoutMs as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildLockContentionMessage as mn, stateBucketExistenceConfirmed as mr, isTerminationProtectionPropagationError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as ni, isSingleDynamicReferenceToken as nn, getDockerImageBySourceHash as nr, maskerOrIdentity as nt, planFailedOps as o, isRetryableTransientError as oi, recoverMaskedOutput as on, getLegacyStateBucketName as or, isInterruptedWaitError as ot, maskingRetryLogger as p, buildForceUnlockCommand as pn, resolveUseCdkBootstrapAssets as pr, disableInstanceApiTermination as pt, getCurrentResourceSecrets as q, formatDockerLoginError as qn, PartialFailureError as qr, DagBuilder as qt, DeployEngine as r, normalizeAwsError as ri, maskSecretsInError as rn, Synthesizer as rr, beginCommandInterruptScope as rt, planRollback as s, isThrottlingError as si, redactSecretsForState as sn, resolveApp as sr, startInterruptWatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as ti, errorCauseChain as tn, AssetManifestLoader as tr, maskDeep as tt, updatePartialMessage as u, markRedactedCause as ui, S3StateBackend as un, resolveSkipPrefix as ur, UNSPECIFIED_SKIP_REASON as ut, buildFinalSnapshotIdentifier as v, DEFAULT_STATE_PREFIX as vn, MIGRATE_TMP_PREFIX as vr, coerceParameterTypedValue as vt, makeCanonicalizePropertiesFn as w, stringifyValue as wn, PARTITION_TABLE as wr, normalizeAwsTagsToCfn as wt, isFinalSnapshotError as x, importableOutputs as xn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xr, parameterTypeMayLoseSecretIdentity as xt, ccRoutedFinalSnapshotError as y, exportNamesCarriedFrom as yn, findLargeInlineResources as yr, getAccountInfo as yt, red as z, validateContainerRepoName as zn, DependencyError as zr, s3BucketDualStackDomainName as zt };
+//# sourceMappingURL=deploy-engine-DylsbAdu.js.map