@go-to-k/cdkd 0.286.2 → 0.286.4

package/dist/{program-BuZzDR4s.js → program-dEYAo80R.js}

@@ -1,8 +1,8 @@
-import { $ as beginCommandInterruptScope, $n as resolveAutoAssetStorage, $r as isTransientServerError, $t as maskSecretsInError, A as formatResourceLine, An as ensureAssetStorage, At as requireConfigString, B as isExportAliasCollision, Bn as dockerSpawnEnvWithSensitive, Br as ResourceTimeoutError, Bt as INTRINSIC_KEYS, C as unsupportedFinalSnapshotError, Cn as loadPublishableAssetManifest, Cr as getAwsClients, Ct as coerceCfnBoolean, D as isStatefulRecreateTargetForReplace, Dn as AssetModeResolver, Dr as CdkdError, Dt as replayWarn, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as stripControlChars, Et as readConfigString, F as red, Fn as validateAssetBucketName, Fr as LocalStartServiceError, Ft as s3BucketDualStackDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as runDockerStreaming, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as stateKeySecretExposure, Hn as getDockerCmd, Hr as StackHasActiveImportsError, Ht as withRetry, I as yellow, In as validateContainerRepoName, It as s3BucketRegionalDomainName, J as findActionableSilentDrops, Jn as Synthesizer, Jr as normalizeAwsError, Jt as carriesSecretMask, K as clearOnUpdateRemoval, Kn as AssetManifestLoader, Kt as STATE_SOURCED_READBACK_RULES, L as collectDeclaredOutputNames, Ln as buildDenyExternalAccessPolicy, Lr as NestedStackChildDirectDestroyError, Lt as s3BucketWebsiteUrl, M as cyan, Mn as isCrossRegionRedirect, Mr as DynamicReferenceRegionAmbiguousError, Mt as producerRegionsFromState, N as gray, Nn as parseBootstrapMarker, Nr as IntrinsicResolutionRefusalError, Nt as s3BucketArn, O as isStatefulRecreateTargetSync, On as BOOTSTRAP_MARKER_PREFIX, Ot as requireConfigArray, P as green, Pn as readBootstrapMarkerBody, Pr as LocalInvokeBuildError$1, Pt as s3BucketDomainName, Q as maskerOrIdentity, Qn as resolveApp, Qr as isThrottlingError, Qt as isSingleDynamicReferenceToken, R as collectPublishedOutputNames, Rn as describeAwsFailure, Rr as PartialFailureError, Rt as applyRoleArnIfSet, S as refusesFinalSnapshot, Sn as createAssetRedirectResolver, Sr as AwsClients, St as assertRegionMatch, T as extractDeploymentEventError, Tn as escapeRegExp, Tr as setAwsClients, Tt as configStringRefusal, U as getCurrentResourceSecrets, Un as partitionSensitiveEnv, Ur as StackTerminationProtectionError, Ut as DagBuilder, V as secretBearingStateKeyWarning, Vn as formatDockerLoginError, Vr as ResourceUpdateNotSupportedError, Vt as describeTypeWithThrottleRetry, W as IAMRoleProvider, Wn as runDockerForeground, Wt as TemplateParser, X as createMaskedRetryLogger, Xn as getDefaultStateBucketName, Xr as isMarkedNonRetryable, Xt as dynamicReferenceTokens, Y as findSilentDropProperties, Yn as synthesisStatusMessage, Yr as withErrorHandling, Yt as createSecretMasker, Z as maskDeep, Zn as getLegacyStateBucketName, Zr as isRetryableTransientError, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shouldRetainResource, _r as derivePartitionAndUrlSuffix, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, an as LockManager, ar as stateBucketExistenceConfirmed, at as slowCcOperationTimeoutMs, b as createPreDeleteFinalSnapshot, bn as WorkGraph, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as UNRENDERABLE, cr as CFN_TEMPLATE_URL_LIMIT, ct as deleteSkipReason, d as updatePartialReason, dn as forceQuitRecoveryClause, dr as uploadCfnTemplate, dt as IntrinsicFunctionResolver, ei as markNonRetryable, en as maskSecretsInText, er as resolveCaptureObservedState, et as endCommandInterruptScope, f as withResourceDeadline, fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, fr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ft as carriesDynamicReference, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as importableOutputs, gr as canonicalizeRegion, gt as isUnboundTemplateParameter, h as computeImplicitDeleteEdges, hn as importableOutputKeys, hr as PARTITION_TABLE, ht as getAccountInfo, i as DeploymentEventsReader, in as scrubResourceRecord, ir as resolveUseCdkBootstrapAssets, it as CloudControlProvider, j as bold, jn as getBootstrapMarkerKey, jr as DeployCancelledError, jt as classifyReplaySecretRegion, k as renderStatefulReason, kn as assertAssetBucketRegion, kr as CrossAccountSecretRefusalError, kt as requireConfigObject, l as replayRollback, ln as buildForceUnlockCommand, lr as MIGRATE_TMP_PREFIX, lt as disableInstanceApiTermination, m as IMPLICIT_DELETE_DEPENDENCIES, mn as exportNamesCarriedFrom, mr as expectedOwnerParam, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as retryClassificationText, nn as recoverMaskedOutput, nr as resolveStateBucketWithDefault, nt as isInterruptedWaitError, o as planFailedOps, on as S3StateBackend, or as warnDeprecatedNoPrefixCliFlag, ot as UNSPECIFIED_SKIP_REASON, p as maskingRetryLogger, pn as DEFAULT_STATE_PREFIX, pr as displaySafe, pt as cfnRefValueFromPhysicalId, q as ProviderRegistry, qn as getDockerImageBySourceHash, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, rn as redactSecretsForState, rr as resolveStateBucketWithDefaultAndSource, rt as startInterruptWatch, s as planRollback, sn as rebuildClientForBucketRegion, sr as CFN_TEMPLATE_BODY_LIMIT, st as deleteIndeterminateGuards, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as markRedactedCause, tn as recordMaskOnlyValue, tr as resolveSkipPrefix, tt as interruptWatchListenerCount, u as updatePartialMessage, un as buildLockContentionMessage, ur as findLargeInlineResources, ut as isTerminationProtectionPropagationError, v as buildFinalSnapshotIdentifier, vn as AssetPublisher, vr as AssemblyReader, vt as refStateLookupFromResource, w as makeCanonicalizePropertiesFn, wn as rewriteTemplateAssetReferences, wr as resetAwsClients, wt as configBooleanRefusal, x as isFinalSnapshotError, xn as buildAssetRedirectMap, xr as resolveBucketRegion, xt as resolveExplicitPhysicalId, y as ccRoutedFinalSnapshotError, yn as stringifyValue, yr as processStackMessages, yt as WAFv2WebACLProvider, z as exportAliasCollisionScrubWarning, zn as buildDockerImage, zr as ProvisioningError, zt as DiffCalculator } from "./deploy-engine-BoSlW08T.js";
+import { $ as findSilentDropProperties, $n as escapeRegExp, $t as createSecretMasker, A as WARM_THROUGHPUT_MEMBERS, An as AssetModeResolver, Ar as resolveBucketRegion, At as readConfigString, B as yellow, Bn as buildDenyExternalAccessPolicy, Br as DeployCancelledError, Bt as s3BucketRegionalDomainName, C as unsupportedFinalSnapshotError, Cn as AssetPublisher, Cr as expectedOwnerParam, Ct as WAFv2WebACLProvider, D as isStatefulRecreateTargetForReplace, Dn as createAssetRedirectResolver, Dr as AssemblyReader, Dt as coerceCfnBoolean, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as buildAssetRedirectMap, Er as derivePartitionAndUrlSuffix, Et as assertRegionMatch, F as bold, Fn as isCrossRegionRedirect, Ft as classifyReplaySecretRegion, G as secretBearingStateKeyWarning, Gn as describeDockerFailure, Gt as describeTypeWithThrottleRetry, H as collectPublishedOutputNames, Hn as buildDockerImage, Hr as IntrinsicResolutionRefusalError, Ht as applyRoleArnIfSet, I as cyan, In as parseBootstrapMarker, Ir as CdkdError, It as producerRegionsFromState, J as IAMRoleProvider, Jn as getDockerCmd, Jr as ProvisioningError, Jt as TemplateParser, K as stateKeySecretExposure, Kn as dockerSpawnEnvWithSensitive, Kr as NestedStackChildDirectDestroyError, Kt as withRetry, L as gray, Ln as readBootstrapMarkerBody, Lt as s3BucketArn, M as isWarmThroughputDecrease, Mn as assertAssetBucketRegion, Mr as getAwsClients, Mt as requireConfigArray, N as toFiniteNumber, Nn as ensureAssetStorage, Nr as resetAwsClients, Nt as requireConfigObject, O as isStatefulRecreateTargetSync, On as loadPublishableAssetManifest, Or as processStackMessages, Ot as configBooleanRefusal, P as formatResourceLine, Pn as getBootstrapMarkerKey, Pr as setAwsClients, Pt as requireConfigString, Q as findActionableSilentDrops, Qn as runDockerStreaming, Qr as StackTerminationProtectionError, Qt as carriesSecretMask, R as green, Rn as validateAssetBucketName, Rr as CrossAccountSecretRefusalError, Rt as s3BucketDomainName, S as refusesFinalSnapshot, Sn as shouldRetainResource, Sr as displaySafe, St as refStateLookupFromResource, T as extractDeploymentEventError, Tn as WorkGraph, Tr as canonicalizeRegion, Tt as resolveExplicitPhysicalId, U as exportAliasCollisionScrubWarning, Un as describeDockerCapturedOutput, Ur as LocalInvokeBuildError$1, Ut as DiffCalculator, V as collectDeclaredOutputNames, Vn as describeAwsFailure, Vr as DynamicReferenceRegionAmbiguousError, Vt as s3BucketWebsiteUrl, W as isExportAliasCollision, Wn as describeDockerExecFailure, Wr as LocalStartServiceError, Wt as INTRINSIC_KEYS, X as clearOnUpdateRemoval, Xn as redactDockerArgvValues, Xr as ResourceUpdateNotSupportedError, Xt as STATE_SOURCED_READBACK_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as partitionSensitiveEnv, Yr as ResourceTimeoutError, Yt as STATE_SOURCED_CROSS_GENERATION_RULES, Z as ProviderRegistry, Zn as runDockerForeground, Zr as StackHasActiveImportsError, Zt as TEMPLATE_SOURCED_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as CUSTOM_RESOURCE_RESPONSE_PREFIX, _r as CFN_TEMPLATE_URL_LIMIT, _t as cfnRefValueFromPhysicalId, a as DeploymentEventsStore, ai as isMarkedNonRetryable, an as recordMaskOnlyValue, ar as getDefaultStateBucketName, at as interruptWatchListenerCount, b as createPreDeleteFinalSnapshot, bn as importableOutputKeys, br as uploadCfnTemplate, bt as isUnboundTemplateParameter, c as replayFailedOperations, ci as isTransientServerError, cn as scrubResourceRecord, cr as resolveAutoAssetStorage, ct as CloudControlProvider, d as updatePartialReason, di as retryClassificationText, dn as rebuildClientForBucketRegion, dr as resolveStateBucketWithDefault, dt as deleteIndeterminateGuards, en as dynamicReferenceTokens, er as stripControlChars, et as createMaskedRetryLogger, f as withResourceDeadline, fn as UNRENDERABLE, fr as resolveStateBucketWithDefaultAndSource, ft as deleteSkipReason, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as shellQuote, gr as CFN_TEMPLATE_BODY_LIMIT, gt as carriesDynamicReference, h as computeImplicitDeleteEdges, hn as forceQuitRecoveryClause, hr as warnDeprecatedNoPrefixCliFlag, ht as IntrinsicFunctionResolver, i as DeploymentEventsReader, ii as withErrorHandling, in as maskSecretsInText, ir as synthesisStatusMessage, it as endCommandInterruptScope, j as coerceWarmThroughput$1, jn as BOOTSTRAP_MARKER_PREFIX, jr as AwsClients, jt as replayWarn, k as renderStatefulReason, kn as rewriteTemplateAssetReferences, kt as configStringRefusal, l as replayRollback, li as markNonRetryable, ln as LockManager, lr as resolveCaptureObservedState, lt as slowCcOperationTimeoutMs, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildLockContentionMessage, mr as stateBucketExistenceConfirmed, mt as isTerminationProtectionPropagationError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as isSingleDynamicReferenceToken, nr as getDockerImageBySourceHash, nt as maskerOrIdentity, o as planFailedOps, oi as isRetryableTransientError, on as recoverMaskedOutput, or as getLegacyStateBucketName, ot as isInterruptedWaitError, p as maskingRetryLogger, pn as buildForceUnlockCommand, pr as resolveUseCdkBootstrapAssets, pt as disableInstanceApiTermination, q as getCurrentResourceSecrets, qn as formatDockerLoginError, qr as PartialFailureError, qt as DagBuilder, r as DeployEngine, ri as normalizeAwsError, rn as maskSecretsInError, rr as Synthesizer, rt as beginCommandInterruptScope, s as planRollback, si as isThrottlingError, sn as redactSecretsForState, sr as resolveApp, st as startInterruptWatch, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as errorCauseChain, tr as AssetManifestLoader, tt as maskDeep, u as updatePartialMessage, ui as markRedactedCause, un as S3StateBackend, ur as resolveSkipPrefix, ut as UNSPECIFIED_SKIP_REASON, v as buildFinalSnapshotIdentifier, vn as DEFAULT_STATE_PREFIX, vr as MIGRATE_TMP_PREFIX, vt as coerceParameterTypedValue, w as makeCanonicalizePropertiesFn, wn as stringifyValue, wr as PARTITION_TABLE, wt as normalizeAwsTagsToCfn, x as isFinalSnapshotError, xn as importableOutputs, xr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, xt as parameterTypeMayLoseSecretIdentity, y as ccRoutedFinalSnapshotError, yn as exportNamesCarriedFrom, yr as findLargeInlineResources, yt as getAccountInfo, z as red, zn as validateContainerRepoName, zt as s3BucketDualStackDomainName } from "./deploy-engine-DylsbAdu.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-Crg_SdRh.js";
-import { t as ASGProvider } from "./asg-provider-CSEPihOt.js";
+import { t as getCdkdVersion } from "./version-CKOnsgg1.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-dBSdt3nB.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -36,6 +36,7 @@ import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, Creat
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotEmptyException, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
+import { isDeepStrictEqual, promisify } from "node:util";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-rds";
 import { Command, InvalidArgumentError, Option } from "commander";
@@ -45,7 +46,6 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, isScalar, parse, stringify, visit } from "yaml";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
-import { isDeepStrictEqual, promisify } from "node:util";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteAccessLogSettingsCommand, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteCorsConfigurationCommand, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteRouteRequestParameterCommand, DeleteRouteSettingsCommand, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand, waitUntilServicesStable } from "@aws-sdk/client-ecs";
@@ -2579,6 +2579,31 @@ function isPromptAbortError(error) {
 * intent** — does the user want SDK + silent drop, or CC migration?
 * Fail fast and let the user pick one strategy per resource.
 */
+const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
+/**
+* The CFn type of a nested stack's row in its PARENT's template. It decides
+* both the refusal (`blockedNestedStackTargets`) and the evidence the
+* unknown-id note renders (`nestedStackLogicalIds`) — so within this module it
+* is spelled once, or the note could name ids the validator does not refuse.
+*
+* The two are NOT the same set, and deliberately so. The refusal fires when
+* EITHER the state record or the template says nested, because the two types
+* select different halves of the destructive path: the TEMPLATE's type picks
+* the provider that deletes the old resource (a Type change emits an UPDATE
+* carrying `resourceType: desiredResource.Type`, which is what
+* `oldDeleteProvider` resolves from), while the STATE's type is what
+* `NestedStackProvider` owns and derives `<parent>~<logicalId>` from. The note
+* keys on the TEMPLATE alone, because it is telling the user what their current
+* template contains. Which type governs was argued from plausibility twice and
+* settled by reading `analyzer/diff-calculator.ts` and `deploy-engine.ts`'s
+* `oldDeleteProvider`; do not re-derive it from either name. Other modules spell it
+* for themselves rather than sharing one export: the only EXPORTED copy lives
+* in `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
+* from the deployment layer would invert the dependency direction. (No count of
+* the other spellings is given here on purpose — an unfenced number in a
+* comment is a number that goes stale.)
+*/
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /**
 * Plan-time validation of the user's recreate-via-cc-api list.
 *
@@ -2592,7 +2617,6 @@ function isPromptAbortError(error) {
 * Input order is preserved; duplicate logical ids in the user's input
 * are deduplicated.
 */
-const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
 function validateRecreateTargets(input) {
 	const seenCcApi = new Set(input.recreateViaCcApi);
 	const seenSdk = new Set(input.recreateViaSdkProvider ?? []);
@@ -2605,6 +2629,7 @@ function validateRecreateTargets(input) {
 	const ambiguousIntentSdk = [];
 	const blockedStatefulTargets = [];
 	const blockedMultiRegionTargets = [];
+	const blockedNestedStackTargets = [];
 	const blockedAlreadySdk = [];
 	const blockedAlreadyCcApi = [];
 	const blockedNoSdkProvider = [];
@@ -2635,11 +2660,12 @@ function validateRecreateTargets(input) {
 			logicalId,
 			resourceType,
 			physicalId: recordedResource.physicalId,
-			statefulReason: isStatefulRecreateTargetSync(resourceType, recordedResource.properties),
+			statefulReason: isStatefulRecreateTargetSync(resourceType, recordedResource.properties, recordedResource.observedProperties),
 			direction
 		};
 		targets.push(target);
 		if (MULTI_REGION_RECREATE_BLOCKED_TYPES.has(resourceType)) blockedMultiRegionTargets.push(target);
+		if (resourceType === NESTED_STACK_RESOURCE_TYPE$1 || templateResource.Type === NESTED_STACK_RESOURCE_TYPE$1) blockedNestedStackTargets.push(target);
 		if (direction === "to-cc-api") {
 			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, EMPTY_ALLOW_SET$1);
 			for (const { property } of actionableDrops) {
@@ -2671,10 +2697,12 @@ function validateRecreateTargets(input) {
 		ambiguousIntentSdk,
 		blockedStatefulTargets,
 		blockedMultiRegionTargets,
+		blockedNestedStackTargets,
 		blockedAlreadySdk,
 		blockedAlreadyCcApi,
 		blockedNoSdkProvider,
-		conflictingDirections
+		conflictingDirections,
+		nestedStackLogicalIds: Object.entries(input.template.Resources ?? {}).filter(([, resource]) => resource?.Type === NESTED_STACK_RESOURCE_TYPE$1).map(([id]) => id)
 	};
 }
 /**
@@ -2691,6 +2719,8 @@ function renderRecreateTargetsErrors(validation) {
 		lines.push(`${FLAG_UMBRELLA} named ${validation.unknownLogicalIds.length} logical id(s) not present in the synth template:`);
 		for (const id of validation.unknownLogicalIds) lines.push(`  - ${id}`);
 		lines.push("  Fix: confirm each id exists in the template (CDK display path is the parent; the logical id is the CFn-emitted name, e.g. cdkd synth | jq '.Resources | keys'). Recreate operates on the synth template's logical ids, not CDK display paths.");
+		lines.push("  Note: each stack of this deploy validates this WHOLE flag list against its OWN template, so an id declared by a different stack of the same run is reported here as unknown. Name it in a deploy of only that stack.");
+		if (validation.nestedStackLogicalIds.length > 0) lines.push(`  Note: resources inside a nested stack are NOT addressable — the flags name logical ids of the stack being deployed, and this template's nested stack(s) (${validation.nestedStackLogicalIds.join(", ")}) carry their own. A logical id that a nested child happens to share with a top-level resource recreates the TOP-LEVEL one only, and the nested stack row itself is refused as a target.`);
 	}
 	if (validation.missingFromState.length > 0) {
 		if (lines.length > 0) lines.push("");
@@ -2709,6 +2739,16 @@ function renderRecreateTargetsErrors(validation) {
 		lines.push(`${FLAG_UMBRELLA} would destroy + recreate ${validation.blockedStatefulTargets.length} stateful resource(s). Recreate loses ALL data — no automatic data migration. Re-run with --force-stateful-recreation to acknowledge the data-loss footgun.`);
 		for (const blocked of validation.blockedStatefulTargets) lines.push(`  - ${blocked.logicalId} (${blocked.resourceType}) — ${renderStatefulReason(blocked.statefulReason)}`);
 	}
+	if (validation.blockedNestedStackTargets.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push(`${FLAG_UMBRELLA} refuses to operate on ${validation.blockedNestedStackTargets.length} nested-stack resource(s):`);
+		for (const blocked of validation.blockedNestedStackTargets) {
+			const templateType = validation.nestedStackLogicalIds.includes(blocked.logicalId) ? NESTED_STACK_RESOURCE_TYPE$1 : void 0;
+			const shown = templateType && templateType !== blocked.resourceType ? `${blocked.resourceType} in state, ${templateType} in the template` : blocked.resourceType;
+			lines.push(`  - ${blocked.logicalId} (${shown})`);
+		}
+		lines.push("  Recreating one would DELETE the whole child stack — every resource it owns, with no per-resource confirmation — and re-create it through a layer that does not implement cdkd's nested-stack handling. Where cdkd holds no state for that child, the delete is a no-op instead and the old resource is silently left behind. There is no --force-stateful-recreation bypass. A resource inside a child is not addressable by these flags at all.");
+	}
 	if (validation.blockedMultiRegionTargets.length > 0) {
 		if (lines.length > 0) lines.push("");
 		lines.push(`--recreate-via-cc-api / --recreate-via-sdk-provider refuses to operate on ${validation.blockedMultiRegionTargets.length} multi-region resource(s) — out of scope for v1 of these flags (the destroy + recreate cycle across replica regions is more involved than the single-region path):`);
@@ -3072,7 +3112,7 @@ async function promptRecreateConfirm(input) {
 	else if (toCcCount > 0) logger.warn(`--recreate-via-cc-api will destroy + recreate ${toCcCount} resource(s) via Cloud Control API on stack ${input.stackName}:`);
 	else logger.warn(`--recreate-via-sdk-provider will destroy + recreate ${toSdkCount} resource(s) via SDK Provider on stack ${input.stackName}:`);
 	for (const t of input.targets) {
-		const rederivedReason = t.statefulReason === null && input.forceStatefulRecreation ? isStatefulRecreateTargetForReplace(t.resourceType, void 0) : null;
+		const rederivedReason = t.statefulReason === null && input.forceStatefulRecreation ? isStatefulRecreateTargetForReplace(t.resourceType, void 0, void 0) : null;
 		const rederived = rederivedReason !== null;
 		const reason = t.statefulReason ?? rederivedReason;
 		const stateful = reason !== null;
@@ -15996,209 +16036,6 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-warm-throughput.ts
-/**
-* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
-* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
-*
-* `WarmThroughput` is the same CloudFormation block on both types, and both
-* providers have to answer the same two questions about it before an
-* `UpdateTable` / `CreateTable` goes out:
-*
-*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
-*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
-*     came back from an `Fn::Sub` — arrives as a STRING and must not be
-*     forwarded verbatim into a numeric `Long` field.
-*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
-*     only ever rises with a table's traffic and AWS REJECTS a call that
-*     lowers it (`decreasing WarmThroughput is not supported`, measured live
-*     us-east-1 2026-08-13 for issue #1768).
-*
-* **Provenance, stated precisely because it is easy to over-claim.** Exactly
-* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
-* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
-* existed outside the change that created this file (issue #1857). So this is
-* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
-* behaviour changed for either type when it moved here.
-*
-* What WAS compared is the lifted rule against the GlobalTable spelling
-* drafted alongside it, over the shapes both had to answer (a quoted numeric
-* string, a partially usable block, a mixed decrease/increase, an absent live
-* value, a zero, a negative, a non-numeric string, a whitespace string, an
-* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
-* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
-* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
-* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
-* since `'   '` is not a capacity anyone declared and a warm throughput of 0
-* is not a request AWS can honour. That is a DRAFT reconciled against a
-* shipped rule, which is worth less than two shipped rules agreeing — the
-* reason to read the probe list as a design note rather than as field
-* evidence.
-*
-* Living here rather than in either provider is the point. A decrease guard is
-* three clauses that all FAIL OPEN for different reasons, and two files
-* spelling it independently is two chances for a later "fix" to change one of
-* them — at which point the sibling type silently keeps the old answer, and
-* nothing in the tree says which is intended. Same class as
-* `emr-configuration.ts`, and the same reason.
-*
-* Deliberately NOT here: everything only ONE provider has. The `Table` side's
-* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
-* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
-* and already-matches gates, which `GlobalTable` has no counterpart to (issue
-* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
-* comparison sides unconditionally, so drift never asks the question there);
-* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
-* `ThroughputDiagnostic` that only that provider's collector understands.
-* Moving a helper with one caller here would buy nothing and cost a hop.
-*
-* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
-*/
-/**
-* The two `WarmThroughput` members, in the ONE order every message, every
-* comparison and every emitted block uses. A shared order is what makes two
-* blocks carrying the same numbers compare equal by `deepEqual` and serialize
-* to the same wire bytes regardless of the order the template wrote them in.
-*/
-const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
-/**
-* A CloudFormation-borne numeric property, or `undefined` when the value is
-* not a usable number.
-*
-* Plain `Number()` coercion is NOT good enough and the tree learned it three
-* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
-* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
-* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
-* string would be forwarded as a request for zero units.
-*
-* A YAML-borne numeric STRING is still accepted, because that is a real
-* template shape and `'12000'` genuinely means 12000.
-*
-* EXPORTED, and not because warm throughput needs it exported. This exact rule
-* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
-* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
-* `toFiniteNumber` (a different spelling of the same total function) — which is
-* precisely the divergence this module exists to stop: the next "fix" to one of
-* them would have left the other two answering differently, with nothing in the
-* tree saying which was intended. It reads `ReadCapacityUnits` /
-* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
-* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
-* stringly-typed CFn value a number I can send?".
-*/
-function toFiniteNumber(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value === "string" && value.trim() !== "") {
-		const n = Number(value);
-		return Number.isFinite(n) ? n : void 0;
-	}
-}
-/**
-* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
-* fields accept, PER MEMBER.
-*
-* PER MEMBER, not whole-block, and that distinction is the point: a block
-* whose write half is an unresolved intrinsic still has a perfectly good read
-* half, and dropping both would silently discard a value the template really
-* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
-* warning can say which half went missing instead of reporting the whole
-* property.
-*
-* A block with NO usable member yields `spec: undefined` — refused rather than
-* forwarded, because forwarding a malformed block surfaces as an opaque AWS
-* validation error naming neither cdkd nor the property. `droppedMembers` is
-* still populated in that case, so a REFUSAL message can name what it refused;
-* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
-* array) has no member to name and reports none, which is what lets a caller
-* word "one half went missing" differently from "the block is unusable".
-*
-* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
-* own message, so the wording stays consistent across that provider's send
-* sites without forcing one wording across both providers.
-*/
-function coerceWarmThroughput$1(raw) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
-	const bag = raw;
-	const spec = {};
-	const droppedMembers = [];
-	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (bag[member] === void 0) continue;
-		const coerced = toFiniteNumber(bag[member]);
-		if (coerced === void 0) {
-			droppedMembers.push(member);
-			continue;
-		}
-		spec[member] = coerced;
-	}
-	if (Object.keys(spec).length === 0) return { droppedMembers };
-	return {
-		spec,
-		droppedMembers
-	};
-}
-/**
-* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
-* reports.
-*
-* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
-* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
-*
-* ```
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
-*   ValidationException: One or more parameter values were invalid: Requested
-*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
-*   WarmThroughput, decreasing WarmThroughput is not supported
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
-* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
-* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
-* ```
-*
-* So the value is one AWS raises with the table's traffic and never lowers,
-* and a decrease is REJECTED rather than accepted-and-ignored — which is what
-* had to be measured before choosing, because the two produce different
-* correct answers. The caller SKIPS the call on a true here.
-*
-* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
-* makes the verdict describe a request that is not the one being sent (a
-* dropped member is not part of the call and must not be part of the
-* comparison).
-*
-* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
-* leave AWS as the authority — because a false positive here silently drops a
-* legitimate INCREASE, which is a real capacity change the user asked for,
-* while a false negative merely reproduces the pre-fix behaviour of an
-* AWS-side rejection that names the property:
-*  - DECLARED members only. An absent member is not a request to lower
-*    anything, so it takes no part in the verdict.
-*  - MIXED is not a decrease. One member below live and the other above means
-*    the call carries a genuine increase; AWS decides.
-*  - An absent or unusable LIVE counterpart is not a decrease. Without a
-*    number to compare against there is no evidence of one. Only the LIVE side
-*    can reach that arm: the desired side is a COERCED spec, so a malformed
-*    template value has already been dropped by {@link coerceWarmThroughput}.
-*
-* A decrease therefore requires every declared member to be at-or-below live
-* AND at least one to be strictly below.
-*
-* The skip this drives is right for EVERY `update()` caller — the deploy
-* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
-* because none of them can make AWS lower the value, so none loses anything a
-* doomed call would have achieved.
-*/
-function isWarmThroughputDecrease(desired, live) {
-	if (desired === void 0 || live === void 0) return false;
-	let sawDecrease = false;
-	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (desired[member] === void 0) continue;
-		const wanted = toFiniteNumber(desired[member]);
-		const current = toFiniteNumber(live[member]);
-		if (wanted === void 0 || current === void 0) return false;
-		if (wanted > current) return false;
-		if (wanted < current) sawDecrease = true;
-	}
-	return sawDecrease;
-}
-
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -19969,9 +19806,27 @@ var DynamoDBGlobalTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		debug(`Updating DynamoDB GlobalTable ${logicalId}: ${maskSecrets(physicalId)}`);
-		if (properties["TableName"] !== void 0 && previousProperties["TableName"] !== void 0 && properties["TableName"] !== previousProperties["TableName"]) throw new ProvisioningError(`TableName is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
-		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual$1(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
-		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
+		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+		const replaceRemedy = async () => {
+			let guardRegion = "";
+			try {
+				guardRegion = await this.dynamoDBClient.config.region() ?? "";
+			} catch {
+				guardRegion = "";
+			}
+			return extractLocalDeletionProtection(previousProperties, guardRegion) === true ? protectedReplacementAdvice({
+				evidence: "cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the deploy region",
+				replaceFlags,
+				disable: {
+					before: "aws dynamodb update-table --table-name",
+					identifier: physicalId,
+					after: "--no-deletion-protection-enabled"
+				}
+			}) : `replacement required (deploy with ${replaceFlags}, or destroy + redeploy)`;
+		};
+		if (properties["TableName"] !== void 0 && previousProperties["TableName"] !== void 0 && properties["TableName"] !== previousProperties["TableName"]) throw new ProvisioningError(`TableName is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
+		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual$1(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
+		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
 		const oldAttrs = previousProperties["AttributeDefinitions"] ?? [];
 		const newAttrs = properties["AttributeDefinitions"] ?? [];
 		const desiredKeyAttrNames = collectDesiredKeyAttributeNames(properties);
@@ -19984,7 +19839,7 @@ var DynamoDBGlobalTableProvider = class {
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
 			const extractLocalTags = (props) => {
-				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
+				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const liveWarmByIndexName = /* @__PURE__ */ new Map();
@@ -21034,7 +20889,7 @@ var DynamoDBGlobalTableProvider = class {
 				return entry;
 			}));
 			result["Replicas"] = replicas;
-			const localReplicaEntry = replicas.find((r) => r["Region"] === currentRegion);
+			const localReplica = replicas.find((r) => r["Region"] === currentRegion);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
 				const cfnIndexes = [];
 				const replicaIndexEntries = [];
@@ -21065,11 +20920,11 @@ var DynamoDBGlobalTableProvider = class {
 					if (Object.keys(replicaEntry).length > 1) replicaIndexEntries.push(replicaEntry);
 				}
 				result["GlobalSecondaryIndexes"] = cfnIndexes;
-				if (localReplicaEntry && replicaIndexEntries.length > 0) localReplicaEntry["GlobalSecondaryIndexes"] = replicaIndexEntries;
+				if (localReplica && replicaIndexEntries.length > 0) localReplica["GlobalSecondaryIndexes"] = replicaIndexEntries;
 			}
 			if (table.OnDemandThroughput?.MaxWriteRequestUnits !== void 0) result["WriteOnDemandThroughputSettings"] = { MaxWriteRequestUnits: table.OnDemandThroughput.MaxWriteRequestUnits };
 			else result["WriteOnDemandThroughputSettings"] = {};
-			if (localReplicaEntry && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) localReplicaEntry["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
+			if (localReplica && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) localReplica["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
 			if (billingMode === "PROVISIONED") {
 				const autoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:table:WriteCapacityUnits");
 				if (autoScaling) result["WriteProvisionedThroughputSettings"] = { WriteCapacityAutoScalingSettings: autoScaling };
@@ -21638,10 +21493,29 @@ var DynamoDBGlobalTableProvider = class {
 	}
 };
 /**
-* Diff CFn `Replicas[]` arrays. Keyed by `Region`. Returns adds, removes,
-* and modifies (entries whose other keys — KMSMasterKeyId,
-* GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
+* The `Replicas[]` entry for `region`, or `undefined`.
+*
+* ONE predicate, because two readers of the same field had drifted: issue
+* [#2610]'s review round guarded `extractLocalDeletionProtection` against a
+* non-array `Replicas` and left `update()`'s inline `extractLocalTags` on the
+* old `(props['Replicas'] ?? []) as Array<...>` -- which is the one that
+* actually throws FIRST on the apply path, ~400 lines earlier in the same
+* method, so guarding only the other produced no visible change and no test
+* went red. A shared predicate is what stops the next reader inheriting the
+* unguarded spelling; `derivePerCallProvisionedThroughput` documents the same
+* hazard for the same field and guards independently.
+*
+* `Array.isArray`, not `?? []`: a non-array `Replicas` -- an unresolved
+* intrinsic, or a hand-edited state record -- makes `.find` throw a bare
+* `TypeError`, and since [#2610] one caller sits on the REFUSAL path, where a
+* throw REPLACES three informative `ProvisioningError`s with a stack trace.
+* The `r?.` guards a null ENTRY inside an otherwise-valid array.
 */
+function localReplicaEntry(props, region) {
+	const raw = props["Replicas"];
+	if (!Array.isArray(raw)) return void 0;
+	return raw.find((r) => r?.["Region"] === region);
+}
 /**
 * Extract the local replica's `DeletionProtectionEnabled` from a CFn
 * properties shape. The `AWS::DynamoDB::GlobalTable` CFn schema places
@@ -21657,7 +21531,7 @@ var DynamoDBGlobalTableProvider = class {
 * the SDK call.
 */
 function extractLocalDeletionProtection(props, region) {
-	const perReplica = (props["Replicas"] ?? []).find((r) => r["Region"] === region)?.["DeletionProtectionEnabled"];
+	const perReplica = localReplicaEntry(props, region)?.["DeletionProtectionEnabled"];
 	if (typeof perReplica === "boolean") return perReplica;
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
@@ -22916,6 +22790,11 @@ function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecre
 		}
 	};
 }
+/**
+* Diff CFn `Replicas[]` arrays. Keyed by `Region`. Returns adds, removes,
+* and modifies (entries whose other keys — KMSMasterKeyId,
+* GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
+*/
 function diffReplicas(oldReplicas, newReplicas) {
 	const oldByRegion = /* @__PURE__ */ new Map();
 	const newByRegion = /* @__PURE__ */ new Map();
@@ -22984,6 +22863,75 @@ function deepEqual$1(a, b) {
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
 /**
+* Refuse a `RetentionInDays` the send path cannot USE (issue [#2521]).
+*
+* **The scope of this refusal is a TEST, not a paragraph.** Every review round
+* on issue [#2521] found a hole in a PROSE statement of it — a coercible
+* negative that fell through to `DeleteRetentionPolicy`, an unusable value
+* silenced by the wrong change gate, wrong cells in the hand-written table
+* that replaced those sentences, and then the one non-finite number
+* JavaScript makes FALSY. No count is given here: the count itself drifted
+* between this comment and the changelog, which is the same failure one level
+* up. The table now lives in
+* `tests/unit/provisioning/logs-loggroup-provider-retention-coercion.test.ts`
+* as `CREATE_MATRIX` / `UPDATE_MATRIX`: one row per (value, previous) pair,
+* each asserting which AWS call goes out, each carrying what the pre-#2521
+* code did. Read a change against those rows and add one for any pair they do
+* not cover; do not restate the rule here, because a fourth restatement is
+* the thing that keeps being wrong.
+*
+* THREE refusal CASES across TWO `throw` statements — the non-finite guard
+* clause at the top of the body has its own, and the other two share the
+* second, differing only in the `detail` clause. Only the WHY of each:
+*
+*  - **a non-finite NUMBER** (`NaN`, `Infinity`, `-Infinity`). It sits ahead
+*    of the falsy return because `NaN` is FALSY: without it that value exits
+*    early, fails the `> 0` send test and reaches `DeleteRetentionPolicy`,
+*    while its two siblings — truthy — were already refused. Leaving one
+*    member of a family out is the inconsistency the negative arm below
+*    introduced, so the arm names the family.
+*  - **not a number at all** (`'  '`, `'abc'`, `[]`, `{}`, `true`). The
+*    pre-coercion code tested `if (properties['RetentionInDays'])` and handed
+*    the raw value to `PutRetentionPolicyCommand`, so CloudWatch Logs rejected
+*    it. Refusing moves that rejection one layer earlier and names the
+*    property.
+*  - **a NEGATIVE number** (`-1`, `'-1'`). It coerces, so a refusal gated on
+*    coercibility alone let it through; it then failed the `> 0` send test and
+*    fell into the UPDATE path's `else`, which issues
+*    `DeleteRetentionPolicy` — a template typo SILENTLY REMOVING a live
+*    retention where the old code sent `-1` and failed loudly.
+*
+* The FALSY values pass through, as they did before — `0`, `''`, `false`,
+* `null` and absent; `NaN` is the one exception, refused above because it is a
+* malformed number rather than a spelling of "no retention".
+*
+* `'0'` is TRUTHY, so it reaches this function and passes too: zero is
+* what {@link LogsLogGroupProvider.readCurrentState} records for a group with
+* no retention policy, and CloudFormation coerces `'0'` to `0`, so routing the
+* string to the same arm as the number is the consistency the coercion is for.
+* On the UPDATE path against a live positive retention that is a real change —
+* it DELETES where the old code sent and was rejected — and `UPDATE_MATRIX`
+* pins it.
+*
+* The message names the value's TYPE and never the value. A provider's
+* `properties` bag arrives with dynamic references already RESOLVED, so a
+* `{{resolve:secretsmanager:...}}` scalar is PLAINTEXT by the time it reaches
+* here, and this function has no masker to thread — `create()` takes no
+* `CreateContext` and `applyUpdate` no `UpdateContext`
+* (`.claude/rules/provider-masking.md`). Interpolating it as
+* `${JSON.stringify(raw)}` was the first draft and
+* `vp run audit:provider-secret-mask:check` refused it — but read that as one
+* SPELLING being fenced, not the rule: the critic's population is
+* interpolated `JSON.stringify` calls, so a bare `${raw}` here would leave it
+* green. Do not put the value back without threading the capability first.
+*/
+function assertUsableRetention(raw, coerced, logicalId, resourceType) {
+	if (typeof raw === "number" && !Number.isFinite(raw)) throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); the template declares a non-finite number`, resourceType, logicalId);
+	if (!raw) return;
+	if (coerced !== void 0 && coerced >= 0) return;
+	throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); ${coerced === void 0 ? `the template's value is of type ${Array.isArray(raw) ? "array" : typeof raw} and does not parse as a finite number` : "the template declares a negative number"}`, resourceType, logicalId);
+}
+/**
 * AWS CloudWatch Logs LogGroup Provider
 *
 * Implements resource provisioning for AWS::Logs::LogGroup using the CloudWatch Logs SDK.
@@ -23064,8 +23012,10 @@ var LogsLogGroupProvider = class {
 				else throw createError;
 			}
 			try {
-				const retentionInDays = properties["RetentionInDays"];
-				if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
+				const rawRetention = properties["RetentionInDays"];
+				const retentionInDays = toFiniteNumber(rawRetention);
+				assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+				if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 					logGroupName,
 					retentionInDays
 				}));
@@ -23135,14 +23085,14 @@ var LogsLogGroupProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating log group ${logicalId}: ${physicalId}`);
 		const normalizeClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 		const prevClass = normalizeClass(previousProperties["LogGroupClass"]);
@@ -23151,6 +23101,13 @@ var LogsLogGroupProvider = class {
 			const replaceFlags = "--replace --force-stateful-recreation";
 			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
+		const rawRetention = properties["RetentionInDays"];
+		const rawPreviousRetention = previousProperties["RetentionInDays"];
+		const renderedRetention = JSON.stringify(rawRetention);
+		const sameRawRetention = Object.is(rawRetention, rawPreviousRetention) || renderedRetention !== void 0 && renderedRetention !== "null" && renderedRetention === JSON.stringify(rawPreviousRetention);
+		const retentionInDays = toFiniteNumber(rawRetention);
+		const oldRetentionInDays = toFiniteNumber(rawPreviousRetention);
+		if (!sameRawRetention) assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -23160,8 +23117,7 @@ var LogsLogGroupProvider = class {
 			else await this.logsClient.send(new DisassociateKmsKeyCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Updated KMS key association for log group ${physicalId}`);
 		}
-		const retentionInDays = properties["RetentionInDays"];
-		if (retentionInDays !== previousProperties["RetentionInDays"]) if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
+		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 			logGroupName: physicalId,
 			retentionInDays
 		}));
@@ -37258,7 +37214,15 @@ var ELBv2Provider = class {
 			for (const [k, v] of Object.entries(p)) if (!handledKeys.has(k)) out[k] = v;
 			return out;
 		};
-		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
+		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + (this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
+			evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
+			replaceFlags: "cdkd deploy --replace",
+			disable: {
+				before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
+				identifier: physicalId,
+				after: "--attributes Key=deletion_protection.enabled,Value=false"
+			}
+		}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
 		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
@@ -43897,7 +43861,7 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
-			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
+			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"], (properties["DeletionProtection"] ? properties["DeletionProtection"] : previousProperties["DeletionProtection"]) === "ACTIVE");
 			await this.applyMfaConfig(physicalId, properties, mfaConfiguration, {
 				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
 				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
@@ -43939,7 +43903,7 @@ var CognitoUserPoolProvider = class {
 	*    attribute, requires replacement -> ResourceUpdateNotSupportedError.
 	* A byte-identical Schema is a no-op (no AddCustomAttributes call).
 	*/
-	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema) {
+	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema, deletionProtected = false) {
 		const newAttrs = newSchema ?? [];
 		const oldAttrs = oldSchema ?? [];
 		for (const attr of newAttrs) if (attr.Name === void 0) throw new ProvisioningError(`Cognito User Pool ${logicalId} has a Schema attribute with no Name — every Schema entry must have a Name`, resourceType, logicalId, physicalId);
@@ -43964,7 +43928,20 @@ var CognitoUserPoolProvider = class {
 			...modified.map((n) => `modified attribute '${n}'`),
 			...addedStandard.map((n) => `added standard attribute '${n}'`)
 		];
-		if (immutableChanges.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. AWS::Cognito::UserPool is a stateful type, so re-run with cdkd deploy --replace --force-stateful-recreation to recreate it (this deletes all users in the pool)`);
+		if (immutableChanges.length > 0) {
+			const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+			const remedy = deletionProtected ? protectedReplacementAdvice({
+				evidence: "cdkd's properties for this user pool carry DeletionProtection: ACTIVE",
+				replaceFlags,
+				disable: {
+					before: "aws cognito-idp update-user-pool --user-pool-id",
+					identifier: physicalId,
+					after: "--deletion-protection INACTIVE",
+					caveat: "Note UpdateUserPool's behaviour on an omitted member differs per field, and is unmeasured for DeletionProtection, so send your complete pool configuration alongside that flag rather than the flag alone."
+				}
+			}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
+			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. ${remedy}`);
+		}
 		const addedCustom = added.filter((a) => a.Name !== void 0 && !STANDARD_USER_POOL_ATTRIBUTES.has(a.Name));
 		if (addedCustom.length === 0) return;
 		this.logger.debug(`Adding ${addedCustom.length} custom attribute(s) to ${physicalId}: ` + addedCustom.map((a) => a.Name).join(", "));
@@ -52048,7 +52025,7 @@ var SchedulerScheduleProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const groupName = this.groupNameOf(properties);
 		const previousGroupName = this.groupNameOf(previousProperties);
-		if (groupName !== previousGroupName) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (${previousGroupName ?? "default"} -> ${groupName ?? "default"}); re-run with \`cdkd deploy --replace ${logicalId}\` to recreate it in the new group`);
+		if (groupName !== previousGroupName) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (${previousGroupName ?? "default"} -> ${groupName ?? "default"}); re-run with \`cdkd deploy --replace\` to recreate it in the new group (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)`);
 		this.logger.debug(`Updating Schedule ${logicalId}: ${physicalId}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
 			const input = {
@@ -52070,7 +52047,11 @@ var SchedulerScheduleProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const groupName = this.groupNameOf(properties);
-		if (properties === void 0) this.logger.warn(`State record for Schedule ${logicalId} carries no properties — deleting '${physicalId}' from the default group. If the schedule lives in a custom group, delete it manually: aws scheduler delete-schedule --name ${physicalId} --group-name <group>`);
+		if (properties === void 0) {
+			const safeId = displaySafe(physicalId, { asciiOnly: true });
+			const manualHint = safeId && safeId === physicalId ? `If the schedule lives in a custom group, delete it manually: aws scheduler delete-schedule --name ${shellQuote(safeId)} --group-name <group>` : "If the schedule lives in a custom group, delete it manually via the console: the name recorded for it cannot be reproduced safely on a command line.";
+			this.logger.warn(`State record for Schedule ${logicalId} carries no properties — deleting '${safeId || "<unrenderable>"}' from the default group. ${manualHint}`);
+		}
 		this.logger.debug(`Deleting Schedule ${logicalId}: ${physicalId}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
 			await this.getClient().send(new DeleteScheduleCommand({
@@ -52254,7 +52235,7 @@ var EFSProvider = class {
 		]) {
 			const next = properties[key];
 			const prev = previousProperties[key];
-			if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const newThroughputMode = properties["ThroughputMode"];
 		const newProvisioned = properties["ProvisionedThroughputInMibps"];
@@ -53375,7 +53356,7 @@ var FSxFileSystemProvider = class {
 		for (const key of TOP_LEVEL_IMMUTABLE_PROPS) {
 			const next = properties[key];
 			const prev = previousProperties[key];
-			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const variantConfigKey = this.detectVariantConfigKey(properties, previousProperties);
 		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
@@ -53456,7 +53437,7 @@ var FSxFileSystemProvider = class {
 			const nextVal = next[key];
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
-			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 			const ctx = {
 				resourceType,
 				logicalId,
@@ -54417,6 +54398,16 @@ var EMRClusterProvider = class {
 		const changed = (key) => !jsonEqual$2(properties[key], previousProperties[key]);
 		const nextInstances = properties["Instances"] ?? {};
 		const prevInstances = previousProperties["Instances"] ?? {};
+		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+		const replaceRemedy = () => toBoolean(prevInstances["TerminationProtected"]) === true ? protectedReplacementAdvice({
+			evidence: "cdkd's recorded properties for this cluster carry Instances.TerminationProtected: true",
+			replaceFlags,
+			disable: {
+				before: "aws emr modify-cluster-attributes --cluster-id",
+				identifier: physicalId,
+				after: "--no-termination-protected"
+			}
+		}) : `Re-deploy with ${replaceFlags}, or destroy + redeploy the stack.`;
 		let terminationProtectedChanged = false;
 		if (changed("Instances")) {
 			const instanceKeys = /* @__PURE__ */ new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
@@ -54426,7 +54417,7 @@ var EMRClusterProvider = class {
 					terminationProtectedChanged = true;
 					continue;
 				}
-				throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster Instances.${key} is immutable on AWS — a running cluster's instance topology / networking cannot be changed in place. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+				throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster Instances.${key} is immutable on AWS — a running cluster's instance topology / networking cannot be changed in place. ${replaceRemedy()}`);
 			}
 		}
 		for (const key of Object.keys({
@@ -54435,7 +54426,7 @@ var EMRClusterProvider = class {
 		})) {
 			if (key === "Instances") continue;
 			if (!changed(key)) continue;
-			if (!MUTABLE_TOP_LEVEL_PROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster ${key} is immutable on AWS — it is fixed at cluster creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (!MUTABLE_TOP_LEVEL_PROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster ${key} is immutable on AWS — it is fixed at cluster creation. ${replaceRemedy()}`);
 		}
 		const visibleChanged = changed("VisibleToAllUsers");
 		const stepConcurrencyChanged = changed("StepConcurrencyLevel");
@@ -58447,7 +58438,7 @@ var DLMLifecyclePolicyProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `DefaultPolicy cannot be changed in place; re-run with \`cdkd deploy --replace ${logicalId}\` to recreate the policy`);
+		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "DefaultPolicy cannot be changed in place; re-run with `cdkd deploy --replace` to recreate the policy (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)");
 		this.logger.debug(`Updating DLM Lifecycle Policy ${logicalId} (${physicalId})`);
 		try {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
@@ -58647,7 +58638,7 @@ var S3VectorsProvider = class {
 	* is surfaced as `ResourceUpdateNotSupportedError`.
 	*/
 	async updateVectorBucket(logicalId, physicalId, resourceType, properties, previousProperties) {
-		for (const createOnly of ["VectorBucketName", "EncryptionConfiguration"]) if (JSON.stringify(properties[createOnly]) !== JSON.stringify(previousProperties[createOnly])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `'${createOnly}' is immutable (create-only) on VectorBucket '${physicalId}'; a change requires replacement (cdkd deploy --replace)`);
+		for (const createOnly of ["VectorBucketName", "EncryptionConfiguration"]) if (JSON.stringify(properties[createOnly]) !== JSON.stringify(previousProperties[createOnly])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `'${createOnly}' is immutable (create-only) on VectorBucket '${physicalId}'; a change requires replacement (cdkd deploy --replace --force-stateful-recreation — the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED)`);
 		const oldTags = this.cfnTagsToRecord(previousProperties["Tags"]);
 		const newTags = this.cfnTagsToRecord(properties["Tags"]);
 		const toSet = {};
@@ -62686,8 +62677,7 @@ async function deployCommand(stacks, options) {
 					skipPrefix,
 					yes: options.yes
 				});
-				let recreateViaCcApiTargets;
-				let recreateViaSdkProviderTargets;
+				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
 					const validation = await probeAndRevalidateStateful({
@@ -62716,9 +62706,12 @@ async function deployCommand(stacks, options) {
 					});
 					const errorBlock = renderRecreateTargetsErrors(validation);
 					if (errorBlock) throw new CdkdError(errorBlock, "RECREATE_TARGETS_INVALID");
-					recreateViaCcApiTargets = new Set(validation.targets.filter((t) => t.direction === "to-cc-api").map((t) => t.logicalId));
-					recreateViaSdkProviderTargets = new Set(validation.targets.filter((t) => t.direction === "to-sdk").map((t) => t.logicalId));
-					if (recreateViaCcApiTargets.size > 0 || recreateViaSdkProviderTargets.size > 0) {
+					recreateTargets = {
+						stackName: stackInfo.stackName,
+						viaCcApi: new Set(validation.targets.filter((t) => t.direction === "to-cc-api").map((t) => t.logicalId)),
+						viaSdkProvider: new Set(validation.targets.filter((t) => t.direction === "to-sdk").map((t) => t.logicalId))
+					};
+					if (recreateTargets.viaCcApi.size > 0 || recreateTargets.viaSdkProvider.size > 0) {
 						const downstreamConsumers = await findDownstreamConsumers({
 							producerStack: stackInfo.stackName,
 							producerRegion: stackRegion,
@@ -62743,8 +62736,7 @@ async function deployCommand(stacks, options) {
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...migrationGate && { onCurrentStateLoaded: migrationGate },
-					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
-					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
+					...recreateTargets && (recreateTargets.viaCcApi.size > 0 || recreateTargets.viaSdkProvider.size > 0) && { recreateTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
 					...options.skipFinalSnapshot && { skipFinalSnapshot: true },
@@ -65301,7 +65293,7 @@ async function scrubCommand(stacks, options) {
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${unverifiableNote}${failureNote}`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${failureNote}`);
 	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
@@ -67962,9 +67954,10 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * `notCompared`. The roll-up also contains resources whose only problem is a
 * surviving `{{resolve:...}}` token cdkd resolves for nobody — a look-alike
 * spelling, since issue #2482 moved `ssm-secure` onto the `ssm` path — which
-* can never clear on a re-run, and which this change did not create. Exiting non-zero for them would break `cdkd drift` in CI forever over
-* an unrelated defect, so the exit reads `refused` and `readFailed` while the
-* report covers all three. See `NotComparedCause` and `outcomeExitSignal`.
+* can never clear on a re-run, and which this change did not create. Exiting
+* non-zero for them would break `cdkd drift` in CI forever over an unrelated
+* defect, so the exit reads `refused` and `readFailed` while the report covers
+* all three. See `NotComparedCause` and `outcomeExitSignal`.
 *
 * WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
 * Pre-#2108 that population resolved the reference in the WRONG region, the
@@ -68075,7 +68068,8 @@ function notComparedOutcomes(report) {
 * code covers only the CLEARABLE ones — `refused` (the population #2108 created)
 * and `readFailed` (issues #2151 / #1945). Exiting non-zero on
 * `unresolvedToken` would break `cdkd drift` in CI forever for every stack
-* holding such a spelling — permanent, unclearable, and unrelated. See {@link NotComparedCause}.
+* holding such a spelling — permanent, unclearable, and unrelated. See
+* {@link NotComparedCause}.
 *
 * A `drifted` outcome reports `drifted` even when its own comparison was
 * refused: drift is the stronger, actionable signal and the caller ranks it
@@ -68211,10 +68205,10 @@ function uncomparedTally(reports) {
 *
 *   - The TRIGGER is `anyIncomplete`, i.e. {@link outcomeExitSignal}'s
 *     `incomplete`. It is narrow on purpose: a stack whose ONLY uncompared
-*     resource holds a `{{resolve:...}}` token cdkd resolves for nobody must not start
-*     shouting on every run about a comparison no action of the user's can ever
-*     complete -- the same CI-forever hazard that cause is kept out of the exit
-*     code on.
+*     resource holds a `{{resolve:...}}` token cdkd resolves for nobody must
+*     not start shouting on every run about a comparison no action of the
+*     user's can ever complete -- the same CI-forever hazard that cause is
+*     kept out of the exit code on.
 *   - The COUNT and the LABELS, once the line is triggered, cover EVERY
 *     uncompared resource, each named by its own reason (see
 *     {@link uncomparedTally}). A resource that was not compared was not
@@ -70490,9 +70484,19 @@ function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
 *
 * Purges the stack's deployment-event history (the post-mortem `deployments/`
 * store cdkd keeps by default) ONLY after a clean, non-interrupted destroy, so
-* the state bucket returns fully empty. Deliberately skipped on a failed /
-* interrupted destroy — those events ARE the post-mortem the user wants on the
-* retry — and a no-op when `--purge-events` was not passed.
+* a plain object listing of the state bucket comes back empty. Deliberately
+* skipped on a failed / interrupted destroy — those events ARE the post-mortem
+* the user wants on the retry — and a no-op when `--purge-events` was not
+* passed.
+*
+* "Empty" is bounded, and this used to say "the state bucket returns fully
+* empty" without the bound (issue
+* [#2624](https://github.com/go-to-k/cdkd/issues/2624)). The purge routes
+* through `DeploymentEventsReader.pruneRuns` -> `deleteRawObjects`, which sends
+* `DeleteObjects` with no `VersionId`: on the versioned state bucket that
+* writes DELETE MARKERS and leaves every earlier version of those keys readable
+* with a `VersionId`. The log line below states that rather than claiming a
+* removal that did not happen.
 *
 * MUST be called AFTER the run's `eventRecorder.finalize()` (which writes this
 * run's own events + index): purging first would just be re-created by the
@@ -70509,7 +70513,7 @@ async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger)
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
 		const purge = await reader.pruneRuns(stackName, region, { all: true });
-		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${stackName} (${region}).`);
+		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${stackName} (${region}). Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId.`);
 		return purge;
 	} catch (purgeError) {
 		logger.warn(`  Failed to purge deployment-event history for ${stackName}: ${purgeError instanceof Error ? purgeError.message : String(purgeError)}`);
@@ -70793,7 +70797,7 @@ async function destroyCommand(stackArgs, options) {
 * Create destroy command
 */
 function createDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", "After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so the state bucket returns fully empty. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: 'cdkd events prune <stack> --all'.", false).action(withErrorHandling(destroyCommand));
+	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", "After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so an object listing of the state bucket comes back empty. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: 'cdkd events prune <stack> --all'.", false).action(withErrorHandling(destroyCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -76201,8 +76205,8 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${op.logicalId} (${op.resourceType}) [--orphan]`;
 		case "revert": return `  - revert   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "reverse-replacement": return `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
-		case "reverse-replacement-readopt": return `  - reverse-replace ${op.logicalId} (${op.resourceType}) [delete new, re-adopt retained old resource]`;
+		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
+		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${op.logicalId} (${op.resourceType}) — was DELETED, unrecoverable`;
 		case "skip-mismatch": return `  - skip     ${op.logicalId} (${op.resourceType}) — physical id changed, needs manual attention`;
 		case "skip-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no longer in state`;
@@ -76538,6 +76542,73 @@ function createRollbackCommand() {
 //#endregion
 //#region src/cli/commands/events.ts
 /**
+* Issue [#2438](https://github.com/go-to-k/cdkd/issues/2438): every string
+* `cdkd events` renders on its HUMAN path comes back out of a durable store
+* (`deployments/{runId}.jsonl` and `deployments/index.json`), and several of
+* those fields are provider- or template-authored — a logical id, a resource
+* type, a `reason` that interpolates a user-chosen physical name, an AWS error
+* message. `JSON.stringify` escapes control bytes on the way IN, so the store
+* is well-formed, but the reader is a plain `JSON.parse` that restores the
+* original bytes verbatim. Without a sanitising pass here an ESC-bracket
+* sequence stored in any of them re-forges the terminal of the one command
+* whose entire purpose is to be BELIEVED after a run.
+*
+* Three helpers rather than one, because the field classes have different
+* correct answers:
+*
+* - {@link safeId} is for values with a KNOWN ASCII charset (a run id, a
+*   logical id, a CFn resource type, a region, an event type, a version
+*   string). `asciiOnly` is a positive allowlist and therefore has no residual
+*   at all — the right fence when nothing legitimate is lost.
+* - {@link safeText} is for free PROSE (`reason`, `error.name`,
+*   `error.message`). A legitimate AWS error message may carry non-ASCII, and
+*   `asciiOnly` would mangle it — so prose gets the control-character denylist,
+*   accepting `display-safe.ts`'s documented residual.
+*
+* The wrap goes around the VALUE, never around the colorized token: sanitising
+* `red(x)` would strip cdkd's OWN ANSI and leave the row uncolored.
+*/
+const safeId = (value) => displaySafe(value, { asciiOnly: true });
+/** Free-prose counterpart of {@link safeId}. See that helper's block comment. */
+const safeText = (value) => displaySafe(value);
+/**
+* Numeric counterpart of {@link safeId}, for the stored COUNTER fields.
+*
+* Their declared `number` type is the WRITER's guarantee; the value rendered
+* here came back through `JSON.parse` and can be any JSON scalar. Sanitising
+* would be the wrong tool — it would still render the forged text, merely
+* stripped — so a value that is not a number is not renderable as one and
+* becomes `?`. Mirrors the pre-existing `typeof e.durationMs === 'number'`
+* guard, which is why that one line needed no change.
+*/
+const safeCount = (value) => typeof value === "number" ? String(value) : "?";
+/**
+* Appended to every `cdkd events prune` line that reports a DELETE, because
+* "pruned" and "removed" would otherwise read as removal and are not (issue
+* [#2624](https://github.com/go-to-k/cdkd/issues/2624)).
+*
+* The pruner reaches S3 through `S3StateBackend.deleteRawObjects`, which sends
+* `DeleteObjects` with no `VersionId`. On the versioned state bucket
+* `cdkd bootstrap` creates, that writes a DELETE MARKER and leaves every
+* earlier version of the key readable through `GetObject` with a `VersionId`.
+* And the versions exist in QUANTITY here rather than as a theoretical
+* remainder: the store re-PUTs a run's whole JSONL body on every flush, so a
+* single run accumulates one noncurrent version per flush before it is ever
+* pruned. `docs/deployment-events.md` classes `deployments/*.jsonl` as
+* sensitive, which is what makes the distinction worth a line of output.
+*
+* Deliberately NOT appended to the "no runs matched" arm: that arm returns
+* before any `deleteRawObjects` call, so there is no delete to qualify.
+*
+* The converse does NOT hold, and the gap is tracked on issue #2624 rather than
+* closed here: `pruneRuns({ all: true })` reports `indexDeleted: true`
+* unconditionally (its `DeleteObjects` is idempotent, so it "succeeds" on an
+* empty prefix), so the arms this note IS appended to can fire for a stack that
+* had no history at all. Making that gate truthful is a behaviour change, not a
+* wording one.
+*/
+const NONCURRENT_VERSIONS_SURVIVE_NOTE = " Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.";
+/**
 * `cdkd events <stack>` — read back the structured deployment events
 * (issue #808) cdkd persists per deploy / destroy run, the local
 * equivalent of CloudFormation's `DescribeStackEvents`.
@@ -76580,7 +76651,7 @@ async function eventsCommand(stackName, options) {
 		const targetRegion = await resolveEventsRegion(reader, stackName, options.stackRegion);
 		if (options.run) {
 			const events = await reader.readRunEvents(stackName, targetRegion, options.run);
-			if (events === null) throw new CdkdError(`No deployment-event stream found for run '${options.run}' of stack '${stackName}' in region '${targetRegion}'.`, "EVENTS_RUN_NOT_FOUND");
+			if (events === null) throw new CdkdError(`No deployment-event stream found for run '${safeId(options.run) || "<unrenderable>"}' of stack '${safeId(stackName) || "<unrenderable>"}' in region '${safeId(targetRegion) || "<unrenderable>"}'.`, "EVENTS_RUN_NOT_FOUND");
 			if (asJson) {
 				process.stdout.write(JSON.stringify(events, null, 2) + "\n");
 				return;
@@ -76611,16 +76682,22 @@ async function eventsCommand(stackName, options) {
 async function resolveEventsRegion(reader, stackName, explicitRegion) {
 	if (explicitRegion) return explicitRegion;
 	const regions = await reader.listRegions(stackName);
-	if (regions.length === 0) throw new CdkdError(`No deployment-event history found for stack '${stackName}'. Events are recorded by 'cdkd deploy' / 'cdkd destroy' (issue #808); a stack deployed by an older cdkd version has none.`, "EVENTS_NOT_FOUND");
-	if (regions.length > 1) throw new CdkdError(`Stack '${stackName}' has deployment-event history in multiple regions: ${regions.join(", ")}. Re-run with '--stack-region <region>' to disambiguate.`, "EVENTS_REGION_AMBIGUOUS");
+	if (regions.length === 0) throw new CdkdError(`No deployment-event history found for stack '${safeId(stackName) || "<unrenderable>"}'. Events are recorded by 'cdkd deploy' / 'cdkd destroy' (issue #808); a stack deployed by an older cdkd version has none.`, "EVENTS_NOT_FOUND");
+	if (regions.length > 1) throw new CdkdError(`Stack '${safeId(stackName) || "<unrenderable>"}' has deployment-event history in multiple regions: ${regions.map((r) => safeId(r) || "<unrenderable>").join(", ")}. Re-run with '--stack-region <region>' to disambiguate.`, "EVENTS_REGION_AMBIGUOUS");
 	return regions[0];
 }
 /**
-* `cdkd events prune <stack>` — reclaim S3 space by deleting old per-run
-* `{runId}.jsonl` event streams (issue #885). `cdkd destroy` deliberately
-* keeps event history as post-mortem context, so this is the explicit way
-* to purge it; the deploy/destroy writer also self-bounds to the last
-* {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs automatically.
+* `cdkd events prune <stack>` — clear old per-run `{runId}.jsonl` event
+* streams out of the bucket's object LISTING (issue #885). `cdkd destroy`
+* deliberately keeps event history as post-mortem context, so this is the
+* explicit way to purge it; the deploy/destroy writer also self-bounds to the
+* last {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs automatically.
+*
+* It does NOT reclaim the storage, and the wording above said it did until
+* issue [#2624](https://github.com/go-to-k/cdkd/issues/2624): the delete
+* carries no `VersionId`, so on a versioned state bucket every earlier
+* version of a pruned key is still billed and still readable. See
+* {@link NONCURRENT_VERSIONS_SURVIVE_NOTE}.
 *
 * Retention selection:
 *   - `--all`              purge every run + the index.
@@ -76657,10 +76734,12 @@ async function eventsPruneCommand(stackName, options) {
 		await stateBackend.verifyBucketExists();
 		const reader = new DeploymentEventsReader(stateBackend);
 		const targetRegion = await resolveEventsRegion(reader, stackName, options.stackRegion);
+		const safeStack = safeId(stackName) || "<unrenderable>";
+		const safeRegion = safeId(targetRegion) || "<unrenderable>";
 		const totalRuns = (await reader.listRuns(stackName, targetRegion)).length;
-		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${options.olderThan}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${options.olderThan}` : `runs beyond the newest ${20}`;
+		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${safeId(options.olderThan)}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${safeId(options.olderThan)}` : `runs beyond the newest ${20}`;
 		if (options.yes !== true) {
-			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(stackName)} ${gray(`(${targetRegion})`)}: ${scope}?`)) {
+			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}: ${scope}?`)) {
 				logger.info(gray("Aborted; nothing was deleted."));
 				return;
 			}
@@ -76671,10 +76750,10 @@ async function eventsPruneCommand(stackName, options) {
 			...olderThanMs !== void 0 && { olderThanMs }
 		});
 		if (result.deletedRunIds.length === 0) {
-			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${stackName} (${targetRegion}); no run streams to delete.` : `No runs matched the prune criteria for ${stackName} (${targetRegion}).`));
+			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${safeStack} (${safeRegion}); no run streams to delete. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.` : `No runs matched the prune criteria for ${safeStack} (${safeRegion}).`));
 			return;
 		}
-		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(stackName)} ${gray(`(${targetRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + ".");
+		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + "." + gray(NONCURRENT_VERSIONS_SURVIVE_NOTE));
 	} finally {
 		awsClients.destroy();
 	}
@@ -76690,19 +76769,29 @@ async function eventsPruneCommand(stackName, options) {
 async function confirmPrompt$2(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd events prune confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the prune, or run the command from a real terminal. Nothing has been deleted." });
 }
-/** Human-readable run listing (newest first). */
+/**
+* Human-readable run listing (newest first).
+*
+* Issue #2438: every `run.*` field here comes back out of
+* `deployments/index.json` via a plain `JSON.parse`, so its declared type is a
+* claim about the writer, not about the bytes on disk — each one goes through
+* {@link safeId}. `result` is sanitised BEFORE the colour decision so the
+* colour matches the text the user actually sees.
+*/
 function printRunList(stackName, region, runs) {
 	const logger = getLogger();
-	logger.info(`${bold("Deployment runs for")} ${cyan(stackName)} ${gray(`(${region})`)}`);
+	const safeStack = safeId(stackName) || "<unrenderable>";
+	logger.info(`${bold("Deployment runs for")} ${cyan(safeStack)} ${gray(`(${safeId(region) || "<unrenderable>"})`)}`);
 	if (runs.length === 0) {
 		logger.info(gray("  (no runs recorded)"));
 		return;
 	}
 	for (const run of runs) {
-		const resultColored = run.result === "SUCCEEDED" ? green(run.result) : run.result === "UNKNOWN" ? gray(run.result) : red(run.result);
-		logger.info(`  ${cyan(run.runId)}  ${run.command}  ${resultColored}  ${gray(run.startedAt || "?")} -> ${gray(run.finishedAt || "?")}  ${gray(`cdkd ${run.cdkdVersion}`)}  ${gray(`${run.eventCount} events`)}`);
+		const result = safeId(run.result) || "<unrenderable>";
+		const resultColored = result === "SUCCEEDED" ? green(result) : result === "UNKNOWN" || result === "<unrenderable>" ? gray(result) : red(result);
+		logger.info(`  ${cyan(safeId(run.runId) || "<unrenderable>")}  ${safeId(run.command) || "<unrenderable>"}  ${resultColored}  ${gray(safeId(run.startedAt) || "?")} -> ${gray(safeId(run.finishedAt) || "?")}  ${gray(`cdkd ${safeId(run.cdkdVersion) || "<unrenderable>"}`)}  ${gray(`${safeCount(run.eventCount)} events`)}`);
 	}
-	logger.info(gray(`\nUse 'cdkd events ${stackName} --run <runId>' to read one run's events.`));
+	logger.info(gray(`\nUse 'cdkd events ${safeStack} --run <runId>' to read one run's events.`));
 }
 /** Human-readable single-run event stream (in recorded order). */
 /**
@@ -76712,29 +76801,38 @@ function printRunList(stackName, region, runs) {
 */
 function printRunEvents(stackName, region, runId, events) {
 	const logger = getLogger();
-	logger.info(`${bold("Events for run")} ${cyan(runId)} ${gray(`(${stackName}, ${region})`)}`);
+	logger.info(`${bold("Events for run")} ${cyan(safeId(runId) || "<unrenderable>")} ${gray(`(${safeId(stackName) || "<unrenderable>"}, ${safeId(region) || "<unrenderable>"})`)}`);
 	if (events.length === 0) {
 		logger.info(gray("  (no events)"));
 		return;
 	}
 	for (const e of events) {
-		const parts = [gray(e.timestamp), colorizeEventType(e.eventType)];
-		if (e.logicalId) parts.push(`${e.logicalId}${e.resourceType ? ` (${e.resourceType})` : ""}`);
-		if (e.operation) parts.push(gray(e.operation));
-		if (e.guard) parts.push(gray(`guard=${e.guard}`));
-		if (e.provisionedBy) parts.push(gray(`[${e.provisionedBy}]`));
-		if (e.command) parts.push(gray(e.command));
-		if (e.region) parts.push(gray(e.region));
-		if (e.cdkdVersion) parts.push(gray(`cdkd ${e.cdkdVersion}`));
-		if (e.result) parts.push(e.result === "SUCCEEDED" ? green(e.result) : red(e.result));
+		const parts = [gray(safeId(e.timestamp) || "<unrenderable>"), colorizeEventType(e.eventType)];
+		if (e.logicalId) {
+			const logicalId = safeId(e.logicalId) || "<unrenderable>";
+			const resourceType = e.resourceType ? ` (${safeId(e.resourceType) || "<unrenderable>"})` : "";
+			parts.push(`${logicalId}${resourceType}`);
+		}
+		if (e.operation) parts.push(gray(safeId(e.operation) || "<unrenderable>"));
+		if (e.guard) parts.push(gray(`guard=${safeId(e.guard) || "<unrenderable>"}`));
+		if (e.provisionedBy) parts.push(gray(`[${safeId(e.provisionedBy) || "<unrenderable>"}]`));
+		if (e.command) parts.push(gray(safeId(e.command) || "<unrenderable>"));
+		if (e.region) parts.push(gray(safeId(e.region) || "<unrenderable>"));
+		if (e.cdkdVersion) parts.push(gray(`cdkd ${safeId(e.cdkdVersion) || "<unrenderable>"}`));
+		if (e.result) {
+			const result = safeId(e.result) || "<unrenderable>";
+			parts.push(result === "SUCCEEDED" ? green(result) : result === "<unrenderable>" ? gray(result) : red(result));
+		}
 		if (typeof e.durationMs === "number") parts.push(gray(`${e.durationMs}ms`));
-		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "") + (e.counts.skipped ? ` ⚠${e.counts.skipped}` : "")));
+		if (e.counts) parts.push(gray(`+${safeCount(e.counts.created)}/~${safeCount(e.counts.updated)}/-${safeCount(e.counts.deleted)}` + (e.counts.failed ? ` !${safeCount(e.counts.failed)}` : "") + (e.counts.skipped ? ` ⚠${safeCount(e.counts.skipped)}` : "")));
 		logger.info(`  ${parts.join("  ")}`);
-		if (e.reason) logger.info(`      ${yellow(e.reason)}`);
+		if (e.reason) logger.info(`      ${yellow(safeText(e.reason) || "<unrenderable>")}`);
 		if (e.error) {
-			const code = e.error.awsErrorCode ? ` (${e.error.awsErrorCode})` : "";
-			const reqId = e.error.requestId ? gray(` requestId=${e.error.requestId}`) : "";
-			logger.info(`      ${red(`${e.error.name}${code}: ${e.error.message}`)}${reqId}`);
+			const code = e.error.awsErrorCode ? ` (${safeId(e.error.awsErrorCode) || "<unrenderable>"})` : "";
+			const reqId = e.error.requestId ? gray(` requestId=${safeId(e.error.requestId) || "<unrenderable>"}`) : "";
+			const name = safeText(e.error.name) || "<unrenderable>";
+			const message = e.error.message ? `: ${safeText(e.error.message) || "<unrenderable>"}` : "";
+			logger.info(`      ${red(`${name}${code}${message}`)}${reqId}`);
 		}
 	}
 }
@@ -76744,14 +76842,22 @@ function printRunEvents(stackName, region, runId, events) {
 * Exported for unit-test coverage (matching `destroy-runner.ts`'s
 * `PROTECTION_PROPERTY_BY_TYPE` convention) — it is pure, so testing it
 * directly beats driving it through the renderer's log output.
+*
+* Issue #2438: the declared union is what the WRITER emits; the value handed
+* here was restored by `JSON.parse` from the stored stream and is therefore
+* arbitrary text. It is sanitised once, up front, and every arm below both
+* classifies AND colorizes the sanitised token — classifying the raw value
+* while printing the sanitised one would let the two disagree. The token is
+* a known-ASCII discriminator, so `safeId`'s positive allowlist loses nothing.
 */
 function colorizeEventType(eventType) {
-	if (eventType.endsWith("FAILED")) return red(eventType);
-	if (eventType.endsWith("SUCCEEDED") || eventType === "RUN_FINISHED") return green(eventType);
-	if (eventType === "RESOURCE_SKIPPED") return yellow(eventType);
-	if (eventType === "RESOURCE_GUARD_INDETERMINATE") return yellow(eventType);
-	if (eventType.startsWith("ROLLBACK")) return yellow(eventType);
-	return cyan(eventType);
+	const token = safeId(eventType) || "<unrenderable>";
+	if (token.endsWith("FAILED")) return red(token);
+	if (token.endsWith("SUCCEEDED") || token === "RUN_FINISHED") return green(token);
+	if (token === "RESOURCE_SKIPPED") return yellow(token);
+	if (token === "RESOURCE_GUARD_INDETERMINATE") return yellow(token);
+	if (token.startsWith("ROLLBACK")) return yellow(token);
+	return cyan(token);
 }
 /**
 * Create the `cdkd events` command.
@@ -76780,11 +76886,11 @@ function createEventsCommand() {
 * action therefore reads the merged view via `command.optsWithGlobals()`.
 */
 function createEventsPruneCommand() {
-	return new Command("prune").description("Delete old per-run deployment-event streams to reclaim S3 space").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
+	return new Command("prune").description("Delete old per-run deployment-event streams. On a versioned state bucket this clears the object listing; earlier versions of the deleted keys survive and are not purged.").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
 		const n = parseInt(v, 10);
-		if (!Number.isInteger(n) || n < 0) throw new Error(`Invalid --keep value "${v}": expected a non-negative integer.`);
+		if (!Number.isInteger(n) || n < 0) throw new Error(`Invalid --keep value "${safeId(v)}": expected a non-negative integer.`);
 		return n;
-	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index (full purge)", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
+	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
 }
 
 //#endregion
@@ -82182,7 +82288,7 @@ async function pullImage(image, skipPull) {
 		try {
 			await runDockerForeground(["pull", image]);
 		} catch (err) {
-			throw new DockerRunnerError(`docker pull ${image} failed: ${err.message}`);
+			throw new DockerRunnerError(`docker pull ${image} failed: ${describeDockerFailure(err, ["pull", image])}`);
 		}
 		return;
 	}
@@ -82191,8 +82297,8 @@ async function pullImage(image, skipPull) {
 		await runDockerStreaming(["pull", image], { streamLive: false });
 	} catch (err) {
 		const e = err;
-		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${image} failed: ${e.message ?? String(err)}`);
-		const detail = e.stderr?.trim() || e.stdout?.trim() || "(no output)";
+		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${image} failed: ${describeDockerFailure(err, ["pull", image])}`);
+		const detail = describeDockerCapturedOutput(err, ["pull", image], "(no output)");
 		throw new DockerRunnerError(`docker pull ${image} exited with code ${e.exitCode}: ${detail}`);
 	}
 }
@@ -82238,7 +82344,7 @@ async function runDetached(opts) {
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
-	logger.debug(`${getDockerCmd()} ${redactAwsCredentialsInArgs(args).join(" ")}`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`);
 	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
@@ -82247,8 +82353,7 @@ async function runDetached(opts) {
 		});
 		return stdout.trim();
 	} catch (error) {
-		const err = error;
-		throw new DockerRunnerError(`docker run failed: ${err.stderr?.trim() || err.message || String(error)}`);
+		throw new DockerRunnerError(`docker run failed: ${describeDockerFailure(error, args)}`);
 	}
 }
 /**
@@ -82280,16 +82385,16 @@ function streamLogs(containerId) {
 async function removeContainer(containerId) {
 	if (!containerId) return;
 	const logger = getLogger().child("docker");
+	const args = [
+		"rm",
+		"-f",
+		containerId
+	];
 	try {
-		await execFileAsync$3(getDockerCmd(), [
-			"rm",
-			"-f",
-			containerId
-		]);
+		await execFileAsync$3(getDockerCmd(), args);
 		logger.debug(`Removed container ${containerId}`);
 	} catch (error) {
-		const err = error;
-		logger.debug(`docker rm -f ${containerId} failed: ${err.stderr || err.message || String(error)}`);
+		logger.debug(`docker rm -f ${containerId} failed: ${describeDockerFailure(error, args)}`);
 	}
 }
 /**
@@ -82299,16 +82404,16 @@ async function removeContainer(containerId) {
 */
 async function ensureDockerAvailable() {
 	const cmd = getDockerCmd();
+	const args = [
+		"version",
+		"--format",
+		"{{.Server.Version}}"
+	];
 	try {
-		await execFileAsync$3(cmd, [
-			"version",
-			"--format",
-			"{{.Server.Version}}"
-		]);
+		await execFileAsync$3(cmd, args);
 	} catch (error) {
-		const err = error;
-		if (err.code === "ENOENT") throw new DockerRunnerError(`${cmd} is not installed or not on PATH. cdkd local invoke needs Docker (or a compatible CLI specified via CDK_DOCKER) — install it and retry.`);
-		throw new DockerRunnerError(`${cmd} daemon is not reachable: ${err.stderr?.trim() || err.message || String(error)}. Start Docker Desktop / the docker daemon and retry.`);
+		if (error.code === "ENOENT") throw new DockerRunnerError(`${cmd} is not installed or not on PATH. cdkd local invoke needs Docker (or a compatible CLI specified via CDK_DOCKER) — install it and retry.`);
+		throw new DockerRunnerError(`${cmd} daemon is not reachable: ${describeDockerFailure(error, args)}. Start Docker Desktop / the docker daemon and retry.`);
 	}
 }
 /**
@@ -82339,25 +82444,12 @@ function pickFreePort() {
 	});
 }
 /**
-* AWS credential keys whose values must NOT be written to the debug log.
-* `forwardAwsEnv` / `assumeLambdaExecutionRole` (in `local-invoke.ts`)
-* push these via `-e <KEY>=<value>` flags into `runDetached`'s args
-* array, and `cdkd local invoke --verbose` would otherwise leak them
-* into stdout / log files. Only the matching `-e <KEY>=<value>` pair is
-* redacted; non-credential `-e KEY=val` entries pass through unchanged.
-*/
-const REDACTED_ENV_KEYS = /* @__PURE__ */ new Set([
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN"
-]);
-/**
 * Built-in sensitive env keys whose VALUES are always routed through
 * docker's value-from-process-env form (`-e KEY` rather than
-* `-e KEY=value`) by {@link runDetached}. Mirrors the redaction-only
-* {@link REDACTED_ENV_KEYS} set above, but stronger: the value is kept
-* off the docker `run` argv (and therefore off `ps` / `/proc/<pid>/cmdline`
-* / verbose debug logs) instead of just being masked at log time. A caller
+* `-e KEY=value`) by {@link runDetached}. Stronger than any log-time
+* masking: the value is kept off the docker `run` argv entirely (and
+* therefore off `ps` / `/proc/<pid>/cmdline` as well as every rendering of
+* the argv) instead of only being hidden at display time. A caller
 * may extend this set via the `sensitiveEnvKeys` option (used by the
 * AgentCore local-invoke path to keep decrypted `--from-cfn-stack`
 * SecureString SSM values off the argv).
@@ -82367,32 +82459,6 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_SESSION_TOKEN"
 ]);
-/**
-* Returns a copy of `args` with any `-e <KEY>=<value>` pair whose KEY is
-* in {@link REDACTED_ENV_KEYS} replaced with `-e <KEY>=***`. The actual
-* `args` passed to `spawn` are never mutated — this is for log output
-* only.
-*/
-function redactAwsCredentialsInArgs(args) {
-	const out = [];
-	for (let i = 0; i < args.length; i++) {
-		const cur = args[i];
-		const next = args[i + 1];
-		if (cur === "-e" && typeof next === "string") {
-			const eqIdx = next.indexOf("=");
-			if (eqIdx > 0) {
-				const key = next.substring(0, eqIdx);
-				if (REDACTED_ENV_KEYS.has(key)) {
-					out.push("-e", `${key}=***`);
-					i++;
-					continue;
-				}
-			}
-		}
-		out.push(cur);
-	}
-	return out;
-}
 
 //#endregion
 //#region src/local/docker-image-builder.ts
@@ -82588,10 +82654,11 @@ async function pullEcrImage(imageUri, options) {
 		ecr.destroy();
 	}
 	logger.info(`Pulling ${canonicalUri}...`);
+	const pullArgs = ["pull", canonicalUri];
 	try {
-		await runDockerForeground(["pull", canonicalUri]);
+		await runDockerForeground(pullArgs);
 	} catch (err) {
-		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${describeDockerFailure(err, pullArgs)}`);
 	}
 	return canonicalUri;
 }
@@ -82640,17 +82707,17 @@ async function ecrLogin(client, accountId, region) {
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
 	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const loginArgs = [
+		"login",
+		"--username",
+		username,
+		"--password-stdin",
+		endpoint
+	];
 	try {
-		await runDockerStreaming([
-			"login",
-			"--username",
-			username,
-			"--password-stdin",
-			endpoint
-		], { input: password });
+		await runDockerStreaming(loginArgs, { input: password });
 	} catch (err) {
-		const e = err;
-		throw new LocalInvokeBuildError$1(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+		throw new LocalInvokeBuildError$1(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
 	}
 }
 /**
@@ -85373,19 +85440,19 @@ async function createNetworkAndSidecar(args) {
 	const { networkName, cidr, sidecarIp, credentials, cluster, skipPull } = args;
 	await pullImage(METADATA_ENDPOINT_IMAGE, skipPull);
 	logger.info(`Creating docker network ${networkName} (subnet ${cidr})...`);
+	const createArgs = [
+		"network",
+		"create",
+		"--driver",
+		"bridge",
+		"--subnet",
+		cidr,
+		networkName
+	];
 	try {
-		await execFileAsync$2(getDockerCmd(), [
-			"network",
-			"create",
-			"--driver",
-			"bridge",
-			"--subnet",
-			cidr,
-			networkName
-		]);
+		await execFileAsync$2(getDockerCmd(), createArgs);
 	} catch (err) {
-		const e = err;
-		throw new DockerRunnerError(`docker network create failed: ${e.stderr?.trim() || e.message || String(err)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local start-service\` shares one network across every service in the run; bare \`cdkd local run-task\` uses a per-task network so only one run can be active at a time.`);
+		throw new DockerRunnerError(`docker network create failed: ${describeDockerFailure(err, createArgs)}. Hint: another cdkd run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`cdkd local start-service\` shares one network across every service in the run; bare \`cdkd local run-task\` uses a per-task network so only one run can be active at a time.`);
 	}
 	const sidecarArgs = [
 		"run",
@@ -85418,8 +85485,7 @@ async function createNetworkAndSidecar(args) {
 		return stdout.trim();
 	} catch (err) {
 		await destroyNetworkOnly(networkName);
-		const e = err;
-		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${e.stderr?.trim() || e.message || String(err)}`);
+		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${describeDockerFailure(err, sidecarArgs)}`);
 	}
 }
 /**
@@ -85481,16 +85547,16 @@ async function destroyTaskNetwork(net) {
 async function destroyNetworkOnly(networkName) {
 	if (!networkName) return;
 	const logger = getLogger().child("ecs-network");
+	const rmArgs = [
+		"network",
+		"rm",
+		networkName
+	];
 	try {
-		await execFileAsync$2(getDockerCmd(), [
-			"network",
-			"rm",
-			networkName
-		]);
+		await execFileAsync$2(getDockerCmd(), rmArgs);
 		logger.debug(`Removed docker network ${networkName}`);
 	} catch (err) {
-		const e = err;
-		logger.debug(`docker network rm ${networkName} failed: ${e.stderr || e.message || String(err)}`);
+		logger.debug(`docker network rm ${networkName} failed: ${describeDockerFailure(err, rmArgs)}`);
 	}
 }
 
@@ -85666,30 +85732,38 @@ async function cleanupEcsRun(state, options) {
 	state.logStoppers = [];
 	if (!options.keepRunning) {
 		for (const c of state.startedContainers) {
+			const stopArgs = dockerStopArgs(c.id, CLEANUP_STOP_GRACE_SECONDS);
 			try {
-				await stopContainer(c.id, 10);
+				await stopContainer(c.id, CLEANUP_STOP_GRACE_SECONDS);
 			} catch (err) {
-				logger.debug(`docker stop ${c.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`docker stop ${c.id} failed: ${describeDockerFailure(err, stopArgs)}`);
 			}
 			try {
 				await removeContainer(c.id);
 			} catch (err) {
-				logger.debug(`docker rm -f ${c.id} failed: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`docker rm -f ${c.id} failed: ${describeDockerFailure(err, [
+					"rm",
+					"-f",
+					c.id
+				])}`);
 			}
 		}
 		state.startedContainers = [];
 	}
 	if (state.network && !state.network.ownedByCaller) await destroyTaskNetwork(state.network);
 	state.network = void 0;
-	for (const v of state.dockerVolumeNames) try {
-		await execFileAsync$1(getDockerCmd(), [
+	for (const v of state.dockerVolumeNames) {
+		const rmArgs = [
 			"volume",
 			"rm",
 			v
-		]);
-		logger.debug(`Removed docker volume ${v}`);
-	} catch (err) {
-		logger.debug(`docker volume rm ${v} failed: ${err instanceof Error ? err.message : String(err)}`);
+		];
+		try {
+			await execFileAsync$1(getDockerCmd(), rmArgs);
+			logger.debug(`Removed docker volume ${v}`);
+		} catch (err) {
+			logger.debug(`docker volume rm ${v} failed: ${describeDockerFailure(err, rmArgs)}`);
+		}
 	}
 	state.dockerVolumeNames = [];
 }
@@ -85783,8 +85857,7 @@ async function runEcsTask(task, options, state) {
 			});
 			id = stdout.trim();
 		} catch (err) {
-			const e = err;
-			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${describeDockerFailure(err, args)}`);
 		}
 		state.startedContainers.push({
 			name: container.name,
@@ -85887,14 +85960,15 @@ async function waitForContainerHealthy(containerId, displayName) {
 	const logger = getLogger().child("ecs-runner");
 	const deadline = Date.now() + 300 * 1e3;
 	let lastStatus = "";
+	const inspectArgs = [
+		"inspect",
+		"--format",
+		"{{.State.Health.Status}}",
+		containerId
+	];
 	while (Date.now() < deadline) {
 		try {
-			const { stdout } = await execFileAsync$1(getDockerCmd(), [
-				"inspect",
-				"--format",
-				"{{.State.Health.Status}}",
-				containerId
-			]);
+			const { stdout } = await execFileAsync$1(getDockerCmd(), inspectArgs);
 			const status = stdout.trim();
 			if (status !== lastStatus) {
 				logger.debug(`Container '${displayName}' health status: ${status}`);
@@ -85904,30 +85978,36 @@ async function waitForContainerHealthy(containerId, displayName) {
 			if (status === "unhealthy") throw new EcsTaskRunnerError(`Container '${displayName}' health status is 'unhealthy'; aborting before dependents start.`);
 		} catch (err) {
 			if (err instanceof EcsTaskRunnerError) throw err;
-			logger.debug(`docker inspect on '${displayName}' failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`docker inspect on '${displayName}' failed: ${describeDockerFailure(err, inspectArgs)}`);
 		}
 		await sleep(1e3);
 	}
 	throw new EcsTaskRunnerError(`Container '${displayName}' did not become healthy within 5 minutes.`);
 }
 async function waitForContainerExit(containerId) {
+	const waitArgs = ["wait", containerId];
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$1(getDockerCmd(), waitArgs, { maxBuffer: 1024 * 1024 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
-		const e = err;
-		throw new DockerRunnerError(`docker wait failed: ${e.stderr?.trim() || e.message || String(err)}`);
+		throw new DockerRunnerError(`docker wait failed: ${describeDockerFailure(err, waitArgs)}`);
 	}
 }
+/** Seconds `cleanupEcsRun` gives a container to stop before `docker rm -f`. */
+const CLEANUP_STOP_GRACE_SECONDS = 10;
+/** The exact `docker stop` argv, so callers redact with the argv actually spawned. */
+function dockerStopArgs(containerId, graceSeconds) {
+	return [
+		"stop",
+		"-t",
+		String(graceSeconds),
+		containerId
+	];
+}
 async function stopContainer(containerId, graceSeconds) {
 	try {
-		await execFileAsync$1(getDockerCmd(), [
-			"stop",
-			"-t",
-			String(graceSeconds),
-			containerId
-		]);
+		await execFileAsync$1(getDockerCmd(), dockerStopArgs(containerId, graceSeconds));
 	} catch {}
 }
 function sleep(ms) {
@@ -86009,17 +86089,19 @@ async function prepareOneImage(task, container, options) {
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? (asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0)}): ${stderr}`)
 			});
-			if (actualTag !== tag) try {
-				await runDockerStreaming([
+			if (actualTag !== tag) {
+				const tagArgs = [
 					"tag",
 					actualTag,
 					tag
-				]);
-			} catch (err) {
-				const e = err;
-				throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${actualTag}' → '${tag}' for ECS container '${container.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+				];
+				try {
+					await runDockerStreaming(tagArgs);
+				} catch (err) {
+					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${actualTag}' → '${tag}' for ECS container '${container.name}': ${describeDockerFailure(err, tagArgs)}`);
+				}
 			}
 			return tag;
 		}
@@ -86051,8 +86133,7 @@ async function realizeDockerVolumes(volumes, state) {
 			state.dockerVolumeNames.push(dockerVolumeName);
 			logger.debug(`Created docker volume ${dockerVolumeName} for task volume '${v.name}'`);
 		} catch (err) {
-			const e = err;
-			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${describeDockerFailure(err, args)}`);
 		}
 		out.set(v.name, {
 			...v,
@@ -86778,40 +86859,37 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 	const logger = getLogger();
 	const dockerCmd = getDockerCmd();
 	let workdir;
+	const inspectArgs = [
+		"inspect",
+		"--format",
+		"{{.Config.WorkingDir}}",
+		containerId
+	];
 	try {
-		const { stdout } = await execFileAsync(dockerCmd, [
-			"inspect",
-			"--format",
-			"{{.Config.WorkingDir}}",
-			containerId
-		]);
+		const { stdout } = await execFileAsync(dockerCmd, inspectArgs);
 		workdir = stdout.trim() || "/";
 	} catch (err) {
-		throw new CdkdError(`softReloadAgentContainer: docker inspect of container '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_INSPECT_FAILED");
+		throw new CdkdError(`softReloadAgentContainer: docker inspect of container '${containerId}' failed: ${describeDockerExecFailure(err, inspectArgs)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_INSPECT_FAILED");
 	}
 	const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 	logger.info(`Soft-reload: docker cp ${newAssetSourceDir} -> ${containerId}:${workdirDest}; restart.`);
+	const cpArgs = [
+		"cp",
+		`${newAssetSourceDir}/.`,
+		`${containerId}:${workdirDest}`
+	];
 	try {
-		await execFileAsync(dockerCmd, [
-			"cp",
-			`${newAssetSourceDir}/.`,
-			`${containerId}:${workdirDest}`
-		], { maxBuffer: 64 * 1024 * 1024 });
+		await execFileAsync(dockerCmd, cpArgs, { maxBuffer: 64 * 1024 * 1024 });
 	} catch (err) {
-		throw new CdkdError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
+		throw new CdkdError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeDockerExecFailure(err, cpArgs)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
+	const restartArgs = ["restart", containerId];
 	try {
-		await execFileAsync(dockerCmd, ["restart", containerId]);
+		await execFileAsync(dockerCmd, restartArgs);
 	} catch (err) {
-		throw new CdkdError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeExecError(err)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
+		throw new CdkdError(`softReloadAgentContainer: docker restart of '${containerId}' failed: ${describeDockerExecFailure(err, restartArgs)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_RESTART_FAILED");
 	}
 }
-function describeExecError(err) {
-	if (!(err instanceof Error)) return String(err);
-	const stderr = err.stderr;
-	const stderrText = typeof stderr === "string" ? stderr.trim() : stderr instanceof Buffer ? stderr.toString("utf8").trim() : "";
-	return stderrText ? `${err.message}\n${stderrText}` : err.message;
-}
 /**
 * Build the per-firing classifier context for the agent container. Mirrors the
 * ECS service emulator's `loadAssetContextForTarget` shape: returns `undefined`
@@ -88049,6 +88127,123 @@ function createLocalStartAgentCoreCommand$1() {
 //#endregion
 //#region src/cli/commands/local-start-alb.ts
 /**
+* Every distinct Lambda logical id a resolved front-door plan forwards to,
+* sorted so the warning text is deterministic.
+*
+* Walks BOTH action slots — a listener's `defaultAction` and each of its
+* rules' `action` — because either one can carry a `TargetType: lambda`
+* target group and an ALB that reaches a Lambda only through a
+* `path-pattern` rule is the common shape (`/api/*` to a Lambda, everything
+* else to the ECS service). Mirrors cdk-local's own `collectAlbLambdaTargets`
+* walk, one layer later: this reads the QUALIFIED plan the strategy returns,
+* where a Lambda target already carries its resolved `lambda.logicalId`.
+*/
+function collectLambdaTargetLogicalIds(frontDoor) {
+	if (!frontDoor) return [];
+	const ids = /* @__PURE__ */ new Set();
+	const fromAction = (action) => {
+		if (action?.kind !== "forward") return;
+		for (const target of action.targets) if (target.kind === "lambda") ids.add(target.lambda.logicalId);
+	};
+	for (const listener of frontDoor.listeners) {
+		fromAction(listener.defaultAction);
+		for (const rule of listener.rules) fromAction(rule.action);
+	}
+	return [...ids].sort();
+}
+/**
+* Wrap an ALB {@link EmulatorStrategy} so that, under `--from-state`, a plan
+* carrying a `TargetType: lambda` target group emits a WARNING naming the
+* affected Lambdas — because the flag does not reach their container
+* environment.
+*
+* ## Why a warning and not a refusal
+*
+* `cdkd local start-cloudfront` REFUSES cdkd's state flags outright
+* ([#2528](https://github.com/go-to-k/cdkd/issues/2528)) because NO consumer on
+* that command's path reads a host-registered state source. `start-alb` is
+* partial, not total, so the same remedy would delete a working capability:
+*
+* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` /
+*   `rollOneTarget` (`cdk-local@0.147.7`, `dist/local-studio-BBtUAVNy.js`
+*   `:26474` / `:26422`) hand `createLocalStateProvider` the FULL options bag,
+*   so cdkd's `fromState` factory is selected and the task containers'
+*   images / env / secrets / volumes resolve against S3 state.
+* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv` (`:26614`)
+*   rebuilds the bag it hands the shared `resolveLambdaContainerEnv` as a
+*   SIX-KEY allow-list — `fromCfnStack` / `assumeRole` / `region` / `profile` /
+*   `stackRegion` / `envVars` (`:26619-26626`) — dropping `fromState` /
+*   `stateBucket` / `statePrefix`. It forwards `extraStateProviders` faithfully,
+*   but the dispatcher activates an extra provider only when `options[key]` is
+*   truthy (`:4894`), and the key it looks for is exactly the one the bag no
+*   longer carries. So cdkd's factory is registered and never selected, and the
+*   Lambda boots with its intrinsics dropped — one WARN per variable, none of
+*   which says the flag was the problem.
+*
+* The fix is upstream (two arguments in `resolveAlbLambdaTargetEnv`); until it
+* lands, this makes the partiality LOUD at boot instead of leaving the user to
+* read "Environment variable X contains a CloudFormation intrinsic and was
+* dropped" as a state problem. `--from-cfn-stack` survives the allow-list and
+* therefore reaches both target kinds, which is what the message points at.
+*
+* ## Mechanics
+*
+* `runEcsServiceEmulator` logs every string in the `warnings` array
+* `strategy.resolveBoots` returns, so appending to it is the whole wiring — no
+* second synth, since the front-door plan is already resolved. Returns the
+* strategy UNCHANGED when `--from-state` is absent, so the non-state path
+* carries no wrapper at all.
+*
+* The warning REPEATS on every `--watch` reload, because `resolveBoots` is
+* re-run per reload (`:26264`) and its warnings re-logged. That matches how
+* cdk-local's own ALB resolution warnings behave on the same path, which is
+* the whole reason: repeating is what the surrounding output already does.
+* It is NOT because a reload could introduce a new Lambda target — the reload
+* discards `frontDoor` and `buildFrontDoor` runs only at boot (`:26110`), so
+* a Lambda added mid-`--watch` is never stood up at all. An earlier revision
+* of this comment argued the second, false thing.
+*/
+function warnUnresolvedLambdaTargetEnv(strategy, options) {
+	if (options.fromState !== true) return strategy;
+	return {
+		...strategy,
+		resolveBoots: (stacks, chosenTargets) => {
+			const resolved = strategy.resolveBoots(stacks, chosenTargets);
+			const lambdaIds = collectLambdaTargetLogicalIds(resolved.frontDoor);
+			if (lambdaIds.length === 0) return resolved;
+			const ecsNote = resolved.boots.length > 0 ? "The ECS service targets behind this ALB DO honor --from-state. " : "";
+			return {
+				...resolved,
+				warnings: [...resolved.warnings, `--from-state does not reach the container environment of this ALB's Lambda target group(s): ${lambdaIds.join(", ")}. Their Environment.Variables keep any Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue intrinsics unresolved, and each is then dropped with its own warning. ` + ecsNote + "The only state source the Lambda path reads is --from-cfn-stack <name>, which REPLACES --from-state (the two are mutually exclusive) and reaches both target kinds on a CloudFormation-deployed stack; otherwise override the affected variables with --env-vars. Tracked as go-to-k/cdkd#2602 (upstream go-to-k/cdk-local#707)."]
+			};
+		}
+	};
+}
+/**
+* The `EmulatorStrategy` `cdkd local start-alb` runs with: cdk-local's ALB
+* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv}.
+*
+* Extracted from the command's action for ONE reason, and it is the finding
+* that produced it: with the composition written inline in the `.action(...)`
+* closure, deleting the decorator at its only wiring point left the entire
+* unit suite green (measured in review — 29/29). The decorator's own cases
+* exercise it directly, so they cannot see a call site that stopped calling
+* it. A named export gives that seam a subject a test can hold.
+*
+* The seam is fenced BEHAVIOURALLY, in
+* `tests/unit/cli/local-start-alb-wiring.test.ts`, which runs the real command
+* and drives whatever object the action hands the engine. A source-shape
+* assertion was tried first and defeated in review round 3 by hoisting
+* `albStrategy(options)` into a local one statement up: its positive half was
+* satisfied by the mutation's own COMMENT and its negative half could not
+* cross the `)` the hoist introduced. That case is deleted rather than
+* tightened — the behavioural one catches strictly more, and a fence a comment
+* can satisfy reads as coverage while providing none.
+*/
+function buildAlbEmulatorStrategy(options) {
+	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
+}
+/**
 * `cdkl start-alb <Stack/Alb>` — Issue #86 v1. Names an
 * `AWS::ElasticLoadBalancingV2::LoadBalancer`, discovers the ECS service(s)
 * behind its HTTP `forward` listeners, boots their replicas, and stands up a
@@ -88056,8 +88251,8 @@ function createLocalStartAgentCoreCommand$1() {
 * The symmetric ALB counterpart of `start-api`.
 */
 function createLocalStartAlbCommand() {
-	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token <jwt> to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, albStrategy(options), cdkdExtraStateProviders);
+	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token <jwt> to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Does NOT reach a Lambda target group's container environment (upstream go-to-k/cdk-local#707; a boot warning names the affected functions) — use --from-cfn-stack for those. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
+		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders);
 	}));
 	addAlbSpecificOptions(cmd);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
@@ -89128,4 +89323,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BuZzDR4s.js.map
+//# sourceMappingURL=program-dEYAo80R.js.map