@go-to-k/cdkd 0.286.3 → 0.286.4

package/dist/{deploy-engine--rkIGhow.js → deploy-engine-DylsbAdu.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-D3md0Lde.js";
+import { t as getCdkdVersion } from "./version-CKOnsgg1.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6085,6 +6085,49 @@ var FileAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/regexp.ts
+/**
+* Escape a literal string for embedding in a RegExp.
+*
+* Lives here because the same four-line helper was spelled THREE times — in
+* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
+* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
+* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
+* label) into a pattern. Copies of a security-shaped helper are exactly the
+* shape that drifts: the escaped set is what stops a `.` in an interpolated
+* literal matching ANY character, and in `gc.ts` a widened match decides which
+* live assets are treated as referenced.
+*
+* The character set is the union every JS engine treats as special in a
+* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
+* character class, and no caller embeds into one.
+*/
+function escapeRegExp$1(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Remove control characters from a value about to be PRINTED.
+*
+* Lives beside {@link escapeRegExp} for the reason that helper's own note
+* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
+* in `src/deployment/outputs-export-alias.ts` — and copies of a
+* security-shaped helper drift. Both print the same class of string: a
+* resolved CloudFormation Output / `Export.Name`, which passed no CFn
+* validator, so it can carry ANSI escapes or bidi overrides straight into a
+* terminal or a CI log.
+*
+* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
+* only: a `--json` payload is a machine interface where an export name is data
+* a consumer may match on, and mutating it there trades a correctness
+* regression for a display concern (see `stripDisplayOnlyChars`, which is the
+* narrower guard for an already-serialized payload and stays local to its
+* caller because its C0 exclusion is specific to that path).
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+
 //#endregion
 //#region src/utils/docker-cmd.ts
 /**
@@ -6503,6 +6546,21 @@ const REDACTED_ARGV_VALUE = "***";
 * - `--opt` — `DockerVolumeConfiguration.DriverOpts`, which for the `local`
 *   driver carries mount options (`o=addr=…,username=…,password=…`).
 * - `--label` — `DockerVolumeConfiguration.Labels`, user-authored metadata.
+* - `--build-arg` — a `DockerImageAsset`'s `buildArgs`, forwarded by
+*   `src/assets/docker-build.ts` on BOTH the deploy-time ECR publish path and
+*   `cdkd local run-task`'s image build
+*   ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). The value is
+*   frequently NOT a secret and IS diagnostic (a version pin, a base-image
+*   tag), which is why this one needed arguing rather than assuming — the
+*   argument that settles it is RECOVERABILITY, not likelihood. The build-arg
+*   values sit unredacted in `cdk.out/*.assets.json` on the operator's own
+*   disk, so a masked `--verbose` line costs one `jq` against a file they
+*   already have; the log line is the copy that travels into a CI archive and
+*   a pasted issue, where a build-time registry / package token
+*   (`NPM_TOKEN`, `GITHUB_TOKEN` — a common, if discouraged, use of
+*   `buildArgs`) is disclosed irreversibly. The KEY survives, so "which build
+*   arg" — the half of the diagnostic that identifies the failure — is
+*   unaffected.
 *
 * A flag NOT in this list keeps its value. For most of the argv that is
 * because the value is cdkd-authored or infrastructure-shaped — a container
@@ -6518,33 +6576,348 @@ const REDACTED_ARGV_VALUE = "***";
 * `Environment` / `Secrets` / `DriverOpts`. Revisit per flag if a real leak is
 * found through one; do not widen the set on suspicion, since every addition
 * trades away diagnostic text.
+*
+* Two `docker build` flags were considered WITH `--build-arg` and deliberately
+* left out, because both carry a LOCATOR rather than a value
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)):
+*
+* - `--secret id=<id>,src=<path>` (or `,env=<NAME>`) — BuildKit resolves the
+*   material itself at build time and docker has NO inline-value syntax, so
+*   cdkd never holds the secret to leak. Masking would also blank the `id`,
+*   since the mask keys on the first `=` and `id` is what sits there — trading
+*   the whole diagnostic ("which secret, sourced from where") for a path.
+* - `--build-context <name>=<path|image-ref|git-url>` — a path or a ref, like
+*   the positional image. A URL form CAN embed a credential, but so can the
+*   image ref; masking one of the two would be a guarantee this set does not
+*   make, and neither is a documented place to put one.
+*
+* `--cache-from` / `--cache-to` were in that second bullet for one review
+* round and the security reviewer was right to refuse it: their value is a
+* comma-separated PARAM LIST, and BuildKit's cache backends take real
+* credentials inline there — s3's `access_key_id` / `secret_access_key` /
+* `session_token`, azblob's `secret_access_key`, gha's `token`. Those are not
+* locators, so they get their own structural mask keyed on the PARAM name:
+* {@link ARGV_PARAM_LIST_FLAGS} / {@link ARGV_PARAM_LIST_LOCATOR_PARAMS}.
 */
 const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
 	"-e",
 	"--env",
 	"--opt",
-	"--label"
+	"--label",
+	"--build-arg"
+]);
+/**
+* `docker` argv flags whose NEXT token is a COMMA-SEPARATED `key=value` param
+* list rather than one `KEY=VALUE` pair ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* security review).
+*
+* Only the params in {@link ARGV_PARAM_LIST_LOCATOR_PARAMS} survive, and the
+* rest of the list is masked — `type=s3,region=us-east-1,bucket=b` IS the
+* diagnostic ("which backend, where"), and blanking the whole value would
+* destroy it to hide one field.
+*/
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+/**
+* Param names inside an {@link ARGV_PARAM_LIST_FLAGS} value that are LOCATORS
+* and therefore survive. **Everything else in the list is masked** — this is
+* an ALLOWLIST, and it is one deliberately.
+*
+* The first cut was a denylist of the credential params BuildKit's backends
+* spell (`secret_access_key`, `access_key_id`, `session_token`, `token`), and
+* both round-2 reviewers broke it the same way:
+* `DockerCacheOption.params` is an arbitrary user map that
+* `cacheOptionToFlag` joins with a bare `,` and no quoting, so a value
+* CONTAINING a comma (`token=aa,bb`, or BuildKit's own legal
+* `secret_access_key="ab,cd"`) split into a masked head and a bare tail that
+* printed verbatim — output that LOOKS redacted. Patching that one shape is
+* the enumerate-bad-shapes treadmill; inverting the test ends it, because a
+* CSV continuation fragment has no recognised param name and so masks by
+* construction.
+*
+* The trade is the right way round for a leak fix: a param missing from this
+* list costs one degraded diagnostic, a param missing from a denylist costs a
+* printed credential. The list covers every backend BuildKit ships —
+* `registry` (`ref`), `local` (`dest` / `src` / `digest` / `tag`), `s3`
+* (`region` / `bucket` / `name` / the prefixes / `use_path_style`), `azblob`
+* (`account_name` / `name` / `prefix`), `gha` (`scope` / `timeout`),
+* `inline` (none) — plus the shared export options, so the common case masks
+* nothing.
+*
+* The four URL-valued locators live in {@link ARGV_PARAM_LIST_URL_PARAMS}
+* instead: they survive only after their userinfo and query are stripped. An
+* earlier revision kept them HERE, whole, arguing the repo's locator policy;
+* that paragraph is gone rather than softened, because azblob makes it false.
+*
+* Matched case-INSENSITIVELY on the trimmed param name — the comparison is
+* over a user-supplied key and BuildKit's own option parsing is
+* case-insensitive, so a `Secret_Access_Key` spelling must not walk past.
+*/
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
+]);
+/**
+* Locator params whose value is a URL, and which therefore survive only after
+* their USERINFO, QUERY and FRAGMENT are stripped — and only when the value
+* parses at all
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623) round-3 security
+* review).
+*
+* These were plain allowlist entries for one round, on the reasoning that a
+* credential-in-URL is an incidental hazard shared with `--build-context` and
+* the positional image ref. That reasoning does not survive contact with
+* azblob: BuildKit builds an UNAUTHENTICATED client from `account_url` when
+* `secret_access_key` is absent, so a SAS token in its query string is that
+* backend's SUPPORTED auth path, not an accident. With every other param now
+* fail-closed, leaving the whole URL was the one entry carrying credential
+* material by design.
+*
+* Scheme and host survive, which is what "which endpoint" needs — on the
+* ordinary path. FOUR things mask more than that, and every one of them also
+* masks each param after it in the same value, because they all set `masked`.
+* Three take the value WHOLE: no recognisable `//` authority; a host that is
+* really `user:password` with its `@` cut away; and a later param carrying
+* this URL's severed `@` (the caller's rule, since only it still holds the
+* parts). The fourth is milder in what it keeps, not in what it cascades — a
+* `@` in the PATH costs the host but keeps scheme and tail (`https://h/x@y`
+* -> `https://***@y`). Over-masking is the deliberate direction: see
+* {@link redactUrlLocator} for what each boundary rule leaked before this one.
+*/
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
 ]);
 /**
+* A URL locator with its credential-bearing parts removed: `userinfo@`, and
+* everything from `?` or `#` on.
+*
+* Returns the input UNCHANGED when there was nothing to strip, which is the
+* signal the caller keys "was this masked?" on — so every other branch must
+* differ from its input. An unparseable or implausible value returns `***`
+* rather than itself: these four params are the only ones exempt from the
+* allowlist's mask-by-default rule, so this function is their whole
+* protection and it fails CLOSED.
+*/
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+/**
+* The masked rendering of `value` for `flag`, or `undefined` when this flag
+* carries nothing to mask.
+*
+* The single place every argv spelling converges — `--flag VALUE` (two
+* tokens), `--flag=VALUE` (one), and pflag's shorthand cluster in both forms,
+* which reach it through {@link maskAttachedShortFlag} and through
+* {@link trailingShortFlagOfCluster} in {@link redactDockerArgvValues}.
+*
+* The joined form is valid docker syntax for every long flag here, and it was
+* UNMASKED until the [#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* review: harmless while every argv this repo builds emits two tokens, but
+* `src/assets/docker-build.ts`'s `executable` source mode renders a
+* USER-AUTHORED command line, and a wrapper script spelling
+* `--build-arg=NPM_TOKEN=…` leaked it verbatim into both the `--verbose` log
+* and a thrown error.
+*/
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+/**
+* The masked rendering of an ATTACHED short-flag element (`-eKEY=VALUE`), or
+* `undefined` when this element is not one.
+*
+* pflag — which docker uses — accepts a short flag's value glued to it, so
+* `-eNPM_TOKEN=secret` is `-e NPM_TOKEN=secret`, and neither the two-token nor
+* the `--flag=VALUE` branch can see it ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* round-2 security review). No argv this repo BUILDS uses the form, but
+* `src/assets/docker-build.ts`'s `executable` source mode hands a user's own
+* command line straight to `spawn`, which is the whole reason the joined form
+* is masked too.
+*
+* This OVER-MASKS relative to pflag, and the earlier claim that it "follows
+* docker's own parse" was wrong: pflag stops at the first cluster letter that
+* consumes a value, so it reads `-file=a=b` as `-f` taking `ile=a=b` while
+* this masks at the `e`. Every such divergence costs a diagnostic and hides
+* nothing that was not already a `KEY=VALUE` pair, so the direction is the
+* safe one — but it is a divergence, not parity.
+*/
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+/**
+* The value-bearing short flag a shorthand CLUSTER ENDS in, if any — the form
+* that takes its value from the NEXT argv element.
+*
+* pflag's `parseSingleShortArg` falls through to `value = args[0]` when the
+* cluster runs out, so `-itde K=v` is `-i -t -d -e K=v` with the value in a
+* separate token. {@link maskAttachedShortFlag} bails on a flag letter in last
+* position (there is nothing attached to mask) and the two-token branch looked
+* `-itde` up as a whole flag and missed, so this spelling printed verbatim
+* until [#2623](https://github.com/go-to-k/cdkd/issues/2623)'s round-4 review
+* measured it. Pass 2 cannot rescue it either: its alternation needs a
+* whitespace-preceded `-e`.
+*/
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+/**
 * Structural, whitespace-delimited form of {@link ARGV_VALUE_BEARING_FLAGS}
 * for scanning a STRING that embeds a space-joined argv. Keyed on the FLAG's
 * position — never on the secret's value, so an unrelated literal that merely
 * coincides with a value is left alone.
 *
+* Covers the SEPARATED and JOINED spellings of
+* {@link ARGV_VALUE_BEARING_FLAGS} only. Two gaps, recorded rather than
+* implied. pflag's shorthand cluster is not modelled here in EITHER form —
+* attached (`-eKEY=VALUE` / `-itdeKEY=VALUE`) or separated (`-itde KEY=VALUE`,
+* which this pass's alternation cannot see because it needs a
+* whitespace-preceded `-e`) — this pass has no argv to resolve
+* the cluster against, and a bare `-e` prefix scan over free text would fire
+* on any word starting with `-e`; {@link redactDockerArgvValues} and passes 1
+* / 1b handle it wherever an argv IS available, which is every composer. And
+* {@link ARGV_PARAM_LIST_FLAGS}
+* is deliberately absent: this pass runs with NO argv to key on, and picking a
+* param name out of a free-text comma list is where a structural match stops
+* being structural. The param mask therefore rides passes 1 and 1b, both of
+* which derive from {@link redactDockerArgvValues} and so have the real argv —
+* i.e. a cache credential is masked in every text composed through a composer,
+* and not in a bare text handed to {@link redactDockerArgvInText} with no
+* `args`. Recorded rather than implied.
+*
+* DERIVED from the Set rather than re-spelled beside it
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). Until then this was
+* a hand-written literal listing the same four flags, i.e. the shape where
+* adding a flag to one spelling and not the other masks it on the argv pass
+* and leaks it on the text pass — a divergence no behavioural test of either
+* one can see. Deriving is stronger than fencing the pair: there is nothing
+* left to diverge.
+*
 * What each piece actually buys, since one of them was mis-credited in review:
 * the `(^|\s)` lead is what stops `-e` matching inside `--env` (there is no
 * `m` flag, so `^` is start-of-INPUT), NOT the alternation order — reordering
 * the branches leaves every test green. The order is kept as belt and braces
-* only. The mandatory `\s+` after the flag IS load-bearing: it is what stops
-* `-easy` / `--environment` matching. The KEY is `[^\s=]*` rather than `+` so
-* an EMPTY key (`-e =value`) is masked too.
-*/
-const ARGV_VALUE_TOKEN_RE = /(^|\s)(--env|--label|--opt|-e)(\s+)([^\s=]*)=\S*/g;
+* only, which is why the derivation sorts longest-first. The separator group
+* IS load-bearing: `\s+` is what stops `-easy` / `--environment` matching, and
+* the `=` alternative is the joined `--build-arg=KEY=VALUE` spelling
+* {@link maskArgvFlagValue} handles on the argv side (the group can never be
+* empty, so `--build-argument=X=y` still cannot match). The KEY is `[^\s=]*`
+* rather than `+` so an EMPTY key (`-e =value`) is masked too.
+*
+* The alternation is asserted NON-EMPTY at construction. An empty
+* {@link ARGV_VALUE_BEARING_FLAGS} would collapse it to `(^|\s)()(\s+|=)…`,
+* which masks EVERY whitespace-preceded `k=v` in any docker text — a
+* fail-OPEN that destroys the diagnostic wholesale, and the one failure mode
+* deriving from the Set introduced.
+*/
+const ARGV_VALUE_TOKEN_RE = (() => {
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$1).join("|");
+	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
+	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
+})();
 /**
 * Return a copy of `args` with the VALUE of every
-* {@link ARGV_VALUE_BEARING_FLAGS} pair replaced by `***`. The KEY survives —
-* "which variable" is the diagnostic, "what it was set to" is the disclosure.
-*
+* {@link ARGV_VALUE_BEARING_FLAGS} pair replaced by `***`, and the credential
+* PARAMS of every {@link ARGV_PARAM_LIST_FLAGS} value replaced likewise. The
+* KEY survives — "which variable" is the diagnostic, "what it was set to" is
+* the disclosure.
+*
+* All FOUR argv spellings are handled: `--flag VALUE` (two tokens, what every
+* argv this repo builds emits), `--flag=VALUE`, and pflag's shorthand cluster
+* in both its forms — attached (`-itdeKEY=VALUE`) and separated
+* (`-itde KEY=VALUE`, where the cluster ends in the flag letter and pflag
+* takes the NEXT token). The last three are handled because a user's own
+* build script may spell them
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)).
 * A value-less `-e KEY` (the form {@link partitionSensitiveEnv} emits for a
 * sensitive key) has nothing to mask and is returned unchanged. `args` is
 * never mutated: the redacted copy is for DISPLAY only, never for `spawn`.
@@ -6553,11 +6926,24 @@ function redactDockerArgvValues(args) {
 	const out = [];
 	for (let i = 0; i < args.length; i++) {
 		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
 		const next = args[i + 1];
-		if (ARGV_VALUE_BEARING_FLAGS.has(cur) && typeof next === "string") {
-			const eqIdx = next.indexOf("=");
-			if (eqIdx >= 0) {
-				out.push(cur, `${next.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}`);
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
 				i++;
 				continue;
 			}
@@ -6881,32 +7267,39 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${source.executable.join(" ")} (cwd=${cwd})`);
+		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
+		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
 		try {
 			result = await spawnStreaming(cmd, args, { cwd });
 		} catch (err) {
-			const e = err;
-			throw options.wrapError(e.stderr || e.message || String(err));
+			throw options.wrapError(describeDockerFailure(err, args));
 		}
 		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${cmd} ${args.join(" ")}`);
+		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${shownExecutable}`);
 		return tag;
 	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
+	if (!source.directory) {
+		const carriesAValue = (v) => {
+			if (v === void 0 || v === null || v === "") return false;
+			if (typeof v !== "object") return true;
+			return (Array.isArray(v) ? v.length : Object.keys(v).length) > 0;
+		};
+		const present = Object.keys(source).filter((k) => carriesAValue(source[k])).map((k) => displaySafe(k, { asciiOnly: true })).filter((k) => k !== "").sort().join(", ") || "<no fields set>";
+		throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${present})`);
+	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = `${cdkOutDir}/${source.directory}`;
 	buildArgs.push(".");
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${contextDir})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
 			env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" }
 		});
 	} catch (err) {
-		const e = err;
-		throw options.wrapError(e.stderr || e.message || String(err));
+		throw options.wrapError(describeDockerFailure(err, buildArgs));
 	}
 	return options.tag;
 }
@@ -7074,8 +7467,9 @@ var DockerAssetPublisher = class {
 	}
 	/**
 	* Build Docker image — delegates to the shared `buildDockerImage`
-	* helper so this code path stays in sync with `cdkd local invoke`'s
-	* container-Lambda build path. `--platform` is read from the asset
+	* helper so this code path stays in sync with `cdkd local run-task`'s
+	* `ContainerImage.fromAsset` build path (the other caller; `cdkd local
+	* invoke` moved to `cdk-local`'s own builder). `--platform` is read from the asset
 	* manifest's `source.platform` (when set); cdkd does not currently
 	* inject a publish-side override.
 	*
@@ -7159,33 +7553,33 @@ var DockerAssetPublisher = class {
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
 		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+		const loginArgs = [
+			"login",
+			"--username",
+			username,
+			"--password-stdin",
+			endpoint
+		];
 		try {
-			await runDockerStreaming([
-				"login",
-				"--username",
-				username,
-				"--password-stdin",
-				endpoint
-			], { input: password });
+			await runDockerStreaming(loginArgs, { input: password });
 			loggedInRegistries.add(registryKey);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
 		}
 	}
 	/**
 	* Tag Docker image
 	*/
 	async tagImage(source, target) {
+		const tagArgs = [
+			"tag",
+			source,
+			target
+		];
 		try {
-			await runDockerStreaming([
-				"tag",
-				source,
-				target
-			]);
+			await runDockerStreaming(tagArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker tag failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`);
 		}
 	}
 	/**
@@ -7195,11 +7589,11 @@ var DockerAssetPublisher = class {
 	*/
 	async pushImage(uri) {
 		this.logger.debug(`Pushing: ${uri}`);
+		const pushArgs = ["push", uri];
 		try {
-			await runDockerStreaming(["push", uri]);
+			await runDockerStreaming(pushArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker push failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`);
 		}
 	}
 	/**
@@ -7937,49 +8331,6 @@ var AssetModeResolver = class {
 	}
 };
 
-//#endregion
-//#region src/utils/regexp.ts
-/**
-* Escape a literal string for embedding in a RegExp.
-*
-* Lives here because the same four-line helper was spelled THREE times — in
-* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
-* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
-* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
-* label) into a pattern. Copies of a security-shaped helper are exactly the
-* shape that drifts: the escaped set is what stops a `.` in an interpolated
-* literal matching ANY character, and in `gc.ts` a widened match decides which
-* live assets are treated as referenced.
-*
-* The character set is the union every JS engine treats as special in a
-* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
-* character class, and no caller embeds into one.
-*/
-function escapeRegExp$1(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
-* Remove control characters from a value about to be PRINTED.
-*
-* Lives beside {@link escapeRegExp} for the reason that helper's own note
-* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
-* in `src/deployment/outputs-export-alias.ts` — and copies of a
-* security-shaped helper drift. Both print the same class of string: a
-* resolved CloudFormation Output / `Export.Name`, which passed no CFn
-* validator, so it can carry ANSI escapes or bidi overrides straight into a
-* terminal or a CI log.
-*
-* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
-* only: a `--json` payload is a machine interface where an export name is data
-* a consumer may match on, and mutating it there trades a correctness
-* regression for a display concern (see `stripDisplayOnlyChars`, which is the
-* narrower guard for an already-serialized payload and stays local to its
-* caller because its C0 exclusion is specific to that path).
-*/
-function stripControlChars(value) {
-	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
-}
-
 //#endregion
 //#region src/assets/asset-redirect.ts
 /**
@@ -8861,6 +9212,16 @@ function formatRemaining(ms) {
 	if (minutes < 1) return "in under a minute";
 	return `in ~${minutes}m`;
 }
+/**
+* Quote a value for a pasteable shell command.
+*
+* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
+* prints `aws <service> ...` recovery commands naming a resource's physical id,
+* which is the same hazard one directory over. A second spelling of this
+* predicate is how the two would come to disagree about which values need
+* quoting -- the reason `display-safe.ts`'s header gives for not widening a
+* rule by hand. It is a pure function of its argument and imports nothing.
+*/
 function shellQuote(value) {
 	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -8880,6 +9241,18 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	return parts.join(" ");
 }
 /**
+* What to say INSTEAD of a `cdkd force-unlock ...` line when
+* {@link buildForceUnlockCommand} suppresses.
+*
+* Exported since issue [#2610]: `lock-manager.ts`'s exhausted-retry arm needed
+* the same branch, and it was the THIRD place to spell it. The module header's
+* point applies to the suppression sentence as much as to the command -- a
+* banner ending in a bare `run: ` is the shape the review found, and copies are
+* how the next one drifts. Byte-identical to what `forceQuitRecoveryClause`
+* emitted before the extraction; its callers see no change.
+*/
+const UNREPRODUCIBLE_LOCK_CLAUSE = "Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+/**
 * The force-quit banner's recovery sentence.
 *
 * Exported so the two `destroy-runner.ts` banners do not each decide what to
@@ -8890,7 +9263,7 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 */
 function forceQuitRecoveryClause(stackName, region, recovery) {
 	const command = buildForceUnlockCommand(stackName, region, recovery);
-	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+	return command ? ` If the next run reports a lock, run: ${command}` : ` ${UNREPRODUCIBLE_LOCK_CLAUSE}`;
 }
 /**
 * Build the contention message, reading the holder's identity best-effort.
@@ -10138,7 +10511,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}): ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10362,8 +10735,11 @@ var LockManager = class {
 	/**
 	* Force release a lock regardless of owner or expiry status
 	*
-	* This is intended for CLI usage (e.g., --force-unlock flag) when a lock
-	* is stuck and needs manual intervention.
+	* This is intended for CLI usage -- it is what the `cdkd force-unlock
+	* <stack>` SUBCOMMAND calls -- when a lock is stuck and needs manual
+	* intervention. There is no `--force-unlock` FLAG anywhere in `src/`; this
+	* comment said there was, and issue [#2610] site 14 records that the message
+	* `acquireLockWithRetry` used to raise had inherited the same mistake.
 	*
 	* Pass `region: undefined` to operate on a legacy
 	* `{prefix}/{stackName}/lock.json` file.
@@ -10706,7 +11082,7 @@ var LockManager = class {
 			if (lockInfo) {
 				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${stackName}' (${region}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -10714,7 +11090,9 @@ var LockManager = class {
 		}
 		const lockInfo = await this.getLockInfo(stackName, region);
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
-		throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. Use --force-unlock to manually release the lock.` : "Lock exists but could not read lock info."));
+		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
+		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
+		throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 
@@ -11468,7 +11846,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 * matters: an AWS resource type string is fixed by AWS, and a typo in either
 * copy makes that copy's gate simply never fire (no-op), never fire wrongly.
 */
-const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
 /**
 * What a PARENT stack's resolution proved about each `Parameters` entry of an
 * `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
@@ -11575,7 +11953,7 @@ const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 *    `secret-redaction-nested-parameter-source.test.ts`.
 */
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$1) return;
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$2) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
@@ -16753,9 +17131,28 @@ function secretsManagerSecretId(inner) {
 *  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
 *    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
 *    a different thing in the refusal message than the one that would be read.
+*
+* A COLON-LESS body (`{{resolve:ssm}}` / `{{resolve:ssm-secure}}`) names no
+* parameter at all, and the empty string is what says so: the caller reads a
+* falsy name as `local`, which hands the reference on to the resolver's own
+* `PARAMETER_NAME is required` — thrown BEFORE any client is built, so no
+* `GetParameter` is ever issued for such a token. Without the guard
+* `indexOf(':')` is `-1` and `substring(0)` returns the SERVICE STRING as the
+* parameter name, so with a foreign producer region on record the same
+* malformed input drew the ambiguous-region refusal naming `'ssm-secure'` as
+* the secret. {@link secretsManagerSecretId} already answers `''` for its own
+* nameless body (a fixed-length `substring` past the end of the string), and a
+* sibling that answers something else is the kind of split a later reader has
+* to rediscover.
+*
+* The colon-less relaxation has a CONSUMER-VISIBLE consequence on a mixed
+* leaf, and it is recorded on {@link classifyReplaySecretRegion} rather than
+* here: this function produces a NAME, and the delta belongs beside the
+* VERDICT a reader arrives at it through.
 */
 function ssmParameterName(inner) {
-	return inner.substring(inner.indexOf(":") + 1);
+	const serviceEnd = inner.indexOf(":");
+	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
 }
 /**
 * The region an ARN names, or `undefined` for anything that is not an ARN with
@@ -16893,6 +17290,101 @@ function producerRegionsFromState(state) {
 * A same-region ARN answers `local` even when a foreign producer region IS on
 * record: the expression settles the question itself, so the weaker evidence
 * never gets consulted.
+*
+* ---
+*
+* WHO CONSUMES THIS VERDICT, and what the issue #2501 colon-less fix changed
+* for them. Recorded here because a reader arrives at the blast radius through
+* the verdict, not through {@link ssmParameterName}, which merely produces a
+* name.
+*
+* Three LEAF PRE-PASSES consume it — `rollback-executor.ts`'s
+* `resolveLeafByRegion`, `cdkd drift`'s `resolveDriftLeafByRegion` and `cdkd
+* scrub`'s — and each refuses the WHOLE leaf as soon as ONE token classifies
+* `ambiguous`, before any token is fetched. There is a FOURTH consumer, and it
+* is not a pre-pass: `resolveDynamicReferences` classifies token-by-token
+* INSIDE its substitution loop, so it already fetches earlier tokens before
+* refusing a later one. That is why the pre-fetch refusal was never a designed
+* property of this verdict.
+*
+* Before the fix, a colon-less `{{resolve:ssm-secure}}` produced the SERVICE
+* STRING as its name, so with a foreign producer region on record it drew an
+* `ambiguous` verdict and the pre-pass refused the whole leaf: for
+* `local=<same-region ARN>;secure={{resolve:ssm-secure}}`, nothing was
+* resolved. It now answers `local`, so the leaf IS resolved — by the primary
+* resolver when every other token is `local`, or through the segment-rebuild
+* path when one is `named-region` — and the ARN sibling's plaintext is fetched
+* and cached before the degenerate token throws `PARAMETER_NAME is required`.
+* Pinned by `rollback-executor-cross-region-secret.test.ts`'s "the MIXED-leaf
+* delta the colon-less guard accepts", so the trade is visible rather than
+* argued.
+*
+* Accepted on three grounds, the third being a LIMIT rather than a
+* reassurance:
+*
+*  1. The lost refusal was an ACCIDENT of the mis-parse, not a designed
+*     protection: with no foreign producer region on record — the
+*     overwhelmingly common case — the colon-less token classified `local`
+*     before the fix too, so the same sibling was already fetched.
+*  2. The sibling is fetched from the region its OWN verdict names, never a
+*     guessed one (a name-form sibling would itself be `ambiguous` and the
+*     pre-pass would still refuse), so nothing here weakens the issue #1957
+*     rule this module exists to enforce. Nothing fetched reaches a DURABLE
+*     sink — `state.json`, the rollback journal, the `deployments/` event
+*     store, a `--json` payload — and the reason is NOT "the op throws before
+*     any write", which is false for scrub (see 3: scrub swallows and keeps
+*     writing). It is that both places a fetched plaintext is retained are
+*     IN-PROCESS and neither is copied out: the resolver's own
+*     `cachedDynamicReferences` (instance-scoped since issue #1933, so it dies
+*     with the resolver) and `recordedSecretValues`, which every persist path
+*     consults as a redaction NEEDLE set — an entry there causes a value to be
+*     REPLACED BY its expression on the way out, never inserted.
+*
+*     ON THIS PATH one more needle can only redact more, which is why the
+*     direction is safe even though it fetches more — and the qualifier is
+*     load-bearing rather than hedging. It is NOT a general property of the
+*     needle machinery: `redactSecretsForState`'s own doc (see the
+*     `preferPositionDecisions` ordering note) records that a needle rewriting
+*     a FRAME ANCHOR can un-certify `unkeyedArrayPairsByAnchors`, refuse the
+*     array, and leave a sibling MIXED leaf in plaintext — "a regression of
+*     shipped redaction, in the GHSA disclosure direction". That is reachable
+*     with a NON-EMPTY map on a `STATE_SOURCED_READBACK_RULES` caller, e.g.
+*     `rollback-executor.ts`'s `redactRollbackRecord` ->
+*     `scrubResourceRecord`. It is not what fires here: the case this
+*     paragraph is about records FEWER needles, not more, so nothing new can
+*     rewrite an anchor.
+*  3. WHAT THE OP DOES NEXT IS NOT UNIFORM. The replay fails the op and `cdkd
+*     drift` reports the resource NOT compared — both loud. `cdkd scrub` is
+*     NOT: `isRegionAmbiguousRefusal` re-raises only a
+*     `DynamicReferenceRegionAmbiguousError`, and the resolver's replacement is
+*     a plain `Error`, so scrub swallows it to `debug` and the run reports
+*     clean. A LOUDNESS regression for that one command on this one input,
+*     bounded by the identical silent miss that already happens for the same
+*     leaf whenever no foreign producer region is on record.
+*
+*     Issue [#2692](https://github.com/go-to-k/cdkd/issues/2692) tracks it, and
+*     the remedy is NOT resolver-local. Two candidate fixes are wrong, each in
+*     its own way, and scrub has TWO predicates that must not be confused:
+*     `isRegionAmbiguousRefusal` decides RE-RAISE vs SWALLOW (its three call
+*     sites), while `isByDesignRefusal` — matching
+*     `CrossAccountSecretRefusalError` — decides FINDING vs REFUSE. They point
+*     in opposite directions, so a fix aimed at one must not be argued from
+*     the other's record.
+*
+*      - Throwing `IntrinsicResolutionRefusalError` and widening
+*        `isRegionAmbiguousRefusal` to match the BASE class would make every
+*        user-fixable refusal that class carries RE-RAISE and fail the whole
+*        stack — not the silent-downgrade hazard `isByDesignRefusal`'s doc
+*        records, but the opposite over-refusal, on a class with throw sites
+*        spread across the resolver.
+*      - Throwing the region-ambiguous SUBCLASS is wrong differently: scrub
+*        already re-raises it, but its message tells the user to spell the
+*        reference as a full ARN, which cannot fix a reference naming no
+*        parameter.
+*
+*     So #2692 needs a NEW sibling subclass AND a scrub-side predicate change,
+*     which makes it blocked on `src/cli/commands/scrub.ts` (held by PR
+*     #2562), not merely on the resolver's `integ-broad` cost.
 */
 function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
 	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
@@ -18586,7 +19078,7 @@ function carriesDynamicReference(value) {
 	return false;
 }
 /** The nested-stack resource type, whose `Outputs.<Name>` attributes are re-resolved (issue #2055). */
-const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /** Prefix `NestedStackProvider` records a child stack output under. */
 const NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX = "Outputs.";
 /**
@@ -20077,7 +20569,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -20094,7 +20586,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 			}
 		}
-		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
+		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
@@ -23308,7 +23800,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-uaOnRUMe.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-dBSdt3nB.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25493,7 +25985,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					reuseClientCredentials: true,
 					tolerateNonStandardClient: true,
 					onRebuild: ({ bucketRegion, currentRegion }) => {
-						this.logger.debug(`Custom resource response bucket '${bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); building a region-corrected S3 client for response operations.`);
+						this.logger.debug(`Custom resource response bucket '${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}' is in '${displaySafe(bucketRegion, { asciiOnly: true }) || "<unrenderable>"}' (client was '${displaySafe(currentRegion, { asciiOnly: true }) || "<unrenderable>"}'); building a region-corrected S3 client for response operations.`);
 					}
 				});
 				if (generation !== this.responseClientGeneration) {
@@ -26170,7 +26662,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			Key: responseKey
 		});
 		const presignedUrl = await getSignedUrl(this.s3Client, command, { expiresIn: 7200 });
-		this.logger.debug(`Generated pre-signed URL for response: s3://${this.responseBucket}/${responseKey}`);
+		this.logger.debug(`Generated pre-signed URL for response: s3://${displaySafe(this.responseBucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}`);
 		return presignedUrl;
 	}
 	/**
@@ -26274,7 +26766,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				Key: responseKey
 			}));
 		} catch (error) {
-			this.logger.debug(`Failed to delete custom-resource response object s3://${bucket}/${responseKey}; it remains as a current object. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(error instanceof Error ? error.message : String(error)) || "<unrenderable>"}`);
 		}
 		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
 			logger: this.logger,
@@ -29771,6 +30263,70 @@ function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
 
+//#endregion
+//#region src/deployment/type-change-guard.ts
+/**
+* The CFn type of a nested stack's row in its PARENT's template.
+*
+* Spelled locally rather than imported, matching
+* `src/deployment/recreate-targets.ts`: the only exported copy lives in
+* `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
+* from the deployment layer would invert the dependency direction.
+*/
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+/**
+* Find every planned change whose recorded type and template type differ with
+* `AWS::CloudFormation::Stack` on one side.
+*
+* Reads exactly the two values the defect is made of: `change.resourceType`
+* (what `provisionResource` binds and routes BOTH replacement halves on) and
+* the state record's `resourceType` (the resource that actually exists). That
+* is deliberate — deriving the "desired" type from the template again would be
+* a second implementation of the diff's own Type-change rule (metadata skip,
+* condition pruning) which could drift away from the routing decision this
+* guards.
+*
+* `changeType` is not filtered on. A Type change surfaces as an `UPDATE`, but a
+* DELETE / NO_CHANGE row cannot diverge in the first place (the diff builds
+* both from the state record's own type), so filtering would only add a way for
+* a future change-shape to slip past.
+*/
+function findNestedStackTypeChanges(input) {
+	const found = [];
+	for (const [logicalId, change] of input.changes) {
+		if (!Object.hasOwn(input.stateResources, logicalId)) continue;
+		const currentResource = input.stateResources[logicalId];
+		if (!currentResource) continue;
+		const currentType = currentResource.resourceType;
+		const desiredType = change.resourceType;
+		if (currentType === desiredType) continue;
+		const intoNested = desiredType === NESTED_STACK_RESOURCE_TYPE;
+		if (!intoNested && !(currentType === NESTED_STACK_RESOURCE_TYPE)) continue;
+		found.push({
+			logicalId,
+			currentType,
+			desiredType,
+			physicalId: currentResource.physicalId,
+			direction: intoNested ? "into-nested-stack" : "out-of-nested-stack"
+		});
+	}
+	return found;
+}
+/**
+* Render the refusal. Names the logical id, BOTH types, the resource the
+* mis-routed delete would be aimed at, and what to do instead.
+*
+* `stackName` is the stack being deployed, so the into-nested arm can print the
+* child stack name `NestedStackProvider.delete` would derive and destroy — the
+* one piece of the damage the user cannot read off their own template.
+*/
+function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
+	const rows = typeChanges.map((tc) => {
+		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Both halves of the replacement would route on the TEMPLATE's type, so the existing resource's delete would be dispatched at the ${NESTED_STACK_RESOURCE_TYPE} provider — which ignores the physical id it is handed and instead destroys the nested child stack "${stackName}~${tc.logicalId}" and every resource that child owns. Where no such child exists the delete is a no-op and ${tc.physicalId} is silently leaked instead.` : `    Both halves of the replacement would route on the TEMPLATE's type, so the existing nested stack's delete would be dispatched at the ${tc.desiredType} provider, which cannot delete a nested stack — the child stack "${stackName}~${tc.logicalId}" and every resource it owns would be left behind, untracked.`}`;
+	});
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd cannot replace safely (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal: the delete's TARGET would be wrong, not merely its consequences.`;
+}
+
 //#endregion
 //#region src/deployment/outputs-export-alias.ts
 /**
@@ -30094,6 +30650,218 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-warm-throughput.ts
+/**
+* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* `WarmThroughput` is the same CloudFormation block on both types, and both
+* providers have to answer the same two questions about it before an
+* `UpdateTable` / `CreateTable` goes out:
+*
+*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
+*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
+*     came back from an `Fn::Sub` — arrives as a STRING and must not be
+*     forwarded verbatim into a numeric `Long` field.
+*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
+*     only ever rises with a table's traffic and AWS REJECTS a call that
+*     lowers it (`decreasing WarmThroughput is not supported`, measured live
+*     us-east-1 2026-08-13 for issue #1768).
+*
+* **Provenance, stated precisely because it is easy to over-claim.** Exactly
+* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
+* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
+* existed outside the change that created this file (issue #1857). So this is
+* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
+* behaviour changed for either type when it moved here.
+*
+* What WAS compared is the lifted rule against the GlobalTable spelling
+* drafted alongside it, over the shapes both had to answer (a quoted numeric
+* string, a partially usable block, a mixed decrease/increase, an absent live
+* value, a zero, a negative, a non-numeric string, a whitespace string, an
+* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
+* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
+* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
+* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
+* since `'   '` is not a capacity anyone declared and a warm throughput of 0
+* is not a request AWS can honour. That is a DRAFT reconciled against a
+* shipped rule, which is worth less than two shipped rules agreeing — the
+* reason to read the probe list as a design note rather than as field
+* evidence.
+*
+* Living here rather than in either provider is the point. A decrease guard is
+* three clauses that all FAIL OPEN for different reasons, and two files
+* spelling it independently is two chances for a later "fix" to change one of
+* them — at which point the sibling type silently keeps the old answer, and
+* nothing in the tree says which is intended. Same class as
+* `emr-configuration.ts`, and the same reason.
+*
+* Deliberately NOT here: everything only ONE provider has. The `Table` side's
+* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
+* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
+* and already-matches gates, which `GlobalTable` has no counterpart to (issue
+* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
+* comparison sides unconditionally, so drift never asks the question there);
+* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
+* `ThroughputDiagnostic` that only that provider's collector understands.
+* Moving a helper with one caller here would buy nothing and cost a hop.
+*
+* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
+*/
+/**
+* The two `WarmThroughput` members, in the ONE order every message, every
+* comparison and every emitted block uses. A shared order is what makes two
+* blocks carrying the same numbers compare equal by `deepEqual` and serialize
+* to the same wire bytes regardless of the order the template wrote them in.
+*/
+const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
+/**
+* A CloudFormation-borne numeric property, or `undefined` when the value is
+* not a usable number.
+*
+* Plain `Number()` coercion is NOT good enough and the tree learned it three
+* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
+* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
+* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
+* string would be forwarded as a request for zero units.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'12000'` genuinely means 12000.
+*
+* The accepted STRING set is `Number()`'s, which is WIDER than a decimal
+* integer: `'0x1e'`, `'0o36'`, `'1e3'`, `'30.5'` and `' 30 '` all coerce.
+* Whether CloudFormation accepts those for an `Integer`-typed property is
+* unmeasured, and issue [#2698](https://github.com/go-to-k/cdkd/issues/2698)
+* holds the live A/B that would settle it. It matters at the CALLERS that
+* FORWARD the result to AWS rather than merely compare it — narrowing this
+* shared helper would change the DynamoDB capacity readers too, so read that
+* issue before tightening anything here.
+*
+* EXPORTED, and not because warm throughput needs it exported. This exact rule
+* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
+* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
+* `toFiniteNumber` (a different spelling of the same total function) — which is
+* precisely the divergence this module exists to stop: the next "fix" to one of
+* them would have left the other two answering differently, with nothing in the
+* tree saying which was intended. It reads `ReadCapacityUnits` /
+* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
+* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
+* stringly-typed CFn value a number I can send?".
+*/
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
+* fields accept, PER MEMBER.
+*
+* PER MEMBER, not whole-block, and that distinction is the point: a block
+* whose write half is an unresolved intrinsic still has a perfectly good read
+* half, and dropping both would silently discard a value the template really
+* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
+* warning can say which half went missing instead of reporting the whole
+* property.
+*
+* A block with NO usable member yields `spec: undefined` — refused rather than
+* forwarded, because forwarding a malformed block surfaces as an opaque AWS
+* validation error naming neither cdkd nor the property. `droppedMembers` is
+* still populated in that case, so a REFUSAL message can name what it refused;
+* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
+* array) has no member to name and reports none, which is what lets a caller
+* word "one half went missing" differently from "the block is unusable".
+*
+* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
+* own message, so the wording stays consistent across that provider's send
+* sites without forcing one wording across both providers.
+*/
+function coerceWarmThroughput(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
+	const bag = raw;
+	const spec = {};
+	const droppedMembers = [];
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (bag[member] === void 0) continue;
+		const coerced = toFiniteNumber(bag[member]);
+		if (coerced === void 0) {
+			droppedMembers.push(member);
+			continue;
+		}
+		spec[member] = coerced;
+	}
+	if (Object.keys(spec).length === 0) return { droppedMembers };
+	return {
+		spec,
+		droppedMembers
+	};
+}
+/**
+* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
+* reports.
+*
+* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
+* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* had to be measured before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
+* makes the verdict describe a request that is not the one being sent (a
+* dropped member is not part of the call and must not be part of the
+* comparison).
+*
+* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
+* leave AWS as the authority — because a false positive here silently drops a
+* legitimate INCREASE, which is a real capacity change the user asked for,
+* while a false negative merely reproduces the pre-fix behaviour of an
+* AWS-side rejection that names the property:
+*  - DECLARED members only. An absent member is not a request to lower
+*    anything, so it takes no part in the verdict.
+*  - MIXED is not a decrease. One member below live and the other above means
+*    the call carries a genuine increase; AWS decides.
+*  - An absent or unusable LIVE counterpart is not a decrease. Without a
+*    number to compare against there is no evidence of one. Only the LIVE side
+*    can reach that arm: the desired side is a COERCED spec, so a malformed
+*    template value has already been dropped by {@link coerceWarmThroughput}.
+*
+* A decrease therefore requires every declared member to be at-or-below live
+* AND at least one to be strictly below.
+*
+* The skip this drives is right for EVERY `update()` caller — the deploy
+* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
+* because none of them can make AWS lower the value, so none loses anything a
+* doomed call would have achieved.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (desired === void 0 || live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (desired[member] === void 0) continue;
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+
 //#endregion
 //#region src/provisioning/stateful-types.ts
 /**
@@ -30140,9 +30908,12 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *     "never expire" — the most data-bearing configuration the type
 *     has, and what `LogsLogGroupProvider` records `0` for — so reading
 *     it as "holds nothing" destroyed years of events on a plain
-*     `cdkd deploy`. A recorded `RetentionInDays > 0` still answers
-*     `has-retention` from the bag alone (a cheap positive, never
-*     probed away); every other bag DEFERS, exactly as the bucket does.
+*     `cdkd deploy`. A `RetentionInDays > 0` recorded in EITHER of the
+*     state record's property bags still answers `has-retention` from
+*     the bags alone (a cheap positive, never probed away); every other
+*     bag DEFERS, exactly as the bucket does. Which bags, and why the
+*     value is coerced rather than type-tested, is issue [#2521] —
+*     see {@link logGroupHasPositiveRetention}.
 *     The pre-flight resolves the deferral with a live
 *     `logs:DescribeLogStreams` probe (a log group with no stream can
 *     hold no event, since every event belongs to a stream); mid-deploy,
@@ -30327,10 +31098,66 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 */
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
-* Cheap, synchronous read of the resource's recorded properties only.
+* Does either recorded bag prove this log group carries a POSITIVE
+* `RetentionInDays`? (issue [#2521])
+*
+* Two decisions, and both were defects before this function existed.
+*
+* **The value is COERCED, not type-tested.** The predicate used to gate on
+* `typeof retention === 'number' && retention > 0`, and CloudFormation is
+* stringly typed: a hand-written L1, an `Fn::Sub`-produced value, a
+* `Type: String` parameter's default, or a record imported by
+* `cdkd import --migrate-from-cloudformation` all put `'30'` into the bag,
+* where the type test answers "not a number". {@link toFiniteNumber} is the
+* repo's single answer to "is this stringly-typed CFn value a number?" —
+* imported rather than re-spelled here for the reason its own doc gives, that
+* the same rule hand-written twice diverges on the next fix to one copy. It
+* rejects `''`, `'   '`, `null`, `[]` and `false`, each of which a bare
+* `Number()` turns into a `0` that would read as never-expire.
+*
+* **BOTH bags are consulted, and a positive in EITHER wins.** The old read
+* saw `properties` alone, so a retention set OUT OF BAND (the console,
+* `aws logs put-retention-policy`, another tool) or one recorded only in
+* `observedProperties` — an imported record whose template never declared
+* the property — never produced `has-retention`.
+*
+* The rule is a plain OR, and the loop order below is INERT — a review round
+* caught an earlier version of this paragraph claiming `observedProperties`
+* is "read FIRST", a precedence the code does not implement and must not.
+* A strict "observed when present, else properties" rule — which is what
+* issue [#2521] literally prescribed — was tried and REJECTED:
+* `LogsLogGroupProvider.readCurrentState` writes `RetentionInDays: 0` for a
+* group with no retention policy, so the observed bag almost always CARRIES
+* the key, and precedence would make the recorded bag dead for every record
+* that has ever been captured and would DROP the `has-retention` verdict this
+* guard already produced. A test pins that rejection
+* (`tests/unit/provisioning/stateful-types.test.ts`, "reads a retention that
+* lives ONLY in properties, even against a ZERO observed one"). The OR is
+* also the strictly safer direction: it can only ADD refusals, never remove
+* one.
+*
+* What a `false` here means is DEFER, not "holds nothing" — see the callers.
+*/
+function logGroupHasPositiveRetention(recordedProperties, observedProperties) {
+	for (const bag of [observedProperties, recordedProperties]) {
+		const retention = toFiniteNumber(bag?.["RetentionInDays"]);
+		if (retention !== void 0 && retention > 0) return true;
+	}
+	return false;
+}
+/**
+* Cheap, synchronous read of the state record's own property bags only —
+* no AWS call. Both bags are parameters rather than one: `properties` is
+* what the last deploy applied, `observedProperties` what it read back,
+* and the log group's arm consults BOTH (issue [#2521]). Passing the
+* observed bag is REQUIRED, not optional, so a new call site has to
+* decide what it holds instead of silently repeating the omission that
+* issue records; `undefined` is the right answer where no record is in
+* hand (`recreate-confirm-prompt.ts`).
+*
 * TWO types return `null` meaning DEFER rather than "not stateful":
-* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever the
-* recorded bag does not already prove `has-retention`. The live probes
+* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever neither
+* bag already proves `has-retention`. The live probes
 * that resolve both deferrals (`ListObjectVersions` for the bucket,
 * `DescribeLogStreams` for the log group) live in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
@@ -30343,11 +31170,10 @@ const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::Dynam
 * Returns the {@link StatefulReason} when the type is stateful (or
 * `null` for non-stateful types).
 */
-function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
+function isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties) {
 	if (!STATEFUL_TYPES.has(resourceType)) return null;
 	if (resourceType === "AWS::Logs::LogGroup") {
-		const retention = recordedProperties?.["RetentionInDays"];
-		if (typeof retention === "number" && retention > 0) return "has-retention";
+		if (logGroupHasPositiveRetention(recordedProperties, observedProperties)) return "has-retention";
 		return null;
 	}
 	if (resourceType === "AWS::S3::Bucket") return null;
@@ -30374,16 +31200,38 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 * — be DELETE + CREATEd (data loss) without `--force-stateful-recreation`. To
 * stay fail-safe, both deferrals resolve to stateful here: the user must pass
 * `--force-stateful-recreation` to replace ANY S3 bucket, and any log group
-* whose recorded bag does not already prove `has-retention`, on any of those
-* paths — empty or not.
+* neither of whose recorded property bags already proves `has-retention`, on
+* any of those paths — empty or not.
+*
+* `UpdateReplacePolicy: Retain` is the standing EXEMPTION, and it covers all
+* three (issue [#2604]): the engine never consults this predicate under it —
+* the property-driven guard tests `updateReplacePolicy !== 'Retain'`
+* directly, and the fallback's two triggers short-circuit through
+* `retainOldOnReplace`, which issue [#2518] added. The old resource survives
+* the replacement, so there is no data loss to confirm, and the refusal's own
+* remedy would have destroyed exactly what the user asked to keep.
+* `Snapshot` is NOT exempt on any of them — a snapshot is a copy, not a
+* surviving resource. So read the paragraph above as scoped to a template
+* that is not retaining.
+*
+* The two engine sites are not the only callers: a THIRD sits outside those
+* paths and outside that exemption — `recreate-confirm-prompt.ts` re-derives
+* a `null` verdict for the `--recreate-via-*` pre-flight, where
+* `--force-stateful-recreation` is what skipped the probe.
+* `stateful-replace-message-doc-sync` pins the whole guard's reader list by
+* file, but the residuals comment above its own walk enumerates what that
+* cannot see — among them an ALIASED import, a `.mts` / `.cts` reader, and,
+* the one that bit, a NEW PATH routed through an existing call site, which
+* adds no file and reds nothing (issue [#2514]'s shape). So this enumeration
+* is maintained by hand.
 *
 * The log group's arm is the one issue [#2558] added, and the reason it is
 * needed is that the old predicate treated "no retention recorded" as "holds
 * nothing" when it is CloudWatch Logs' never-expire. Every other type matches
 * {@link isStatefulRecreateTargetSync} exactly.
 */
-function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
-	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties);
+function isStatefulRecreateTargetForReplace(resourceType, recordedProperties, observedProperties) {
+	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties);
 	if (sync) return sync;
 	if (resourceType === "AWS::S3::Bucket") return "has-objects";
 	if (resourceType === "AWS::Logs::LogGroup") return "has-log-events";
@@ -31545,6 +32393,84 @@ function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
 	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
 }
 /**
+* `UpdateReplacePolicy: Retain` on the resource a replacement CREATED — the
+* copy a rollback would otherwise destroy (issue
+* [#2598](https://github.com/go-to-k/cdkd/issues/2598)).
+*
+* Reads the CURRENT record, i.e. the one the replacing deploy wrote from the
+* template it was applying (`extractTemplateAttributes`), so the attribute
+* consulted is the one that was in force when the new copy was created. Its
+* `Snapshot` sibling, {@link rollbackFinalSnapshotId}, reads the same field of
+* the same record — `Retain` and `Snapshot` are alternative values of ONE
+* attribute, so the two can never both apply.
+*
+* **`UpdateReplacePolicy`, NOT `DeletionPolicy`, and that is measured, not
+* reasoned.** The repo refuses a CloudFormation-parity claim taken on
+* folklore, and the AWS documentation answers nothing here: every sentence on
+* both attribute pages, in the API reference and in the release notes
+* describes the OLD resource, never the new copy's fate during a rollback. A
+* live four-variant A/B (2026-09-05, us-east-1: a forced `AWS::SSM::Parameter`
+* replacement plus a deterministically failing sibling, rolled back) settled
+* it:
+*
+* | DeletionPolicy | UpdateReplacePolicy | new copy  | decisive event   |
+* | -------------- | ------------------- | --------- | ---------------- |
+* | (none)         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | Retain         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | (none)         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+* | Retain         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+*
+* Row 2 alone refutes "`DeletionPolicy` governs it"; row 3 alone refutes
+* "neither — always deleted". The old copy was restored intact in all four,
+* and both outcomes land in `UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS`.
+*
+* A retained new copy is ORPHANED OUT of the stack, not kept as a managed
+* resource — the A/B proved it by deleting the whole stack afterwards and
+* finding the retained parameter still alive. So every caller below leaves NO
+* state record naming the survivor: the two arms that can complete point state
+* at the old resource exactly as they already did, and the survivor becomes
+* untracked. That is the same disposition the deploy engine gives a
+* `Retain`-orphaned OLD resource, so the two directions agree.
+*
+* LIMIT OF THAT EVIDENCE, stated so a later reader does not over-read it: all
+* four variants carried the SAME policy in both template versions, so the A/B
+* pinned WHICH ATTRIBUTE wins and did NOT discriminate which template's copy
+* of it is read. This function reads the current record for the reasons above
+* (it is the one the new copy was created under, and it matches the
+* `Snapshot` sibling and both CREATE-rollback arms), not because the A/B
+* settled that question.
+*/
+function rollbackRetainsNewResource(record) {
+	return record?.updateReplacePolicy === "Retain";
+}
+/**
+* The two sentences a `UpdateReplacePolicy: Retain` survivor needs: the `⚠`
+* terminal warning and the compact `reason` that rides on the durable
+* `ROLLBACK_RESOURCE_SUCCEEDED` event.
+*
+* ONE function because the two must not drift apart. Both replacement-rollback
+* retain arms produced these by hand, four near-identical copies, and the
+* failure mode a reviewer named is precise: the warn and the DURABLE record
+* disagreeing about which id survived. Deriving both from one set of inputs
+* makes that unrepresentable. The shapes stay deliberately different -- the
+* warn carries the cost/`cdkd destroy` guidance a human reads once, the reason
+* stays compact for a `--json` consumer -- so this is one input set, not one
+* string.
+*
+* `stateClause` is the only thing that differs between the two arms (the
+* readopt arm restores the old id; the create-first arm records a re-created
+* one), so it is a parameter rather than a branch in here.
+*
+* NOT used by the delete-failed survivor a few lines down: that one is an
+* orphan by OUTCOME rather than by policy, and says so.
+*/
+function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause) {
+	return {
+		warn: `  ⚠ ${logicalId} (${resourceType}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${survivorPhysicalId}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need it. ${stateClause}`,
+		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorPhysicalId}); it is live, still billing, and no longer tracked by cdkd. ${stateClause}`
+	};
+}
+/**
 * `DeletionPolicy: Snapshot` on a rolled-back CREATE (issue #1358) — the
 * executor's copy of the deploy engine's `prepareFinalSnapshotForDelete`
 * mechanism matrix, run BEFORE the delete. Shared with the FAILED in-flight
@@ -31643,7 +32569,7 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
-		return op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
+		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
 	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
@@ -31683,12 +32609,16 @@ function planFailedOps(failedOps, stateResources) {
 */
 function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
 	const { createOps, otherOps } = partitionOps(operations);
-	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => ({
-		op,
-		action: classifyRollbackOp(op, stateResources, orphanLogicalIds),
-		replacement: isReplacementOp(op),
-		effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy)
-	}));
+	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => {
+		const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
+		return {
+			op,
+			action,
+			replacement: isReplacementOp(op),
+			effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy),
+			retainsNewResource: (action === "reverse-replacement" || action === "reverse-replacement-readopt") && rollbackRetainsNewResource(stateResources[op.logicalId])
+		};
+	});
 }
 function partitionOps(operations) {
 	const createOps = [];
@@ -32046,11 +32976,32 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 * writer is one of only two that can honestly claim it.
 *
 * Using `STATE_SOURCED_READBACK_RULES` here reads plausible and is wrong in the
-* quiet direction: it turns positional array descent off. Since issue #1915 a
-* `Tags[]` / ECS `Environment[]` element is reached by KEYED descent either
-* way, so the concrete loss is narrower than it was — it is a list whose
-* elements carry no `Name` / `Key` identity, which only positional descent can
-* walk.
+* quiet direction: it turns BLIND positional array descent off. BLIND is
+* load-bearing, and an earlier revision of this paragraph omitted it — the
+* concrete loss is narrower than "positional descent is off" makes it sound,
+* by TWO mechanisms rather than one:
+*
+*  - Since issue #1915 a `Tags[]` / ECS `Environment[]` element is reached by
+*    the order-independent KEYED descent either way.
+*  - Since issue #2012 an UNKEYED list is reached too, under corroboration.
+*    That is not a general relaxation: swapping this constant in would satisfy
+*    all three conjuncts of `isReadbackProjectedFromState`
+*    (`trustAnyExpression && !descendArrays && sourceIsSameGeneration`), which
+*    ARMS `refuseUncertifiedReadbackPositions`, and its unkeyed arm walks
+*    element i against element i whenever `unkeyedArrayPairsByAnchors`
+*    corroborates the alignment (index counts match; every position whose
+*    SOURCE subtree carries no dynamic reference is deep-equal on both sides;
+*    every reference-bearing element carries a distinguishing anchor of its own
+*    or, being a bare reference leaf, leans on the array's literal frame; and
+*    no two reference-bearing elements share an order-insensitive anchor
+*    signature).
+*
+* So the residual loss is narrower again: an unkeyed list whose positions ALSO
+* fail to corroborate. The CONCLUSION is unchanged — `STATE_DERIVED_RULES` is
+* still right here, for the reason one paragraph up (the bag was produced by
+* resolving the source, so the two correspond positionally by construction and
+* need no corroboration to say so). What changes is only how much a reader
+* should think the alternative costs (issue #2691).
 *
 * No-op when the op resolved no secret.
 */
@@ -32260,7 +33211,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				return;
 			case "orphan-flag":
 				if (op.changeType === "CREATE") {
-					const orphanFlagProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+					const record = stateResources[op.logicalId];
+					const orphanFlagProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 					createRollbackRoute = orphanFlagProvisionedBy;
 					delete stateResources[op.logicalId];
 					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
@@ -32271,12 +33223,17 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						operation: "CREATE",
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
-						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy }
+						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy },
+						...record?.physicalId && {
+							physicalId: record.physicalId,
+							reason: `--orphan left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+						}
 					});
 				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
 				return;
 			case "orphan-retain": {
-				const orphanProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+				const record = stateResources[op.logicalId];
+				const orphanProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 				createRollbackRoute = orphanProvisionedBy;
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
@@ -32287,7 +33244,11 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					operation: "CREATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy }
+					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy },
+					...record?.physicalId && {
+						physicalId: record.physicalId,
+						reason: `DeletionPolicy: Retain left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+					}
 				});
 				return;
 			}
@@ -32330,11 +33291,32 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
-					resourceType: op.resourceType,
-					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
-				{
+				/**
+				* Set when this arm ORPHANS the replacement's new copy. Read at the
+				* `ROLLBACK_RESOURCE_SUCCEEDED` event below, which is the only channel
+				* that OUTLIVES the terminal (security review of issue #2598): a
+				* rollback runs during an already-failing deploy, often non-TTY with
+				* the log truncated or discarded, so a `logger.warn` is the least
+				* likely thing the user still has. Without this the survivor's id dies
+				* with the terminal -- `cdkd events` shows a clean success and state
+				* names only the OLD resource, while a live, billing, untracked copy
+				* remains. `Retain` is precisely the marker users put on data-bearing
+				* resources, so that is the worst population to lose the id for.
+				*
+				* Same shape as the `rollbackPartial` survivor record ~700 lines down
+				* and as the deploy engine's `RESOURCE_SKIPPED` twin.
+				*/
+				let survivorReason;
+				if (rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State is restored to the old resource (${prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else {
+					const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: current.provisionedBy ?? op.provisionedBy
+					});
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
@@ -32344,13 +33326,19 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
 				await afterOp?.(op.logicalId);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -32366,10 +33354,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
 				});
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+				const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
+				}).provider;
 				let deletedNewFirst = false;
 				let createResult;
 				try {
@@ -32378,11 +33366,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
 				} catch (createError) {
-					if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+					const msg = createError instanceof Error ? createError.message : String(createError);
+					if (!isNameCollisionError(msg)) throw createError;
+					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${op.logicalId} (${op.resourceType}): the re-create of the old resource (${prev.physicalId}) collided with the name still held by the new one (${current.physicalId}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with \`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${msg}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-						throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 							expectedRegion: ctx.region,
 							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 						}), op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
@@ -32396,7 +33386,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
 					} catch (recreateError) {
-						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
@@ -32412,24 +33402,37 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
 				}, secrets, prevRecord.properties);
 				await afterOp?.(op.logicalId);
-				if (!deletedNewFirst && !adoptedLiveNewResource) try {
+				let survivorReason;
+				if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
 					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
+					survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 					result.warnings++;
 				}
 				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -33118,7 +34121,10 @@ var DeploymentEventsReader = class {
 	* window and rewrites (or removes) `index.json` to match.
 	*
 	* Retention semantics (see {@link DeploymentEventsPruneOptions}):
-	*   - `all`        — delete every run + the index (full purge).
+	*   - `all`        — delete every run + the index. Clears the LISTING only:
+	*                    this deletes by key with no `VersionId`, so on a
+	*                    versioned bucket every earlier version survives
+	*                    (issue #2624).
 	*   - `keep N`     — retain the newest N runs, delete the rest.
 	*   - `olderThanMs`— delete runs whose run-id timestamp is older than the
 	*                    cutoff; a run id with no parseable timestamp is kept.
@@ -33533,6 +34539,39 @@ var DeployEngine = class {
 	*/
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	/**
+	* Logical ids whose replacement this deploy DELIBERATELY left the old
+	* physical resource alive for — `UpdateReplacePolicy: Retain` (issue
+	* [#2603](https://github.com/go-to-k/cdkd/issues/2603)).
+	*
+	* Written by every engine path that skips the post-replacement delete, read
+	* once at the `completedOperations.push` site to stamp
+	* {@link CompletedOperation.oldResourceRetained}. It exists because the
+	* rollback classifier used to re-derive the verdict from
+	* `previousState.updateReplacePolicy` — a DIFFERENT source than the
+	* template read the engine decides from — so the two disagreed on exactly
+	* the deploy that changes the attribute, in both directions:
+	*
+	*   - ADDING `Retain`: the deploy orphans the old resource while the
+	*     previous state record carries no policy, so the rollback re-CREATED a
+	*     resource that is still alive (a duplicate for an auto-named type, an
+	*     `AlreadyExists` failure for a user-named one).
+	*   - DROPPING `Retain`: state still carries the stale `Retain`, the
+	*     template omits it so the deploy correctly DELETES the old resource,
+	*     and the rollback then re-adopted a physical id that no longer exists,
+	*     leaving state naming a deleted resource.
+	*
+	* Records only the DELIBERATE retention. A best-effort cleanup delete that
+	* FAILED, was SKIPPED, or was blocked by a failed final snapshot also leaves
+	* the old resource alive, but the deploy does not KNOW it survived — those
+	* stay `false` and keep today's `reverse-replacement` behaviour rather than
+	* having the rollback re-adopt an id it cannot vouch for (issue
+	* [#2631](https://github.com/go-to-k/cdkd/issues/2631)).
+	*
+	* Cleared per `deploy()` alongside the other per-run maps: a `false` here
+	* must mean "this deploy deleted it", never "a previous run said so".
+	*/
+	retainedOldOnReplacement = /* @__PURE__ */ new Set();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -33571,6 +34610,7 @@ var DeployEngine = class {
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
 		this.outputsSourceUsable = true;
+		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -33992,7 +35032,10 @@ var DeployEngine = class {
 		for (const { logicalId, resource } of candidates) {
 			let provider;
 			try {
-				provider = this.providerRegistry.getProvider(resource.resourceType);
+				provider = this.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
 			} catch {
 				continue;
 			}
@@ -34084,6 +35127,11 @@ var DeployEngine = class {
 			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry));
+			const nestedStackTypeChanges = findNestedStackTypeChanges({
+				changes,
+				stateResources: currentState.resources
+			});
+			if (nestedStackTypeChanges.length > 0) throw markNonRetryable(new CdkdError(renderNestedStackTypeChangeRefusal(nestedStackTypeChanges, stackName), "TYPE_CHANGE_NESTED_STACK"));
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
@@ -34293,7 +35341,8 @@ var DeployEngine = class {
 							provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 							previousState,
 							physicalId: newResources[logicalId]?.physicalId,
-							properties: newResources[logicalId]?.properties
+							properties: newResources[logicalId]?.properties,
+							...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) }
 						});
 						saveStateAfterResource(logicalId);
 					}, () => this.interrupted);
@@ -34820,7 +35869,7 @@ var DeployEngine = class {
 				isRetryable: isRecreateRetryableError
 			});
 		} catch (recreateError) {
-			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets));
+			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? recreateError : void 0 });
 		}
 	}
 	/**
@@ -34917,15 +35966,16 @@ var DeployEngine = class {
 					break;
 				}
 				const propertyDrivenReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
-				const recreateViaCcApi = this.options.recreateViaCcApiTargets?.has(logicalId) ?? false;
-				const recreateViaSdkProvider = this.options.recreateViaSdkProviderTargets?.has(logicalId) ?? false;
+				const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+				const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
+				const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
 				const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
 				const needsReplacement = propertyDrivenReplacement || recreateFlagged;
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 				if (needsReplacement) {
 					if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
-						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
 							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
 							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
@@ -34951,8 +36001,10 @@ var DeployEngine = class {
 					let createResult;
 					if (recreateFlagged) {
 						const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
-						if (updateReplacePolicy === "Retain") this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
-						else {
+						if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
+						} else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 							let recreateDeleteResult;
@@ -35003,8 +36055,10 @@ var DeployEngine = class {
 							deletedOldFirst = true;
 							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
-						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
-						else {
+						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+						} else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 							let cleanupFinalSnapshotId;
 							let snapshotBlockedDelete = false;
@@ -35061,6 +36115,7 @@ var DeployEngine = class {
 					const updateProps = updateDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
+					let captureProvider = updateProvider;
 					try {
 						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, {
 							maskSecrets: createSecretMasker(updateSecrets),
@@ -35071,7 +36126,7 @@ var DeployEngine = class {
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
 							const retainOldOnReplace = updateReplacePolicy === "Retain";
-							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 							if (statefulReason && this.options.forceStatefulRecreation !== true) throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 							this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							if (!retainOldOnReplace) {
@@ -35102,7 +36157,7 @@ var DeployEngine = class {
 							try {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
-								if (!retainOldOnReplace) throw createError;
+								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
 								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
@@ -35112,6 +36167,7 @@ var DeployEngine = class {
 									const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 									throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 								}
+								this.retainedOldOnReplacement.add(logicalId);
 								this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
 								retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 							}
@@ -35129,6 +36185,7 @@ var DeployEngine = class {
 							if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
 							result = replacementResult;
 							resultProvisionedBy = replDecision.provisionedBy;
+							captureProvider = replProvider;
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
@@ -35148,7 +36205,7 @@ var DeployEngine = class {
 						provisionedBy: resultProvisionedBy
 					};
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
+					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
 					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
 					else counts.updated++;
@@ -35601,5 +36658,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { beginCommandInterruptScope as $, synthesisStatusMessage as $n, withErrorHandling as $r, maskSecretsInError as $t, formatResourceLine as A, ensureAssetStorage as An, AssetError as Ar, requireConfigString as At, isExportAliasCollision as B, describeDockerCapturedOutput as Bn, LockError as Br, INTRINSIC_KEYS as Bt, unsupportedFinalSnapshotError as C, loadPublishableAssetManifest as Cn, processStackMessages as Cr, coerceCfnBoolean as Ct, isStatefulRecreateTargetForReplace as D, AssetModeResolver as Dn, getAwsClients as Dr, replayWarn as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, stripControlChars as En, AwsClients as Er, readConfigString as Et, red as F, validateAssetBucketName as Fn, DeployCancelledError as Fr, s3BucketDualStackDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, getDockerCmd as Gn, ResourceUpdateNotSupportedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, stateKeySecretExposure as H, describeDockerFailure as Hn, PartialFailureError as Hr, withRetry as Ht, yellow as I, validateContainerRepoName as In, DynamicReferenceRegionAmbiguousError as Ir, s3BucketRegionalDomainName as It, findActionableSilentDrops as J, runDockerForeground as Jn, StateError as Jr, carriesSecretMask as Jt, clearOnUpdateRemoval as K, partitionSensitiveEnv as Kn, StackHasActiveImportsError as Kr, STATE_SOURCED_READBACK_RULES as Kt, collectDeclaredOutputNames as L, buildDenyExternalAccessPolicy as Ln, IntrinsicResolutionRefusalError as Lr, s3BucketWebsiteUrl as Lt, cyan as M, isCrossRegionRedirect as Mn, ConfigError as Mr, producerRegionsFromState as Mt, gray as N, parseBootstrapMarker as Nn, CrossAccountSecretRefusalError as Nr, s3BucketArn as Nt, isStatefulRecreateTargetSync as O, BOOTSTRAP_MARKER_PREFIX as On, resetAwsClients as Or, requireConfigArray as Ot, green as P, readBootstrapMarkerBody as Pn, DependencyError as Pr, s3BucketDomainName as Pt, maskerOrIdentity as Q, Synthesizer as Qn, normalizeAwsError as Qr, isSingleDynamicReferenceToken as Qt, collectPublishedOutputNames as R, describeAwsFailure as Rn, LocalInvokeBuildError as Rr, applyRoleArnIfSet as Rt, refusesFinalSnapshot as S, createAssetRedirectResolver as Sn, AssemblyReader as Sr, assertRegionMatch as St, extractDeploymentEventError as T, escapeRegExp$1 as Tn, resolveBucketRegion as Tr, configStringRefusal as Tt, getCurrentResourceSecrets as U, dockerSpawnEnvWithSensitive as Un, ProvisioningError as Ur, DagBuilder as Ut, secretBearingStateKeyWarning as V, describeDockerExecFailure as Vn, NestedStackChildDirectDestroyError as Vr, describeTypeWithThrottleRetry as Vt, IAMRoleProvider as W, formatDockerLoginError as Wn, ResourceTimeoutError as Wr, TemplateParser as Wt, createMaskedRetryLogger as X, AssetManifestLoader as Xn, formatError as Xr, dynamicReferenceTokens as Xt, findSilentDropProperties as Y, runDockerStreaming as Yn, SynthesisError as Yr, createSecretMasker as Yt, maskDeep as Z, getDockerImageBySourceHash as Zn, isCdkdError as Zr, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shouldRetainResource as _n, displaySafe as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, markRedactedCause as ai, LockManager as an, resolveSkipPrefix as ar, slowCcOperationTimeoutMs as at, createPreDeleteFinalSnapshot as b, WorkGraph as bn, canonicalizeRegion as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, UNRENDERABLE as cn, resolveUseCdkBootstrapAssets as cr, deleteSkipReason as ct, updatePartialReason as d, forceQuitRecoveryClause as dn, CFN_TEMPLATE_BODY_LIMIT as dr, IntrinsicFunctionResolver as dt, isMarkedNonRetryable as ei, maskSecretsInText as en, getDefaultStateBucketName as er, endCommandInterruptScope as et, withResourceDeadline as f, CUSTOM_RESOURCE_RESPONSE_PREFIX as fn, CFN_TEMPLATE_URL_LIMIT as fr, carriesDynamicReference as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, importableOutputs as gn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gr, isUnboundTemplateParameter as gt, computeImplicitDeleteEdges as h, importableOutputKeys as hn, uploadCfnTemplate as hr, getAccountInfo as ht, DeploymentEventsReader as i, markNonRetryable as ii, scrubResourceRecord as in, resolveCaptureObservedState as ir, CloudControlProvider as it, bold as j, getBootstrapMarkerKey as jn, CdkdError as jr, classifyReplaySecretRegion as jt, renderStatefulReason as k, assertAssetBucketRegion as kn, setAwsClients as kr, requireConfigObject as kt, replayRollback as l, buildForceUnlockCommand as ln, stateBucketExistenceConfirmed as lr, disableInstanceApiTermination as lt, IMPLICIT_DELETE_DEPENDENCIES as m, exportNamesCarriedFrom as mn, findLargeInlineResources as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as ni, recoverMaskedOutput as nn, resolveApp as nr, isInterruptedWaitError as nt, planFailedOps as o, retryClassificationText as oi, S3StateBackend as on, resolveStateBucketWithDefault as or, UNSPECIFIED_SKIP_REASON as ot, maskingRetryLogger as p, DEFAULT_STATE_PREFIX as pn, MIGRATE_TMP_PREFIX as pr, cfnRefValueFromPhysicalId as pt, ProviderRegistry as q, redactDockerArgvValues as qn, StackTerminationProtectionError as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, isTransientServerError as ri, redactSecretsForState as rn, resolveAutoAssetStorage as rr, startInterruptWatch as rt, planRollback as s, __exportAll as si, rebuildClientForBucketRegion as sn, resolveStateBucketWithDefaultAndSource as sr, deleteIndeterminateGuards as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ti, recordMaskOnlyValue as tn, getLegacyStateBucketName as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, buildLockContentionMessage as un, warnDeprecatedNoPrefixCliFlag as ur, isTerminationProtectionPropagationError as ut, buildFinalSnapshotIdentifier as v, AssetPublisher as vn, expectedOwnerParam as vr, refStateLookupFromResource as vt, makeCanonicalizePropertiesFn as w, rewriteTemplateAssetReferences as wn, clearBucketRegionCache as wr, configBooleanRefusal as wt, isFinalSnapshotError as x, buildAssetRedirectMap as xn, derivePartitionAndUrlSuffix as xr, resolveExplicitPhysicalId as xt, ccRoutedFinalSnapshotError as y, stringifyValue as yn, PARTITION_TABLE as yr, WAFv2WebACLProvider as yt, exportAliasCollisionScrubWarning as z, buildDockerImage as zn, LocalStartServiceError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine--rkIGhow.js.map
+export { findSilentDropProperties as $, escapeRegExp$1 as $n, StateError as $r, createSecretMasker as $t, WARM_THROUGHPUT_MEMBERS as A, AssetModeResolver as An, resolveBucketRegion as Ar, readConfigString as At, yellow as B, buildDenyExternalAccessPolicy as Bn, DeployCancelledError as Br, s3BucketRegionalDomainName as Bt, unsupportedFinalSnapshotError as C, AssetPublisher as Cn, expectedOwnerParam as Cr, WAFv2WebACLProvider as Ct, isStatefulRecreateTargetForReplace as D, createAssetRedirectResolver as Dn, AssemblyReader as Dr, coerceCfnBoolean as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, buildAssetRedirectMap as En, derivePartitionAndUrlSuffix as Er, assertRegionMatch as Et, bold as F, isCrossRegionRedirect as Fn, AssetError as Fr, classifyReplaySecretRegion as Ft, secretBearingStateKeyWarning as G, describeDockerFailure as Gn, LockError as Gr, describeTypeWithThrottleRetry as Gt, collectPublishedOutputNames as H, buildDockerImage as Hn, IntrinsicResolutionRefusalError as Hr, applyRoleArnIfSet as Ht, cyan as I, parseBootstrapMarker as In, CdkdError as Ir, producerRegionsFromState as It, IAMRoleProvider as J, getDockerCmd as Jn, ProvisioningError as Jr, TemplateParser as Jt, stateKeySecretExposure as K, dockerSpawnEnvWithSensitive as Kn, NestedStackChildDirectDestroyError as Kr, withRetry as Kt, gray as L, readBootstrapMarkerBody as Ln, ConfigError as Lr, s3BucketArn as Lt, isWarmThroughputDecrease as M, assertAssetBucketRegion as Mn, getAwsClients as Mr, requireConfigArray as Mt, toFiniteNumber as N, ensureAssetStorage as Nn, resetAwsClients as Nr, requireConfigObject as Nt, isStatefulRecreateTargetSync as O, loadPublishableAssetManifest as On, processStackMessages as Or, configBooleanRefusal as Ot, formatResourceLine as P, getBootstrapMarkerKey as Pn, setAwsClients as Pr, requireConfigString as Pt, findActionableSilentDrops as Q, runDockerStreaming as Qn, StackTerminationProtectionError as Qr, carriesSecretMask as Qt, green as R, validateAssetBucketName as Rn, CrossAccountSecretRefusalError as Rr, s3BucketDomainName as Rt, refusesFinalSnapshot as S, shouldRetainResource as Sn, displaySafe as Sr, refStateLookupFromResource as St, extractDeploymentEventError as T, WorkGraph as Tn, canonicalizeRegion as Tr, resolveExplicitPhysicalId as Tt, exportAliasCollisionScrubWarning as U, describeDockerCapturedOutput as Un, LocalInvokeBuildError as Ur, DiffCalculator as Ut, collectDeclaredOutputNames as V, describeAwsFailure as Vn, DynamicReferenceRegionAmbiguousError as Vr, s3BucketWebsiteUrl as Vt, isExportAliasCollision as W, describeDockerExecFailure as Wn, LocalStartServiceError as Wr, INTRINSIC_KEYS as Wt, clearOnUpdateRemoval as X, redactDockerArgvValues as Xn, ResourceUpdateNotSupportedError as Xr, STATE_SOURCED_READBACK_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, partitionSensitiveEnv as Yn, ResourceTimeoutError as Yr, STATE_SOURCED_CROSS_GENERATION_RULES as Yt, ProviderRegistry as Z, runDockerForeground as Zn, StackHasActiveImportsError as Zr, TEMPLATE_SOURCED_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, CUSTOM_RESOURCE_RESPONSE_PREFIX as _n, CFN_TEMPLATE_URL_LIMIT as _r, cfnRefValueFromPhysicalId as _t, DeploymentEventsStore as a, isMarkedNonRetryable as ai, recordMaskOnlyValue as an, getDefaultStateBucketName as ar, interruptWatchListenerCount as at, createPreDeleteFinalSnapshot as b, importableOutputKeys as bn, uploadCfnTemplate as br, isUnboundTemplateParameter as bt, replayFailedOperations as c, isTransientServerError as ci, scrubResourceRecord as cn, resolveAutoAssetStorage as cr, CloudControlProvider as ct, updatePartialReason as d, retryClassificationText as di, rebuildClientForBucketRegion as dn, resolveStateBucketWithDefault as dr, deleteIndeterminateGuards as dt, SynthesisError as ei, dynamicReferenceTokens as en, stripControlChars as er, createMaskedRetryLogger as et, withResourceDeadline as f, __exportAll as fi, UNRENDERABLE as fn, resolveStateBucketWithDefaultAndSource as fr, deleteSkipReason as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, shellQuote as gn, CFN_TEMPLATE_BODY_LIMIT as gr, carriesDynamicReference as gt, computeImplicitDeleteEdges as h, forceQuitRecoveryClause as hn, warnDeprecatedNoPrefixCliFlag as hr, IntrinsicFunctionResolver as ht, DeploymentEventsReader as i, withErrorHandling as ii, maskSecretsInText as in, synthesisStatusMessage as ir, endCommandInterruptScope as it, coerceWarmThroughput as j, BOOTSTRAP_MARKER_PREFIX as jn, AwsClients as jr, replayWarn as jt, renderStatefulReason as k, rewriteTemplateAssetReferences as kn, clearBucketRegionCache as kr, configStringRefusal as kt, replayRollback as l, markNonRetryable as li, LockManager as ln, resolveCaptureObservedState as lr, slowCcOperationTimeoutMs as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildLockContentionMessage as mn, stateBucketExistenceConfirmed as mr, isTerminationProtectionPropagationError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as ni, isSingleDynamicReferenceToken as nn, getDockerImageBySourceHash as nr, maskerOrIdentity as nt, planFailedOps as o, isRetryableTransientError as oi, recoverMaskedOutput as on, getLegacyStateBucketName as or, isInterruptedWaitError as ot, maskingRetryLogger as p, buildForceUnlockCommand as pn, resolveUseCdkBootstrapAssets as pr, disableInstanceApiTermination as pt, getCurrentResourceSecrets as q, formatDockerLoginError as qn, PartialFailureError as qr, DagBuilder as qt, DeployEngine as r, normalizeAwsError as ri, maskSecretsInError as rn, Synthesizer as rr, beginCommandInterruptScope as rt, planRollback as s, isThrottlingError as si, redactSecretsForState as sn, resolveApp as sr, startInterruptWatch as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as ti, errorCauseChain as tn, AssetManifestLoader as tr, maskDeep as tt, updatePartialMessage as u, markRedactedCause as ui, S3StateBackend as un, resolveSkipPrefix as ur, UNSPECIFIED_SKIP_REASON as ut, buildFinalSnapshotIdentifier as v, DEFAULT_STATE_PREFIX as vn, MIGRATE_TMP_PREFIX as vr, coerceParameterTypedValue as vt, makeCanonicalizePropertiesFn as w, stringifyValue as wn, PARTITION_TABLE as wr, normalizeAwsTagsToCfn as wt, isFinalSnapshotError as x, importableOutputs as xn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as xr, parameterTypeMayLoseSecretIdentity as xt, ccRoutedFinalSnapshotError as y, exportNamesCarriedFrom as yn, findLargeInlineResources as yr, getAccountInfo as yt, red as z, validateContainerRepoName as zn, DependencyError as zr, s3BucketDualStackDomainName as zt };
+//# sourceMappingURL=deploy-engine-DylsbAdu.js.map