@go-to-k/cdkd 0.286.3 → 0.287.0

package/dist/{program-CG34-sQd.js → program-D2Vykejc.js}

@@ -1,8 +1,8 @@
-import { $ as beginCommandInterruptScope, $n as synthesisStatusMessage, $r as withErrorHandling, $t as maskSecretsInError, A as formatResourceLine, An as ensureAssetStorage, At as requireConfigString, B as isExportAliasCollision, Bn as describeDockerCapturedOutput, Bt as INTRINSIC_KEYS, C as unsupportedFinalSnapshotError, Cn as loadPublishableAssetManifest, Cr as processStackMessages, Ct as coerceCfnBoolean, D as isStatefulRecreateTargetForReplace, Dn as AssetModeResolver, Dr as getAwsClients, Dt as replayWarn, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as stripControlChars, Er as AwsClients, Et as readConfigString, F as red, Fn as validateAssetBucketName, Fr as DeployCancelledError, Ft as s3BucketDualStackDomainName, G as collectInlinePolicyNamesManagedBySiblings, Gn as getDockerCmd, Gr as ResourceUpdateNotSupportedError, Gt as STATE_SOURCED_CROSS_GENERATION_RULES, H as stateKeySecretExposure, Hn as describeDockerFailure, Hr as PartialFailureError, Ht as withRetry, I as yellow, In as validateContainerRepoName, Ir as DynamicReferenceRegionAmbiguousError, It as s3BucketRegionalDomainName, J as findActionableSilentDrops, Jn as runDockerForeground, Jt as carriesSecretMask, K as clearOnUpdateRemoval, Kn as partitionSensitiveEnv, Kr as StackHasActiveImportsError, Kt as STATE_SOURCED_READBACK_RULES, L as collectDeclaredOutputNames, Ln as buildDenyExternalAccessPolicy, Lr as IntrinsicResolutionRefusalError, Lt as s3BucketWebsiteUrl, M as cyan, Mn as isCrossRegionRedirect, Mt as producerRegionsFromState, N as gray, Nn as parseBootstrapMarker, Nr as CrossAccountSecretRefusalError, Nt as s3BucketArn, O as isStatefulRecreateTargetSync, On as BOOTSTRAP_MARKER_PREFIX, Or as resetAwsClients, Ot as requireConfigArray, P as green, Pn as readBootstrapMarkerBody, Pt as s3BucketDomainName, Q as maskerOrIdentity, Qn as Synthesizer, Qr as normalizeAwsError, Qt as isSingleDynamicReferenceToken, R as collectPublishedOutputNames, Rn as describeAwsFailure, Rr as LocalInvokeBuildError$1, Rt as applyRoleArnIfSet, S as refusesFinalSnapshot, Sn as createAssetRedirectResolver, Sr as AssemblyReader, St as assertRegionMatch, T as extractDeploymentEventError, Tn as escapeRegExp, Tr as resolveBucketRegion, Tt as configStringRefusal, U as getCurrentResourceSecrets, Un as dockerSpawnEnvWithSensitive, Ur as ProvisioningError, Ut as DagBuilder, V as secretBearingStateKeyWarning, Vn as describeDockerExecFailure, Vr as NestedStackChildDirectDestroyError, Vt as describeTypeWithThrottleRetry, W as IAMRoleProvider, Wn as formatDockerLoginError, Wr as ResourceTimeoutError, Wt as TemplateParser, X as createMaskedRetryLogger, Xn as AssetManifestLoader, Xt as dynamicReferenceTokens, Y as findSilentDropProperties, Yn as runDockerStreaming, Yt as createSecretMasker, Z as maskDeep, Zn as getDockerImageBySourceHash, Zt as errorCauseChain, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shouldRetainResource, _r as displaySafe, _t as parameterTypeMayLoseSecretIdentity, a as DeploymentEventsStore, ai as markRedactedCause, an as LockManager, ar as resolveSkipPrefix, at as slowCcOperationTimeoutMs, b as createPreDeleteFinalSnapshot, bn as WorkGraph, br as canonicalizeRegion, bt as normalizeAwsTagsToCfn, c as replayFailedOperations, cn as UNRENDERABLE, cr as resolveUseCdkBootstrapAssets, ct as deleteSkipReason, d as updatePartialReason, dn as forceQuitRecoveryClause, dr as CFN_TEMPLATE_BODY_LIMIT, dt as IntrinsicFunctionResolver, ei as isMarkedNonRetryable, en as maskSecretsInText, er as getDefaultStateBucketName, et as endCommandInterruptScope, f as withResourceDeadline, fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, fr as CFN_TEMPLATE_URL_LIMIT, ft as carriesDynamicReference, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as importableOutputs, gr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gt as isUnboundTemplateParameter, h as computeImplicitDeleteEdges, hn as importableOutputKeys, hr as uploadCfnTemplate, ht as getAccountInfo, i as DeploymentEventsReader, ii as markNonRetryable, in as scrubResourceRecord, ir as resolveCaptureObservedState, it as CloudControlProvider, j as bold, jn as getBootstrapMarkerKey, jr as CdkdError, jt as classifyReplaySecretRegion, k as renderStatefulReason, kn as assertAssetBucketRegion, kr as setAwsClients, kt as requireConfigObject, l as replayRollback, ln as buildForceUnlockCommand, lr as stateBucketExistenceConfirmed, lt as disableInstanceApiTermination, m as IMPLICIT_DELETE_DEPENDENCIES, mn as exportNamesCarriedFrom, mr as findLargeInlineResources, mt as coerceParameterTypedValue, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as isThrottlingError, nn as recoverMaskedOutput, nr as resolveApp, nt as isInterruptedWaitError, o as planFailedOps, oi as retryClassificationText, on as S3StateBackend, or as resolveStateBucketWithDefault, ot as UNSPECIFIED_SKIP_REASON, p as maskingRetryLogger, pn as DEFAULT_STATE_PREFIX, pr as MIGRATE_TMP_PREFIX, pt as cfnRefValueFromPhysicalId, q as ProviderRegistry, qn as redactDockerArgvValues, qr as StackTerminationProtectionError, qt as TEMPLATE_SOURCED_RULES, r as DeployEngine, ri as isTransientServerError, rn as redactSecretsForState, rr as resolveAutoAssetStorage, rt as startInterruptWatch, s as planRollback, sn as rebuildClientForBucketRegion, sr as resolveStateBucketWithDefaultAndSource, st as deleteIndeterminateGuards, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as isRetryableTransientError, tn as recordMaskOnlyValue, tr as getLegacyStateBucketName, tt as interruptWatchListenerCount, u as updatePartialMessage, un as buildLockContentionMessage, ur as warnDeprecatedNoPrefixCliFlag, ut as isTerminationProtectionPropagationError, v as buildFinalSnapshotIdentifier, vn as AssetPublisher, vr as expectedOwnerParam, vt as refStateLookupFromResource, w as makeCanonicalizePropertiesFn, wn as rewriteTemplateAssetReferences, wt as configBooleanRefusal, x as isFinalSnapshotError, xn as buildAssetRedirectMap, xr as derivePartitionAndUrlSuffix, xt as resolveExplicitPhysicalId, y as ccRoutedFinalSnapshotError, yn as stringifyValue, yr as PARTITION_TABLE, yt as WAFv2WebACLProvider, z as exportAliasCollisionScrubWarning, zn as buildDockerImage, zr as LocalStartServiceError, zt as DiffCalculator } from "./deploy-engine--rkIGhow.js";
+import { $ as findActionableSilentDrops, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as configStringRefusal, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketDualStackDomainName, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as refStateLookupFromResource, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as assertRegionMatch, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as resolveExplicitPhysicalId, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as requireConfigString, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as INTRINSIC_KEYS, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as s3BucketWebsiteUrl, I as cyan, In as isCrossRegionRedirect, It as classifyReplaySecretRegion, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as producerRegionsFromState, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as replayWarn, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigArray, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as coerceCfnBoolean, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as requireConfigObject, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketArn, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as parameterTypeMayLoseSecretIdentity, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as normalizeAwsTagsToCfn, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as applyRoleArnIfSet, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as s3BucketRegionalDomainName, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as DiffCalculator, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as carriesDynamicReference, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as endCommandInterruptScope, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as getAccountInfo, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as startInterruptWatch, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as UNSPECIFIED_SKIP_REASON, en as createSecretMasker, er as escapeRegExp, et as findSilentDropProperties, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as deleteIndeterminateGuards, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as beginCommandInterruptScope, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as readConfigString, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as configBooleanRefusal, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as maskDeep, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as interruptWatchListenerCount, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as deleteSkipReason, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as maskerOrIdentity, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as slowCcOperationTimeoutMs, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as cfnRefValueFromPhysicalId, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as WAFv2WebACLProvider, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as isUnboundTemplateParameter, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as coerceParameterTypedValue, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketDomainName } from "./deploy-engine-B377YKBI.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-D3md0Lde.js";
-import { t as ASGProvider } from "./asg-provider-uaOnRUMe.js";
+import { t as getCdkdVersion } from "./version-Rs7TV7Gz.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-D10GWdiA.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -745,6 +745,32 @@ function parseRecreateViaSdkProviderToken(value, previous) {
 	if (!LOGICAL_ID_FORMAT.test(token)) throw new Error(`Invalid --recreate-via-sdk-provider value "${value}": expected a CloudFormation logical id (alphanumeric, starts with a letter, max 255 chars). One --recreate-via-sdk-provider flag per resource — repeat the flag for additional targets.`);
 	return [...previous ?? [], token];
 }
+/**
+* Issue [#2719] — `--pin-cc-api <logicalId>` keeps a named resource on the
+* Cloud Control route for this deploy, suppressing the `'sdk-coverage'`
+* sticky-exemption that would otherwise return it to its SDK provider.
+*
+* The lightweight counterpart to `--recreate-via-cc-api`: that one forces the
+* CC layer by DESTROYING and recreating the resource, which is not something a
+* user can do to a stateful resource just to decline a routing change. This
+* one changes only which provider runs the update.
+*
+* Deliberately per-deploy rather than a state field. A persisted pin would be
+* a v10 schema bump plus its migration integ, and nothing has yet shown a user
+* needing the pin to survive a deploy they did not pass it on -- the flip is
+* conditioned on the resource's own coverage, so the case it guards against is
+* "I disagree with this specific deploy's routing", not a standing preference.
+*
+* It does NOT override a `'cc-broken'` exemption: honoring it there would pin
+* the resource to a handler that cannot manage it, which is the bug those
+* entries exist to escape.
+*/
+function parsePinCcApiToken(value, previous) {
+	const token = value.trim();
+	if (!LOGICAL_ID_FORMAT.test(token)) throw new Error(`Invalid --pin-cc-api value "${value}": expected a CloudFormation logical id (alphanumeric, starts with a letter, max 255 chars). One --pin-cc-api flag per resource — repeat the flag for additional targets.`);
+	return [...previous ?? [], token];
+}
+const pinCcApiOption = new Option("--pin-cc-api <logicalId>", "Keep the named resource (by CloudFormation logical id) on the Cloud Control route in this deploy, declining the automatic return to the SDK Provider that a type-level sdk-coverage exemption would otherwise apply to a resource recorded as provisionedBy: cc-api. Repeatable — pass the flag once per resource. Has no effect on a resource already on the SDK path, and does not override an exemption admitted because Cloud Control cannot manage the type.").argParser(parsePinCcApiToken);
 const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <logicalId>", "Destroy + recreate the named resource (by CloudFormation logical id) via cdkd's SDK Provider in this deploy, so a resource currently sticky on provisionedBy: cc-api flips back to provisionedBy: sdk. Used after a #609 backfill release adds SDK coverage for a type the user originally needed CC for (e.g. Lambda LoggingConfig). Repeatable — pass the flag once per resource. Per-resource opt-in. Stateful resource types refuse unless --force-stateful-recreation is ALSO passed.").argParser(parseRecreateViaSdkProviderToken);
 /**
 * Issue [#615] — `--force-stateful-recreation` (boolean) confirms a
@@ -874,6 +900,7 @@ const deployOptions = [
 	allowUnsupportedPropertiesOption,
 	recreateViaCcApiOption,
 	recreateViaSdkProviderOption,
+	pinCcApiOption,
 	forceStatefulRecreationOption,
 	replaceOption,
 	useCdkBootstrapAssetsOption,
@@ -2579,6 +2606,31 @@ function isPromptAbortError(error) {
 * intent** — does the user want SDK + silent drop, or CC migration?
 * Fail fast and let the user pick one strategy per resource.
 */
+const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
+/**
+* The CFn type of a nested stack's row in its PARENT's template. It decides
+* both the refusal (`blockedNestedStackTargets`) and the evidence the
+* unknown-id note renders (`nestedStackLogicalIds`) — so within this module it
+* is spelled once, or the note could name ids the validator does not refuse.
+*
+* The two are NOT the same set, and deliberately so. The refusal fires when
+* EITHER the state record or the template says nested, because the two types
+* select different halves of the destructive path: the TEMPLATE's type picks
+* the provider that deletes the old resource (a Type change emits an UPDATE
+* carrying `resourceType: desiredResource.Type`, which is what
+* `oldDeleteProvider` resolves from), while the STATE's type is what
+* `NestedStackProvider` owns and derives `<parent>~<logicalId>` from. The note
+* keys on the TEMPLATE alone, because it is telling the user what their current
+* template contains. Which type governs was argued from plausibility twice and
+* settled by reading `analyzer/diff-calculator.ts` and `deploy-engine.ts`'s
+* `oldDeleteProvider`; do not re-derive it from either name. Other modules spell it
+* for themselves rather than sharing one export: the only EXPORTED copy lives
+* in `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
+* from the deployment layer would invert the dependency direction. (No count of
+* the other spellings is given here on purpose — an unfenced number in a
+* comment is a number that goes stale.)
+*/
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /**
 * Plan-time validation of the user's recreate-via-cc-api list.
 *
@@ -2592,7 +2644,6 @@ function isPromptAbortError(error) {
 * Input order is preserved; duplicate logical ids in the user's input
 * are deduplicated.
 */
-const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
 function validateRecreateTargets(input) {
 	const seenCcApi = new Set(input.recreateViaCcApi);
 	const seenSdk = new Set(input.recreateViaSdkProvider ?? []);
@@ -2605,6 +2656,7 @@ function validateRecreateTargets(input) {
 	const ambiguousIntentSdk = [];
 	const blockedStatefulTargets = [];
 	const blockedMultiRegionTargets = [];
+	const blockedNestedStackTargets = [];
 	const blockedAlreadySdk = [];
 	const blockedAlreadyCcApi = [];
 	const blockedNoSdkProvider = [];
@@ -2635,11 +2687,12 @@ function validateRecreateTargets(input) {
 			logicalId,
 			resourceType,
 			physicalId: recordedResource.physicalId,
-			statefulReason: isStatefulRecreateTargetSync(resourceType, recordedResource.properties),
+			statefulReason: isStatefulRecreateTargetSync(resourceType, recordedResource.properties, recordedResource.observedProperties),
 			direction
 		};
 		targets.push(target);
 		if (MULTI_REGION_RECREATE_BLOCKED_TYPES.has(resourceType)) blockedMultiRegionTargets.push(target);
+		if (resourceType === NESTED_STACK_RESOURCE_TYPE$1 || templateResource.Type === NESTED_STACK_RESOURCE_TYPE$1) blockedNestedStackTargets.push(target);
 		if (direction === "to-cc-api") {
 			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, EMPTY_ALLOW_SET$1);
 			for (const { property } of actionableDrops) {
@@ -2671,10 +2724,12 @@ function validateRecreateTargets(input) {
 		ambiguousIntentSdk,
 		blockedStatefulTargets,
 		blockedMultiRegionTargets,
+		blockedNestedStackTargets,
 		blockedAlreadySdk,
 		blockedAlreadyCcApi,
 		blockedNoSdkProvider,
-		conflictingDirections
+		conflictingDirections,
+		nestedStackLogicalIds: Object.entries(input.template.Resources ?? {}).filter(([, resource]) => resource?.Type === NESTED_STACK_RESOURCE_TYPE$1).map(([id]) => id)
 	};
 }
 /**
@@ -2691,6 +2746,8 @@ function renderRecreateTargetsErrors(validation) {
 		lines.push(`${FLAG_UMBRELLA} named ${validation.unknownLogicalIds.length} logical id(s) not present in the synth template:`);
 		for (const id of validation.unknownLogicalIds) lines.push(`  - ${id}`);
 		lines.push("  Fix: confirm each id exists in the template (CDK display path is the parent; the logical id is the CFn-emitted name, e.g. cdkd synth | jq '.Resources | keys'). Recreate operates on the synth template's logical ids, not CDK display paths.");
+		lines.push("  Note: each stack of this deploy validates this WHOLE flag list against its OWN template, so an id declared by a different stack of the same run is reported here as unknown. Name it in a deploy of only that stack.");
+		if (validation.nestedStackLogicalIds.length > 0) lines.push(`  Note: resources inside a nested stack are NOT addressable — the flags name logical ids of the stack being deployed, and this template's nested stack(s) (${validation.nestedStackLogicalIds.join(", ")}) carry their own. A logical id that a nested child happens to share with a top-level resource recreates the TOP-LEVEL one only, and the nested stack row itself is refused as a target.`);
 	}
 	if (validation.missingFromState.length > 0) {
 		if (lines.length > 0) lines.push("");
@@ -2709,6 +2766,16 @@ function renderRecreateTargetsErrors(validation) {
 		lines.push(`${FLAG_UMBRELLA} would destroy + recreate ${validation.blockedStatefulTargets.length} stateful resource(s). Recreate loses ALL data — no automatic data migration. Re-run with --force-stateful-recreation to acknowledge the data-loss footgun.`);
 		for (const blocked of validation.blockedStatefulTargets) lines.push(`  - ${blocked.logicalId} (${blocked.resourceType}) — ${renderStatefulReason(blocked.statefulReason)}`);
 	}
+	if (validation.blockedNestedStackTargets.length > 0) {
+		if (lines.length > 0) lines.push("");
+		lines.push(`${FLAG_UMBRELLA} refuses to operate on ${validation.blockedNestedStackTargets.length} nested-stack resource(s):`);
+		for (const blocked of validation.blockedNestedStackTargets) {
+			const templateType = validation.nestedStackLogicalIds.includes(blocked.logicalId) ? NESTED_STACK_RESOURCE_TYPE$1 : void 0;
+			const shown = templateType && templateType !== blocked.resourceType ? `${blocked.resourceType} in state, ${templateType} in the template` : blocked.resourceType;
+			lines.push(`  - ${blocked.logicalId} (${shown})`);
+		}
+		lines.push("  Recreating one would DELETE the whole child stack — every resource it owns, with no per-resource confirmation — and re-create it through a layer that does not implement cdkd's nested-stack handling. Where cdkd holds no state for that child, the delete is a no-op instead and the old resource is silently left behind. There is no --force-stateful-recreation bypass. A resource inside a child is not addressable by these flags at all.");
+	}
 	if (validation.blockedMultiRegionTargets.length > 0) {
 		if (lines.length > 0) lines.push("");
 		lines.push(`--recreate-via-cc-api / --recreate-via-sdk-provider refuses to operate on ${validation.blockedMultiRegionTargets.length} multi-region resource(s) — out of scope for v1 of these flags (the destroy + recreate cycle across replica regions is more involved than the single-region path):`);
@@ -3072,7 +3139,7 @@ async function promptRecreateConfirm(input) {
 	else if (toCcCount > 0) logger.warn(`--recreate-via-cc-api will destroy + recreate ${toCcCount} resource(s) via Cloud Control API on stack ${input.stackName}:`);
 	else logger.warn(`--recreate-via-sdk-provider will destroy + recreate ${toSdkCount} resource(s) via SDK Provider on stack ${input.stackName}:`);
 	for (const t of input.targets) {
-		const rederivedReason = t.statefulReason === null && input.forceStatefulRecreation ? isStatefulRecreateTargetForReplace(t.resourceType, void 0) : null;
+		const rederivedReason = t.statefulReason === null && input.forceStatefulRecreation ? isStatefulRecreateTargetForReplace(t.resourceType, void 0, void 0) : null;
 		const rederived = rederivedReason !== null;
 		const reason = t.statefulReason ?? rederivedReason;
 		const stateful = reason !== null;
@@ -3105,6 +3172,32 @@ async function promptRecreateConfirm(input) {
 	}
 }
 
+//#endregion
+//#region src/cli/commands/pin-cc-api-reachability.ts
+function analyzePinCcApiReachability(pinnedLogicalIds, stacks) {
+	const idSets = stacks.map((s) => ({
+		stackName: s.stackName,
+		ids: new Set(s.logicalIds)
+	}));
+	const unmatched = [];
+	const partial = [];
+	for (const logicalId of [...new Set(pinnedLogicalIds)]) {
+		const appliesTo = idSets.filter((t) => t.ids.has(logicalId)).map((t) => t.stackName);
+		const absentFrom = idSets.filter((t) => !t.ids.has(logicalId)).map((t) => t.stackName);
+		if (appliesTo.length === 0) unmatched.push(logicalId);
+		else if (absentFrom.length > 0) partial.push({
+			logicalId,
+			appliesTo,
+			absentFrom
+		});
+	}
+	return {
+		unmatched,
+		partial,
+		errorMessage: unmatched.length === 0 ? "" : `--pin-cc-api named ${unmatched.length} logical id(s) present in no stack of this run:\n` + unmatched.map((id) => `  - ${id}`).join("\n") + `\n  Stacks in this run: ${idSets.map((t) => t.stackName).join(", ")}\n  Fix: pass the CFn-emitted logical id, not the CDK display path (\`cdkd synth\`, then read \`.Resources | keys\`). A resource inside a NESTED child stack cannot be pinned from its parent's deploy — name it in a deploy of that child.`
+	};
+}
+
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
@@ -15996,209 +16089,6 @@ function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-//#endregion
-//#region src/provisioning/dynamodb-warm-throughput.ts
-/**
-* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
-* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
-*
-* `WarmThroughput` is the same CloudFormation block on both types, and both
-* providers have to answer the same two questions about it before an
-* `UpdateTable` / `CreateTable` goes out:
-*
-*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
-*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
-*     came back from an `Fn::Sub` — arrives as a STRING and must not be
-*     forwarded verbatim into a numeric `Long` field.
-*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
-*     only ever rises with a table's traffic and AWS REJECTS a call that
-*     lowers it (`decreasing WarmThroughput is not supported`, measured live
-*     us-east-1 2026-08-13 for issue #1768).
-*
-* **Provenance, stated precisely because it is easy to over-claim.** Exactly
-* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
-* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
-* existed outside the change that created this file (issue #1857). So this is
-* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
-* behaviour changed for either type when it moved here.
-*
-* What WAS compared is the lifted rule against the GlobalTable spelling
-* drafted alongside it, over the shapes both had to answer (a quoted numeric
-* string, a partially usable block, a mixed decrease/increase, an absent live
-* value, a zero, a negative, a non-numeric string, a whitespace string, an
-* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
-* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
-* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
-* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
-* since `'   '` is not a capacity anyone declared and a warm throughput of 0
-* is not a request AWS can honour. That is a DRAFT reconciled against a
-* shipped rule, which is worth less than two shipped rules agreeing — the
-* reason to read the probe list as a design note rather than as field
-* evidence.
-*
-* Living here rather than in either provider is the point. A decrease guard is
-* three clauses that all FAIL OPEN for different reasons, and two files
-* spelling it independently is two chances for a later "fix" to change one of
-* them — at which point the sibling type silently keeps the old answer, and
-* nothing in the tree says which is intended. Same class as
-* `emr-configuration.ts`, and the same reason.
-*
-* Deliberately NOT here: everything only ONE provider has. The `Table` side's
-* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
-* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
-* and already-matches gates, which `GlobalTable` has no counterpart to (issue
-* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
-* comparison sides unconditionally, so drift never asks the question there);
-* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
-* `ThroughputDiagnostic` that only that provider's collector understands.
-* Moving a helper with one caller here would buy nothing and cost a hop.
-*
-* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
-*/
-/**
-* The two `WarmThroughput` members, in the ONE order every message, every
-* comparison and every emitted block uses. A shared order is what makes two
-* blocks carrying the same numbers compare equal by `deepEqual` and serialize
-* to the same wire bytes regardless of the order the template wrote them in.
-*/
-const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
-/**
-* A CloudFormation-borne numeric property, or `undefined` when the value is
-* not a usable number.
-*
-* Plain `Number()` coercion is NOT good enough and the tree learned it three
-* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
-* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
-* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
-* string would be forwarded as a request for zero units.
-*
-* A YAML-borne numeric STRING is still accepted, because that is a real
-* template shape and `'12000'` genuinely means 12000.
-*
-* EXPORTED, and not because warm throughput needs it exported. This exact rule
-* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
-* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
-* `toFiniteNumber` (a different spelling of the same total function) — which is
-* precisely the divergence this module exists to stop: the next "fix" to one of
-* them would have left the other two answering differently, with nothing in the
-* tree saying which was intended. It reads `ReadCapacityUnits` /
-* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
-* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
-* stringly-typed CFn value a number I can send?".
-*/
-function toFiniteNumber(value) {
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value === "string" && value.trim() !== "") {
-		const n = Number(value);
-		return Number.isFinite(n) ? n : void 0;
-	}
-}
-/**
-* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
-* fields accept, PER MEMBER.
-*
-* PER MEMBER, not whole-block, and that distinction is the point: a block
-* whose write half is an unresolved intrinsic still has a perfectly good read
-* half, and dropping both would silently discard a value the template really
-* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
-* warning can say which half went missing instead of reporting the whole
-* property.
-*
-* A block with NO usable member yields `spec: undefined` — refused rather than
-* forwarded, because forwarding a malformed block surfaces as an opaque AWS
-* validation error naming neither cdkd nor the property. `droppedMembers` is
-* still populated in that case, so a REFUSAL message can name what it refused;
-* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
-* array) has no member to name and reports none, which is what lets a caller
-* word "one half went missing" differently from "the block is unusable".
-*
-* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
-* own message, so the wording stays consistent across that provider's send
-* sites without forcing one wording across both providers.
-*/
-function coerceWarmThroughput$1(raw) {
-	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
-	const bag = raw;
-	const spec = {};
-	const droppedMembers = [];
-	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (bag[member] === void 0) continue;
-		const coerced = toFiniteNumber(bag[member]);
-		if (coerced === void 0) {
-			droppedMembers.push(member);
-			continue;
-		}
-		spec[member] = coerced;
-	}
-	if (Object.keys(spec).length === 0) return { droppedMembers };
-	return {
-		spec,
-		droppedMembers
-	};
-}
-/**
-* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
-* reports.
-*
-* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
-* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
-*
-* ```
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
-*   ValidationException: One or more parameter values were invalid: Requested
-*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
-*   WarmThroughput, decreasing WarmThroughput is not supported
-* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
-* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
-* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
-* ```
-*
-* So the value is one AWS raises with the table's traffic and never lowers,
-* and a decrease is REJECTED rather than accepted-and-ignored — which is what
-* had to be measured before choosing, because the two produce different
-* correct answers. The caller SKIPS the call on a true here.
-*
-* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
-* makes the verdict describe a request that is not the one being sent (a
-* dropped member is not part of the call and must not be part of the
-* comparison).
-*
-* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
-* leave AWS as the authority — because a false positive here silently drops a
-* legitimate INCREASE, which is a real capacity change the user asked for,
-* while a false negative merely reproduces the pre-fix behaviour of an
-* AWS-side rejection that names the property:
-*  - DECLARED members only. An absent member is not a request to lower
-*    anything, so it takes no part in the verdict.
-*  - MIXED is not a decrease. One member below live and the other above means
-*    the call carries a genuine increase; AWS decides.
-*  - An absent or unusable LIVE counterpart is not a decrease. Without a
-*    number to compare against there is no evidence of one. Only the LIVE side
-*    can reach that arm: the desired side is a COERCED spec, so a malformed
-*    template value has already been dropped by {@link coerceWarmThroughput}.
-*
-* A decrease therefore requires every declared member to be at-or-below live
-* AND at least one to be strictly below.
-*
-* The skip this drives is right for EVERY `update()` caller — the deploy
-* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
-* because none of them can make AWS lower the value, so none loses anything a
-* doomed call would have achieved.
-*/
-function isWarmThroughputDecrease(desired, live) {
-	if (desired === void 0 || live === void 0) return false;
-	let sawDecrease = false;
-	for (const member of WARM_THROUGHPUT_MEMBERS) {
-		if (desired[member] === void 0) continue;
-		const wanted = toFiniteNumber(desired[member]);
-		const current = toFiniteNumber(live[member]);
-		if (wanted === void 0 || current === void 0) return false;
-		if (wanted > current) return false;
-		if (wanted < current) sawDecrease = true;
-	}
-	return sawDecrease;
-}
-
 //#endregion
 //#region src/provisioning/dynamodb-index-busy-delete.ts
 /**
@@ -19969,9 +19859,27 @@ var DynamoDBGlobalTableProvider = class {
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		const debug = (message) => this.logger.debug(maskSecrets(message));
 		debug(`Updating DynamoDB GlobalTable ${logicalId}: ${maskSecrets(physicalId)}`);
-		if (properties["TableName"] !== void 0 && previousProperties["TableName"] !== void 0 && properties["TableName"] !== previousProperties["TableName"]) throw new ProvisioningError(`TableName is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
-		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual$1(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
-		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; replacement required (deploy with --replace, or destroy + redeploy)`, resourceType, logicalId, physicalId);
+		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+		const replaceRemedy = async () => {
+			let guardRegion = "";
+			try {
+				guardRegion = await this.dynamoDBClient.config.region() ?? "";
+			} catch {
+				guardRegion = "";
+			}
+			return extractLocalDeletionProtection(previousProperties, guardRegion) === true ? protectedReplacementAdvice({
+				evidence: "cdkd's recorded properties for this table carry DeletionProtectionEnabled: true for the deploy region",
+				replaceFlags,
+				disable: {
+					before: "aws dynamodb update-table --table-name",
+					identifier: physicalId,
+					after: "--no-deletion-protection-enabled"
+				}
+			}) : `replacement required (deploy with ${replaceFlags}, or destroy + redeploy)`;
+		};
+		if (properties["TableName"] !== void 0 && previousProperties["TableName"] !== void 0 && properties["TableName"] !== previousProperties["TableName"]) throw new ProvisioningError(`TableName is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
+		if (properties["KeySchema"] !== void 0 && previousProperties["KeySchema"] !== void 0 && !deepEqual$1(properties["KeySchema"], previousProperties["KeySchema"])) throw new ProvisioningError(`KeySchema is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
+		if (properties["LocalSecondaryIndexes"] !== void 0 && previousProperties["LocalSecondaryIndexes"] !== void 0 && !deepEqual$1(properties["LocalSecondaryIndexes"], previousProperties["LocalSecondaryIndexes"])) throw new ProvisioningError(`LocalSecondaryIndexes is immutable on AWS::DynamoDB::GlobalTable; ${await replaceRemedy()}`, resourceType, logicalId, physicalId);
 		const oldAttrs = previousProperties["AttributeDefinitions"] ?? [];
 		const newAttrs = properties["AttributeDefinitions"] ?? [];
 		const desiredKeyAttrNames = collectDesiredKeyAttributeNames(properties);
@@ -19984,7 +19892,7 @@ var DynamoDBGlobalTableProvider = class {
 			const describeResp = await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }));
 			const tableArn = describeResp.Table?.TableArn;
 			const extractLocalTags = (props) => {
-				return (props["Replicas"] ?? []).find((r) => r["Region"] === currentRegion)?.["Tags"];
+				return localReplicaEntry(props, currentRegion)?.["Tags"];
 			};
 			if (tableArn) await this.applyTagDiff(tableArn, extractLocalTags(previousProperties), extractLocalTags(properties));
 			const liveWarmByIndexName = /* @__PURE__ */ new Map();
@@ -21034,7 +20942,7 @@ var DynamoDBGlobalTableProvider = class {
 				return entry;
 			}));
 			result["Replicas"] = replicas;
-			const localReplicaEntry = replicas.find((r) => r["Region"] === currentRegion);
+			const localReplica = replicas.find((r) => r["Region"] === currentRegion);
 			if (table.GlobalSecondaryIndexes && table.GlobalSecondaryIndexes.length > 0) {
 				const cfnIndexes = [];
 				const replicaIndexEntries = [];
@@ -21065,11 +20973,11 @@ var DynamoDBGlobalTableProvider = class {
 					if (Object.keys(replicaEntry).length > 1) replicaIndexEntries.push(replicaEntry);
 				}
 				result["GlobalSecondaryIndexes"] = cfnIndexes;
-				if (localReplicaEntry && replicaIndexEntries.length > 0) localReplicaEntry["GlobalSecondaryIndexes"] = replicaIndexEntries;
+				if (localReplica && replicaIndexEntries.length > 0) localReplica["GlobalSecondaryIndexes"] = replicaIndexEntries;
 			}
 			if (table.OnDemandThroughput?.MaxWriteRequestUnits !== void 0) result["WriteOnDemandThroughputSettings"] = { MaxWriteRequestUnits: table.OnDemandThroughput.MaxWriteRequestUnits };
 			else result["WriteOnDemandThroughputSettings"] = {};
-			if (localReplicaEntry && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) localReplicaEntry["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
+			if (localReplica && table.OnDemandThroughput?.MaxReadRequestUnits !== void 0) localReplica["ReadOnDemandThroughputSettings"] = { MaxReadRequestUnits: table.OnDemandThroughput.MaxReadRequestUnits };
 			if (billingMode === "PROVISIONED") {
 				const autoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:table:WriteCapacityUnits");
 				if (autoScaling) result["WriteProvisionedThroughputSettings"] = { WriteCapacityAutoScalingSettings: autoScaling };
@@ -21638,10 +21546,29 @@ var DynamoDBGlobalTableProvider = class {
 	}
 };
 /**
-* Diff CFn `Replicas[]` arrays. Keyed by `Region`. Returns adds, removes,
-* and modifies (entries whose other keys — KMSMasterKeyId,
-* GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
+* The `Replicas[]` entry for `region`, or `undefined`.
+*
+* ONE predicate, because two readers of the same field had drifted: issue
+* [#2610]'s review round guarded `extractLocalDeletionProtection` against a
+* non-array `Replicas` and left `update()`'s inline `extractLocalTags` on the
+* old `(props['Replicas'] ?? []) as Array<...>` -- which is the one that
+* actually throws FIRST on the apply path, ~400 lines earlier in the same
+* method, so guarding only the other produced no visible change and no test
+* went red. A shared predicate is what stops the next reader inheriting the
+* unguarded spelling; `derivePerCallProvisionedThroughput` documents the same
+* hazard for the same field and guards independently.
+*
+* `Array.isArray`, not `?? []`: a non-array `Replicas` -- an unresolved
+* intrinsic, or a hand-edited state record -- makes `.find` throw a bare
+* `TypeError`, and since [#2610] one caller sits on the REFUSAL path, where a
+* throw REPLACES three informative `ProvisioningError`s with a stack trace.
+* The `r?.` guards a null ENTRY inside an otherwise-valid array.
 */
+function localReplicaEntry(props, region) {
+	const raw = props["Replicas"];
+	if (!Array.isArray(raw)) return void 0;
+	return raw.find((r) => r?.["Region"] === region);
+}
 /**
 * Extract the local replica's `DeletionProtectionEnabled` from a CFn
 * properties shape. The `AWS::DynamoDB::GlobalTable` CFn schema places
@@ -21657,7 +21584,7 @@ var DynamoDBGlobalTableProvider = class {
 * the SDK call.
 */
 function extractLocalDeletionProtection(props, region) {
-	const perReplica = (props["Replicas"] ?? []).find((r) => r["Region"] === region)?.["DeletionProtectionEnabled"];
+	const perReplica = localReplicaEntry(props, region)?.["DeletionProtectionEnabled"];
 	if (typeof perReplica === "boolean") return perReplica;
 	const topLevel = props["DeletionProtectionEnabled"];
 	return typeof topLevel === "boolean" ? topLevel : void 0;
@@ -22916,6 +22843,11 @@ function collectTableOnDemandCeilings(properties, region, diagnostics, maskSecre
 		}
 	};
 }
+/**
+* Diff CFn `Replicas[]` arrays. Keyed by `Region`. Returns adds, removes,
+* and modifies (entries whose other keys — KMSMasterKeyId,
+* GlobalSecondaryIndexes, TableClassOverride — differ from the old shape).
+*/
 function diffReplicas(oldReplicas, newReplicas) {
 	const oldByRegion = /* @__PURE__ */ new Map();
 	const newByRegion = /* @__PURE__ */ new Map();
@@ -22984,6 +22916,75 @@ function deepEqual$1(a, b) {
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
 /**
+* Refuse a `RetentionInDays` the send path cannot USE (issue [#2521]).
+*
+* **The scope of this refusal is a TEST, not a paragraph.** Every review round
+* on issue [#2521] found a hole in a PROSE statement of it — a coercible
+* negative that fell through to `DeleteRetentionPolicy`, an unusable value
+* silenced by the wrong change gate, wrong cells in the hand-written table
+* that replaced those sentences, and then the one non-finite number
+* JavaScript makes FALSY. No count is given here: the count itself drifted
+* between this comment and the changelog, which is the same failure one level
+* up. The table now lives in
+* `tests/unit/provisioning/logs-loggroup-provider-retention-coercion.test.ts`
+* as `CREATE_MATRIX` / `UPDATE_MATRIX`: one row per (value, previous) pair,
+* each asserting which AWS call goes out, each carrying what the pre-#2521
+* code did. Read a change against those rows and add one for any pair they do
+* not cover; do not restate the rule here, because a fourth restatement is
+* the thing that keeps being wrong.
+*
+* THREE refusal CASES across TWO `throw` statements — the non-finite guard
+* clause at the top of the body has its own, and the other two share the
+* second, differing only in the `detail` clause. Only the WHY of each:
+*
+*  - **a non-finite NUMBER** (`NaN`, `Infinity`, `-Infinity`). It sits ahead
+*    of the falsy return because `NaN` is FALSY: without it that value exits
+*    early, fails the `> 0` send test and reaches `DeleteRetentionPolicy`,
+*    while its two siblings — truthy — were already refused. Leaving one
+*    member of a family out is the inconsistency the negative arm below
+*    introduced, so the arm names the family.
+*  - **not a number at all** (`'  '`, `'abc'`, `[]`, `{}`, `true`). The
+*    pre-coercion code tested `if (properties['RetentionInDays'])` and handed
+*    the raw value to `PutRetentionPolicyCommand`, so CloudWatch Logs rejected
+*    it. Refusing moves that rejection one layer earlier and names the
+*    property.
+*  - **a NEGATIVE number** (`-1`, `'-1'`). It coerces, so a refusal gated on
+*    coercibility alone let it through; it then failed the `> 0` send test and
+*    fell into the UPDATE path's `else`, which issues
+*    `DeleteRetentionPolicy` — a template typo SILENTLY REMOVING a live
+*    retention where the old code sent `-1` and failed loudly.
+*
+* The FALSY values pass through, as they did before — `0`, `''`, `false`,
+* `null` and absent; `NaN` is the one exception, refused above because it is a
+* malformed number rather than a spelling of "no retention".
+*
+* `'0'` is TRUTHY, so it reaches this function and passes too: zero is
+* what {@link LogsLogGroupProvider.readCurrentState} records for a group with
+* no retention policy, and CloudFormation coerces `'0'` to `0`, so routing the
+* string to the same arm as the number is the consistency the coercion is for.
+* On the UPDATE path against a live positive retention that is a real change —
+* it DELETES where the old code sent and was rejected — and `UPDATE_MATRIX`
+* pins it.
+*
+* The message names the value's TYPE and never the value. A provider's
+* `properties` bag arrives with dynamic references already RESOLVED, so a
+* `{{resolve:secretsmanager:...}}` scalar is PLAINTEXT by the time it reaches
+* here, and this function has no masker to thread — `create()` takes no
+* `CreateContext` and `applyUpdate` no `UpdateContext`
+* (`.claude/rules/provider-masking.md`). Interpolating it as
+* `${JSON.stringify(raw)}` was the first draft and
+* `vp run audit:provider-secret-mask:check` refused it — but read that as one
+* SPELLING being fenced, not the rule: the critic's population is
+* interpolated `JSON.stringify` calls, so a bare `${raw}` here would leave it
+* green. Do not put the value back without threading the capability first.
+*/
+function assertUsableRetention(raw, coerced, logicalId, resourceType) {
+	if (typeof raw === "number" && !Number.isFinite(raw)) throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); the template declares a non-finite number`, resourceType, logicalId);
+	if (!raw) return;
+	if (coerced !== void 0 && coerced >= 0) return;
+	throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); ${coerced === void 0 ? `the template's value is of type ${Array.isArray(raw) ? "array" : typeof raw} and does not parse as a finite number` : "the template declares a negative number"}`, resourceType, logicalId);
+}
+/**
 * AWS CloudWatch Logs LogGroup Provider
 *
 * Implements resource provisioning for AWS::Logs::LogGroup using the CloudWatch Logs SDK.
@@ -23064,8 +23065,10 @@ var LogsLogGroupProvider = class {
 				else throw createError;
 			}
 			try {
-				const retentionInDays = properties["RetentionInDays"];
-				if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
+				const rawRetention = properties["RetentionInDays"];
+				const retentionInDays = toFiniteNumber(rawRetention);
+				assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+				if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 					logGroupName,
 					retentionInDays
 				}));
@@ -23135,14 +23138,14 @@ var LogsLogGroupProvider = class {
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating log group ${logicalId}: ${physicalId}`);
 		const normalizeClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 		const prevClass = normalizeClass(previousProperties["LogGroupClass"]);
@@ -23151,6 +23154,13 @@ var LogsLogGroupProvider = class {
 			const replaceFlags = "--replace --force-stateful-recreation";
 			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
+		const rawRetention = properties["RetentionInDays"];
+		const rawPreviousRetention = previousProperties["RetentionInDays"];
+		const renderedRetention = JSON.stringify(rawRetention);
+		const sameRawRetention = Object.is(rawRetention, rawPreviousRetention) || renderedRetention !== void 0 && renderedRetention !== "null" && renderedRetention === JSON.stringify(rawPreviousRetention);
+		const retentionInDays = toFiniteNumber(rawRetention);
+		const oldRetentionInDays = toFiniteNumber(rawPreviousRetention);
+		if (!sameRawRetention) assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -23160,8 +23170,7 @@ var LogsLogGroupProvider = class {
 			else await this.logsClient.send(new DisassociateKmsKeyCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Updated KMS key association for log group ${physicalId}`);
 		}
-		const retentionInDays = properties["RetentionInDays"];
-		if (retentionInDays !== previousProperties["RetentionInDays"]) if (retentionInDays) await this.logsClient.send(new PutRetentionPolicyCommand({
+		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 			logGroupName: physicalId,
 			retentionInDays
 		}));
@@ -37258,7 +37267,15 @@ var ELBv2Provider = class {
 			for (const [k, v] of Object.entries(p)) if (!handledKeys.has(k)) out[k] = v;
 			return out;
 		};
-		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
+		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + (this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
+			evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
+			replaceFlags: "cdkd deploy --replace",
+			disable: {
+				before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
+				identifier: physicalId,
+				after: "--attributes Key=deletion_protection.enabled,Value=false"
+			}
+		}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
 		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
@@ -43897,7 +43914,7 @@ var CognitoUserPoolProvider = class {
 			if (properties["SmsVerificationMessage"] !== void 0) updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
 			if (properties["UserPoolTier"]) updateParams.UserPoolTier = properties["UserPoolTier"];
 			await this.getClient().send(new UpdateUserPoolCommand(updateParams));
-			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"]);
+			await this.reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, properties["Schema"], previousProperties["Schema"], (properties["DeletionProtection"] ? properties["DeletionProtection"] : previousProperties["DeletionProtection"]) === "ACTIVE");
 			await this.applyMfaConfig(physicalId, properties, mfaConfiguration, {
 				...liveMfa?.value !== void 0 ? { liveMfaConfiguration: liveMfa.value } : {},
 				...liveMfa?.failed === true ? { liveReadFailed: true } : {},
@@ -43939,7 +43956,7 @@ var CognitoUserPoolProvider = class {
 	*    attribute, requires replacement -> ResourceUpdateNotSupportedError.
 	* A byte-identical Schema is a no-op (no AddCustomAttributes call).
 	*/
-	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema) {
+	async reconcileSchemaCustomAttributes(logicalId, physicalId, resourceType, newSchema, oldSchema, deletionProtected = false) {
 		const newAttrs = newSchema ?? [];
 		const oldAttrs = oldSchema ?? [];
 		for (const attr of newAttrs) if (attr.Name === void 0) throw new ProvisioningError(`Cognito User Pool ${logicalId} has a Schema attribute with no Name — every Schema entry must have a Name`, resourceType, logicalId, physicalId);
@@ -43964,7 +43981,20 @@ var CognitoUserPoolProvider = class {
 			...modified.map((n) => `modified attribute '${n}'`),
 			...addedStandard.map((n) => `added standard attribute '${n}'`)
 		];
-		if (immutableChanges.length > 0) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. AWS::Cognito::UserPool is a stateful type, so re-run with cdkd deploy --replace --force-stateful-recreation to recreate it (this deletes all users in the pool)`);
+		if (immutableChanges.length > 0) {
+			const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+			const remedy = deletionProtected ? protectedReplacementAdvice({
+				evidence: "cdkd's properties for this user pool carry DeletionProtection: ACTIVE",
+				replaceFlags,
+				disable: {
+					before: "aws cognito-idp update-user-pool --user-pool-id",
+					identifier: physicalId,
+					after: "--deletion-protection INACTIVE",
+					caveat: "Note UpdateUserPool's behaviour on an omitted member differs per field, and is unmeasured for DeletionProtection, so send your complete pool configuration alongside that flag rather than the flag alone."
+				}
+			}) : `AWS::Cognito::UserPool is a stateful type, so re-run with ${replaceFlags} to recreate it (this deletes all users in the pool).`;
+			throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `the Schema change (${immutableChanges.join("; ")}) is immutable on AWS — AWS can only ADD custom attributes in place, so removing or modifying an attribute requires recreating the pool. ${remedy}`);
+		}
 		const addedCustom = added.filter((a) => a.Name !== void 0 && !STANDARD_USER_POOL_ATTRIBUTES.has(a.Name));
 		if (addedCustom.length === 0) return;
 		this.logger.debug(`Adding ${addedCustom.length} custom attribute(s) to ${physicalId}: ` + addedCustom.map((a) => a.Name).join(", "));
@@ -52048,7 +52078,7 @@ var SchedulerScheduleProvider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		const groupName = this.groupNameOf(properties);
 		const previousGroupName = this.groupNameOf(previousProperties);
-		if (groupName !== previousGroupName) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (${previousGroupName ?? "default"} -> ${groupName ?? "default"}); re-run with \`cdkd deploy --replace ${logicalId}\` to recreate it in the new group`);
+		if (groupName !== previousGroupName) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (${previousGroupName ?? "default"} -> ${groupName ?? "default"}); re-run with \`cdkd deploy --replace\` to recreate it in the new group (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)`);
 		this.logger.debug(`Updating Schedule ${logicalId}: ${physicalId}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
 			const input = {
@@ -52070,7 +52100,11 @@ var SchedulerScheduleProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		const groupName = this.groupNameOf(properties);
-		if (properties === void 0) this.logger.warn(`State record for Schedule ${logicalId} carries no properties — deleting '${physicalId}' from the default group. If the schedule lives in a custom group, delete it manually: aws scheduler delete-schedule --name ${physicalId} --group-name <group>`);
+		if (properties === void 0) {
+			const safeId = displaySafe(physicalId, { asciiOnly: true });
+			const manualHint = safeId && safeId === physicalId ? `If the schedule lives in a custom group, delete it manually: aws scheduler delete-schedule --name ${shellQuote(safeId)} --group-name <group>` : "If the schedule lives in a custom group, delete it manually via the console: the name recorded for it cannot be reproduced safely on a command line.";
+			this.logger.warn(`State record for Schedule ${logicalId} carries no properties — deleting '${safeId || "<unrenderable>"}' from the default group. ${manualHint}`);
+		}
 		this.logger.debug(`Deleting Schedule ${logicalId}: ${physicalId}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
 			await this.getClient().send(new DeleteScheduleCommand({
@@ -52254,7 +52288,7 @@ var EFSProvider = class {
 		]) {
 			const next = properties[key];
 			const prev = previousProperties[key];
-			if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EFS FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const newThroughputMode = properties["ThroughputMode"];
 		const newProvisioned = properties["ProvisionedThroughputInMibps"];
@@ -53375,7 +53409,7 @@ var FSxFileSystemProvider = class {
 		for (const key of TOP_LEVEL_IMMUTABLE_PROPS) {
 			const next = properties[key];
 			const prev = previousProperties[key];
-			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 		}
 		const variantConfigKey = this.detectVariantConfigKey(properties, previousProperties);
 		const { diff: variantDiff, hasMutableDiff: variantHasMutableDiff } = variantConfigKey ? this.computeVariantConfigDiff(resourceType, logicalId, variantConfigKey, properties[variantConfigKey] ?? {}, previousProperties[variantConfigKey] ?? {}) : {
@@ -53456,7 +53490,7 @@ var FSxFileSystemProvider = class {
 			const nextVal = next[key];
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
-			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace --force-stateful-recreation (the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED), or destroy + redeploy the stack.`);
 			const ctx = {
 				resourceType,
 				logicalId,
@@ -54417,6 +54451,16 @@ var EMRClusterProvider = class {
 		const changed = (key) => !jsonEqual$2(properties[key], previousProperties[key]);
 		const nextInstances = properties["Instances"] ?? {};
 		const prevInstances = previousProperties["Instances"] ?? {};
+		const replaceFlags = "cdkd deploy --replace --force-stateful-recreation";
+		const replaceRemedy = () => toBoolean(prevInstances["TerminationProtected"]) === true ? protectedReplacementAdvice({
+			evidence: "cdkd's recorded properties for this cluster carry Instances.TerminationProtected: true",
+			replaceFlags,
+			disable: {
+				before: "aws emr modify-cluster-attributes --cluster-id",
+				identifier: physicalId,
+				after: "--no-termination-protected"
+			}
+		}) : `Re-deploy with ${replaceFlags}, or destroy + redeploy the stack.`;
 		let terminationProtectedChanged = false;
 		if (changed("Instances")) {
 			const instanceKeys = /* @__PURE__ */ new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
@@ -54426,7 +54470,7 @@ var EMRClusterProvider = class {
 					terminationProtectedChanged = true;
 					continue;
 				}
-				throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster Instances.${key} is immutable on AWS — a running cluster's instance topology / networking cannot be changed in place. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+				throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster Instances.${key} is immutable on AWS — a running cluster's instance topology / networking cannot be changed in place. ${replaceRemedy()}`);
 			}
 		}
 		for (const key of Object.keys({
@@ -54435,7 +54479,7 @@ var EMRClusterProvider = class {
 		})) {
 			if (key === "Instances") continue;
 			if (!changed(key)) continue;
-			if (!MUTABLE_TOP_LEVEL_PROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster ${key} is immutable on AWS — it is fixed at cluster creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			if (!MUTABLE_TOP_LEVEL_PROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster ${key} is immutable on AWS — it is fixed at cluster creation. ${replaceRemedy()}`);
 		}
 		const visibleChanged = changed("VisibleToAllUsers");
 		const stepConcurrencyChanged = changed("StepConcurrencyLevel");
@@ -58447,7 +58491,7 @@ var DLMLifecyclePolicyProvider = class {
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `DefaultPolicy cannot be changed in place; re-run with \`cdkd deploy --replace ${logicalId}\` to recreate the policy`);
+		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "DefaultPolicy cannot be changed in place; re-run with `cdkd deploy --replace` to recreate the policy (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)");
 		this.logger.debug(`Updating DLM Lifecycle Policy ${logicalId} (${physicalId})`);
 		try {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
@@ -58647,7 +58691,7 @@ var S3VectorsProvider = class {
 	* is surfaced as `ResourceUpdateNotSupportedError`.
 	*/
 	async updateVectorBucket(logicalId, physicalId, resourceType, properties, previousProperties) {
-		for (const createOnly of ["VectorBucketName", "EncryptionConfiguration"]) if (JSON.stringify(properties[createOnly]) !== JSON.stringify(previousProperties[createOnly])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `'${createOnly}' is immutable (create-only) on VectorBucket '${physicalId}'; a change requires replacement (cdkd deploy --replace)`);
+		for (const createOnly of ["VectorBucketName", "EncryptionConfiguration"]) if (JSON.stringify(properties[createOnly]) !== JSON.stringify(previousProperties[createOnly])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `'${createOnly}' is immutable (create-only) on VectorBucket '${physicalId}'; a change requires replacement (cdkd deploy --replace --force-stateful-recreation — the type is in cdkd's stateful-recreate guard set, so a bare --replace is refused a second time with STATEFUL_REPLACE_BLOCKED)`);
 		const oldTags = this.cfnTagsToRecord(previousProperties["Tags"]);
 		const newTags = this.cfnTagsToRecord(properties["Tags"]);
 		const toSet = {};
@@ -62686,8 +62730,7 @@ async function deployCommand(stacks, options) {
 					skipPrefix,
 					yes: options.yes
 				});
-				let recreateViaCcApiTargets;
-				let recreateViaSdkProviderTargets;
+				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
 					const validation = await probeAndRevalidateStateful({
@@ -62716,9 +62759,12 @@ async function deployCommand(stacks, options) {
 					});
 					const errorBlock = renderRecreateTargetsErrors(validation);
 					if (errorBlock) throw new CdkdError(errorBlock, "RECREATE_TARGETS_INVALID");
-					recreateViaCcApiTargets = new Set(validation.targets.filter((t) => t.direction === "to-cc-api").map((t) => t.logicalId));
-					recreateViaSdkProviderTargets = new Set(validation.targets.filter((t) => t.direction === "to-sdk").map((t) => t.logicalId));
-					if (recreateViaCcApiTargets.size > 0 || recreateViaSdkProviderTargets.size > 0) {
+					recreateTargets = {
+						stackName: stackInfo.stackName,
+						viaCcApi: new Set(validation.targets.filter((t) => t.direction === "to-cc-api").map((t) => t.logicalId)),
+						viaSdkProvider: new Set(validation.targets.filter((t) => t.direction === "to-sdk").map((t) => t.logicalId))
+					};
+					if (recreateTargets.viaCcApi.size > 0 || recreateTargets.viaSdkProvider.size > 0) {
 						const downstreamConsumers = await findDownstreamConsumers({
 							producerStack: stackInfo.stackName,
 							producerRegion: stackRegion,
@@ -62743,8 +62789,11 @@ async function deployCommand(stacks, options) {
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...migrationGate && { onCurrentStateLoaded: migrationGate },
-					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
-					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
+					...options.pinCcApi?.length && { pinCcApi: {
+						stackName: stackInfo.stackName,
+						logicalIds: new Set(options.pinCcApi)
+					} },
+					...recreateTargets && (recreateTargets.viaCcApi.size > 0 || recreateTargets.viaSdkProvider.size > 0) && { recreateTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
 					...options.skipFinalSnapshot && { skipFinalSnapshot: true },
@@ -62821,6 +62870,18 @@ async function deployCommand(stacks, options) {
 				setAwsClients(awsClients);
 			}
 		};
+		if (options.pinCcApi?.length && options.recreateViaSdkProvider?.length) {
+			const both = options.pinCcApi.filter((id) => (options.recreateViaSdkProvider ?? []).includes(id));
+			if (both.length > 0) throw new CdkdError(`--pin-cc-api and --recreate-via-sdk-provider both named: ${both.join(", ")}. They are opposite requests — the first keeps the resource on Cloud Control, the second destroys and recreates it via the SDK provider. Pass one.`, "PIN_CC_API_INVALID");
+		}
+		if (options.pinCcApi?.length) {
+			const reach = analyzePinCcApiReachability(options.pinCcApi, targetStacks.map((st) => ({
+				stackName: st.stackName,
+				logicalIds: Object.keys(st.template.Resources ?? {})
+			})));
+			if (reach.unmatched.length > 0) throw new CdkdError(reach.errorMessage, "PIN_CC_API_INVALID");
+			for (const partial of reach.partial) logger.info(`--pin-cc-api ${partial.logicalId}: applies to ${partial.appliesTo.join(", ")}; not declared by ${partial.absentFrom.join(", ")}`);
+		}
 		await workGraph.execute({
 			"asset-build": options.imageBuildConcurrency,
 			"asset-publish": options.assetPublishConcurrency,
@@ -64189,6 +64250,13 @@ function isStackNotFoundError(err) {
 
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
+/**
+* The one spelling of the routing token for a resource leaving Cloud Control
+* (issue #2719). A literal, because `collectCcApiRoutes` writes it and
+* `annotateRouting` special-cases it, and the integ fixture greps for it --
+* three places that must agree on a string.
+*/
+const SDK_MIGRATION_TOKEN = "returning to SDK provider";
 const logger = getLogger().child("DiffRecursive");
 /** Every `Ref` target reachable from a value, collected in one walk. */
 function collectRefTargets(value, refs) {
@@ -64645,7 +64713,15 @@ function collectCcApiRoutes(template, state) {
 			hits.set(logicalId, drops.map((d) => d.property));
 			continue;
 		}
-		if (state.resources[logicalId]?.provisionedBy === "cc-api") hits.set(logicalId, ["sticky"]);
+		const record = state.resources[logicalId];
+		if (record?.provisionedBy === "cc-api") {
+			const leaving = wouldReturnToSdkProvider({
+				resourceType: resource.Type,
+				desiredProperties: resource.Properties ?? {},
+				previousProperties: record.properties
+			});
+			hits.set(logicalId, [leaving ? SDK_MIGRATION_TOKEN : "sticky"]);
+		}
 	}
 	return hits;
 }
@@ -64791,6 +64867,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 	const annotateRouting = (logicalId) => {
 		const props = ccApiRoutes?.get(logicalId);
 		if (!props || props.length === 0) return "";
+		if (props.length === 1 && props[0] === "returning to SDK provider") return ` [${SDK_MIGRATION_TOKEN}]`;
 		return ` [via CC API: ${props.join(", ")}]`;
 	};
 	for (const [logicalId, change] of changes.entries()) switch (change.changeType) {
@@ -65301,7 +65378,7 @@ async function scrubCommand(stacks, options) {
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The plaintext is no longer stored there, but a value that was ever persisted should be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating).${keyNote}${unverifiableNote}${failureNote}`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${failureNote}`);
 	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
@@ -66501,6 +66578,108 @@ function isRegionAmbiguousRefusal(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof DynamicReferenceRegionAmbiguousError);
 }
 /**
+* A secrets map with its OWN identity whose entries ARE `target`'s (issue
+* #2531): every read and write goes to `target`; nothing is stored here.
+*
+* The outputs pass resolves each `Export.Name` through one of these rather
+* than through the pass map itself. The resolver records the uncollapsed
+* `expression -> plaintext` PAIR beside each entry, keyed by the map INSTANCE
+* (`recordResolvedPair`), and a second write of one expression with a
+* different plaintext marks that pair conflicting — so a name's resolution
+* recording straight into the pass map could conflict the pair a literal
+* Output embedding the same token needs. Pairs recorded through this view
+* hang off THIS instance and are discarded with it (a name never positions a
+* leaf); the entries are the pass map's, live, in both directions.
+*
+* Live sharing rather than a private map with a copy: the resolver records
+* as it goes and `Fn::Join` resolves its parts concurrently, so a part that
+* rejects while a secret part is still pending ends the name's block before
+* that part records — a copy at the end of the block misses the late entry,
+* and a private map SEEDED from the pass map is a snapshot that a LATER
+* name's resolution would not see the late entry through either. Every
+* reader in the block (the cross-region pin, the cross-stack pre-pass, the
+* resolver, the masking of their messages) needs exactly what the pass map
+* holds at the moment it reads, which is what a view gives. (The deploy
+* engine's sibling block keeps its end-of-block copy and so still has the
+* late-entry hole — issue #2563.)
+*
+* TWO RESIDUALS of discarding what the view recorded, both bounded to the
+* choice of EXPRESSION and neither reaching a plaintext:
+*
+* - The pairs. A value leaf re-using the token records its own pair at the
+*   seam, which is what positions it — PROVIDED its own resolution succeeds.
+*   A value whose read through the PRIMARY resolver fails after the name's
+*   succeeded (that call sits in the value loop's best-effort catch) has no
+*   pair of its own and no name-recorded one to fall back on, so its leaf
+*   drops to the value scan (the #2485 shape, a sibling's spelling for a
+*   same-plaintext pair); the entry the name recorded is still a needle, so
+*   the plaintext is scrubbed either way — whole, at any length, when the
+*   leaf IS the plaintext (`redactSecretsForState`'s whole-value arm is
+*   unbounded and this pass hands it the raw pass map), and by the substring
+*   arm at `MIN_NEEDLE_LENGTH` or longer when the plaintext is EMBEDDED in a
+*   larger leaf; a shorter embedded one is the #2516 residual, which has
+*   nothing to do with the name loop. A failed read through the cross-region PIN
+*   is not a fallback at all: `unresolvableForeignScrubSecretError` refuses
+*   the whole scrub (`SCRUB_CROSS_REGION_SECRET_UNRESOLVED`), name loop or
+*   value loop.
+* - The cross-stack associations the pre-pass records
+*   (`recordCrossStackExpression`), keyed by instance the same way. They are
+*   recorded only for a plaintext ALREADY in the map (the resolver gates on
+*   `recordedSecretValues.has(...)`), so losing one degrades the expression a
+*   later leaf is positioned by, never whether the plaintext is found. No
+*   case pins this arm on its own.
+*
+* Every member of `Map.prototype` that reads or writes entries is overridden,
+* and a unit fence (`scrub-shared-entries-secrets.test.ts`) asserts that set
+* against the runtime's `Map.prototype` so a future addition (the stage-3
+* `getOrInsert` / `getOrInsertComputed`) cannot land on the permanently empty
+* backing store unnoticed — a needle inserted there would never reach the
+* pass map. `structuredClone` reads the internal slots the same way and is
+* equally unreachable from this file; a clone of a view would be an empty
+* `Map`.
+*/
+var SharedEntriesSecrets = class extends Map {
+	target;
+	constructor(target) {
+		super();
+		this.target = target;
+	}
+	get size() {
+		return this.target.size;
+	}
+	get(plaintext) {
+		return this.target.get(plaintext);
+	}
+	has(plaintext) {
+		return this.target.has(plaintext);
+	}
+	set(plaintext, expression) {
+		this.target.set(plaintext, expression);
+		return this;
+	}
+	delete(plaintext) {
+		return this.target.delete(plaintext);
+	}
+	clear() {
+		this.target.clear();
+	}
+	keys() {
+		return this.target.keys();
+	}
+	values() {
+		return this.target.values();
+	}
+	entries() {
+		return this.target.entries();
+	}
+	forEach(callback, thisArg) {
+		this.target.forEach((value, key) => callback.call(thisArg, value, key, this));
+	}
+	[Symbol.iterator]() {
+		return this.target[Symbol.iterator]();
+	}
+};
+/**
 * Build the CROSS-STACK pre-pass for ONE stack's scrub (issue
 * [#2133](https://github.com/go-to-k/cdkd/issues/2133)).
 *
@@ -66898,21 +67077,28 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			const declaredExportName = output.Export?.Name;
 			let exportName = declaredExportName;
 			if (declaredExportName !== void 0 && typeof declaredExportName !== "string") {
+				const nameSecrets = new SharedEntriesSecrets(outputSecrets);
+				let nameFailed = false;
+				let nameError;
 				const nameSource = await pinCrossRegionSecrets(declaredExportName, stack.stackName, {
 					stackRegion: region,
 					producerRegions,
 					resolvers,
-					recordedSecretValues: outputSecrets,
+					recordedSecretValues: nameSecrets,
 					origin: `Export.Name of output '${name}'`
 				});
-				const nameContext = resolverContext(outputSecrets);
+				const nameContext = resolverContext(nameSecrets);
 				await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				try {
 					exportName = await resolver.resolve(nameSource, nameContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err)) throw err;
+					nameFailed = true;
+					nameError = err;
+				}
+				if (nameFailed) {
 					outputsSourceUntrusted = true;
-					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+					logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 				}
 			}
 			if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
@@ -67962,9 +68148,10 @@ var DriftDetectedError = class DriftDetectedError extends CdkdError {
 * `notCompared`. The roll-up also contains resources whose only problem is a
 * surviving `{{resolve:...}}` token cdkd resolves for nobody — a look-alike
 * spelling, since issue #2482 moved `ssm-secure` onto the `ssm` path — which
-* can never clear on a re-run, and which this change did not create. Exiting non-zero for them would break `cdkd drift` in CI forever over
-* an unrelated defect, so the exit reads `refused` and `readFailed` while the
-* report covers all three. See `NotComparedCause` and `outcomeExitSignal`.
+* can never clear on a re-run, and which this change did not create. Exiting
+* non-zero for them would break `cdkd drift` in CI forever over an unrelated
+* defect, so the exit reads `refused` and `readFailed` while the report covers
+* all three. See `NotComparedCause` and `outcomeExitSignal`.
 *
 * WHY A NON-ZERO EXIT, and why it is a PRESERVATION rather than a new signal.
 * Pre-#2108 that population resolved the reference in the WRONG region, the
@@ -68075,7 +68262,8 @@ function notComparedOutcomes(report) {
 * code covers only the CLEARABLE ones — `refused` (the population #2108 created)
 * and `readFailed` (issues #2151 / #1945). Exiting non-zero on
 * `unresolvedToken` would break `cdkd drift` in CI forever for every stack
-* holding such a spelling — permanent, unclearable, and unrelated. See {@link NotComparedCause}.
+* holding such a spelling — permanent, unclearable, and unrelated. See
+* {@link NotComparedCause}.
 *
 * A `drifted` outcome reports `drifted` even when its own comparison was
 * refused: drift is the stronger, actionable signal and the caller ranks it
@@ -68211,10 +68399,10 @@ function uncomparedTally(reports) {
 *
 *   - The TRIGGER is `anyIncomplete`, i.e. {@link outcomeExitSignal}'s
 *     `incomplete`. It is narrow on purpose: a stack whose ONLY uncompared
-*     resource holds a `{{resolve:...}}` token cdkd resolves for nobody must not start
-*     shouting on every run about a comparison no action of the user's can ever
-*     complete -- the same CI-forever hazard that cause is kept out of the exit
-*     code on.
+*     resource holds a `{{resolve:...}}` token cdkd resolves for nobody must
+*     not start shouting on every run about a comparison no action of the
+*     user's can ever complete -- the same CI-forever hazard that cause is
+*     kept out of the exit code on.
 *   - The COUNT and the LABELS, once the line is triggered, cover EVERY
 *     uncompared resource, each named by its own reason (see
 *     {@link uncomparedTally}). A resource that was not compared was not
@@ -70490,9 +70678,19 @@ function orderConsumersBeforeProducers(stackNames, consumerToProducers) {
 *
 * Purges the stack's deployment-event history (the post-mortem `deployments/`
 * store cdkd keeps by default) ONLY after a clean, non-interrupted destroy, so
-* the state bucket returns fully empty. Deliberately skipped on a failed /
-* interrupted destroy — those events ARE the post-mortem the user wants on the
-* retry — and a no-op when `--purge-events` was not passed.
+* a plain object listing of the state bucket comes back empty. Deliberately
+* skipped on a failed / interrupted destroy — those events ARE the post-mortem
+* the user wants on the retry — and a no-op when `--purge-events` was not
+* passed.
+*
+* "Empty" is bounded, and this used to say "the state bucket returns fully
+* empty" without the bound (issue
+* [#2624](https://github.com/go-to-k/cdkd/issues/2624)). The purge routes
+* through `DeploymentEventsReader.pruneRuns` -> `deleteRawObjects`, which sends
+* `DeleteObjects` with no `VersionId`: on the versioned state bucket that
+* writes DELETE MARKERS and leaves every earlier version of those keys readable
+* with a `VersionId`. The log line below states that rather than claiming a
+* removal that did not happen.
 *
 * MUST be called AFTER the run's `eventRecorder.finalize()` (which writes this
 * run's own events + index): purging first would just be re-created by the
@@ -70509,7 +70707,7 @@ async function purgeEventsAfterDestroy(reader, stackName, region, opts, logger)
 	if (opts.purgeEvents !== true || opts.runResult !== "SUCCEEDED" || opts.interrupted) return null;
 	try {
 		const purge = await reader.pruneRuns(stackName, region, { all: true });
-		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${stackName} (${region}).`);
+		if (purge.deletedRunIds.length > 0 || purge.indexDeleted) logger.info(`  Purged deployment-event history for ${stackName} (${region}). Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId.`);
 		return purge;
 	} catch (purgeError) {
 		logger.warn(`  Failed to purge deployment-event history for ${stackName}: ${purgeError instanceof Error ? purgeError.message : String(purgeError)}`);
@@ -70793,7 +70991,7 @@ async function destroyCommand(stackArgs, options) {
 * Create destroy command
 */
 function createDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", "After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so the state bucket returns fully empty. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: 'cdkd events prune <stack> --all'.", false).action(withErrorHandling(destroyCommand));
+	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", "After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so an object listing of the state bucket comes back empty. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: 'cdkd events prune <stack> --all'.", false).action(withErrorHandling(destroyCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -76201,8 +76399,8 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-retain": return `  - orphan   ${op.logicalId} (${op.resourceType}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${op.logicalId} (${op.resourceType}) [--orphan]`;
 		case "revert": return `  - revert   ${op.logicalId} (${op.resourceType})${rep}`;
-		case "reverse-replacement": return `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
-		case "reverse-replacement-readopt": return `  - reverse-replace ${op.logicalId} (${op.resourceType}) [delete new, re-adopt retained old resource]`;
+		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-create old resource, delete new]`;
+		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${op.logicalId} (${op.resourceType}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${op.logicalId} (${op.resourceType}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${op.logicalId} (${op.resourceType}) — was DELETED, unrecoverable`;
 		case "skip-mismatch": return `  - skip     ${op.logicalId} (${op.resourceType}) — physical id changed, needs manual attention`;
 		case "skip-absent": return `  - skip     ${op.logicalId} (${op.resourceType}) — no longer in state`;
@@ -76538,6 +76736,73 @@ function createRollbackCommand() {
 //#endregion
 //#region src/cli/commands/events.ts
 /**
+* Issue [#2438](https://github.com/go-to-k/cdkd/issues/2438): every string
+* `cdkd events` renders on its HUMAN path comes back out of a durable store
+* (`deployments/{runId}.jsonl` and `deployments/index.json`), and several of
+* those fields are provider- or template-authored — a logical id, a resource
+* type, a `reason` that interpolates a user-chosen physical name, an AWS error
+* message. `JSON.stringify` escapes control bytes on the way IN, so the store
+* is well-formed, but the reader is a plain `JSON.parse` that restores the
+* original bytes verbatim. Without a sanitising pass here an ESC-bracket
+* sequence stored in any of them re-forges the terminal of the one command
+* whose entire purpose is to be BELIEVED after a run.
+*
+* Three helpers rather than one, because the field classes have different
+* correct answers:
+*
+* - {@link safeId} is for values with a KNOWN ASCII charset (a run id, a
+*   logical id, a CFn resource type, a region, an event type, a version
+*   string). `asciiOnly` is a positive allowlist and therefore has no residual
+*   at all — the right fence when nothing legitimate is lost.
+* - {@link safeText} is for free PROSE (`reason`, `error.name`,
+*   `error.message`). A legitimate AWS error message may carry non-ASCII, and
+*   `asciiOnly` would mangle it — so prose gets the control-character denylist,
+*   accepting `display-safe.ts`'s documented residual.
+*
+* The wrap goes around the VALUE, never around the colorized token: sanitising
+* `red(x)` would strip cdkd's OWN ANSI and leave the row uncolored.
+*/
+const safeId = (value) => displaySafe(value, { asciiOnly: true });
+/** Free-prose counterpart of {@link safeId}. See that helper's block comment. */
+const safeText = (value) => displaySafe(value);
+/**
+* Numeric counterpart of {@link safeId}, for the stored COUNTER fields.
+*
+* Their declared `number` type is the WRITER's guarantee; the value rendered
+* here came back through `JSON.parse` and can be any JSON scalar. Sanitising
+* would be the wrong tool — it would still render the forged text, merely
+* stripped — so a value that is not a number is not renderable as one and
+* becomes `?`. Mirrors the pre-existing `typeof e.durationMs === 'number'`
+* guard, which is why that one line needed no change.
+*/
+const safeCount = (value) => typeof value === "number" ? String(value) : "?";
+/**
+* Appended to every `cdkd events prune` line that reports a DELETE, because
+* "pruned" and "removed" would otherwise read as removal and are not (issue
+* [#2624](https://github.com/go-to-k/cdkd/issues/2624)).
+*
+* The pruner reaches S3 through `S3StateBackend.deleteRawObjects`, which sends
+* `DeleteObjects` with no `VersionId`. On the versioned state bucket
+* `cdkd bootstrap` creates, that writes a DELETE MARKER and leaves every
+* earlier version of the key readable through `GetObject` with a `VersionId`.
+* And the versions exist in QUANTITY here rather than as a theoretical
+* remainder: the store re-PUTs a run's whole JSONL body on every flush, so a
+* single run accumulates one noncurrent version per flush before it is ever
+* pruned. `docs/deployment-events.md` classes `deployments/*.jsonl` as
+* sensitive, which is what makes the distinction worth a line of output.
+*
+* Deliberately NOT appended to the "no runs matched" arm: that arm returns
+* before any `deleteRawObjects` call, so there is no delete to qualify.
+*
+* The converse does NOT hold, and the gap is tracked on issue #2624 rather than
+* closed here: `pruneRuns({ all: true })` reports `indexDeleted: true`
+* unconditionally (its `DeleteObjects` is idempotent, so it "succeeds" on an
+* empty prefix), so the arms this note IS appended to can fire for a stack that
+* had no history at all. Making that gate truthful is a behaviour change, not a
+* wording one.
+*/
+const NONCURRENT_VERSIONS_SURVIVE_NOTE = " Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.";
+/**
 * `cdkd events <stack>` — read back the structured deployment events
 * (issue #808) cdkd persists per deploy / destroy run, the local
 * equivalent of CloudFormation's `DescribeStackEvents`.
@@ -76580,7 +76845,7 @@ async function eventsCommand(stackName, options) {
 		const targetRegion = await resolveEventsRegion(reader, stackName, options.stackRegion);
 		if (options.run) {
 			const events = await reader.readRunEvents(stackName, targetRegion, options.run);
-			if (events === null) throw new CdkdError(`No deployment-event stream found for run '${options.run}' of stack '${stackName}' in region '${targetRegion}'.`, "EVENTS_RUN_NOT_FOUND");
+			if (events === null) throw new CdkdError(`No deployment-event stream found for run '${safeId(options.run) || "<unrenderable>"}' of stack '${safeId(stackName) || "<unrenderable>"}' in region '${safeId(targetRegion) || "<unrenderable>"}'.`, "EVENTS_RUN_NOT_FOUND");
 			if (asJson) {
 				process.stdout.write(JSON.stringify(events, null, 2) + "\n");
 				return;
@@ -76611,16 +76876,22 @@ async function eventsCommand(stackName, options) {
 async function resolveEventsRegion(reader, stackName, explicitRegion) {
 	if (explicitRegion) return explicitRegion;
 	const regions = await reader.listRegions(stackName);
-	if (regions.length === 0) throw new CdkdError(`No deployment-event history found for stack '${stackName}'. Events are recorded by 'cdkd deploy' / 'cdkd destroy' (issue #808); a stack deployed by an older cdkd version has none.`, "EVENTS_NOT_FOUND");
-	if (regions.length > 1) throw new CdkdError(`Stack '${stackName}' has deployment-event history in multiple regions: ${regions.join(", ")}. Re-run with '--stack-region <region>' to disambiguate.`, "EVENTS_REGION_AMBIGUOUS");
+	if (regions.length === 0) throw new CdkdError(`No deployment-event history found for stack '${safeId(stackName) || "<unrenderable>"}'. Events are recorded by 'cdkd deploy' / 'cdkd destroy' (issue #808); a stack deployed by an older cdkd version has none.`, "EVENTS_NOT_FOUND");
+	if (regions.length > 1) throw new CdkdError(`Stack '${safeId(stackName) || "<unrenderable>"}' has deployment-event history in multiple regions: ${regions.map((r) => safeId(r) || "<unrenderable>").join(", ")}. Re-run with '--stack-region <region>' to disambiguate.`, "EVENTS_REGION_AMBIGUOUS");
 	return regions[0];
 }
 /**
-* `cdkd events prune <stack>` — reclaim S3 space by deleting old per-run
-* `{runId}.jsonl` event streams (issue #885). `cdkd destroy` deliberately
-* keeps event history as post-mortem context, so this is the explicit way
-* to purge it; the deploy/destroy writer also self-bounds to the last
-* {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs automatically.
+* `cdkd events prune <stack>` — clear old per-run `{runId}.jsonl` event
+* streams out of the bucket's object LISTING (issue #885). `cdkd destroy`
+* deliberately keeps event history as post-mortem context, so this is the
+* explicit way to purge it; the deploy/destroy writer also self-bounds to the
+* last {@link DEPLOYMENT_EVENTS_MAX_INDEX_RUNS} runs automatically.
+*
+* It does NOT reclaim the storage, and the wording above said it did until
+* issue [#2624](https://github.com/go-to-k/cdkd/issues/2624): the delete
+* carries no `VersionId`, so on a versioned state bucket every earlier
+* version of a pruned key is still billed and still readable. See
+* {@link NONCURRENT_VERSIONS_SURVIVE_NOTE}.
 *
 * Retention selection:
 *   - `--all`              purge every run + the index.
@@ -76657,10 +76928,12 @@ async function eventsPruneCommand(stackName, options) {
 		await stateBackend.verifyBucketExists();
 		const reader = new DeploymentEventsReader(stateBackend);
 		const targetRegion = await resolveEventsRegion(reader, stackName, options.stackRegion);
+		const safeStack = safeId(stackName) || "<unrenderable>";
+		const safeRegion = safeId(targetRegion) || "<unrenderable>";
 		const totalRuns = (await reader.listRuns(stackName, targetRegion)).length;
-		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${options.olderThan}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${options.olderThan}` : `runs beyond the newest ${20}`;
+		const scope = options.all ? `ALL ${totalRuns} run(s)` : options.keep !== void 0 && olderThanMs !== void 0 ? `runs beyond the newest ${options.keep} AND older than ${safeId(options.olderThan)}` : options.keep !== void 0 ? `runs beyond the newest ${options.keep}` : olderThanMs !== void 0 ? `runs older than ${safeId(options.olderThan)}` : `runs beyond the newest ${20}`;
 		if (options.yes !== true) {
-			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(stackName)} ${gray(`(${targetRegion})`)}: ${scope}?`)) {
+			if (!await confirmPrompt$2(`Prune deployment-event history for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}: ${scope}?`)) {
 				logger.info(gray("Aborted; nothing was deleted."));
 				return;
 			}
@@ -76671,10 +76944,10 @@ async function eventsPruneCommand(stackName, options) {
 			...olderThanMs !== void 0 && { olderThanMs }
 		});
 		if (result.deletedRunIds.length === 0) {
-			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${stackName} (${targetRegion}); no run streams to delete.` : `No runs matched the prune criteria for ${stackName} (${targetRegion}).`));
+			logger.info(gray(result.indexDeleted ? `Removed the empty deployment-event index for ${safeStack} (${safeRegion}); no run streams to delete. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of the deleted keys survive and stay readable with GetObject and a VersionId; prune does not purge them.` : `No runs matched the prune criteria for ${safeStack} (${safeRegion}).`));
 			return;
 		}
-		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(stackName)} ${gray(`(${targetRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + ".");
+		logger.info(`${green("Pruned")} ${result.deletedRunIds.length} deployment-event run(s) for ${cyan(safeStack)} ${gray(`(${safeRegion})`)}; ${result.remainingRunIds.length} retained` + (result.indexDeleted ? gray(" (index removed)") : "") + "." + gray(NONCURRENT_VERSIONS_SURVIVE_NOTE));
 	} finally {
 		awsClients.destroy();
 	}
@@ -76690,19 +76963,29 @@ async function eventsPruneCommand(stackName, options) {
 async function confirmPrompt$2(prompt) {
 	return confirmOrRefuse(prompt, { refusal: "The cdkd events prune confirmation prompt cannot run in a non-interactive environment. Pass -y / --yes to confirm the prune, or run the command from a real terminal. Nothing has been deleted." });
 }
-/** Human-readable run listing (newest first). */
+/**
+* Human-readable run listing (newest first).
+*
+* Issue #2438: every `run.*` field here comes back out of
+* `deployments/index.json` via a plain `JSON.parse`, so its declared type is a
+* claim about the writer, not about the bytes on disk — each one goes through
+* {@link safeId}. `result` is sanitised BEFORE the colour decision so the
+* colour matches the text the user actually sees.
+*/
 function printRunList(stackName, region, runs) {
 	const logger = getLogger();
-	logger.info(`${bold("Deployment runs for")} ${cyan(stackName)} ${gray(`(${region})`)}`);
+	const safeStack = safeId(stackName) || "<unrenderable>";
+	logger.info(`${bold("Deployment runs for")} ${cyan(safeStack)} ${gray(`(${safeId(region) || "<unrenderable>"})`)}`);
 	if (runs.length === 0) {
 		logger.info(gray("  (no runs recorded)"));
 		return;
 	}
 	for (const run of runs) {
-		const resultColored = run.result === "SUCCEEDED" ? green(run.result) : run.result === "UNKNOWN" ? gray(run.result) : red(run.result);
-		logger.info(`  ${cyan(run.runId)}  ${run.command}  ${resultColored}  ${gray(run.startedAt || "?")} -> ${gray(run.finishedAt || "?")}  ${gray(`cdkd ${run.cdkdVersion}`)}  ${gray(`${run.eventCount} events`)}`);
+		const result = safeId(run.result) || "<unrenderable>";
+		const resultColored = result === "SUCCEEDED" ? green(result) : result === "UNKNOWN" || result === "<unrenderable>" ? gray(result) : red(result);
+		logger.info(`  ${cyan(safeId(run.runId) || "<unrenderable>")}  ${safeId(run.command) || "<unrenderable>"}  ${resultColored}  ${gray(safeId(run.startedAt) || "?")} -> ${gray(safeId(run.finishedAt) || "?")}  ${gray(`cdkd ${safeId(run.cdkdVersion) || "<unrenderable>"}`)}  ${gray(`${safeCount(run.eventCount)} events`)}`);
 	}
-	logger.info(gray(`\nUse 'cdkd events ${stackName} --run <runId>' to read one run's events.`));
+	logger.info(gray(`\nUse 'cdkd events ${safeStack} --run <runId>' to read one run's events.`));
 }
 /** Human-readable single-run event stream (in recorded order). */
 /**
@@ -76712,29 +76995,38 @@ function printRunList(stackName, region, runs) {
 */
 function printRunEvents(stackName, region, runId, events) {
 	const logger = getLogger();
-	logger.info(`${bold("Events for run")} ${cyan(runId)} ${gray(`(${stackName}, ${region})`)}`);
+	logger.info(`${bold("Events for run")} ${cyan(safeId(runId) || "<unrenderable>")} ${gray(`(${safeId(stackName) || "<unrenderable>"}, ${safeId(region) || "<unrenderable>"})`)}`);
 	if (events.length === 0) {
 		logger.info(gray("  (no events)"));
 		return;
 	}
 	for (const e of events) {
-		const parts = [gray(e.timestamp), colorizeEventType(e.eventType)];
-		if (e.logicalId) parts.push(`${e.logicalId}${e.resourceType ? ` (${e.resourceType})` : ""}`);
-		if (e.operation) parts.push(gray(e.operation));
-		if (e.guard) parts.push(gray(`guard=${e.guard}`));
-		if (e.provisionedBy) parts.push(gray(`[${e.provisionedBy}]`));
-		if (e.command) parts.push(gray(e.command));
-		if (e.region) parts.push(gray(e.region));
-		if (e.cdkdVersion) parts.push(gray(`cdkd ${e.cdkdVersion}`));
-		if (e.result) parts.push(e.result === "SUCCEEDED" ? green(e.result) : red(e.result));
+		const parts = [gray(safeId(e.timestamp) || "<unrenderable>"), colorizeEventType(e.eventType)];
+		if (e.logicalId) {
+			const logicalId = safeId(e.logicalId) || "<unrenderable>";
+			const resourceType = e.resourceType ? ` (${safeId(e.resourceType) || "<unrenderable>"})` : "";
+			parts.push(`${logicalId}${resourceType}`);
+		}
+		if (e.operation) parts.push(gray(safeId(e.operation) || "<unrenderable>"));
+		if (e.guard) parts.push(gray(`guard=${safeId(e.guard) || "<unrenderable>"}`));
+		if (e.provisionedBy) parts.push(gray(`[${safeId(e.provisionedBy) || "<unrenderable>"}]`));
+		if (e.command) parts.push(gray(safeId(e.command) || "<unrenderable>"));
+		if (e.region) parts.push(gray(safeId(e.region) || "<unrenderable>"));
+		if (e.cdkdVersion) parts.push(gray(`cdkd ${safeId(e.cdkdVersion) || "<unrenderable>"}`));
+		if (e.result) {
+			const result = safeId(e.result) || "<unrenderable>";
+			parts.push(result === "SUCCEEDED" ? green(result) : result === "<unrenderable>" ? gray(result) : red(result));
+		}
 		if (typeof e.durationMs === "number") parts.push(gray(`${e.durationMs}ms`));
-		if (e.counts) parts.push(gray(`+${e.counts.created}/~${e.counts.updated}/-${e.counts.deleted}` + (e.counts.failed ? ` !${e.counts.failed}` : "") + (e.counts.skipped ? ` ⚠${e.counts.skipped}` : "")));
+		if (e.counts) parts.push(gray(`+${safeCount(e.counts.created)}/~${safeCount(e.counts.updated)}/-${safeCount(e.counts.deleted)}` + (e.counts.failed ? ` !${safeCount(e.counts.failed)}` : "") + (e.counts.skipped ? ` ⚠${safeCount(e.counts.skipped)}` : "")));
 		logger.info(`  ${parts.join("  ")}`);
-		if (e.reason) logger.info(`      ${yellow(e.reason)}`);
+		if (e.reason) logger.info(`      ${yellow(safeText(e.reason) || "<unrenderable>")}`);
 		if (e.error) {
-			const code = e.error.awsErrorCode ? ` (${e.error.awsErrorCode})` : "";
-			const reqId = e.error.requestId ? gray(` requestId=${e.error.requestId}`) : "";
-			logger.info(`      ${red(`${e.error.name}${code}: ${e.error.message}`)}${reqId}`);
+			const code = e.error.awsErrorCode ? ` (${safeId(e.error.awsErrorCode) || "<unrenderable>"})` : "";
+			const reqId = e.error.requestId ? gray(` requestId=${safeId(e.error.requestId) || "<unrenderable>"}`) : "";
+			const name = safeText(e.error.name) || "<unrenderable>";
+			const message = e.error.message ? `: ${safeText(e.error.message) || "<unrenderable>"}` : "";
+			logger.info(`      ${red(`${name}${code}${message}`)}${reqId}`);
 		}
 	}
 }
@@ -76744,14 +77036,22 @@ function printRunEvents(stackName, region, runId, events) {
 * Exported for unit-test coverage (matching `destroy-runner.ts`'s
 * `PROTECTION_PROPERTY_BY_TYPE` convention) — it is pure, so testing it
 * directly beats driving it through the renderer's log output.
+*
+* Issue #2438: the declared union is what the WRITER emits; the value handed
+* here was restored by `JSON.parse` from the stored stream and is therefore
+* arbitrary text. It is sanitised once, up front, and every arm below both
+* classifies AND colorizes the sanitised token — classifying the raw value
+* while printing the sanitised one would let the two disagree. The token is
+* a known-ASCII discriminator, so `safeId`'s positive allowlist loses nothing.
 */
 function colorizeEventType(eventType) {
-	if (eventType.endsWith("FAILED")) return red(eventType);
-	if (eventType.endsWith("SUCCEEDED") || eventType === "RUN_FINISHED") return green(eventType);
-	if (eventType === "RESOURCE_SKIPPED") return yellow(eventType);
-	if (eventType === "RESOURCE_GUARD_INDETERMINATE") return yellow(eventType);
-	if (eventType.startsWith("ROLLBACK")) return yellow(eventType);
-	return cyan(eventType);
+	const token = safeId(eventType) || "<unrenderable>";
+	if (token.endsWith("FAILED")) return red(token);
+	if (token.endsWith("SUCCEEDED") || token === "RUN_FINISHED") return green(token);
+	if (token === "RESOURCE_SKIPPED") return yellow(token);
+	if (token === "RESOURCE_GUARD_INDETERMINATE") return yellow(token);
+	if (token.startsWith("ROLLBACK")) return yellow(token);
+	return cyan(token);
 }
 /**
 * Create the `cdkd events` command.
@@ -76780,11 +77080,11 @@ function createEventsCommand() {
 * action therefore reads the merged view via `command.optsWithGlobals()`.
 */
 function createEventsPruneCommand() {
-	return new Command("prune").description("Delete old per-run deployment-event streams to reclaim S3 space").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
+	return new Command("prune").description("Delete old per-run deployment-event streams. On a versioned state bucket this clears the object listing; earlier versions of the deleted keys survive and are not purged.").argument("<stack>", "Stack name (physical CloudFormation name)").addOption(new Option("--keep <N>", "Retain only the newest N runs").argParser((v) => {
 		const n = parseInt(v, 10);
-		if (!Number.isInteger(n) || n < 0) throw new Error(`Invalid --keep value "${v}": expected a non-negative integer.`);
+		if (!Number.isInteger(n) || n < 0) throw new Error(`Invalid --keep value "${safeId(v)}": expected a non-negative integer.`);
 		return n;
-	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index (full purge)", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
+	})).option("--older-than <duration>", "Delete runs older than this duration (e.g. 24h, 90m)").option("--all", "Delete every recorded run and the index", false).action(withErrorHandling((stack, _options, command) => eventsPruneCommand(stack, command.optsWithGlobals())));
 }
 
 //#endregion
@@ -82548,10 +82848,11 @@ async function pullEcrImage(imageUri, options) {
 		ecr.destroy();
 	}
 	logger.info(`Pulling ${canonicalUri}...`);
+	const pullArgs = ["pull", canonicalUri];
 	try {
-		await runDockerForeground(["pull", canonicalUri]);
+		await runDockerForeground(pullArgs);
 	} catch (err) {
-		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${err.message}`);
+		throw new LocalInvokeBuildError$1(`docker pull ${canonicalUri} failed: ${describeDockerFailure(err, pullArgs)}`);
 	}
 	return canonicalUri;
 }
@@ -82600,17 +82901,17 @@ async function ecrLogin(client, accountId, region) {
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
 	const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+	const loginArgs = [
+		"login",
+		"--username",
+		username,
+		"--password-stdin",
+		endpoint
+	];
 	try {
-		await runDockerStreaming([
-			"login",
-			"--username",
-			username,
-			"--password-stdin",
-			endpoint
-		], { input: password });
+		await runDockerStreaming(loginArgs, { input: password });
 	} catch (err) {
-		const e = err;
-		throw new LocalInvokeBuildError$1(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+		throw new LocalInvokeBuildError$1(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
 	}
 }
 /**
@@ -85982,7 +86283,7 @@ async function prepareOneImage(task, container, options) {
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? asset.source.executable?.join(" ")}): ${stderr}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${container.name}' (${asset.source.directory ?? (asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0)}): ${stderr}`)
 			});
 			if (actualTag !== tag) {
 				const tagArgs = [
@@ -88020,6 +88321,123 @@ function createLocalStartAgentCoreCommand$1() {
 //#endregion
 //#region src/cli/commands/local-start-alb.ts
 /**
+* Every distinct Lambda logical id a resolved front-door plan forwards to,
+* sorted so the warning text is deterministic.
+*
+* Walks BOTH action slots — a listener's `defaultAction` and each of its
+* rules' `action` — because either one can carry a `TargetType: lambda`
+* target group and an ALB that reaches a Lambda only through a
+* `path-pattern` rule is the common shape (`/api/*` to a Lambda, everything
+* else to the ECS service). Mirrors cdk-local's own `collectAlbLambdaTargets`
+* walk, one layer later: this reads the QUALIFIED plan the strategy returns,
+* where a Lambda target already carries its resolved `lambda.logicalId`.
+*/
+function collectLambdaTargetLogicalIds(frontDoor) {
+	if (!frontDoor) return [];
+	const ids = /* @__PURE__ */ new Set();
+	const fromAction = (action) => {
+		if (action?.kind !== "forward") return;
+		for (const target of action.targets) if (target.kind === "lambda") ids.add(target.lambda.logicalId);
+	};
+	for (const listener of frontDoor.listeners) {
+		fromAction(listener.defaultAction);
+		for (const rule of listener.rules) fromAction(rule.action);
+	}
+	return [...ids].sort();
+}
+/**
+* Wrap an ALB {@link EmulatorStrategy} so that, under `--from-state`, a plan
+* carrying a `TargetType: lambda` target group emits a WARNING naming the
+* affected Lambdas — because the flag does not reach their container
+* environment.
+*
+* ## Why a warning and not a refusal
+*
+* `cdkd local start-cloudfront` REFUSES cdkd's state flags outright
+* ([#2528](https://github.com/go-to-k/cdkd/issues/2528)) because NO consumer on
+* that command's path reads a host-registered state source. `start-alb` is
+* partial, not total, so the same remedy would delete a working capability:
+*
+* - **ECS service targets DO honor `--from-state`.** `bootOneTarget` /
+*   `rollOneTarget` (`cdk-local@0.147.7`, `dist/local-studio-BBtUAVNy.js`
+*   `:26474` / `:26422`) hand `createLocalStateProvider` the FULL options bag,
+*   so cdkd's `fromState` factory is selected and the task containers'
+*   images / env / secrets / volumes resolve against S3 state.
+* - **Lambda target groups do NOT.** `resolveAlbLambdaTargetEnv` (`:26614`)
+*   rebuilds the bag it hands the shared `resolveLambdaContainerEnv` as a
+*   SIX-KEY allow-list — `fromCfnStack` / `assumeRole` / `region` / `profile` /
+*   `stackRegion` / `envVars` (`:26619-26626`) — dropping `fromState` /
+*   `stateBucket` / `statePrefix`. It forwards `extraStateProviders` faithfully,
+*   but the dispatcher activates an extra provider only when `options[key]` is
+*   truthy (`:4894`), and the key it looks for is exactly the one the bag no
+*   longer carries. So cdkd's factory is registered and never selected, and the
+*   Lambda boots with its intrinsics dropped — one WARN per variable, none of
+*   which says the flag was the problem.
+*
+* The fix is upstream (two arguments in `resolveAlbLambdaTargetEnv`); until it
+* lands, this makes the partiality LOUD at boot instead of leaving the user to
+* read "Environment variable X contains a CloudFormation intrinsic and was
+* dropped" as a state problem. `--from-cfn-stack` survives the allow-list and
+* therefore reaches both target kinds, which is what the message points at.
+*
+* ## Mechanics
+*
+* `runEcsServiceEmulator` logs every string in the `warnings` array
+* `strategy.resolveBoots` returns, so appending to it is the whole wiring — no
+* second synth, since the front-door plan is already resolved. Returns the
+* strategy UNCHANGED when `--from-state` is absent, so the non-state path
+* carries no wrapper at all.
+*
+* The warning REPEATS on every `--watch` reload, because `resolveBoots` is
+* re-run per reload (`:26264`) and its warnings re-logged. That matches how
+* cdk-local's own ALB resolution warnings behave on the same path, which is
+* the whole reason: repeating is what the surrounding output already does.
+* It is NOT because a reload could introduce a new Lambda target — the reload
+* discards `frontDoor` and `buildFrontDoor` runs only at boot (`:26110`), so
+* a Lambda added mid-`--watch` is never stood up at all. An earlier revision
+* of this comment argued the second, false thing.
+*/
+function warnUnresolvedLambdaTargetEnv(strategy, options) {
+	if (options.fromState !== true) return strategy;
+	return {
+		...strategy,
+		resolveBoots: (stacks, chosenTargets) => {
+			const resolved = strategy.resolveBoots(stacks, chosenTargets);
+			const lambdaIds = collectLambdaTargetLogicalIds(resolved.frontDoor);
+			if (lambdaIds.length === 0) return resolved;
+			const ecsNote = resolved.boots.length > 0 ? "The ECS service targets behind this ALB DO honor --from-state. " : "";
+			return {
+				...resolved,
+				warnings: [...resolved.warnings, `--from-state does not reach the container environment of this ALB's Lambda target group(s): ${lambdaIds.join(", ")}. Their Environment.Variables keep any Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue intrinsics unresolved, and each is then dropped with its own warning. ` + ecsNote + "The only state source the Lambda path reads is --from-cfn-stack <name>, which REPLACES --from-state (the two are mutually exclusive) and reaches both target kinds on a CloudFormation-deployed stack; otherwise override the affected variables with --env-vars. Tracked as go-to-k/cdkd#2602 (upstream go-to-k/cdk-local#707)."]
+			};
+		}
+	};
+}
+/**
+* The `EmulatorStrategy` `cdkd local start-alb` runs with: cdk-local's ALB
+* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv}.
+*
+* Extracted from the command's action for ONE reason, and it is the finding
+* that produced it: with the composition written inline in the `.action(...)`
+* closure, deleting the decorator at its only wiring point left the entire
+* unit suite green (measured in review — 29/29). The decorator's own cases
+* exercise it directly, so they cannot see a call site that stopped calling
+* it. A named export gives that seam a subject a test can hold.
+*
+* The seam is fenced BEHAVIOURALLY, in
+* `tests/unit/cli/local-start-alb-wiring.test.ts`, which runs the real command
+* and drives whatever object the action hands the engine. A source-shape
+* assertion was tried first and defeated in review round 3 by hoisting
+* `albStrategy(options)` into a local one statement up: its positive half was
+* satisfied by the mutation's own COMMENT and its negative half could not
+* cross the `)` the hoist introduced. That case is deleted rather than
+* tightened — the behavioural one catches strictly more, and a fence a comment
+* can satisfy reads as coverage while providing none.
+*/
+function buildAlbEmulatorStrategy(options) {
+	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
+}
+/**
 * `cdkl start-alb <Stack/Alb>` — Issue #86 v1. Names an
 * `AWS::ElasticLoadBalancingV2::LoadBalancer`, discovers the ECS service(s)
 * behind its HTTP `forward` listeners, boots their replicas, and stands up a
@@ -88027,8 +88445,8 @@ function createLocalStartAgentCoreCommand$1() {
 * The symmetric ALB counterpart of `start-api`.
 */
 function createLocalStartAlbCommand() {
-	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token <jwt> to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, albStrategy(options), cdkdExtraStateProviders);
+	const cmd = new Command("start-alb").description("Run an Application Load Balancer locally: name the ALB, and cdk-local boots the ECS service(s) behind its listeners and stands up a local front-door on each listener port that round-robins across the running replicas and routes its listener rules across the backing services — a stable host endpoint, like behind a real load balancer. The symmetric ALB counterpart of `start-api`. Each <target> accepts a CDK display path (MyStack/MyAlb) or stack-qualified logical ID; single-stack apps may omit the stack prefix. Supports HTTP and HTTPS listeners — by default a cloud-HTTPS listener is served over plain HTTP locally (with X-Forwarded-Proto: https preserved). Pass --tls (or --tls-cert / --tls-key) to terminate TLS locally with a self-signed or user-supplied cert. All six ALB rule-condition fields are honored (path-pattern / host-header / http-header / http-request-method / query-string / source-ip); forward (single and weighted), redirect, and fixed-response actions; and ECS or Lambda targets (a Lambda target group is invoked locally via the Lambda RIE). authenticate-cognito / authenticate-oidc actions enforce a local Bearer-JWT check (or AWSELBAuthSessionCookie pass-through) against the same JWKS / OIDC discovery URL the deployed ALB would; use --bearer-token <jwt> to inject a default token or --no-verify-auth to disable the guard. Omit <targets> in an interactive terminal to multi-select the load balancers from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ElasticLoadBalancingV2::LoadBalancer resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes of the ECS services behind the ALB. Does NOT reach a Lambda target group's container environment (upstream go-to-k/cdk-local#707; a boot warning names the affected functions) — use --from-cfn-stack for those. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
+		await runEcsServiceEmulator(targets, options, buildAlbEmulatorStrategy(options), cdkdExtraStateProviders);
 	}));
 	addAlbSpecificOptions(cmd);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
@@ -89099,4 +89517,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CG34-sQd.js.map
+//# sourceMappingURL=program-D2Vykejc.js.map