@go-to-k/cdkd 0.288.1 → 0.288.3

package/dist/{program-BPeZLD0q.js → program-BXH3FeeV.js}

@@ -1,8 +1,8 @@
-import { $ as createMaskedRetryLogger, $n as runDockerStreaming, $r as StackTerminationProtectionError, $t as carriesSecretMask, A as WARM_THROUGHPUT_MEMBERS, An as rewriteTemplateAssetReferences, At as replayWarn, B as yellow, Bn as validateContainerRepoName, Bt as s3BucketWebsiteUrl, C as unsupportedFinalSnapshotError, Cn as shouldRetainResource, Cr as displaySafe, Ct as normalizeAwsTagsToCfn, D as isStatefulRecreateTargetForReplace, Dn as buildAssetRedirectMap, Dr as derivePartitionAndUrlSuffix, Dt as configBooleanRefusal, E as MULTI_REGION_RECREATE_BLOCKED_TYPES, En as WorkGraph, Er as canonicalizeRegion, Et as coerceCfnBoolean, F as bold, Fn as getBootstrapMarkerKey, Fr as setAwsClients, Ft as producerRegionsFromState, G as secretBearingStateKeyWarning, Gn as describeDockerExecFailure, Gr as LocalStartServiceError, Gt as findSilentDropProperties, H as collectPublishedOutputNames, Hn as describeAwsFailure, Hr as DynamicReferenceRegionAmbiguousError, Ht as DiffCalculator, I as cyan, In as isCrossRegionRedirect, It as s3BucketArn, J as IAMRoleProvider, Jn as formatDockerLoginError, Jr as PartialFailureError, Jt as DagBuilder, K as stateKeySecretExposure, Kn as describeDockerFailure, Kt as describeTypeWithThrottleRetry, L as gray, Ln as parseBootstrapMarker, Lr as CdkdError, Lt as s3BucketDomainName, M as isWarmThroughputDecrease, Mn as BOOTSTRAP_MARKER_PREFIX, Mr as AwsClients, Mt as requireConfigObject, N as toFiniteNumber, Nn as assertAssetBucketRegion, Nr as getAwsClients, Nt as requireConfigString, O as isStatefulRecreateTargetSync, On as createAssetRedirectResolver, Or as AssemblyReader, Ot as configStringRefusal, P as formatResourceLine, Pn as ensureAssetStorage, Pr as resetAwsClients, Pt as classifyReplaySecretRegion, Q as wouldReturnToSdkProvider, Qn as runDockerForeground, Qr as StackHasActiveImportsError, Qt as TEMPLATE_SOURCED_RULES, R as green, Rn as readBootstrapMarkerBody, Rt as s3BucketDualStackDomainName, S as refusesFinalSnapshot, Sn as importableOutputs, Sr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, St as WAFv2WebACLProvider, T as extractDeploymentEventError, Tn as stringifyValue, Tr as PARTITION_TABLE, Tt as assertRegionMatch, U as exportAliasCollisionScrubWarning, Un as buildDockerImage, Ur as IntrinsicResolutionRefusalError, Ut as INTRINSIC_KEYS, V as collectDeclaredOutputNames, Vn as buildDenyExternalAccessPolicy, Vr as DeployCancelledError, Vt as applyRoleArnIfSet, W as isExportAliasCollision, Wn as describeDockerCapturedOutput, Wr as LocalInvokeBuildError$1, Wt as findActionableSilentDrops, X as clearOnUpdateRemoval, Xn as partitionSensitiveEnv, Xr as ResourceTimeoutError, Xt as STATE_SOURCED_CROSS_GENERATION_RULES, Y as collectInlinePolicyNamesManagedBySiblings, Yn as getDockerCmd, Yr as ProvisioningError, Yt as TemplateParser, Z as ProviderRegistry, Zn as redactDockerArgvValues, Zr as ResourceUpdateNotSupportedError, Zt as STATE_SOURCED_READBACK_RULES, _ as PRE_DELETE_SNAPSHOT_TYPES, _n as shellQuote, _r as CFN_TEMPLATE_BODY_LIMIT, _t as coerceParameterTypedValue, a as DeploymentEventsStore, ai as withErrorHandling, an as maskSecretsInText, ar as synthesisStatusMessage, at as isInterruptedWaitError, b as createPreDeleteFinalSnapshot, bn as exportNamesCarriedFrom, br as findLargeInlineResources, bt as parameterTypeMayLoseSecretIdentity, c as replayFailedOperations, ci as isThrottlingError, cn as redactSecretsForState, cr as resolveApp, ct as slowCcOperationTimeoutMs, d as updatePartialReason, di as markRedactedCause, dn as S3StateBackend, dr as resolveSkipPrefix, dt as deleteSkipReason, en as createSecretMasker, er as escapeRegExp, et as maskDeep, f as withResourceDeadline, fi as retryClassificationText, fn as rebuildClientForBucketRegion, fr as resolveStateBucketWithDefault, ft as disableInstanceApiTermination, g as ATOMIC_FINAL_SNAPSHOT_TYPES, gn as forceQuitRecoveryClause, gr as warnDeprecatedNoPrefixCliFlag, gt as cfnRefValueFromPhysicalId, h as computeImplicitDeleteEdges, hn as buildLockContentionMessage, hr as stateBucketExistenceConfirmed, ht as carriesDynamicReference, i as DeploymentEventsReader, ii as normalizeAwsError, in as maskSecretsInError, ir as Synthesizer, it as interruptWatchListenerCount, j as coerceWarmThroughput$1, jn as AssetModeResolver, jr as resolveBucketRegion, jt as requireConfigArray, k as renderStatefulReason, kn as loadPublishableAssetManifest, kr as processStackMessages, kt as readConfigString, l as replayRollback, li as isTransientServerError, ln as scrubResourceRecord, lr as resolveAutoAssetStorage, lt as UNSPECIFIED_SKIP_REASON, m as IMPLICIT_DELETE_DEPENDENCIES, mn as buildForceUnlockCommand, mr as resolveUseCdkBootstrapAssets, mt as IntrinsicFunctionResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as errorCauseChain, nr as AssetManifestLoader, nt as beginCommandInterruptScope, o as planFailedOps, oi as isMarkedNonRetryable, on as recordMaskOnlyValue, or as getDefaultStateBucketName, ot as startInterruptWatch, p as maskingRetryLogger, pn as UNRENDERABLE, pr as resolveStateBucketWithDefaultAndSource, pt as isTerminationProtectionPropagationError, q as getCurrentResourceSecrets, qn as dockerSpawnEnvWithSensitive, qr as NestedStackChildDirectDestroyError, qt as withRetry, r as DeployEngine, rn as isSingleDynamicReferenceToken, rr as getDockerImageBySourceHash, rt as endCommandInterruptScope, s as planRollback, si as isRetryableTransientError, sn as recoverMaskedOutput, sr as getLegacyStateBucketName, st as CloudControlProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as dynamicReferenceTokens, tr as stripControlChars, tt as maskerOrIdentity, u as updatePartialMessage, ui as markNonRetryable, un as LockManager, ur as resolveCaptureObservedState, ut as deleteIndeterminateGuards, v as buildFinalSnapshotIdentifier, vn as CUSTOM_RESOURCE_RESPONSE_PREFIX, vr as CFN_TEMPLATE_URL_LIMIT, vt as getAccountInfo, w as makeCanonicalizePropertiesFn, wn as AssetPublisher, wr as expectedOwnerParam, wt as resolveExplicitPhysicalId, x as isFinalSnapshotError, xn as importableOutputKeys, xr as uploadCfnTemplate, xt as refStateLookupFromResource, y as ccRoutedFinalSnapshotError, yn as DEFAULT_STATE_PREFIX, yr as MIGRATE_TMP_PREFIX, yt as isUnboundTemplateParameter, z as red, zn as validateAssetBucketName, zr as CrossAccountSecretRefusalError, zt as s3BucketRegionalDomainName } from "./deploy-engine-ZPkBIilF.js";
+import { $ as ProviderRegistry, $n as redactDockerArgvValues, $r as ResourceUpdateNotSupportedError, $t as STATE_SOURCED_READBACK_RULES, A as renderStatefulReason, An as createAssetRedirectResolver, Ar as AssemblyReader, At as configStringRefusal, B as red, Bn as readBootstrapMarkerBody, Bt as s3BucketDualStackDomainName, C as refusesFinalSnapshot, Cn as importableOutputKeys, Cr as uploadCfnTemplate, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as stringifyValue, Dr as PARTITION_TABLE, Dt as assertRegionMatch, E as extractDeploymentEventError, En as AssetPublisher, Er as expectedOwnerParam, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as assertAssetBucketRegion, Fr as getAwsClients, Ft as requireConfigString, G as isExportAliasCollision, Gn as buildDockerImage, Gr as IntrinsicResolutionRefusalError, Gt as INTRINSIC_KEYS, H as collectDeclaredOutputNames, Hn as validateContainerRepoName, Ht as s3BucketWebsiteUrl, I as bold, In as ensureAssetStorage, Ir as resetAwsClients, It as classifyReplaySecretRegion, J as stateKeySecretExposure, Jn as describeDockerFailure, Jt as describeTypeWithThrottleRetry, K as secretBearingStateKeyWarning, Kn as describeDockerCapturedOutput, Kr as LocalInvokeBuildError$1, Kt as findActionableSilentDrops, L as cyan, Ln as getBootstrapMarkerKey, Lr as setAwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as rewriteTemplateAssetReferences, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as AssetModeResolver, Nr as resolveBucketRegion, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as WorkGraph, Or as canonicalizeRegion, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as BOOTSTRAP_MARKER_PREFIX, Pr as AwsClients, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as partitionSensitiveEnv, Qr as ResourceTimeoutError, Qt as STATE_SOURCED_CROSS_GENERATION_RULES, R as gray, Rn as isCrossRegionRedirect, Rt as s3BucketArn, S as isFinalSnapshotError, Sn as exportNamesCarriedFrom, Sr as findLargeInlineResources, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as shouldRetainResource, Tr as displaySafe, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as buildDenyExternalAccessPolicy, Ur as DeployCancelledError, Ut as applyRoleArnIfSet, V as yellow, Vn as validateAssetBucketName, Vr as CrossAccountSecretRefusalError, Vt as s3BucketRegionalDomainName, W as exportAliasCollisionScrubWarning, Wn as describeAwsFailure, Wr as DynamicReferenceRegionAmbiguousError, Wt as DiffCalculator, X as IAMRoleProvider, Xn as formatDockerLoginError, Xr as PartialFailureError, Xt as DagBuilder, Y as getCurrentResourceSecrets, Yn as dockerSpawnEnvWithSensitive, Yr as NestedStackChildDirectDestroyError, Yt as withRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as getDockerCmd, Zr as ProvisioningError, Zt as TemplateParser, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _n as buildLockContentionMessage, _r as stateBucketExistenceConfirmed, _t as carriesDynamicReference, a as DeploymentEventsStore, an as isSingleDynamicReferenceToken, ar as getDockerImageBySourceHash, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as CUSTOM_RESOURCE_RESPONSE_PREFIX, br as CFN_TEMPLATE_URL_LIMIT, bt as getAccountInfo, c as replayFailedOperations, ci as isMarkedNonRetryable, cn as recordMaskOnlyValue, cr as getDefaultStateBucketName, ct as startInterruptWatch, d as updatePartialReason, di as isTransientServerError, dn as scrubResourceRecord, dr as resolveAutoAssetStorage, dt as UNSPECIFIED_SKIP_REASON, ei as StackHasActiveImportsError, en as TEMPLATE_SOURCED_RULES, er as runDockerForeground, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as markNonRetryable, fn as LockManager, fr as resolveCaptureObservedState, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gn as buildForceUnlockCommand, gr as resolveUseCdkBootstrapAssets, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hn as UNRENDERABLE, hr as resolveStateBucketWithDefaultAndSource, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, in as errorCauseChain, ir as AssetManifestLoader, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as loadPublishableAssetManifest, jr as processStackMessages, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as buildAssetRedirectMap, kr as derivePartitionAndUrlSuffix, kt as configBooleanRefusal, l as replayRollback, li as isRetryableTransientError, ln as recoverMaskedOutput, lr as getLegacyStateBucketName, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as retryClassificationText, mn as rebuildClientForBucketRegion, mr as resolveStateBucketWithDefault, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as createSecretMasker, nr as escapeRegExp, nt as maskDeep, o as planFailedOps, oi as normalizeAwsError, on as maskSecretsInError, or as Synthesizer, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as markRedactedCause, pn as S3StateBackend, pr as resolveSkipPrefix, pt as deleteSkipReason, q as secretSafeKeyDisplay, qn as describeDockerExecFailure, qr as LocalStartServiceError, qt as findSilentDropProperties, r as DeployEngine, rn as dynamicReferenceTokens, rr as stripControlChars, rt as maskerOrIdentity, s as planRollback, si as withErrorHandling, sn as maskSecretsInText, sr as synthesisStatusMessage, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as StackTerminationProtectionError, tn as carriesSecretMask, tr as runDockerStreaming, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as isThrottlingError, un as redactSecretsForState, ur as resolveApp, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as forceQuitRecoveryClause, vr as warnDeprecatedNoPrefixCliFlag, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as importableOutputs, wr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as DEFAULT_STATE_PREFIX, xr as MIGRATE_TMP_PREFIX, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as shellQuote, yr as CFN_TEMPLATE_BODY_LIMIT, yt as coerceParameterTypedValue, z as green, zn as parseBootstrapMarker, zr as CdkdError, zt as s3BucketDomainName } from "./deploy-engine-CfxcC3q3.js";
 import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CGFRodgE.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-4QzW_6q5.js";
+import { t as getCdkdVersion } from "./version-CEyZvTcB.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CQrHElrl.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1780,15 +1780,16 @@ async function bootstrapCommand(options) {
 			});
 		}
 		let skipStateBucketConfig = false;
-		if (bucketExists) if (!options.force) {
-			if (!options.assets) {
-				logger.warn(`Bucket ${bucketName} already exists. Use --force to reconfigure (this will not delete existing state)`);
-				return;
-			}
-			logger.info(`State bucket ${bucketName} already exists — skipping reconfiguration (use --force to reconfigure)`);
-			skipStateBucketConfig = true;
-		} else logger.info("--force specified, continuing with existing bucket");
-		else {
+		if (bucketExists) {
+			if (!options.force) {
+				if (!options.assets) {
+					logger.warn(`Bucket ${bucketName} already exists. Use --force to reconfigure (this will not delete existing state)`);
+					return;
+				}
+				logger.info(`State bucket ${bucketName} already exists — skipping reconfiguration (use --force to reconfigure)`);
+				skipStateBucketConfig = true;
+			} else logger.info("--force specified, continuing with existing bucket");
+		} else {
 			logger.info(`Creating S3 bucket: ${bucketName} in region ${region}`);
 			const createBucketParams = { Bucket: bucketName };
 			if (region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: region };
@@ -3469,6 +3470,67 @@ function mapsEqual(a, b) {
 	}
 	return true;
 }
+/**
+* Describe a `JSON.parse` failure WITHOUT echoing the body (issue
+* [#2667](https://github.com/go-to-k/cdkd/issues/2667) review).
+*
+* V8 embeds a window of the INPUT in its parse error, so interpolating
+* `err.message` republishes whatever bytes sat near the syntax error. Measured
+* on node v24.19.0:
+*
+* ```
+* JSON.parse('{"exports":{"K":{"value":hunter2SECRET}}}')
+* -> Unexpected token 'h', ..."K":{"value":hunter2SEC"... is not valid JSON
+* ```
+*
+* This index holds resolved Output VALUES, and for the unscrubbed state
+* `cdkd scrub` targets those are exactly the plaintext — which then reaches a
+* `logger.error` and the command's failure message, i.e. `--dry-run --fail` CI
+* logs. Same class as the `import.ts` parse-snippet leak issue
+* [#2829](https://github.com/go-to-k/cdkd/issues/2829) closed.
+*
+* What survives is the SIZE, plus the OFFSET WHEN V8 STATES ONE — neither is a
+* function of the body's content, and both help an operator holding the object
+* locate the damage. The offset is extracted by pattern rather than passed
+* through, so a message worded differently yields no offset instead of leaking
+* the rest of the sentence. The two numbers are in DIFFERENT UNITS and the
+* message says so: V8 counts `at position` in UTF-16 code units while the size
+* is UTF-8 bytes, so `'{ n\u00f6t json'` reports position 2 and 11 bytes. Measured on node v24.19.0: the `Expected ...`
+* family carries `at position N` and the `Unexpected token 'X', ...snippet...`
+* family — the one that embeds the body, i.e. the case this exists for — does
+* NOT, so the size is what is always present and the offset is a bonus. Both
+* arms are driven by tests.
+*/
+function describeParseFailure(err, bytes) {
+	const raw = err instanceof Error ? err.message : String(err);
+	const at = /at position (\d+)/.exec(raw);
+	return `invalid JSON${at ? ` at code-unit position ${at[1]}` : ""}; ${bytes} byte(s) read`;
+}
+/**
+* UTF-8 byte length of a decoded body, for {@link describeParseFailure}.
+*
+* `body.length` counts UTF-16 CODE UNITS, so reporting it as "byte(s)" is
+* wrong for any non-ASCII index — an export name outside the BMP counts 2
+* where the object holds 4 (issue #2667 review). The number is meant to help
+* an operator match the message against the object S3 holds, so it has to be
+* the same unit S3 reports.
+*/
+function utf8ByteLength(body) {
+	return Buffer.byteLength(body, "utf8");
+}
+/**
+* Describe an `indexVersion` that is not a usable number, WITHOUT rendering it.
+*
+* `String(x)` renders a body-controlled value verbatim for two of the three
+* non-number shapes — measured on node v24.19.0: a JSON string yields itself
+* and a one-element array yields its element, while only an object degrades to
+* `[object Object]`. The field is attacker-controlled in the same sense the
+* rest of the body is, so the message reports its TYPE and, for a number, its
+* value — the only shape whose value is safe because it is a number.
+*/
+function describeIndexVersion(value) {
+	return typeof value === "number" ? String(value) : `a non-numeric value (${typeof value})`;
+}
 const DEFAULT_OPTIONS = {
 	maxWriteRetries: 5,
 	initialBackoffMs: 100,
@@ -3596,12 +3658,57 @@ var ExportIndexStore = class {
 		await this.enqueueWrite("update", () => this.applyStackUpdate(stackName, producerRegion, outputs));
 	}
 	/**
+	* A snapshot of the persisted index, read WITHOUT the rebuild that
+	* {@link lookup} triggers on a missing or corrupt object.
+	*
+	* Every S3 call THIS METHOD makes is a GET, so a caller that must perform no
+	* S3 write (`cdkd scrub --dry-run`) can read the entries here — with ONE
+	* documented exception, which such a caller has to know about: when another
+	* caller on the same instance already has a `doLoad` in flight, the first
+	* line below awaits IT, and `doLoad` rebuilds (a PUT) on a missing or
+	* corrupt object. Unreachable from `cdkd scrub`, which never calls `lookup`
+	* and drives one store per region serially — but the guarantee is the thing
+	* a future no-write caller would rely on, so it is stated with its bound
+	* rather than unconditionally.
+	*
+	* THREE OUTCOMES, and only ONE of them is `undefined`. A MISSING object
+	* returns `undefined`: there is nothing to audit and nothing to repair. A
+	* body that does not PARSE, and an `indexVersion` this binary cannot
+	* interpret, both THROW — because the caller's question is "what does this
+	* index hold", and for those two the honest answer is "this call could not
+	* find out". Collapsing the corrupt case into `undefined` reads as an empty
+	* index, so a caller reports nothing over bytes it never interpreted, which
+	* for `cdkd scrub` is a green gate over a file that may still hold the
+	* plaintext (issue [#2667](https://github.com/go-to-k/cdkd/issues/2667)) —
+	* the exact shape that issue exists to close, one level down. `doLoad`'s own
+	* corrupt arm is unaffected: it REBUILDS, which is a write, and is why this
+	* read cannot share it.
+	*
+	* The returned map is a COPY, and a `patchEntry` on this same instance
+	* afterwards writes under the etag this read cached rather than re-reading.
+	*/
+	async readPersistedEntries() {
+		if (this.loadState.kind === "loading") await this.loadState.promise;
+		if (this.loadState.kind === "loaded") return new Map(this.loadState.entries);
+		const outcome = await this.loadPersisted();
+		if (outcome.kind === "missing") return void 0;
+		if (outcome.kind === "corrupt") throw new Error(`Exports index at ${this.indexKey()} could not be parsed (${describeParseFailure(outcome.error, outcome.bytes)}). Its contents were NOT examined.`);
+		return new Map(outcome.entries);
+	}
+	/**
 	* Patch a single entry into the index after a `lookup` miss fell back
 	* to a state.json scan and found the value. Lightweight write that
 	* does NOT require a full rebuild.
+	*
+	* Returns whether the index now holds `entry` — `false` when the write
+	* was abandoned (a non-retryable S3 failure, or an exhausted If-Match
+	* retry budget), which `runWithRetry` logs and does not throw. A caller
+	* for which an unwritten entry is the outcome it must report — `cdkd
+	* scrub`, where the entry keeps whatever value it held — reads this
+	* return; the deploy path treats the index as a perf hint and ignores it.
 	*/
-	async patchEntry(exportName, entry) {
-		await this.enqueueWrite("patch", () => this.applyPatch(exportName, entry));
+	async patchEntry(exportName, entry, opts = {}) {
+		return this.enqueueWrite("patch", () => this.applyPatch(exportName, entry, opts.requireOwner));
 	}
 	/**
 	* Drop all entries owned by `(stackName, producerRegion)`. Used after
@@ -3622,7 +3729,7 @@ var ExportIndexStore = class {
 	*/
 	async enqueueWrite(label, op) {
 		const next = this.writeChain.then(() => this.runWithRetry(label, op));
-		this.writeChain = next.catch(() => {});
+		this.writeChain = next.then(() => {}, () => {});
 		return next;
 	}
 	/**
@@ -3657,31 +3764,54 @@ var ExportIndexStore = class {
 		};
 		await promise;
 	}
+	/**
+	* GET the index object and, when it parses, install it as `loadState`.
+	* Performs no PUT: the missing / corrupt REBUILD lives one level up in
+	* {@link doLoad}, so {@link readPersistedEntries} can share this parse
+	* without writing. A `indexVersion` above this binary's still throws
+	* here rather than reporting `corrupt` — a rebuild would overwrite an
+	* index a newer binary wrote with this binary's view of it.
+	*/
+	async loadPersisted() {
+		const raw = await this.readIndexRaw();
+		if (raw === null) return { kind: "missing" };
+		const { body, etag } = raw;
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch (err) {
+			return {
+				kind: "corrupt",
+				error: err,
+				bytes: utf8ByteLength(body)
+			};
+		}
+		if (typeof parsed.indexVersion !== "number" || parsed.indexVersion > 1) throw new Error(`Exports index uses indexVersion ${describeIndexVersion(parsed.indexVersion)} which is newer than this cdkd binary supports (max ${1}). Upgrade cdkd.`);
+		const entries = /* @__PURE__ */ new Map();
+		for (const [name, entry] of Object.entries(parsed.exports ?? {})) entries.set(name, entry);
+		this.loadState = {
+			kind: "loaded",
+			etag,
+			entries
+		};
+		return {
+			kind: "loaded",
+			entries
+		};
+	}
 	async doLoad() {
 		try {
-			const raw = await this.readIndexRaw();
-			if (raw === null) {
+			const outcome = await this.loadPersisted();
+			if (outcome.kind === "missing") {
 				this.logger.info("Exports index missing; rebuilding from state.json files");
 				await this.rebuild();
 				return;
 			}
-			const { body, etag } = raw;
-			let parsed;
-			try {
-				parsed = JSON.parse(body);
-			} catch (err) {
-				this.logger.warn(`Exports index corrupt (${err instanceof Error ? err.message : String(err)}); rebuilding from state.json files`);
+			if (outcome.kind === "corrupt") {
+				this.logger.warn(`Exports index corrupt (${outcome.error instanceof Error ? outcome.error.message : String(outcome.error)}); rebuilding from state.json files`);
 				await this.rebuild();
 				return;
 			}
-			if (typeof parsed.indexVersion !== "number" || parsed.indexVersion > 1) throw new Error(`Exports index uses indexVersion ${String(parsed.indexVersion)} which is newer than this cdkd binary supports (max ${1}). Upgrade cdkd.`);
-			const entries = /* @__PURE__ */ new Map();
-			for (const [name, entry] of Object.entries(parsed.exports ?? {})) entries.set(name, entry);
-			this.loadState = {
-				kind: "loaded",
-				etag,
-				entries
-			};
 		} catch (err) {
 			this.loadState = { kind: "unloaded" };
 			throw err;
@@ -3763,7 +3893,7 @@ var ExportIndexStore = class {
 	}
 	async applyStackUpdate(stackName, producerRegion, outputs) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const next = new Map(this.loadState.entries);
 		for (const [name, entry] of next) if (entry.producerStack === stackName && entry.producerRegion === producerRegion) next.delete(name);
 		for (const [name, value] of Object.entries(outputs)) {
@@ -3774,8 +3904,8 @@ var ExportIndexStore = class {
 				producerRegion
 			});
 		}
-		if (mapsEqual(this.loadState.entries, next)) return;
-		await this.persist(next);
+		if (mapsEqual(this.loadState.entries, next)) return true;
+		return this.persist(next);
 	}
 	/**
 	* Two stacks publishing one export name (issue #2193). CloudFormation
@@ -3792,27 +3922,34 @@ var ExportIndexStore = class {
 		const safeName = displaySafe(exportName);
 		this.logger.warn(`Export '${safeName}' is published by both '${existing.producerStack}' (${existing.producerRegion}) and '${stackName}' (${producerRegion}); the exports index keeps the latest writer, so an Fn::ImportValue on it binds to whichever deployed last. CloudFormation refuses a second producer of the same export name — rename one of the two exports. (If '${existing.producerStack}' predates cdkd's state schema v9, this is its stale entry for a plain output of that name, and its next deploy clears it.)`);
 	}
-	async applyPatch(exportName, entry) {
+	async applyPatch(exportName, entry, requireOwner) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
+		if (requireOwner) {
+			const current = this.loadState.entries.get(exportName);
+			if (!current || current.producerStack !== requireOwner.producerStack || current.producerRegion !== requireOwner.producerRegion) {
+				this.logger.warn(`Exports index entry ownership changed under a patch; refusing to write it. Expected producer '${displaySafe(requireOwner.producerStack)}' (${displaySafe(requireOwner.producerRegion)}), found ${current ? `'${displaySafe(current.producerStack)}' (${displaySafe(current.producerRegion)})` : "no entry"}.`);
+				return false;
+			}
+		}
 		const next = new Map(this.loadState.entries);
 		next.set(exportName, entry);
-		await this.persist(next);
+		return this.persist(next);
 	}
 	async applyRemoveStack(stackName, producerRegion) {
 		await this.ensureLoaded();
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const next = new Map(this.loadState.entries);
 		let changed = false;
 		for (const [name, entry] of next) if (entry.producerStack === stackName && entry.producerRegion === producerRegion) {
 			next.delete(name);
 			changed = true;
 		}
-		if (!changed) return;
-		await this.persist(next);
+		if (!changed) return true;
+		return this.persist(next);
 	}
 	async persist(entries) {
-		if (this.loadState.kind !== "loaded") return;
+		if (this.loadState.kind !== "loaded") return false;
 		const file = {
 			indexVersion: 1,
 			region: this.region,
@@ -3825,12 +3962,20 @@ var ExportIndexStore = class {
 			etag,
 			entries
 		};
+		return true;
 	}
+	/**
+	* Run `op` under the If-Match retry budget. `true` means `op` reported the
+	* index now holds what it was asked to write (a PUT, or a no-op skip whose
+	* result was already there); `false` means this store abandoned the write
+	* and logged the warn below. It does NOT throw on either arm — `state.json`
+	* is the canonical record for the deploy path, and a caller that needs the
+	* failure surfaced reads the return value (see {@link patchEntry}).
+	*/
 	async runWithRetry(label, op) {
 		let lastErr;
 		for (let attempt = 0; attempt < this.opts.maxWriteRetries; attempt++) try {
-			await op();
-			return;
+			return await op();
 		} catch (err) {
 			lastErr = err;
 			if (this.isPreconditionFailed(err)) {
@@ -3840,9 +3985,10 @@ var ExportIndexStore = class {
 				continue;
 			}
 			this.logger.warn(`Exports index ${label} failed (non-retryable): ${err instanceof Error ? err.message : String(err)}; continuing without index update`);
-			return;
+			return false;
 		}
 		this.logger.warn(`Exports index ${label} exhausted ${this.opts.maxWriteRetries} retries due to concurrent writers; continuing without index update. Last error: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+		return false;
 	}
 	isNoSuchKey(err) {
 		if (!err || typeof err !== "object") return false;
@@ -4173,7 +4319,8 @@ var IAMPolicyProvider = class {
 			};
 		}
 		const onNotFound = async (target) => {
-			assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
+			const clientRegion = await this.iamClient.config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, `${physicalId} (${target})`);
 		};
 		try {
 			if (legacyRoleFromPhysicalId) {
@@ -4493,7 +4640,8 @@ var IAMManagedPolicyProvider = class {
 				await this.iamClient.send(new GetPolicyCommand({ PolicyArn: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Managed policy ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -4970,7 +5118,8 @@ var IAMInstanceProfileProvider = class {
 				roles = (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: physicalId }))).InstanceProfile?.Roles?.map((r) => r.RoleName).filter((name) => !!name) || [];
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -4989,7 +5138,8 @@ var IAMInstanceProfileProvider = class {
 			this.logger.debug(`Successfully deleted IAM instance profile ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Instance profile ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -5390,7 +5540,8 @@ var IAMAccessKeyProvider = class {
 			this.logger.debug(`Successfully deleted IAM access key ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Access key ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -5719,7 +5870,8 @@ var IAMUserGroupProvider = class {
 				await this.iamClient.send(new GetUserCommand({ UserName: physicalId }));
 			} catch (error) {
 				if (error instanceof NoSuchEntityException) {
-					assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.iamClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`User ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -5983,7 +6135,8 @@ var IAMUserGroupProvider = class {
 			this.logger.debug(`Successfully deleted IAM group ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchEntityException) {
-				assertRegionMatch(await this.iamClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.iamClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Group ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -6829,7 +6982,8 @@ const EVENTBRIDGE_DEFAULT_ENABLED = true;
 * correct once every declared-but-unusable value has been refused.
 */
 function eventBridgeEnabledOf(eb) {
-	return coerceCfnBoolean(isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0) ?? EVENTBRIDGE_DEFAULT_ENABLED;
+	const declared = isPlainObject$1(eb) ? eb["EventBridgeEnabled"] : void 0;
+	return coerceCfnBoolean(declared) ?? EVENTBRIDGE_DEFAULT_ENABLED;
 }
 /** The notification families whose empty declaration is never SENT (issue #1759). */
 const NOTIFICATION_LIST_KEYS = [
@@ -9424,15 +9578,18 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		const replayOnUnusable = replayWarn(this.logger, context).onUnusable;
 		const notifConfig = properties["NotificationConfiguration"];
-		if (notifConfig) if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
-		else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
+		if (notifConfig) {
+			if (!await this.applyNotificationConfiguration(bucketName, notifConfig, replayOnUnusable)) overrides.set("NotificationConfiguration", void 0);
+			else recordEffectiveFold("NotificationConfiguration", effectiveNotificationConfiguration(notifConfig));
+		}
 		const corsConfig = properties["CorsConfiguration"];
 		if (corsConfig?.CorsRules && Array.isArray(corsConfig.CorsRules) && corsConfig.CorsRules.length > 0) await this.applyCorsConfiguration(bucketName, corsConfig);
 		else if (corsConfig != null) this.announceCreateEmptyCollectionSkip("CorsConfiguration", "CorsConfiguration.CorsRules");
 		const lifecycleConfig = properties["LifecycleConfiguration"];
-		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
-		else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(lifecycleConfig));
-		else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
+		if (lifecycleConfig?.Rules && Array.isArray(lifecycleConfig.Rules) && lifecycleConfig.Rules.length > 0) {
+			if (!await this.applyLifecycleConfiguration(bucketName, lifecycleConfig, replayOnUnusable)) overrides.set("LifecycleConfiguration", void 0);
+			else recordEffectiveFold("LifecycleConfiguration", effectiveLifecycleConfiguration(lifecycleConfig));
+		} else if (lifecycleConfig != null) this.announceCreateEmptyCollectionSkip("LifecycleConfiguration", "LifecycleConfiguration.Rules");
 		const loggingConfig = properties["LoggingConfiguration"];
 		const loggingRefusal = replayOnUnusable ? configStringRefusal(loggingConfig, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") : void 0;
 		if (loggingRefusal !== void 0) {
@@ -9839,7 +9996,8 @@ var S3BucketProvider = class S3BucketProvider {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
 			if (error instanceof NoSuchBucket) {
-				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.s3Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -10081,7 +10239,8 @@ var S3BucketProvider = class S3BucketProvider {
 	}
 	async readTags(bucket) {
 		try {
-			return normalizeAwsTagsToCfn((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: bucket }))).TagSet);
+			const resp = await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: bucket }));
+			return normalizeAwsTagsToCfn(resp.TagSet);
 		} catch (err) {
 			if (err.name === "NoSuchTagSet") return [];
 			throw err;
@@ -10773,12 +10932,14 @@ var S3BucketPolicyProvider = class {
 				this.logger.debug(`Successfully deleted S3 bucket policy ${logicalId}`);
 			} catch (error) {
 				if (error instanceof NoSuchBucket) {
-					assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.s3Client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Bucket ${physicalId} does not exist, skipping policy deletion`);
 					return;
 				}
 				if (error instanceof Error && (error.name === "NoSuchBucketPolicy" || error.message.includes("does not have"))) {
-					assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.s3Client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Bucket policy for ${physicalId} does not exist, skipping`);
 					return;
 				}
@@ -11252,7 +11413,8 @@ var SQSQueueProvider = class {
 			this.logger.debug(`Successfully deleted SQS queue ${logicalId}`);
 		} catch (error) {
 			if (error instanceof QueueDoesNotExist) {
-				assertRegionMatch(await this.sqsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.sqsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SQS queue ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -11416,7 +11578,8 @@ var SQSQueueProvider = class {
 			result["RedriveAllowPolicy"] = attributes["RedriveAllowPolicy"];
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: physicalId }))).Tags);
+			const tagsResp = await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof QueueDoesNotExist) return void 0;
 			throw err;
@@ -11548,7 +11711,8 @@ var SQSQueuePolicyProvider = class {
 			this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "QueueDoesNotExist" || error.message.includes("does not exist"))) {
-				assertRegionMatch(await this.sqsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.sqsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Queue ${physicalId} does not exist, skipping policy deletion`);
 				return;
 			}
@@ -11997,7 +12161,8 @@ var SNSTopicProvider = class {
 			this.logger.debug(`Successfully deleted SNS topic ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException) {
-				assertRegionMatch(await this.snsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.snsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SNS topic ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -12098,7 +12263,8 @@ var SNSTopicProvider = class {
 		}
 		result["DeliveryStatusLogging"] = mapDeliveryStatusLogging(attrs, stateProtocolCaseMap(properties?.["DeliveryStatusLogging"]));
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: physicalId }))).Tags);
+			const tagsResp = await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof NotFoundException) return void 0;
 			throw err;
@@ -12628,7 +12794,8 @@ var SNSSubscriptionProvider = class {
 			this.logger.debug(`Successfully deleted SNS subscription ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException) {
-				assertRegionMatch(await this.snsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.snsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Subscription ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -12820,7 +12987,8 @@ var SNSTopicPolicyProvider = class {
 			this.logger.debug(`Removed policy from topic ${topicArn}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NotFoundException" || error.name === "NotFound" || error.message.includes("not found") || error.message.includes("does not exist") || error.message.includes("Invalid parameter"))) {
-				assertRegionMatch(await getAwsClients().sns.config.region(), context?.expectedRegion, resourceType, logicalId, topicArn);
+				const clientRegion = await getAwsClients().sns.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, topicArn);
 				this.logger.debug(`Topic ${topicArn} not found or policy already removed, skipping`);
 				continue;
 			}
@@ -13047,12 +13215,12 @@ var LambdaFunctionProvider = class {
 	*/
 	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::Function", /* @__PURE__ */ new Map([["PublishToLatestPublished", "CloudFormation-only version-publishing directive with no AWS SDK equivalent"]])]]);
 	cleanupDeleteRetryDelayMs = 2e3;
-	eniWaitTimeoutMs = 600 * 1e3;
+	eniWaitTimeoutMs = 6e5;
 	eniWaitInitialDelayMs = 1e4;
 	eniWaitMaxDelayMs = 1e4;
 	functionUpdateMaxWaitSeconds = 600;
 	eniInitialSleepMs = 1e4;
-	eniDeleteRetryBudgetMs = 1800 * 1e3;
+	eniDeleteRetryBudgetMs = 18e5;
 	eniDeleteRetryIntervalMs = 15e3;
 	constructor() {
 		const awsClients = getAwsClients();
@@ -13189,7 +13357,7 @@ var LambdaFunctionProvider = class {
 				const deleteMessage = deleteError instanceof Error ? deleteError.message : String(deleteError);
 				cleanupFailure = deleteMessage;
 				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
-				if (attempt < LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS - 1) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
+				if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
 			}
 			if (cleanupFailure !== void 0) this.logger.error(`Cleanup DeleteFunction failed for ${ctx.logicalId} after ${ctx.apiName} failure — function may be orphaned: ${cleanupFailure}`);
 			throw new ProvisioningError(`Failed to set ${ctx.propertyName} on Lambda function ${ctx.logicalId} (function was deleted to maintain atomicity): ${message}`, ctx.resourceType, ctx.logicalId, ctx.functionName, error instanceof Error ? error : void 0);
@@ -13306,15 +13474,17 @@ var LambdaFunctionProvider = class {
 				this.logger.debug(`Updated RecursiveLoop for Lambda function ${physicalId} to '${newRecursiveLoop}'`);
 			}
 			const newReservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
-			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) if (newReservedConcurrentExecutions === void 0) {
-				await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
-				this.logger.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${physicalId} (template removed the property)`);
-			} else {
-				await this.lambdaClient.send(new PutFunctionConcurrencyCommand({
-					FunctionName: physicalId,
-					ReservedConcurrentExecutions: newReservedConcurrentExecutions
-				}));
-				this.logger.debug(`Updated ReservedConcurrentExecutions for Lambda function ${physicalId} to ${newReservedConcurrentExecutions}`);
+			if (newReservedConcurrentExecutions !== previousProperties["ReservedConcurrentExecutions"]) {
+				if (newReservedConcurrentExecutions === void 0) {
+					await this.lambdaClient.send(new DeleteFunctionConcurrencyCommand({ FunctionName: physicalId }));
+					this.logger.debug(`Cleared ReservedConcurrentExecutions for Lambda function ${physicalId} (template removed the property)`);
+				} else {
+					await this.lambdaClient.send(new PutFunctionConcurrencyCommand({
+						FunctionName: physicalId,
+						ReservedConcurrentExecutions: newReservedConcurrentExecutions
+					}));
+					this.logger.debug(`Updated ReservedConcurrentExecutions for Lambda function ${physicalId} to ${newReservedConcurrentExecutions}`);
+				}
 			}
 			if (codeSigningChanged && newCodeSigningConfigArn !== void 0) {
 				await this.lambdaClient.send(new PutFunctionCodeSigningConfigCommand({
@@ -13373,7 +13543,8 @@ var LambdaFunctionProvider = class {
 				this.logger.debug(`Detached VPC config from Lambda ${physicalId} before deletion`);
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException) {
-					assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.lambdaClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					return;
 				}
 				this.logger.warn(`Pre-delete VPC detach failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)} — continuing with delete`);
@@ -13385,7 +13556,8 @@ var LambdaFunctionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda function ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda function ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14119,7 +14291,8 @@ var LambdaPermissionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda permission ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda permission ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14345,7 +14518,8 @@ var LambdaUrlProvider = class {
 			this.logger.debug(`Successfully deleted Lambda URL ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda URL ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -14839,7 +15013,8 @@ var LambdaEventSourceMappingProvider = class {
 				await this.lambdaClient.send(new GetEventSourceMappingCommand({ UUID: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException) {
-					assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.lambdaClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Event source mapping ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -14849,7 +15024,8 @@ var LambdaEventSourceMappingProvider = class {
 			this.logger.debug(`Successfully deleted event source mapping ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Event source mapping ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15112,7 +15288,8 @@ var LambdaLayerVersionProvider = class {
 			this.logger.debug(`Successfully deleted Lambda layer version ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda layer version ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15312,8 +15489,10 @@ function compositeIdSeparatorRefusal(resourceType, logicalId, segments, maskSecr
 */
 function packCompositeId(resourceType, logicalId, segments, options) {
 	const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, segments, options?.maskSecrets);
-	if (refusal !== void 0) if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
-	else throw new ProvisioningError(refusal, resourceType, logicalId);
+	if (refusal !== void 0) {
+		if (options?.onRefusal) options.onRefusal(`${refusal} Continuing with the ambiguous id because the value comes from a cdkd state record, which no template edit can repair; the same value is REFUSED on a template-path create.`);
+		else throw new ProvisioningError(refusal, resourceType, logicalId);
+	}
 	return segments.map((segment) => String(segment.value)).join("|");
 }
 /** Render the expected id shape, e.g. `<databaseName>|<tableName>`. */
@@ -15556,7 +15735,8 @@ var LambdaEventInvokeConfigProvider = class {
 			this.logger.debug(`Successfully deleted Lambda EventInvokeConfig ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) {
-				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.lambdaClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Lambda EventInvokeConfig ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -15799,7 +15979,8 @@ var LambdaMicrovmImageProvider = class {
 				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$8) {
-					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -15874,7 +16055,8 @@ var LambdaMicrovmImageProvider = class {
 		}
 		const result = {};
 		if (name !== void 0) result["Name"] = name;
-		result["Tags"] = normalizeAwsTagsToCfn((await this.client.send(new ListTagsCommand$1({ Resource: physicalId }))).Tags);
+		const tagsResp = await this.client.send(new ListTagsCommand$1({ Resource: physicalId }));
+		result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		return result;
 	}
 	/**
@@ -16726,7 +16908,7 @@ const DYNAMODB_DELETE_POLL_COST_MS = INDEX_SETTLE_POLL_INTERVAL_MS + 200;
 * having spent different amounts; this is the ceiling on the total, and a total
 * does not need to know which terms produced it.
 */
-const DYNAMODB_DELETE_BUDGET_MS = 26 * 6e4;
+const DYNAMODB_DELETE_BUDGET_MS = 156e4;
 /**
 * What both DynamoDB providers self-report through `getMinResourceTimeoutMs()`.
 *
@@ -16911,7 +17093,7 @@ function autoScalingRetriesWithinDeleteBudget(budget, defaultMaxRetries) {
 * to ~6 min of retry backoff, which at ~8s a retry is ~45 retries spread across
 * however many calls the table's index and replica count produce.
 */
-const AUTO_SCALING_TEARDOWN_RESERVE_MS = 20 * 6e4;
+const AUTO_SCALING_TEARDOWN_RESERVE_MS = 12e5;
 /** `withRetry`'s capped backoff step (`maxDelayMs`), the cost of one retry. */
 const AUTO_SCALING_RETRY_STEP_MS = 8e3;
 /**
@@ -17882,7 +18064,10 @@ var DynamoDBTableProvider = class {
 			} });
 			const billingMode = billingModeUnusable ? prevBillingMode : requestedBillingMode;
 			const billingOrThroughputChanged = billingMode !== prevBillingMode || JSON.stringify(properties["ProvisionedThroughput"]) !== JSON.stringify(previousProperties["ProvisionedThroughput"]);
-			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : ""} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			if (billingOrThroughputChanged && billingMode === "PROVISIONED" && (prevBillingMode === "PAY_PER_REQUEST" || liveBillingMode === "PAY_PER_REQUEST") && properties["OnDemandThroughput"] !== void 0) {
+				const absentNote = properties["BillingMode"] === void 0 ? " (BillingMode is absent from the template, which CloudFormation resets to PROVISIONED)" : "";
+				throw new ProvisioningError(`AWS::DynamoDB::Table ${logicalId}: the template flips BillingMode to PROVISIONED${absentNote} while still declaring OnDemandThroughput, which AWS accepts only on a PAY_PER_REQUEST table. Nothing was applied. Remove OnDemandThroughput, or keep BillingMode: PAY_PER_REQUEST.`, logicalId, resourceType);
+			}
 			const liveIndexes = table?.GlobalSecondaryIndexes ?? [];
 			const desiredIndexByName = /* @__PURE__ */ new Map();
 			for (const entry of Array.isArray(properties["GlobalSecondaryIndexes"]) ? properties["GlobalSecondaryIndexes"] : []) {
@@ -18172,7 +18357,8 @@ var DynamoDBTableProvider = class {
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
-				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.dynamoDBClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB table ${physicalId} does not exist, skipping deletion`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -19146,7 +19332,8 @@ var DynamoDBTableProvider = class {
 			if (table.DeletionProtectionEnabled !== void 0) result["DeletionProtectionEnabled"] = table.DeletionProtectionEnabled;
 			if (table.TableClassSummary?.TableClass) result["TableClass"] = table.TableClassSummary.TableClass;
 			if (table.TableArn) try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }))).Tags);
+				const tagsResp = await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: table.TableArn }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof ResourceNotFoundException$1) return void 0;
 				throw err;
@@ -20219,10 +20406,14 @@ var DynamoDBGlobalTableProvider = class {
 				const onDemand = { ...gsi.OnDemandThroughput };
 				const unresolvedMembers = [];
 				if (!billingFlipped && previousOnDemand) {
-					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) if (declared?.readDeclared) unresolvedMembers.push("MaxReadRequestUnits");
-					else onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
-					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
-					else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
+					if (previousOnDemand.MaxReadRequestUnits !== void 0 && onDemand.MaxReadRequestUnits === void 0) {
+						if (declared?.readDeclared) unresolvedMembers.push("MaxReadRequestUnits");
+						else onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
+					}
+					if (previousOnDemand.MaxWriteRequestUnits !== void 0 && onDemand.MaxWriteRequestUnits === void 0) {
+						if (declared?.writeDeclared) unresolvedMembers.push("MaxWriteRequestUnits");
+						else onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
+					}
 				}
 				if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
 				if (!billingFlipped && gsi.ProvisionedThroughput) update.ProvisionedThroughput = gsi.ProvisionedThroughput;
@@ -20811,7 +21002,8 @@ var DynamoDBGlobalTableProvider = class {
 			this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$1) {
-				assertRegionMatch(await this.dynamoDBClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.dynamoDBClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DynamoDB GlobalTable ${physicalId} does not exist, skipping`);
 				this.deleteBudgets.release(deleteBudgetKey(physicalId, context?.expectedRegion));
 				this.protectionFlips.release(deleteBudgetKey(physicalId, context?.expectedRegion));
@@ -20922,7 +21114,8 @@ var DynamoDBGlobalTableProvider = class {
 				const subs = await this.readReplicaSubSpecs(client, tableNameForSubs, regionLabel);
 				Object.assign(entry, subs);
 				if (replicaArn) try {
-					entry["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }))).Tags);
+					const tagsResp = await client.send(new ListTagsOfResourceCommand({ ResourceArn: replicaArn }));
+					entry["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 				} catch (tagErr) {
 					if (tagErr instanceof ResourceNotFoundException$1) {
 						if (isLocal) throw tagErr;
@@ -23152,7 +23345,8 @@ var LogsLogGroupProvider = class {
 		const nextClass = normalizeClass(properties["LogGroupClass"]);
 		if (prevClass !== nextClass) {
 			const replaceFlags = "--replace --force-stateful-recreation";
-			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
+			const remedy = isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
+			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${remedy} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
 		const rawRetention = properties["RetentionInDays"];
 		const rawPreviousRetention = previousProperties["RetentionInDays"];
@@ -23170,18 +23364,22 @@ var LogsLogGroupProvider = class {
 			else await this.logsClient.send(new DisassociateKmsKeyCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Updated KMS key association for log group ${physicalId}`);
 		}
-		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
-			logGroupName: physicalId,
-			retentionInDays
-		}));
-		else await this.logsClient.send(new DeleteRetentionPolicyCommand({ logGroupName: physicalId }));
-		if (JSON.stringify(properties["DataProtectionPolicy"]) !== JSON.stringify(previousProperties["DataProtectionPolicy"])) if (properties["DataProtectionPolicy"]) {
-			const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
-			await this.logsClient.send(new PutDataProtectionPolicyCommand({
-				logGroupIdentifier: physicalId,
-				policyDocument
+		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) {
+			if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
+				logGroupName: physicalId,
+				retentionInDays
 			}));
-		} else await this.logsClient.send(new DeleteDataProtectionPolicyCommand({ logGroupIdentifier: physicalId }));
+			else await this.logsClient.send(new DeleteRetentionPolicyCommand({ logGroupName: physicalId }));
+		}
+		if (JSON.stringify(properties["DataProtectionPolicy"]) !== JSON.stringify(previousProperties["DataProtectionPolicy"])) {
+			if (properties["DataProtectionPolicy"]) {
+				const policyDocument = typeof properties["DataProtectionPolicy"] === "string" ? properties["DataProtectionPolicy"] : JSON.stringify(properties["DataProtectionPolicy"]);
+				await this.logsClient.send(new PutDataProtectionPolicyCommand({
+					logGroupIdentifier: physicalId,
+					policyDocument
+				}));
+			} else await this.logsClient.send(new DeleteDataProtectionPolicyCommand({ logGroupIdentifier: physicalId }));
+		}
 		if (properties["DeletionProtectionEnabled"] !== previousProperties["DeletionProtectionEnabled"]) {
 			const next = properties["DeletionProtectionEnabled"];
 			if (next !== void 0) await this.logsClient.send(new PutLogGroupDeletionProtectionCommand({
@@ -23206,18 +23404,20 @@ var LogsLogGroupProvider = class {
 		}
 		const newFieldIndex = properties["FieldIndexPolicies"];
 		const oldFieldIndex = previousProperties["FieldIndexPolicies"];
-		if (JSON.stringify(newFieldIndex) !== JSON.stringify(oldFieldIndex)) if (newFieldIndex && newFieldIndex.length > 0) {
-			if (newFieldIndex.length > 1) this.logger.debug(`Log group ${physicalId} declares ${newFieldIndex.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
-			const first = newFieldIndex[0];
-			const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
-			await this.logsClient.send(new PutIndexPolicyCommand({
-				logGroupIdentifier: physicalId,
-				policyDocument
-			}));
-		} else try {
-			await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
-		} catch (err) {
-			if (!(err instanceof ResourceNotFoundException$5)) throw err;
+		if (JSON.stringify(newFieldIndex) !== JSON.stringify(oldFieldIndex)) {
+			if (newFieldIndex && newFieldIndex.length > 0) {
+				if (newFieldIndex.length > 1) this.logger.debug(`Log group ${physicalId} declares ${newFieldIndex.length} FieldIndexPolicies; AWS only supports one log-group-level field index policy. Applying the first.`);
+				const first = newFieldIndex[0];
+				const policyDocument = typeof first === "string" ? first : JSON.stringify(first);
+				await this.logsClient.send(new PutIndexPolicyCommand({
+					logGroupIdentifier: physicalId,
+					policyDocument
+				}));
+			} else try {
+				await this.logsClient.send(new DeleteIndexPolicyCommand({ logGroupIdentifier: physicalId }));
+			} catch (err) {
+				if (!(err instanceof ResourceNotFoundException$5)) throw err;
+			}
 		}
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
@@ -23264,7 +23464,8 @@ var LogsLogGroupProvider = class {
 			this.logger.debug(`Successfully deleted log group ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$5) {
-				assertRegionMatch(await this.logsClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.logsClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Log group ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -23363,7 +23564,8 @@ var LogsLogGroupProvider = class {
 			if (found.arn) {
 				const arnForTags = found.arn.replace(/:\*$/, "");
 				try {
-					tags = normalizeAwsTagsToCfn((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags);
+					const tagsResp = await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
+					tags = normalizeAwsTagsToCfn(tagsResp.tags);
 				} catch (err) {
 					if (err instanceof ResourceNotFoundException$5) return void 0;
 					throw err;
@@ -23527,7 +23729,8 @@ var CloudWatchAlarmProvider = class {
 			this.logger.debug(`Successfully deleted CloudWatch alarm ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && error.name === "ResourceNotFound") {
-				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudWatchClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Alarm ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -23718,7 +23921,8 @@ var CloudWatchAlarmProvider = class {
 		if (alarm.EvaluateLowSampleCountPercentile !== void 0) result["EvaluateLowSampleCountPercentile"] = alarm.EvaluateLowSampleCountPercentile;
 		if (alarm.ThresholdMetricId !== void 0) result["ThresholdMetricId"] = alarm.ThresholdMetricId;
 		if (alarm.AlarmArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }))).Tags);
+			const tagsResp = await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: alarm.AlarmArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`CloudWatch ListTagsForResource(${alarm.AlarmArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -23856,7 +24060,8 @@ var CloudWatchAnomalyDetectorProvider = class {
 			this.logger.debug(`Successfully deleted CloudWatch anomaly detector ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$4) {
-				assertRegionMatch(await this.cloudWatchClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudWatchClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Anomaly detector ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24136,7 +24341,8 @@ var SecretsManagerSecretProvider = class {
 			this.logger.debug(`Successfully deleted secret ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$3) {
-				assertRegionMatch(await this.smClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.smClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Secret ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24530,7 +24736,8 @@ var SSMParameterProvider = class {
 	* `import()` now refuses it — and not here. Do not re-add it.
 	*/
 	async buildParameterArnUnguarded(name, mask) {
-		const accountInfo = await getAccountInfo(await this.ssmClient.config.region());
+		const region = await this.ssmClient.config.region();
+		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) {
 			this.logger.warn(mask(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the Arn attribute for SSM parameter ${name} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`));
 			return;
@@ -24664,7 +24871,8 @@ var SSMParameterProvider = class {
 			this.logger.debug(`Successfully deleted SSM parameter ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ParameterNotFound) {
-				assertRegionMatch(await this.ssmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ssmClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Parameter ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -24748,10 +24956,11 @@ var SSMParameterProvider = class {
 		} catch {}
 		if (!policiesEmitted) result["Policies"] = [];
 		try {
-			const tagArr = normalizeAwsTagsToCfn((await this.ssmClient.send(new ListTagsForResourceCommand$2({
+			const tagsResp = await this.ssmClient.send(new ListTagsForResourceCommand$2({
 				ResourceType: "Parameter",
 				ResourceId: physicalId
-			}))).TagList);
+			}));
+			const tagArr = normalizeAwsTagsToCfn(tagsResp.TagList);
 			result["Tags"] = Object.fromEntries(tagArr.map((t) => [t.Key, t.Value]));
 		} catch {}
 		return result;
@@ -25113,7 +25322,8 @@ var EventBridgeRuleProvider = class {
 				}))).Targets || []).map((t) => t.Id).filter((id) => id !== void 0);
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$2) {
-					assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.eventBridgeClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Rule ${ruleName} does not exist, skipping deletion`);
 					return;
 				}
@@ -25134,7 +25344,8 @@ var EventBridgeRuleProvider = class {
 			this.logger.debug(`Successfully deleted EventBridge rule ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$2) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Rule ${ruleName} does not exist, skipping deletion`);
 				return;
 			}
@@ -25206,7 +25417,8 @@ var EventBridgeRuleProvider = class {
 			if (!(err instanceof ResourceNotFoundException$2)) throw err;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: physicalId }))).Tags);
+			const tagsResp = await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (!(err instanceof ResourceNotFoundException$2)) throw err;
 		}
@@ -25443,13 +25655,15 @@ var EventBridgeBusProvider = class {
 			this.logger.debug(`Successfully deleted EventBus ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$2) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EventBus ${physicalId} does not exist, skipping`);
 				return;
 			}
 			const msg = error instanceof Error ? error.message : String(error);
 			if (msg.includes("does not exist")) {
-				assertRegionMatch(await this.eventBridgeClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.eventBridgeClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EventBus ${physicalId} does not exist, skipping`);
 				return;
 			}
@@ -25534,7 +25748,8 @@ var EventBridgeBusProvider = class {
 				result["Policy"] = resp.Policy;
 			}
 			if (resp.Arn) try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: resp.Arn }))).Tags);
+				const tagsResp = await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: resp.Arn }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof ResourceNotFoundException$2) return void 0;
 				throw err;
@@ -26297,7 +26512,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`VPC ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26470,7 +26686,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Subnet ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26556,7 +26773,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted InternetGateway ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`InternetGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26608,13 +26826,15 @@ var EC2Provider = class {
 			publicIp = response.PublicIp;
 			await this.applyTags(allocationId, properties, logicalId);
 			const instanceId = properties["InstanceId"];
-			if (instanceId) if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
-			else {
-				await this.ec2Client.send(new AssociateAddressCommand({
-					AllocationId: allocationId,
-					InstanceId: instanceId
-				}));
-				this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
+			if (instanceId) {
+				if (process.env["CDKD_NO_WAIT"] === "true") this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${instanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${instanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${instanceId}`);
+				else {
+					await this.ec2Client.send(new AssociateAddressCommand({
+						AllocationId: allocationId,
+						InstanceId: instanceId
+					}));
+					this.logger.debug(`Associated EIP ${logicalId} (${allocationId}) to ${instanceId}`);
+				}
 			}
 			this.logger.debug(`Successfully created EIP ${logicalId}: ${allocationId} (${publicIp})`);
 		} catch (error) {
@@ -26639,19 +26859,21 @@ var EC2Provider = class {
 			await this.applyTagDiff(allocationId, previousProperties["Tags"], properties["Tags"]);
 			const oldInstanceId = previousProperties["InstanceId"];
 			const newInstanceId = properties["InstanceId"];
-			if (oldInstanceId !== newInstanceId) if (newInstanceId) try {
-				await this.ec2Client.send(new AssociateAddressCommand({
-					AllocationId: allocationId,
-					InstanceId: newInstanceId,
-					AllowReassociation: true
-				}));
-			} catch (error) {
-				if (process.env["CDKD_NO_WAIT"] === "true" && this.isIncorrectInstanceStateError(error)) this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${newInstanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${newInstanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${newInstanceId} --allow-reassociation`);
-				else throw error;
-			}
-			else {
-				const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
-				if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
+			if (oldInstanceId !== newInstanceId) {
+				if (newInstanceId) try {
+					await this.ec2Client.send(new AssociateAddressCommand({
+						AllocationId: allocationId,
+						InstanceId: newInstanceId,
+						AllowReassociation: true
+					}));
+				} catch (error) {
+					if (process.env["CDKD_NO_WAIT"] === "true" && this.isIncorrectInstanceStateError(error)) this.logger.warn(`EIP ${logicalId} (${allocationId}) was NOT associated with ${newInstanceId}: --no-wait skips the instance running-state wait, and AssociateAddress rejects an instance that is not yet running. Verify and associate once the instance is running: aws ec2 describe-instances --instance-ids ${newInstanceId} --query 'Reservations[].Instances[].State.Name' && aws ec2 associate-address --allocation-id ${allocationId} --instance-id ${newInstanceId} --allow-reassociation`);
+					else throw error;
+				}
+				else {
+					const associationId = (await this.ec2Client.send(new DescribeAddressesCommand({ AllocationIds: [allocationId] }))).Addresses?.[0]?.AssociationId;
+					if (associationId) await this.ec2Client.send(new DisassociateAddressCommand({ AssociationId: associationId }));
+				}
 			}
 		}
 		return {
@@ -26675,7 +26897,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted EIP ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EIP ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26742,7 +26965,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted VPCGatewayAttachment ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`VPCGatewayAttachment ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26800,7 +27024,8 @@ var EC2Provider = class {
 			await this.ec2Client.send(new DeleteNatGatewayCommand({ NatGatewayId: physicalId }));
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NatGateway ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26855,7 +27080,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted RouteTable ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`RouteTable ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26953,7 +27179,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted Route ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Route ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -26991,7 +27218,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted SubnetRouteTableAssociation ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SubnetRouteTableAssociation ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27142,7 +27370,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SecurityGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27372,7 +27601,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted SecurityGroupIngress ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`SecurityGroupIngress ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -27431,10 +27661,12 @@ var EC2Provider = class {
 						maxDelay: 5
 					}, { InstanceIds: [instanceId] });
 				} else this.logger.debug(`Instance ${instanceId} launched (skipping running-state wait per --no-wait)`);
-				if (iamInstanceProfile) if (process.env["CDKD_NO_WAIT"] === "true") {
-					const profileRef = iamInstanceProfile.arn ?? iamInstanceProfile.name;
-					this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId} — and if it is missing, re-associate with: aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? `Arn=${profileRef}` : `Name=${profileRef}`}`);
-				} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
+				if (iamInstanceProfile) {
+					if (process.env["CDKD_NO_WAIT"] === "true") {
+						const profileRef = iamInstanceProfile.arn ?? iamInstanceProfile.name;
+						this.logger.warn(`Skipped the IAM instance profile association check for ${logicalId} (${instanceId}) because --no-wait leaves the instance in 'pending', where AssociateIamInstanceProfile is rejected. RunInstances associates the profile asynchronously and can complete with NO profile attached when the profile was created moments earlier. Verify with: aws ec2 describe-iam-instance-profile-associations --filters Name=instance-id,Values=${instanceId} — and if it is missing, re-associate with: aws ec2 associate-iam-instance-profile --instance-id ${instanceId} --iam-instance-profile ${iamInstanceProfile.arn ? `Arn=${profileRef}` : `Name=${profileRef}`}`);
+					} else await this.ensureIamInstanceProfileAssociated(instanceId, iamInstanceProfile.arn, iamInstanceProfile.name, logicalId);
+				}
 				const runningInstance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [instanceId] }))).Reservations?.[0]?.Instances?.[0];
 				const attributes = {
 					InstanceId: instanceId,
@@ -27644,8 +27876,10 @@ var EC2Provider = class {
 		}));
 		const newMonitoring = this.coerceBool(properties["Monitoring"]);
 		const oldMonitoring = this.coerceBool(previousProperties["Monitoring"]);
-		if (newMonitoring !== void 0 && newMonitoring !== oldMonitoring) if (newMonitoring) await this.ec2Client.send(new MonitorInstancesCommand({ InstanceIds: [physicalId] }));
-		else await this.ec2Client.send(new UnmonitorInstancesCommand({ InstanceIds: [physicalId] }));
+		if (newMonitoring !== void 0 && newMonitoring !== oldMonitoring) {
+			if (newMonitoring) await this.ec2Client.send(new MonitorInstancesCommand({ InstanceIds: [physicalId] }));
+			else await this.ec2Client.send(new UnmonitorInstancesCommand({ InstanceIds: [physicalId] }));
+		}
 		const newMetadata = this.buildMetadataOptions(properties);
 		const oldMetadata = this.buildMetadataOptions(previousProperties);
 		if (newMetadata !== void 0 && !this.shallowEqual(newMetadata, oldMetadata)) await this.ec2Client.send(new ModifyInstanceMetadataOptionsCommand({
@@ -27691,7 +27925,8 @@ var EC2Provider = class {
 			return;
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EC2 Instance ${physicalId} already terminated (not found), treating as success`);
 				return;
 			}
@@ -27996,7 +28231,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted NetworkAcl ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NetworkAcl ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -28080,7 +28316,8 @@ var EC2Provider = class {
 			this.logger.debug(`Successfully deleted NetworkAclEntry ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.ec2Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.ec2Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`NetworkAclEntry ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -28722,8 +28959,10 @@ var EC2Provider = class {
 		if (route.DestinationCidrBlock !== void 0) result["DestinationCidrBlock"] = route.DestinationCidrBlock;
 		else if (route.DestinationIpv6CidrBlock !== void 0) result["DestinationIpv6CidrBlock"] = route.DestinationIpv6CidrBlock;
 		else if (route.DestinationPrefixListId !== void 0) result["DestinationPrefixListId"] = route.DestinationPrefixListId;
-		if (route.GatewayId !== void 0) if (route.GatewayId.startsWith("vpce-")) result["VpcEndpointId"] = route.GatewayId;
-		else result["GatewayId"] = route.GatewayId;
+		if (route.GatewayId !== void 0) {
+			if (route.GatewayId.startsWith("vpce-")) result["VpcEndpointId"] = route.GatewayId;
+			else result["GatewayId"] = route.GatewayId;
+		}
 		if (route.NatGatewayId !== void 0) result["NatGatewayId"] = route.NatGatewayId;
 		if (route.InstanceId !== void 0) result["InstanceId"] = route.InstanceId;
 		if (route.NetworkInterfaceId !== void 0) result["NetworkInterfaceId"] = route.NetworkInterfaceId;
@@ -29577,7 +29816,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Authorizer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Authorizer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29669,7 +29909,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Resource ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Resource ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29731,7 +29972,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Deployment ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Deployment ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -29982,7 +30224,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Stage ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Stage ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -30291,7 +30534,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			this.logger.debug(`Successfully deleted API Gateway Method ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$1) {
-				assertRegionMatch(await this.apiGatewayClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.apiGatewayClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway Method ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -30990,11 +31234,13 @@ var ApiGatewayV2Provider = class {
 			const apiId = response.ApiId;
 			const apiEndpoint = response.ApiEndpoint;
 			this.logger.debug(`Successfully created API Gateway V2 Api ${logicalId}: ${apiId}`);
+			const executeApiArn = await this.buildExecuteApiArn(apiId);
 			return {
 				physicalId: apiId,
 				attributes: {
 					ApiId: apiId,
-					ApiEndpoint: apiEndpoint
+					ApiEndpoint: apiEndpoint,
+					...executeApiArn !== void 0 ? { ExecuteApiArn: executeApiArn } : {}
 				}
 			};
 		} catch (error) {
@@ -31009,7 +31255,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Api ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Api ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31017,6 +31264,52 @@ var ApiGatewayV2Provider = class {
 			throw new ProvisioningError(`Failed to delete API Gateway V2 Api ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	/**
+	* `arn:{partition}:execute-api:{region}:{account}:{apiId}` — the ARN AWS
+	* documents for an API Gateway v2 API, which no API call returns.
+	*
+	* Refuses to record a FABRICATED account, exactly as
+	* `SSMParameterProvider.buildParameterArn` does: an ARN naming a placeholder
+	* account is worse than an absent one, because it is persisted into
+	* `state.json` and outlives the deploy that produced it. The partition is
+	* DERIVED through the same closed region mapping `${AWS::Partition}` uses,
+	* and the region segment is canonicalized — defence in depth rather than the
+	* only fold, since `getAccountInfo` already canonicalizes what it returns
+	* (the issue #1795 / #1814 class: an unfolded `US-EAST-1` matches no IAM
+	* policy and is persisted).
+	*
+	* **NEVER THROWS, and callers depend on it.** Every call site is INSIDE the
+	* `try` of an operation that has already created or found the API, so an
+	* escape here would report a failed create over a resource that exists —
+	* an orphan. A failure means the attribute is absent, which is the state
+	* every deploy before this change was in.
+	*
+	* Takes NO `SecretMaskingContext`, where its SSM twin takes one, and the
+	* difference is not an oversight: every interpolated value here is
+	* non-secret BY CONSTRUCTION — an AWS-minted api id (or, on import, the
+	* CLI's own `--resource` argument), a derived partition, a region, an
+	* account id — and the catch names the error CLASS rather than its message.
+	* `SSMParameterProvider.buildParameterArn` needs a masker because it
+	* interpolates `error.message`, which quotes a resolved parameter value
+	* back. **Widening this catch to `error.message` therefore requires
+	* threading the masker in the same change**; the invariant is what makes
+	* the omission safe, not the current absence of a caller.
+	*/
+	async buildExecuteApiArn(apiId) {
+		try {
+			const region = await this.getClient().config.region();
+			const accountInfo = await getAccountInfo(region);
+			if (accountInfo.fabricated) {
+				this.logger.warn(`Cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so the ExecuteApiArn attribute for API ${apiId} would be fabricated and is NOT recorded. An Fn::GetAtt on it will fail until a later deploy resolves the account.`);
+				return;
+			}
+			const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
+			return `arn:${partition}:execute-api:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:${apiId}`;
+		} catch (error) {
+			this.logger.warn(`Could not build the ExecuteApiArn attribute for API ${apiId} (${error instanceof Error ? error.name : typeof error}), so it is NOT recorded. An Fn::GetAtt on it will fail until a later deploy records it.`);
+			return;
+		}
+	}
 	getApiAttribute(physicalId, attributeName) {
 		if (attributeName === "ApiId") return physicalId;
 	}
@@ -31061,7 +31354,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Stage ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Stage ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31121,7 +31415,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Integration ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Integration ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31174,7 +31469,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Route ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Route ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31227,7 +31523,8 @@ var ApiGatewayV2Provider = class {
 			this.logger.debug(`Successfully deleted API Gateway V2 Authorizer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$3) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`API Gateway V2 Authorizer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -31437,10 +31734,15 @@ var ApiGatewayV2Provider = class {
 		}
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) try {
-			await this.getClient().send(new GetApiCommand({ ApiId: explicit }));
+			const got = await this.getClient().send(new GetApiCommand({ ApiId: explicit }));
+			const executeApiArn = await this.buildExecuteApiArn(explicit);
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: {
+					ApiId: explicit,
+					...got.ApiEndpoint !== void 0 ? { ApiEndpoint: got.ApiEndpoint } : {},
+					...executeApiArn !== void 0 ? { ExecuteApiArn: executeApiArn } : {}
+				}
 			};
 		} catch (err) {
 			if (err instanceof NotFoundException$3) return null;
@@ -31519,11 +31821,25 @@ var ApiGatewayV2Provider = class {
 		}
 		this.logger.debug(`Updating API Gateway V2 Api ${logicalId}: ${physicalId}`);
 		try {
-			if (changed) await this.getClient().send(new UpdateApiCommand(input));
+			let apiEndpoint;
+			if (changed) apiEndpoint = (await this.getClient().send(new UpdateApiCommand(input))).ApiEndpoint;
 			if (corsRemoved) {
 				this.logger.debug(`Clearing CORS configuration for Api ${logicalId}: ${physicalId}`);
 				await this.getClient().send(new DeleteCorsConfigurationCommand({ ApiId: physicalId }));
 			}
+			if (apiEndpoint !== void 0) {
+				const executeApiArn = await this.buildExecuteApiArn(physicalId);
+				if (executeApiArn !== void 0) return {
+					physicalId,
+					wasReplaced: false,
+					attributes: {
+						ApiId: physicalId,
+						ApiEndpoint: apiEndpoint,
+						ExecuteApiArn: executeApiArn
+					}
+				};
+				this.logger.debug(`Skipping the ExecuteApiArn heal for API ${physicalId}: the ARN could not be built. The previously recorded attributes are kept.`);
+			}
 			return {
 				physicalId,
 				wasReplaced: false
@@ -32368,7 +32684,8 @@ var CloudFrontOAIProvider = class {
 				etag = (await this.cloudFrontClient.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: physicalId }))).ETag;
 			} catch (error) {
 				if (error instanceof NoSuchCloudFrontOriginAccessIdentity) {
-					assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.cloudFrontClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`OAI ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -32381,7 +32698,8 @@ var CloudFrontOAIProvider = class {
 			this.logger.debug(`Successfully deleted CloudFront OAI ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchCloudFrontOriginAccessIdentity) {
-				assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudFrontClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`OAI ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -32705,7 +33023,8 @@ var CloudFrontOACProvider = class {
 	* region matches the region the resource was recorded in.
 	*/
 	async assertDeleteRegion(resourceType, logicalId, physicalId, context) {
-		assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+		const clientRegion = await this.cloudFrontClient.config.region();
+		assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 	}
 };
 
@@ -33012,7 +33331,8 @@ var CloudFrontDistributionProvider = class {
 				config = getConfigResponse.DistributionConfig;
 			} catch (error) {
 				if (error instanceof NoSuchDistribution) {
-					assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.cloudFrontClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Distribution ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -33039,7 +33359,8 @@ var CloudFrontDistributionProvider = class {
 			this.logger.debug(`Successfully deleted CloudFront Distribution ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NoSuchDistribution) {
-				assertRegionMatch(await this.cloudFrontClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.cloudFrontClient.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Distribution ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -33178,7 +33499,7 @@ var CloudFrontDistributionProvider = class {
 	* warning applies), `false` on budget exhaustion.
 	*/
 	async waitForDistributionStable(distributionId, expectedEnabled) {
-		const budgetMs = Math.max(1200 * 1e3, resolvedResourceTimeoutMs("AWS::CloudFront::Distribution") ?? 0);
+		const budgetMs = Math.max(12e5, resolvedResourceTimeoutMs("AWS::CloudFront::Distribution") ?? 0);
 		const deadline = Date.now() + budgetMs;
 		let delay = 5e3;
 		const maxDelay = 1e4;
@@ -33943,7 +34264,8 @@ var AgentCoreRuntimeProvider = class {
 			this.logger.debug(`Successfully deleted BedrockAgentCore Runtime ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$6) {
-				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Runtime ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34513,7 +34835,8 @@ var AgentCoreEvaluatorProvider = class {
 			this.logger.debug(`Successfully deleted BedrockAgentCore Evaluator ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$6) {
-				assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Evaluator ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34728,7 +35051,8 @@ var StepFunctionsProvider = class {
 			this.logger.debug(`Successfully deleted Step Functions state machine ${logicalId}`);
 		} catch (error) {
 			if (error instanceof StateMachineDoesNotExist) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Step Functions state machine ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -34797,7 +35121,8 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
 		}
@@ -35376,7 +35701,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deleted ECS cluster ${logicalId}`);
 		} catch (error) {
 			if (this.isClusterNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS cluster ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -35437,7 +35763,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deregistered ECS task definition ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS task definition ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -35659,7 +35986,8 @@ var ECSProvider = class {
 				this.logger.debug(`Scaled down ECS service ${physicalId} to 0`);
 			} catch (error) {
 				if (this.isServiceNotFoundException(error)) {
-					assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await client.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`ECS service ${physicalId} not found during scale down, skipping deletion`);
 					return;
 				}
@@ -35673,7 +36001,8 @@ var ECSProvider = class {
 			this.logger.debug(`Successfully deleted ECS service ${logicalId}`);
 		} catch (error) {
 			if (this.isServiceNotFoundException(error)) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECS service ${physicalId} not found, skipping deletion`);
 				return;
 			}
@@ -37267,15 +37596,18 @@ var ELBv2Provider = class {
 			for (const [k, v] of Object.entries(p)) if (!handledKeys.has(k)) out[k] = v;
 			return out;
 		};
-		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + (this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
-			evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
-			replaceFlags: "cdkd deploy --replace",
-			disable: {
-				before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
-				identifier: physicalId,
-				after: "--attributes Key=deletion_protection.enabled,Value=false"
-			}
-		}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack."));
+		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) {
+			const remedy = this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]).some((a) => a.Key === "deletion_protection.enabled" && isTruthyCfnBoolean(a.Value)) ? protectedReplacementAdvice({
+				evidence: "cdkd's recorded properties for this load balancer carry LoadBalancerAttributes deletion_protection.enabled=true",
+				replaceFlags: "cdkd deploy --replace",
+				disable: {
+					before: "aws elbv2 modify-load-balancer-attributes --load-balancer-arn",
+					identifier: physicalId,
+					after: "--attributes Key=deletion_protection.enabled,Value=false"
+				}
+			}) : "For Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.";
+			throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place. " + remedy);
+		}
 		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
@@ -37409,7 +37741,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted LoadBalancer ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`LoadBalancer ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -37574,7 +37907,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted TargetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`TargetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -37694,7 +38028,8 @@ var ELBv2Provider = class {
 			this.logger.debug(`Successfully deleted Listener ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Listener ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38424,7 +38759,8 @@ var RDSProvider = class {
 			this.logger.debug(`Successfully deleted DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38582,7 +38918,8 @@ var RDSProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38709,7 +39046,8 @@ var RDSProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -38980,7 +39318,8 @@ var RDSProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -39032,7 +39371,7 @@ var RDSProvider = class {
 //#endregion
 //#region src/provisioning/providers/rds-dbproxy-provider.ts
 const POLL_INTERVAL_MS$1 = 5e3;
-const POLL_TIMEOUT_MS$1 = 1800 * 1e3;
+const POLL_TIMEOUT_MS$1 = 18e5;
 /**
 * AWS RDS DBProxy Provider
 *
@@ -39195,7 +39534,8 @@ var RDSDBProxyProvider = class {
 			await client.send(new DeleteDBProxyCommand({ DBProxyName: physicalId }));
 		} catch (error) {
 			if (error instanceof DBProxyNotFoundFault) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBProxy ${physicalId} already gone, treating as success`);
 				return;
 			}
@@ -39278,7 +39618,8 @@ var RDSDBProxyProvider = class {
 			}))
 		};
 		if (p.DBProxyArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }))).TagList ?? []);
+			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: p.DBProxyArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -39370,7 +39711,7 @@ var RDSDBProxyProvider = class {
 //#endregion
 //#region src/provisioning/providers/rds-dbproxy-endpoint-provider.ts
 const POLL_INTERVAL_MS = 5e3;
-const POLL_TIMEOUT_MS = 1800 * 1e3;
+const POLL_TIMEOUT_MS = 18e5;
 /**
 * AWS RDS DBProxyEndpoint Provider
 *
@@ -39518,7 +39859,8 @@ var RDSDBProxyEndpointProvider = class {
 			await client.send(new DeleteDBProxyEndpointCommand({ DBProxyEndpointName: physicalId }));
 		} catch (error) {
 			if (error instanceof DBProxyEndpointNotFoundFault || error instanceof DBProxyNotFoundFault) {
-				assertRegionMatch(await client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DBProxyEndpoint ${physicalId} or parent already gone, treating as success`);
 				return;
 			}
@@ -39587,7 +39929,8 @@ var RDSDBProxyEndpointProvider = class {
 			TargetRole: e.TargetRole ?? "READ_WRITE"
 		};
 		if (e.DBProxyEndpointArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }))).TagList ?? []);
+			const tagResp = await client.send(new ListTagsForResourceCommand$10({ ResourceName: e.DBProxyEndpointArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagResp.TagList ?? []);
 		} catch (error) {
 			this.logger.debug(`ListTagsForResource failed for ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 			result["Tags"] = [];
@@ -39880,7 +40223,8 @@ var RDSDBProxyTargetGroupProvider = class {
 			}));
 		} catch (error) {
 			if (error instanceof DBProxyNotFoundFault || error instanceof DBProxyTargetGroupNotFoundFault || error instanceof DBProxyTargetNotFoundFault) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`${dbProxyName}/${targetGroupName} or its target is already gone, treating as success`);
 				return;
 			}
@@ -40129,7 +40473,8 @@ var DocDBProvider = class {
 			this.logger.debug(`Successfully deleted DocDB DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40245,7 +40590,8 @@ var DocDBProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40323,7 +40669,8 @@ var DocDBProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DocDB DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40564,7 +40911,8 @@ var DocDBProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -40765,7 +41113,8 @@ var NeptuneProvider = class {
 			this.logger.debug(`Successfully deleted Neptune DBSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40878,7 +41227,8 @@ var NeptuneProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -40972,7 +41322,8 @@ var NeptuneProvider = class {
 			await this.waitForInstanceDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "DBInstanceNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Neptune DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -41203,7 +41554,8 @@ var NeptuneProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -41666,7 +42018,8 @@ var Route53Provider = class {
 			this.logger.debug(`Successfully deleted hosted zone ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && error.name === "NoSuchHostedZone") {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Hosted zone ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -41863,7 +42216,8 @@ var Route53Provider = class {
 			hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId, { requireUnambiguousZoneName: true });
 		} catch (error) {
 			if (error instanceof HostedZoneNameNotFoundError) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.warn(`Hosted zone "${String(properties?.["HostedZoneName"])}" for record set ${logicalId} (${physicalId}) no longer exists; treating the record as already deleted and dropping it from state.`);
 				return;
 			}
@@ -41889,7 +42243,8 @@ var Route53Provider = class {
 			this.logger.debug(`Successfully deleted record set ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "InvalidChangeBatch" || error.message.includes("it was not found"))) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Record set ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -42362,10 +42717,11 @@ var Route53Provider = class {
 		});
 		const idTail = physicalId.replace(/^\/hostedzone\//, "");
 		try {
-			result["HostedZoneTags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$8({
 				ResourceType: "hostedzone",
 				ResourceId: idTail
-			}))).ResourceTagSet?.Tags);
+			}));
+			result["HostedZoneTags"] = normalizeAwsTagsToCfn(tagsResp.ResourceTagSet?.Tags);
 		} catch (err) {
 			this.logger.debug(`Route53 ListTagsForResource(${idTail}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -44028,7 +44384,8 @@ var CognitoUserPoolProvider = class {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
 					if (descError instanceof ResourceNotFoundException$9) {
-						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+						const clientRegion = await this.getClient().config.region();
+						assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
 					}
@@ -44051,7 +44408,8 @@ var CognitoUserPoolProvider = class {
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$9) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44302,7 +44660,8 @@ var ElastiCacheProvider = class {
 			this.logger.debug(`Successfully deleted CacheSubnetGroup ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error, "CacheSubnetGroupNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CacheSubnetGroup ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44428,7 +44787,8 @@ var ElastiCacheProvider = class {
 			await this.waitForClusterDeleted(physicalId);
 		} catch (error) {
 			if (this.isNotFoundError(error, "CacheClusterNotFoundFault")) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CacheCluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -44635,7 +44995,8 @@ var ElastiCacheProvider = class {
 	/** Best-effort tag fetch — failures omit the key without breaking the read. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }))).TagList);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$7({ ResourceName: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.TagList);
 		} catch (err) {
 			this.logger.debug(`ElastiCache ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -44969,7 +45330,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			this.logger.debug(`Successfully deleted Cloud Map namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NamespaceNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -45299,7 +45661,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			this.logger.debug(`Successfully deleted service discovery service ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ServiceNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Service ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -45430,7 +45793,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				if (targets) return targets["NAMESPACE"] || targets["SERVICE"] || operationId;
 				return operationId;
 			}
-			if (status === "FAIL") throw new ProvisioningError(`Operation failed for ${logicalId}: ${maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error")}`, resourceType, logicalId);
+			if (status === "FAIL") {
+				const errorMessage = maskerOrIdentity(maskSecrets)(result.Operation?.ErrorMessage || "Unknown error");
+				throw new ProvisioningError(`Operation failed for ${logicalId}: ${errorMessage}`, resourceType, logicalId);
+			}
 			await new Promise((resolve) => setTimeout(resolve, delay));
 			delay = Math.min(delay * 2, 1e4);
 		}
@@ -45596,7 +45962,8 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -45844,7 +46211,8 @@ var AppSyncProvider = class {
 	* at most one `GetCallerIdentity` per deploy.
 	*/
 	async buildAppSyncArn(suffix, regionOverride) {
-		const accountInfo = await getAccountInfo(regionOverride ?? this.providerRegion ?? await this.getClient().config.region());
+		const region = regionOverride ?? this.providerRegion ?? await this.getClient().config.region();
+		const accountInfo = await getAccountInfo(region);
 		if (accountInfo.fabricated) throw new Error(`cannot determine the AWS account (STS is unreachable, and the resolved account id is a placeholder), so an ARN for ${suffix} would be fabricated`);
 		const { partition } = derivePartitionAndUrlSuffix(accountInfo.region);
 		return `arn:${partition}:appsync:${canonicalizeRegion(accountInfo.region)}:${accountInfo.accountId}:${suffix}`;
@@ -46880,7 +47248,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted GraphQL API ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`GraphQL API ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -46972,7 +47341,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted DataSource ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DataSource ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47040,7 +47410,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted Resolver ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resolver ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47097,7 +47468,8 @@ var AppSyncProvider = class {
 			this.logger.debug(`Successfully deleted ApiKey ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ApiKey ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -47756,7 +48128,8 @@ var GlueProvider = class {
 			this.logger.debug(`Successfully deleted Glue Database ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Database", logicalId, physicalId);
 				return;
 			}
@@ -47859,7 +48232,8 @@ var GlueProvider = class {
 			this.logger.debug(`Successfully deleted Glue Table ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Table", logicalId, physicalId);
 				return;
 			}
@@ -48470,10 +48844,7 @@ var GlueProvider = class {
 				case "pipe-in-name":
 					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot be imported because a name contains '|', which cdkd currently uses as the separator in this type's physical id (<databaseName>|<tableName>). Adopting it would record an id cdkd cannot decode back to the same table. CloudFormation manages such a table fine; this is a cdkd limitation tracked in https://github.com/go-to-k/cdkd/issues/1672. Until it is lifted, rename the table or database to omit '|', or manage this resource outside cdkd.`);
 					break;
-				case "unpairable":
-					this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot resolve a database for physical id '${input.knownPhysicalId}'. ` + (input.knownPhysicalId === "" ? `The supplied physical id is empty. ` : "The template's DatabaseName is absent or is an unresolved intrinsic, so the bare table name cannot be paired. ") + `Pass the composite form instead: --resource '${input.logicalId}=<databaseName>|<tableName>' (quote it — '|' is a shell pipe).`);
-					break;
-				case "unidentified": break;
+				case "unpairable": this.logger.warn(`AWS::Glue::Table ${input.logicalId}: cannot resolve a database for physical id '${input.knownPhysicalId}'. ` + (input.knownPhysicalId === "" ? `The supplied physical id is empty. ` : "The template's DatabaseName is absent or is an unresolved intrinsic, so the bare table name cannot be paired. ") + `Pass the composite form instead: --resource '${input.logicalId}=<databaseName>|<tableName>' (quote it — '|' is a shell pipe).`);
 			}
 			return null;
 		}
@@ -48578,7 +48949,8 @@ var GlueWorkflowProvider = class {
 			this.logger.debug(`Successfully deleted Glue Workflow ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Workflow ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -48622,7 +48994,8 @@ var GlueWorkflowProvider = class {
 		const arn = await this.buildWorkflowArn(physicalId);
 		let tags = [];
 		try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags);
+			const tagResp = await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }));
+			tags = normalizeAwsTagsToCfn(tagResp.Tags);
 		} catch (err) {
 			this.logger.debug(`GetTags failed for Glue Workflow ${physicalId}: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -48716,7 +49089,8 @@ var GlueSecurityConfigurationProvider = class {
 			this.logger.debug(`Successfully deleted Glue SecurityConfiguration ${logicalId}`);
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue SecurityConfiguration ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -48987,7 +49361,8 @@ async function resolveAccountId(stsClient) {
 async function fetchGlueTags(client, stsClient, resource, name, accountId, logger) {
 	try {
 		const arn = await buildGlueResourceArn(client, stsClient, resource, name, accountId);
-		return normalizeAwsTagsToCfn((await client.send(new GetTagsCommand({ ResourceArn: arn }))).Tags);
+		const resp = await client.send(new GetTagsCommand({ ResourceArn: arn }));
+		return normalizeAwsTagsToCfn(resp.Tags);
 	} catch (err) {
 		logger.debug(`GetTags failed for ${resource}/${name}: ${err instanceof Error ? err.message : String(err)}`);
 		return [];
@@ -49111,7 +49486,8 @@ var GlueJobProvider = class {
 			await this.getClient().send(new DeleteJobCommand({ JobName: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Job ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -49495,7 +49871,8 @@ var GlueCrawlerProvider = class {
 			await this.getClient().send(new DeleteCrawlerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Crawler ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -49792,7 +50169,8 @@ var GlueConnectionProvider = class {
 			}));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				logCatalogScopedDeleteSkip(this.logger, target, "Connection", logicalId, physicalId);
 				return;
 			}
@@ -50022,7 +50400,8 @@ var GlueTriggerProvider = class {
 			await this.getClient().send(new DeleteTriggerCommand({ Name: physicalId }));
 		} catch (error) {
 			if (error instanceof EntityNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Glue Trigger ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50214,24 +50593,28 @@ var KMSProvider = class {
 				}));
 			}
 			const newEnableKeyRotation = properties["EnableKeyRotation"];
-			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) if (newEnableKeyRotation) {
-				const rotationPeriodInDays = properties["RotationPeriodInDays"];
-				this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
-				await this.getClient().send(new EnableKeyRotationCommand({
-					KeyId: physicalId,
-					...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
-				}));
-			} else {
-				this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
-				await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+			if (newEnableKeyRotation !== previousProperties["EnableKeyRotation"]) {
+				if (newEnableKeyRotation) {
+					const rotationPeriodInDays = properties["RotationPeriodInDays"];
+					this.logger.debug(`Enabling key rotation for KMS Key ${logicalId}`);
+					await this.getClient().send(new EnableKeyRotationCommand({
+						KeyId: physicalId,
+						...rotationPeriodInDays !== void 0 && { RotationPeriodInDays: rotationPeriodInDays }
+					}));
+				} else {
+					this.logger.debug(`Disabling key rotation for KMS Key ${logicalId}`);
+					await this.getClient().send(new DisableKeyRotationCommand({ KeyId: physicalId }));
+				}
 			}
 			const newEnabled = properties["Enabled"];
-			if (newEnabled !== previousProperties["Enabled"]) if (newEnabled === false) {
-				this.logger.debug(`Disabling KMS Key ${logicalId}`);
-				await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
-			} else {
-				this.logger.debug(`Enabling KMS Key ${logicalId}`);
-				await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+			if (newEnabled !== previousProperties["Enabled"]) {
+				if (newEnabled === false) {
+					this.logger.debug(`Disabling KMS Key ${logicalId}`);
+					await this.getClient().send(new DisableKeyCommand({ KeyId: physicalId }));
+				} else {
+					this.logger.debug(`Enabling KMS Key ${logicalId}`);
+					await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
+				}
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			const newKeyPolicy = properties["KeyPolicy"];
@@ -50266,7 +50649,8 @@ var KMSProvider = class {
 			this.logger.debug(`Successfully scheduled deletion for KMS Key ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$2) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`KMS Key ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50356,7 +50740,8 @@ var KMSProvider = class {
 			this.logger.debug(`Successfully deleted KMS Alias ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$2) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`KMS Alias ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -50433,7 +50818,8 @@ var KMSProvider = class {
 				if (err instanceof NotFoundException$2) return void 0;
 			}
 			try {
-				result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListResourceTagsCommand({ KeyId: md.KeyId }))).Tags);
+				const tagsResp = await this.getClient().send(new ListResourceTagsCommand({ KeyId: md.KeyId }));
+				result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 			} catch (err) {
 				if (err instanceof NotFoundException$2) return void 0;
 			}
@@ -50619,7 +51005,8 @@ var BudgetsBudgetProvider = class {
 	* unchanged byte for byte.
 	*/
 	async budgetArn(accountId, budgetName) {
-		const { partition } = derivePartitionAndUrlSuffix(await this.getClient().config.region() ?? "");
+		const region = await this.getClient().config.region();
+		const { partition } = derivePartitionAndUrlSuffix(region ?? "");
 		return `arn:${partition}:budgets::${accountId}:budget/${budgetName}`;
 	}
 	/**
@@ -50953,7 +51340,8 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully deleted budget ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$5) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Budget ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -51196,11 +51584,15 @@ var KinesisStreamProvider = class {
 		this.logger.debug(`Creating Kinesis stream ${logicalId}`);
 		const streamName = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
 		const desiredRead = readShardLevelMetrics(properties["DesiredShardLevelMetrics"], mask);
-		if (desiredRead.kind === "unusable") if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
-		else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		if (desiredRead.kind === "unusable") {
+			if (context?.replayingState === true) warn(`${desiredRead.reason}. Replaying a state record, so the shard-level metrics are left unset on ${streamName} rather than refusing the restore`);
+			else throw new ProvisioningError(desiredRead.reason, resourceType, logicalId, streamName);
+		}
 		const maxRecordRead = readMaxRecordSize(properties["MaxRecordSizeInKiB"], mask);
-		if (maxRecordRead.kind === "unusable") if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
-		else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
+		if (maxRecordRead.kind === "unusable") {
+			if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
+			else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
+		}
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
@@ -51411,7 +51803,8 @@ var KinesisStreamProvider = class {
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$10) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -51557,7 +51950,8 @@ var KinesisStreamProvider = class {
 			throw err;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -51765,7 +52159,8 @@ var KinesisStreamConsumerProvider = class {
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$10) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
 			}
@@ -51818,7 +52213,8 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$10) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -52114,7 +52510,8 @@ var SchedulerScheduleProvider = class {
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$11) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
 			}
@@ -52508,7 +52905,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS FileSystem ${logicalId}`);
 		} catch (error) {
 			if (error instanceof FileSystemNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS FileSystem ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52574,7 +52972,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS MountTarget ${logicalId}`);
 		} catch (error) {
 			if (error instanceof MountTargetNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS MountTarget ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52746,7 +53145,8 @@ var EFSProvider = class {
 			this.logger.debug(`Successfully deleted EFS AccessPoint ${logicalId}`);
 		} catch (error) {
 			if (error instanceof AccessPointNotFound) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EFS AccessPoint ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -52948,7 +53348,7 @@ var EFSProvider = class {
 * storage-capacity growth and deletes can take substantially longer —
 * mirror the Custom Resource provider's 1-hour ceiling.
 */
-const DEFAULT_MAX_WAIT_MS$3 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$3 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 /**
 * Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
@@ -53672,7 +54072,8 @@ var FSxFileSystemProvider = class {
 			await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: physicalId }));
 		} catch (error) {
 			if (error instanceof FileSystemNotFound$1) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`FSx FileSystem ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -53714,7 +54115,10 @@ var FSxFileSystemProvider = class {
 			const fs = await this.describeForPoll(fileSystemId, transientState);
 			const lifecycle = fs?.Lifecycle;
 			if (fs && lifecycle === "AVAILABLE") return fs;
-			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${fs?.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") {
+				const detail = fs?.FailureDetails?.Message ?? "no failure details reported";
+				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${detail}`, resourceType, logicalId, fileSystemId);
+			}
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${lifecycle ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -53753,7 +54157,10 @@ var FSxFileSystemProvider = class {
 				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
 				if (updateActions.length > 0) seenTrackedAction = true;
 				const failed = updateActions.find((a) => a.Status === "FAILED");
-				if (failed) throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${failed.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+				if (failed) {
+					const detail = failed.FailureDetails?.Message ?? "no failure details reported";
+					throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${detail}`, resourceType, logicalId, fileSystemId);
+				}
 				if (!updateActions.some((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS") && (!requireActionObservation || seenTrackedAction) && fs.Lifecycle === "AVAILABLE") return fs;
 				this.logger.debug(`FSx FileSystem ${fileSystemId} update in progress (lifecycle: ${fs.Lifecycle ?? "unknown"}), waiting...`);
 			}
@@ -53780,7 +54187,10 @@ var FSxFileSystemProvider = class {
 				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 				continue;
 			}
-			if (fs.Lifecycle === "FAILED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${fs.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			if (fs.Lifecycle === "FAILED") {
+				const detail = fs.FailureDetails?.Message ?? "no failure details reported";
+				throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${detail}`, resourceType, logicalId, fileSystemId);
+			}
 			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${fs.Lifecycle ?? "unknown"}, waiting for deletion...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -54041,9 +54451,7 @@ var FSxFileSystemProvider = class {
 			case "OpenZFSConfiguration":
 				result[variantKey] = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration ?? {});
 				break;
-			default:
-				this.logger.warn(`FSx FileSystem ${physicalId} has FileSystemType '${fs.FileSystemType ?? "(unset)"}', which cdkd does not recognize (expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}). Its variant configuration is NOT included in the drift snapshot, so drift in that block cannot be detected. Please report this at https://github.com/go-to-k/cdkd/issues`);
-				break;
+			default: this.logger.warn(`FSx FileSystem ${physicalId} has FileSystemType '${fs.FileSystemType ?? "(unset)"}', which cdkd does not recognize (expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}). Its variant configuration is NOT included in the drift snapshot, so drift in that block cannot be detected. Please report this at https://github.com/go-to-k/cdkd/issues`);
 		}
 		return result;
 	}
@@ -54159,7 +54567,7 @@ function toSdkInstanceTypeConfigs(value) {
 * FSx providers' 1-hour ceiling so the slowest realistic create/terminate
 * still fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS$2 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$2 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 /** Cluster states that mean "create succeeded, the cluster is up". */
 const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
@@ -54577,7 +54985,8 @@ var EMRClusterProvider = class {
 			current = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
 		} catch (error) {
 			if (error instanceof InvalidRequestException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`EMR Cluster ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -54636,7 +55045,10 @@ var EMRClusterProvider = class {
 			const cluster = await this.describeForPoll(clusterId, transientState);
 			const state = cluster?.Status?.State;
 			if (cluster && state && CREATE_READY_STATES.has(state)) return cluster;
-			if (state && TERMINAL_STATES.has(state)) throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, clusterId);
+			if (state && TERMINAL_STATES.has(state)) {
+				const reason = cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${reason}`, resourceType, logicalId, clusterId);
+			}
 			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -54888,9 +55300,7 @@ var EMRClusterProvider = class {
 				case "CORE":
 					instances["CoreInstanceGroup"] = cfn;
 					break;
-				case "TASK":
-					taskGroups.push(cfn);
-					break;
+				case "TASK": taskGroups.push(cfn);
 			}
 		}
 		if (taskGroups.length > 0) instances["TaskInstanceGroups"] = taskGroups;
@@ -54904,9 +55314,7 @@ var EMRClusterProvider = class {
 				case "CORE":
 					instances["CoreInstanceFleet"] = cfn;
 					break;
-				case "TASK":
-					taskFleets.push(cfn);
-					break;
+				case "TASK": taskFleets.push(cfn);
 			}
 		}
 		if (taskFleets.length > 0) instances["TaskInstanceFleets"] = taskFleets;
@@ -54951,7 +55359,7 @@ var EMRClusterProvider = class {
 * EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
 * fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS$1 = 36e5;
 const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 /** Instance-group state that means "the group is up and idle/serving". */
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -55165,7 +55573,8 @@ var EMRInstanceGroupConfigProvider = class {
 				this.logger.debug(`Scaled EMR TASK instance group ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
 			} catch (error) {
 				if (error instanceof InvalidRequestException) {
-					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.getClient().config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance group ${physicalId} scale-to-0 skipped (cluster/group gone): ${error.message}`);
 				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
 			}
@@ -55219,7 +55628,10 @@ var EMRInstanceGroupConfigProvider = class {
 			}
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
-			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) {
+				const reason = group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${reason}`, resourceType, logicalId, groupId);
+			}
 			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -55271,7 +55683,7 @@ var EMRInstanceGroupConfigProvider = class {
 * EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
 * fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_MAX_WAIT_MS = 36e5;
 const DEFAULT_POLL_INTERVAL_MS = 15e3;
 /** Instance-fleet state that means "the fleet is up and idle/serving". */
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
@@ -55475,7 +55887,8 @@ var EMRInstanceFleetConfigProvider = class {
 				this.logger.debug(`Scaled EMR TASK instance fleet ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
 			} catch (error) {
 				if (error instanceof InvalidRequestException) {
-					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.getClient().config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`EMR instance fleet ${physicalId} scale-to-0 skipped (cluster/fleet gone): ${error.message}`);
 				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
 			}
@@ -55569,7 +55982,10 @@ var EMRInstanceFleetConfigProvider = class {
 			}
 			if (state && READY_STATES.has(state) && capacityReady) return;
 			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
-			if (state && enforceFailedStates && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			if (state && enforceFailedStates && FAILED_STATES.has(state)) {
+				const reason = fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+				throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${reason}`, resourceType, logicalId, fleetId);
+			}
 			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${onDemand}/${target.onDemand} on-demand + ${spot}/${target.spot} spot (${provisioned} total), waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
@@ -56085,7 +56501,8 @@ var FirehoseProvider = class {
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$12) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -56650,7 +57067,8 @@ var FirehoseProvider = class {
 		if (enc?.KeyType !== void 0) encOut["KeyType"] = enc.KeyType;
 		result["DeliveryStreamEncryptionConfigurationInput"] = encOut;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
+			const tagsResp = await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -57145,12 +57563,14 @@ var CloudTrailProvider = class {
 				}));
 			}
 			const oldIsLogging = previousProperties["IsLogging"];
-			if (isLogging !== void 0 && isLogging !== oldIsLogging) if (isLogging === false) {
-				this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
-				await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
-			} else {
-				this.logger.debug(`Starting logging for CloudTrail Trail ${logicalId}`);
-				await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
+			if (isLogging !== void 0 && isLogging !== oldIsLogging) {
+				if (isLogging === false) {
+					this.logger.debug(`Stopping logging for CloudTrail Trail ${logicalId}`);
+					await this.getClient().send(new StopLoggingCommand({ Name: physicalId }));
+				} else {
+					this.logger.debug(`Starting logging for CloudTrail Trail ${logicalId}`);
+					await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
+				}
 			}
 			await this.applyTagDiff(physicalId, previousProperties["Tags"], properties["Tags"]);
 			this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
@@ -57173,7 +57593,8 @@ var CloudTrailProvider = class {
 			this.logger.debug(`Successfully deleted CloudTrail Trail ${logicalId}`);
 		} catch (error) {
 			if (error instanceof TrailNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CloudTrail Trail ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -57293,7 +57714,8 @@ var CloudTrailProvider = class {
 		result["InsightSelectors"] = insightSelectors;
 		let tags = [];
 		if (trail.TrailARN) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0]?.TagsList);
+			const tagsResp = await this.getClient().send(new ListTagsCommand$2({ ResourceIdList: [trail.TrailARN] }));
+			tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
 		} catch (err) {
 			this.logger.debug(`CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -57583,7 +58005,8 @@ var CodeBuildProvider = class {
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$13) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58109,7 +58532,8 @@ var CodeCommitRepositoryProvider = class {
 			deletedRepositoryId = (await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName: physicalId }))).repositoryId;
 		} catch (error) {
 			if (error instanceof RepositoryDoesNotExistException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58117,7 +58541,8 @@ var CodeCommitRepositoryProvider = class {
 			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (!deletedRepositoryId) {
-			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			const clientRegion = await this.getClient().config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 			this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
@@ -58191,7 +58616,8 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }));
+			tags = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -58543,7 +58969,8 @@ var DLMLifecyclePolicyProvider = class {
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$14) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58782,7 +59209,8 @@ var S3VectorsProvider = class {
 			this.logger.debug(`Successfully deleted S3 VectorBucket ${logicalId}`);
 		} catch (error) {
 			if (this.isNotFoundError(error)) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 VectorBucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -58844,7 +59272,8 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -59101,7 +59530,8 @@ var S3DirectoryBucketProvider = class {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "NoSuchBucket" || error.name === "BucketNotFound")) {
-				assertRegionMatch(await this.s3Client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.s3Client.config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59205,10 +59635,11 @@ var S3DirectoryBucketProvider = class {
 	async readTags(bucketName) {
 		const accountId = await this.getAccountId();
 		const resourceArn = await this.buildBucketArn(bucketName, accountId);
-		return normalizeAwsTagsToCfn((await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
+		const resp = await this.getS3ControlClient().send(new ListTagsForResourceCommand$18({
 			AccountId: accountId,
 			ResourceArn: resourceArn
-		}))).Tags);
+		}));
+		return normalizeAwsTagsToCfn(resp.Tags);
 	}
 	/**
 	* Adopt an existing S3 Express Directory Bucket into cdkd state.
@@ -59407,7 +59838,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Table Bucket ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Table Bucket ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59511,7 +59943,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Tables Namespace ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Namespace ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -59915,7 +60348,8 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`Failed to resolve S3 Tables Table ${logicalId} (${physicalId}): ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 		if (resolved === "not-found") {
-			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			const clientRegion = await this.getClient().config.region();
+			assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 			this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 			return;
 		}
@@ -59930,7 +60364,8 @@ var S3TablesProvider = class {
 			this.logger.debug(`Successfully deleted S3 Tables Table ${logicalId}`);
 		} catch (error) {
 			if (error instanceof NotFoundException$6) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`S3 Tables Table ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -60375,7 +60810,8 @@ var ECRProvider = class {
 		} catch (error) {
 			if (error instanceof RepositoryNotEmptyException) throw new ProvisioningError(`Failed to delete ECR Repository ${logicalId}: repository ${physicalId} still contains images. Matching CloudFormation, cdkd does not force-delete an image-carrying repository unless it opted in via EmptyOnDelete: true (CDK's emptyOnDelete) or the '${ECR_AUTO_DELETE_IMAGES_TAG}' tag (CDK's autoDeleteImages). Either delete the images first (aws ecr batch-delete-image), or redeploy with emptyOnDelete: true and destroy again.`, resourceType, logicalId, physicalId, error);
 			if (error instanceof RepositoryNotFoundException) {
-				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				const clientRegion = await this.getClient().config.region();
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`ECR Repository ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
@@ -60442,7 +60878,8 @@ var ECRProvider = class {
 			if (!(err instanceof LifecyclePolicyNotFoundException)) throw err;
 		}
 		if (r.repositoryArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: r.repositoryArn }))).tags);
+			const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: r.repositoryArn }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.tags);
 		} catch (err) {
 			if (!(err instanceof RepositoryNotFoundException)) throw err;
 		}
@@ -60919,10 +61356,12 @@ async function runDestroyForStack(stackName, state, ctx) {
 				});
 				try {
 					let finalSnapshotIdentifier;
-					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
-					else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
-					else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
-					else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					if (resource.deletionPolicy === "Snapshot" && ctx.skipFinalSnapshot !== true) {
+						if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType) && resource.provisionedBy !== "cc-api") finalSnapshotIdentifier = buildFinalSnapshotIdentifier(resource.physicalId, resource.resourceType);
+						else if (ATOMIC_FINAL_SNAPSHOT_TYPES.has(resource.resourceType)) throw ccRoutedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+						else if (PRE_DELETE_SNAPSHOT_TYPES.has(resource.resourceType)) await createPreDeleteFinalSnapshot(resource.resourceType, resource.physicalId, logicalId, destroyAwsClients ?? ctx.baseAwsClients, logger);
+						else throw unsupportedFinalSnapshotError(logicalId, resource.resourceType, "--skip-final-snapshot");
+					}
 					const provider = destroyProviderRegistry.getProviderFor({
 						resourceType: resource.resourceType,
 						provisionedBy: resource.provisionedBy
@@ -61377,12 +61816,13 @@ var NestedStackProvider = class {
 		}
 		const resourceCount = Object.keys(childStateData.state.resources).length;
 		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
-		const childResult = await withNestedStackContext({
+		const childCtx = {
 			...ctx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
 			nestedTemplates: void 0
-		}, () => runDestroyForStack(childStackName, childStateData.state, {
+		};
+		const childResult = await withNestedStackContext(childCtx, () => runDestroyForStack(childStackName, childStateData.state, {
 			stateBackend: ctx.stateBackend,
 			lockManager: ctx.lockManager,
 			providerRegistry: ctx.providerRegistry,
@@ -61429,12 +61869,13 @@ var NestedStackProvider = class {
 				parentRegion: parentCtx.parentRegion
 			}
 		}, childRegion, parentCtx.exportIndexStore);
-		await withNestedStackContext({
+		const childCtx = {
 			...parentCtx,
 			parentStackName: childStackName,
 			parentRegion: childRegion,
 			nestedTemplates: grandchildTemplates
-		}, () => childEngine.deploy(childStackName, childTemplate));
+		};
+		await withNestedStackContext(childCtx, () => childEngine.deploy(childStackName, childTemplate));
 	}
 	/**
 	* The child's outputs, as `Outputs.<Key>` attributes for the parent's
@@ -61828,7 +62269,8 @@ var ACMCertificateProvider = class {
 				throw new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${error instanceof Error ? error.message : String(error)}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
+			const detail = error instanceof Error ? error.message : String(error);
+			throw new ProvisioningError(`Failed to create ACM certificate ${logicalId}: ${detail}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
 		}
 	}
 	/**
@@ -61976,7 +62418,8 @@ var ACMCertificateProvider = class {
 				await this.acmClient.send(new DeleteCertificateCommand({ CertificateArn: physicalId }));
 			} catch (error) {
 				if (error instanceof ResourceNotFoundException$7) {
-					assertRegionMatch(await this.acmClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					const clientRegion = await this.acmClient.config.region();
+					assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
 					this.logger.debug(`Certificate ${physicalId} does not exist, skipping deletion`);
 					return;
 				}
@@ -62025,7 +62468,8 @@ var ACMCertificateProvider = class {
 		if (cert.Options?.CertificateTransparencyLoggingPreference !== void 0) result["CertificateTransparencyLoggingPreference"] = cert.Options.CertificateTransparencyLoggingPreference;
 		if (cert.Options?.Export !== void 0) result["CertificateExport"] = cert.Options.Export;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }))).Tags);
+			const tagsResp = await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: physicalId }));
+			result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
 		} catch (err) {
 			if (!(err instanceof ResourceNotFoundException$7)) throw err;
 		}
@@ -62735,23 +63179,24 @@ async function deployCommand(stacks, options) {
 				let recreateTargets;
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
+					const syncValidation = validateRecreateTargets({
+						template: stackInfo.template,
+						state: stateForRecreateCheck?.state ?? {
+							version: 9,
+							stackName: stackInfo.stackName,
+							region: stackRegion,
+							resources: {},
+							outputs: {},
+							lastModified: Date.now()
+						},
+						recreateViaCcApi: options.recreateViaCcApi ?? [],
+						recreateViaSdkProvider: options.recreateViaSdkProvider ?? [],
+						allowUnsupportedProperties: new Set(options.allowUnsupportedProperties ?? []),
+						forceStatefulRecreation: options.forceStatefulRecreation ?? false,
+						hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
+					});
 					const validation = await probeAndRevalidateStateful({
-						validation: validateRecreateTargets({
-							template: stackInfo.template,
-							state: stateForRecreateCheck?.state ?? {
-								version: 9,
-								stackName: stackInfo.stackName,
-								region: stackRegion,
-								resources: {},
-								outputs: {},
-								lastModified: Date.now()
-							},
-							recreateViaCcApi: options.recreateViaCcApi ?? [],
-							recreateViaSdkProvider: options.recreateViaSdkProvider ?? [],
-							allowUnsupportedProperties: new Set(options.allowUnsupportedProperties ?? []),
-							forceStatefulRecreation: options.forceStatefulRecreation ?? false,
-							hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
-						}),
+						validation: syncValidation,
 						clients: {
 							s3: stackAwsClients.s3,
 							cloudWatchLogs: stackAwsClients.cloudWatchLogs,
@@ -63100,12 +63545,30 @@ function valuesEqual(a, b) {
 * the expression that state stores post-redaction.
 *
 * `storedOutputs` is the bag currently in state. It is consulted for exactly
-* one decision — the LITERAL `Export.Name` of a secret-bearing stack, see issue
-* #1942 at that branch — and never merged into the result: everything else here
+* two decisions — the LITERAL `Export.Name` of a secret-bearing stack, see issue
+* #1942 at that branch, and whether a skipped-output record still applies, see
+* issue #2740 below — and never merged into the result: everything else here
 * previews what the template says, and reading state anywhere else would make
 * the preview agree with the past instead of with the next deploy.
-*/
-async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs) {
+*
+* `skippedOutputKeys` (issue #2740) are the keys the LAST DEPLOY could not
+* resolve and skipped, already narrowed by the caller on BOTH halves of the
+* binding rule: the recorded digest still matches today's template, AND no
+* resource the output references is changing on this run
+* (`bindingSkippedOutputs`, over a pre-resolution snapshot and this run's
+* resource diff — see `skipped-outputs.ts` for why the snapshot is the
+* caller's and why the change map cannot come from the digest). Such a key,
+* while still absent from `storedOutputs`, is previewed as ABSENT — skipped
+* without resolving, no bag entry, no row — because that is what the next
+* deploy will leave in state: this resolver runs
+* with `skipDynamicReferences`, so a failure that happened inside a secret
+* lookup would otherwise assemble cleanly and preview an `ADD` the deploy will
+* never perform. NOT a resolution failure: the sibling outputs are previewed
+* normally, so a genuine change beside the broken output still renders and
+* `--fail` still exits 1 for it. The key appearing in state (a later deploy
+* resolved it) ends the suppression.
+*/
+async function resolveTemplateOutputs(template, resolveFn, conditions, storedOutputs, skippedOutputKeys) {
 	const logger = getLogger().child("OutputsDiff");
 	const outputs = Object.create(null);
 	const exportNames = /* @__PURE__ */ new Set();
@@ -63146,6 +63609,10 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
 			continue;
 		}
+		if (skippedOutputKeys?.has(outputKey) && !(storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, outputKey))) {
+			logger.debug(`Diff previewing output ${stripControlChars(outputKey)} as absent — the last deploy could not resolve it and its template inputs are unchanged`);
+			continue;
+		}
 		const sourceUsedSub = templateUsesSub(output.Value);
 		let value;
 		try {
@@ -63174,21 +63641,23 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 				resolutionFailed = true;
 				continue;
 			}
-			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
-			else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
-			else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
-				outputs[exportName] = value;
-				exportNames.add(exportName);
-			} else {
-				logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
-				failedKeys.add(exportName);
-				resolutionFailed = true;
-			}
-			else {
-				outputs[exportName] = value;
-				exportNames.add(exportName);
-			}
-			else resolutionFailed = true;
+			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
+				if (declaredExportIsIntrinsic && isSecretDynamicReference(exportName)) logger.debug(`Diff skipping export alias of ${stripControlChars(outputKey)} — the name carries a secret reference`);
+				else if (isExportAliasCollision(exportName, outputKey, publishedOutputNames)) logger.debug(`Diff skipping export alias ${stripControlChars(exportName)} of ${stripControlChars(outputKey)} — collides with an output name`);
+				else if (!declaredExportIsIntrinsic && secretSourceKeys.size > 0) {
+					if (storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, exportName)) {
+						outputs[exportName] = value;
+						exportNames.add(exportName);
+					} else {
+						logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
+						failedKeys.add(exportName);
+						resolutionFailed = true;
+					}
+				} else {
+					outputs[exportName] = value;
+					exportNames.add(exportName);
+				}
+			} else resolutionFailed = true;
 		}
 	}
 	return {
@@ -64471,6 +64940,10 @@ function tokenValueForComparison(token, declaredType) {
 async function computeStackDiff(currentState, template, region, stackName, stateBackend, diffCalculator, options = {}) {
 	const { parameters, canonicalizeProperties, cfnFallback, inheritSecretBearingTemplate } = options;
 	const intrinsicResolver = new IntrinsicFunctionResolver(region, { cfnFallback: cfnFallback ?? true });
+	const outputsDigestSource = structuredClone({
+		...template,
+		Resources: {}
+	});
 	let mergedParameters = parameters;
 	let parametersBound = false;
 	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
@@ -64520,7 +64993,9 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		skipDynamicReferences: true
 	});
 	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
-	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs);
+	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
+	const bindingSkipped = bindingSkippedOutputs(outputsDigestSource, currentState.skippedOutputs, changedLogicalIds);
+	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs, bindingSkipped);
 	let outputChanges = [];
 	if (resolved.resolutionFailed) {
 		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
@@ -64900,7 +65375,6 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 		case "DELETE":
 			deleteCount++;
 			logFn(`  [-] ${logicalId} (${change.resourceType})`);
-			break;
 	}
 	return {
 		create: createCount,
@@ -64975,7 +65449,6 @@ function renderOutputChangeLines(outputChanges, logFn) {
 				counts.remove++;
 				logFn(`    [-] ${name}${exported}`);
 				logFn(`          old: ${renderOld(change)}`);
-				break;
 		}
 	}
 	return counts;
@@ -65166,6 +65639,24 @@ var ScrubNeededError = class ScrubNeededError extends CdkdError {
 * leak" from "scrub refused to look" — the two call for opposite responses
 * (rotate the secret vs. re-spell the reference and re-run).
 */
+/**
+* An internal invariant of the exports-index repair, thrown where this code
+* believes a case is unreachable (issue #2667 review).
+*
+* A distinct CLASS because the repair runs inside the per-stack `try` whose
+* `catch` attributes everything to "the exports index could not be READ": a
+* plain `Error` there is reported as an S3 read failure, sending an operator to
+* their bucket policy over a bug in cdkd. That catch rethrows this class
+* instead, so it surfaces as the per-stack failure it actually is.
+*/
+var ScrubIndexInvariantError = class ScrubIndexInvariantError extends CdkdError {
+	exitCode = 2;
+	constructor(message) {
+		super(message, "SCRUB_EXPORT_INDEX_INVARIANT");
+		this.name = "ScrubIndexInvariantError";
+		Object.setPrototypeOf(this, ScrubIndexInvariantError.prototype);
+	}
+};
 var ScrubRefusalError = class ScrubRefusalError extends CdkdError {
 	exitCode = 2;
 	constructor(message, code) {
@@ -65210,6 +65701,140 @@ function scrubStacksFailedError(failures) {
 	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
 }
 /**
+* Which of `entries` this stack's post-scrub `outputs` bag disagrees with.
+*
+* OWNERSHIP is read off the entry (`producerStack` / `producerRegion`), never
+* inferred from the name: a pre-v9 state record makes `importableOutputKeys`
+* return every output key (`src/types/state.ts`), so a rebuild can key an entry
+* by a plain output name, and on a name collision the index keeps the latest
+* writer — so a name alone says nothing about whose entry it is.
+*
+* The rule is CONVERGENCE, not a match against scrub's plaintext map. The map
+* is built by LIVE RESOLUTION against Secrets Manager / SSM, so it holds the
+* secret's value AS IT IS NOW; an index entry written before a rotation holds
+* the value as it was THEN, and the two are different strings. Keying on
+* `state.outputs` instead means the rule reads the record a redeploy and
+* `ExportIndexStore.rebuild()` both write, and the plaintext map is not
+* consulted here at all.
+*
+* The lookup runs in ONE direction, and the inverse is not available: an
+* `Export.Name` alias is written into the outputs bag itself
+* (`deploy-engine.ts`, beside `resolvedExportNames.push(exportName)`), so an
+* index entry NAME is a key of that bag — while `ExportIndexEntry` carries no
+* output-key field, so nothing maps an entry back to the output it came from.
+*
+* WHAT CAN STILL GO WRONG. A name absent from `outputs` is reported and
+* nothing is written for it, so an entry in that position keeps its value —
+* `outputs` is `undefined` here whenever the stack has no state record at all,
+* which puts every one of its entries in that arm. An entry whose state value
+* carries no `{{resolve:` is left alone, so a plaintext an index entry holds
+* whose state counterpart is also plaintext is not reported by this pass and
+* not written by it. And `entries` is one region's index: an entry in another
+* region's `exports.json` is outside this call.
+*/
+function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
+	const examined = [];
+	const findings = [];
+	for (const [exportName, entry] of entries) {
+		if (entry.producerStack !== stackName || entry.producerRegion !== producerRegion) continue;
+		examined.push(exportName);
+		if (outputs === void 0 || !Object.hasOwn(outputs, exportName)) {
+			findings.push({
+				kind: "absent",
+				exportName
+			});
+			continue;
+		}
+		const stateValue = outputs[exportName];
+		if (!carriesDynamicReference(stateValue)) continue;
+		if (JSON.stringify(entry.value) === JSON.stringify(stateValue)) continue;
+		findings.push({
+			kind: "converge",
+			exportName,
+			stateValue
+		});
+	}
+	return {
+		examined,
+		findings
+	};
+}
+/**
+* The error a run ends with when `state.json` was rewritten and the exports
+* index was not (issue #2667).
+*
+* EXPLICIT rather than a warn: an entry this run went to converge and did not
+* keeps the value it held, in a region-wide object every principal with
+* `s3:GetObject` on the state bucket can read. `ExportIndexStore.patchEntry`
+* does not throw on a non-retryable S3 failure or an exhausted If-Match budget
+* — it logs and returns `false` — so without this the command would exit 0
+* over exactly that.
+*
+* Naming the remainder is what makes the re-run instruction actionable: the
+* convergence rule reads `state.outputs`, which a completed half already
+* matches, so a second invocation of the same command decides `converge` only
+* for the entries still differing.
+*/
+function exportIndexIncompleteError(unwritten, unreadable, dryRun) {
+	const parts = [dryRun ? "no state written (--dry-run)" : "state.json complete"];
+	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${u.region}`).join(", ")})`);
+	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${u.region}: ${u.reason}`).join("; ")})`);
+	return new ScrubRefusalError(`${parts.join("; ")}. Re-run the same command once the cause is cleared: each entry is written only while its value differs from the producer's state.outputs, so a re-run writes the remainder and leaves the rest alone.`, "SCRUB_EXPORT_INDEX_INCOMPLETE");
+}
+/**
+* Converge one scrubbed stack's entries in one region's exports index.
+*
+* Run as its OWN step by `scrubCommand`, after `scrubStack` returned — never
+* from inside the resolver. `scrubStack`'s resolve contexts deliberately
+* withhold `exportIndex` so `resolveImportValue`'s scan arm cannot `patchEntry`
+* as a side effect of resolution, at a point in the run nothing chose; that
+* withholding is unchanged, and this is a separate call with its own condition.
+*
+* Under `dryRun` no `patchEntry` is issued. The READ still happens:
+* `readPersistedEntries` is a GET that does not rebuild, so the audit half runs
+* without an S3 write.
+*
+* TWO PROPERTIES OF THE WRITE a reader will ask about. It runs OUTSIDE the
+* stack lock — `scrubStack` releases that in its own `finally` — because the
+* lock guards `state.json`, one key per stack, while `exports.json` is shared
+* region-wide and carries its own If-Match optimistic lock plus bounded retry;
+* that is the same concurrency control the deploy path's index write relies on.
+* And it is ONE PutObject PER ENTRY rather than one for the batch: `patchEntry`
+* is the operation that changes a value without touching membership, and a
+* remediation command pays that round trip so a failure names the entry it
+* could not write.
+*/
+async function repairExportIndexForStack(store, stackName, producerRegion, outputs, opts) {
+	const entries = await store.readPersistedEntries();
+	if (!entries) return {
+		examined: [],
+		findings: [],
+		unwritten: []
+	};
+	const plan = planExportIndexRepair(entries, stackName, producerRegion, outputs);
+	const unwritten = [];
+	if (opts.dryRun) return {
+		...plan,
+		unwritten
+	};
+	for (const finding of plan.findings) {
+		if (finding.kind !== "converge") continue;
+		const entry = entries.get(finding.exportName);
+		if (!entry) throw new ScrubIndexInvariantError("exports index repair: a planned entry is absent from the snapshot it was planned from");
+		if (!await store.patchEntry(finding.exportName, {
+			...entry,
+			value: finding.stateValue
+		}, { requireOwner: {
+			producerStack: stackName,
+			producerRegion
+		} })) unwritten.push(finding.exportName);
+	}
+	return {
+		...plan,
+		unwritten
+	};
+}
+/**
 * `cdkd scrub` — rewrite persisted state so any resolved secret dynamic
 * reference is stored as its UNRESOLVED expression rather than the plaintext
 * value (GHSA fix). "Secret" here is whatever the RESOLVER classifies as one,
@@ -65229,10 +65854,14 @@ function scrubStacksFailedError(failures) {
 * re-resolves each resource's properties to learn the resolved secret VALUES
 * (recorded, never printed or re-persisted), and replaces those values in the
 * state record's `properties` / `attributes` / `observedProperties` with the
-* expression. No AWS resource is created, updated, or deleted; only state.json
-* is rewritten. This is why it is a top-level command and not `cdkd state
-* scrub` — the `cdkd state ...` family operates on the state bucket alone and
-* deliberately needs no CDK code.
+* expression. No AWS resource is created, updated, or deleted. What it WRITES
+* is the state bucket: each targeted stack's state.json, and — since issue
+* [#2667](https://github.com/go-to-k/cdkd/issues/2667) — the entries a scrubbed
+* stack publishes in the shared exports index at
+* `{prefix}/_index/{region}/exports.json`, as a separate step after that
+* stack's state.json write. This is why it is a top-level command and not
+* `cdkd state scrub` — the `cdkd state ...` family operates on the state bucket
+* alone and deliberately needs no CDK code.
 *
 * IMPORTANT: scrubbing does not un-expose an already-leaked secret. A value
 * that was stored in plaintext should be treated as compromised and ROTATED at
@@ -65290,10 +65919,11 @@ async function scrubCommand(stacks, options) {
 	if (!app) throw new Error("CDK app is required (scrub needs the template to identify secret references). Pass --app, set CDKD_APP, or add \"app\" to cdk.json.");
 	const region = namedCliRegion(options.region) ?? "us-east-1";
 	const stateBucket = await resolveStateBucketWithDefault(options.stateBucket, region);
-	setAwsClients(new AwsClients({
+	const awsClients = new AwsClients({
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile }
-	}));
+	});
+	setAwsClients(awsClients);
 	logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
 	const synthesizer = new Synthesizer();
 	const context = parseContextOptions(options.context);
@@ -65333,6 +65963,20 @@ async function scrubCommand(stacks, options) {
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
 	const failures = [];
+	const exportIndexStores = /* @__PURE__ */ new Map();
+	const exportIndexFor = (indexRegion) => {
+		const existing = exportIndexStores.get(indexRegion);
+		if (existing) return existing;
+		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend);
+		exportIndexStores.set(indexRegion, store);
+		return store;
+	};
+	const examinedIndexNames = /* @__PURE__ */ new Map();
+	let totalIndexEntriesConverged = 0;
+	let totalIndexEntriesAbsent = 0;
+	let totalIndexEntriesUnexamined = 0;
+	const indexUnwritten = [];
+	const indexUnreadable = [];
 	for (const stack of targetStacks) {
 		const stackRegion = stack.region || region;
 		let scrubbed;
@@ -65349,10 +65993,51 @@ async function scrubCommand(stacks, options) {
 			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
 			continue;
 		}
+		let indexConverged = 0;
+		try {
+			const repair = await repairExportIndexForStack(exportIndexFor(stackRegion), stack.stackName, stackRegion, scrubbed.outputs, { dryRun: options.dryRun ?? false });
+			const seen = examinedIndexNames.get(stackRegion) ?? /* @__PURE__ */ new Set();
+			for (const name of repair.examined) seen.add(name);
+			examinedIndexNames.set(stackRegion, seen);
+			const named = (exportName) => {
+				const shown = scrubbed.exportNameDisplay(exportName);
+				switch (shown.kind) {
+					case "safe": return `'${shown.text}'`;
+					case "masked": return `(masked: "${shown.text}")`;
+					case "withheld": return "(name withheld: it holds a secret this run recorded)";
+				}
+			};
+			const unwrittenNames = new Set(repair.unwritten);
+			for (const exportName of repair.unwritten) indexUnwritten.push({
+				region: stackRegion,
+				shown: named(exportName)
+			});
+			for (const finding of repair.findings) if (finding.kind === "converge") {
+				indexConverged++;
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) differs from ${stack.stackName}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				else {
+					totalIndexEntriesConverged++;
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${stackRegion}) to ${stack.stackName}'s state.outputs value.`);
+				}
+			} else {
+				totalIndexEntriesAbsent++;
+				logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) is published by ${stack.stackName}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${stack.stackName} to rewrite the index from its own outputs.`);
+			}
+		} catch (err) {
+			if (err instanceof ScrubIndexInvariantError) throw err;
+			if (!indexUnreadable.some((u) => u.region === stackRegion)) {
+				const reason = displaySafe(err instanceof Error ? err.message : String(err));
+				indexUnreadable.push({
+					region: stackRegion,
+					reason
+				});
+				logger.error(`Exports index for ${stackRegion} could not be read (first seen while scrubbing ${stack.stackName}): ${reason}`);
+			}
+		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -65362,7 +66047,28 @@ async function scrubCommand(stacks, options) {
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0) {
+	for (const [indexRegion, store] of exportIndexStores) {
+		if (indexUnreadable.some((u) => u.region === indexRegion)) continue;
+		let entries;
+		try {
+			entries = await store.readPersistedEntries();
+		} catch (err) {
+			const reason = displaySafe(err instanceof Error ? err.message : String(err));
+			indexUnreadable.push({
+				region: indexRegion,
+				reason
+			});
+			logger.error(`Exports index for ${indexRegion} could not be read for the coverage report: ${reason}`);
+			continue;
+		}
+		if (!entries) continue;
+		const examined = examinedIndexNames.get(indexRegion) ?? /* @__PURE__ */ new Set();
+		const unexamined = [...entries.keys()].filter((name) => !examined.has(name));
+		if (unexamined.length === 0) continue;
+		totalIndexEntriesUnexamined += unexamined.length;
+		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
+	}
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -65373,16 +66079,25 @@ async function scrubCommand(stacks, options) {
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
+	const indexNote = (() => {
+		const parts = [];
+		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
+		if (totalIndexEntriesAbsent > 0) parts.push(` ${totalIndexEntriesAbsent} exports index entr${totalIndexEntriesAbsent === 1 ? "y is" : "ies are"} published by a scrubbed stack under a name its state.outputs does not carry; nothing was written for ${totalIndexEntriesAbsent === 1 ? "it" : "them"} — redeploy that producer.`);
+		if (totalIndexEntriesUnexamined > 0) parts.push(` ${totalIndexEntriesUnexamined} exports index entr${totalIndexEntriesUnexamined === 1 ? "y" : "ies"} belong to producers outside this run and were NOT examined.`);
+		return parts.join("");
+	})();
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: nothing can be scrubbed.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
+		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${failureNote}`);
-	else logger.info(`\nNothing could be rewritten.${keyNote}${unverifiableNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
+	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
 }
 /**
@@ -67006,7 +67721,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				recordsChanged: 0,
 				secretsFound: 0,
 				secretBearingKeys: 0,
-				unverifiableReads: 0
+				unverifiableReads: 0,
+				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
 		}
 		const state = loaded.state;
@@ -67149,7 +67865,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			recordsChanged: 0,
 			secretsFound: 0,
 			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length
+			unverifiableReads: prePassFindings.unverifiable.length,
+			outputs: state.outputs,
+			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 		let recordsChanged = 0;
 		const newResources = {};
@@ -67168,8 +67886,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
+			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
 			const nextState = {
-				...state,
+				...carriedState,
 				resources: newResources,
 				outputs: newOutputs,
 				lastModified: Date.now()
@@ -67180,7 +67899,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			recordsChanged,
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length
+			unverifiableReads: prePassFindings.unverifiable.length,
+			outputs: newOutputs,
+			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 	} catch (err) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
@@ -69332,18 +70053,19 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					unorderedPaths
 				}), secrets, secretResolutionFailed ? seededSecretPaths : secretPaths, maskSecretPaths);
 				const notComparedCause = secretResolutionFailed ? "refused" : unresolvedTokens.size > 0 ? "unresolvedToken" : void 0;
-				if (reported.changes.length === 0) if (notComparedCause !== void 0) outcomes.push({
-					kind: "notCompared",
-					logicalId,
-					resourceType: resource.resourceType,
-					notComparedCause
-				});
-				else outcomes.push({
-					kind: "clean",
-					logicalId,
-					resourceType: resource.resourceType
-				});
-				else outcomes.push({
+				if (reported.changes.length === 0) {
+					if (notComparedCause !== void 0) outcomes.push({
+						kind: "notCompared",
+						logicalId,
+						resourceType: resource.resourceType,
+						notComparedCause
+					});
+					else outcomes.push({
+						kind: "clean",
+						logicalId,
+						resourceType: resource.resourceType
+					});
+				} else outcomes.push({
 					kind: "drifted",
 					logicalId,
 					resourceType: resource.resourceType,
@@ -69524,8 +70246,9 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					properties: redactedBaseline
 				};
 			}
+			const { skippedOutputs: _droppedByAccept, ...carriedState } = report.state;
 			const newState = {
-				...report.state,
+				...carriedState,
 				resources,
 				lastModified: Date.now()
 			};
@@ -70345,8 +71068,9 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					};
 				}
 				if (recordedCount === 0) continue;
+				const { skippedOutputs: _droppedByRevert, ...carriedState } = report.state;
 				const newState = {
-					...report.state,
+					...carriedState,
 					resources,
 					lastModified: Date.now()
 				};
@@ -70585,10 +71309,11 @@ function writeHumanReport(reports) {
 		const inspected = inspectedCount;
 		const notCompared = notComparedOutcomes(report);
 		const checked = inspected - notCompared.length;
-		if (drifted.length === 0) if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
-		else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
-		else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
-		else {
+		if (drifted.length === 0) {
+			if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
+			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
+			else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
+		} else {
 			const word = drifted.length === 1 ? "resource" : "resources";
 			process.stdout.write(`\n⚠ ${report.stackName} (${report.region}): drift detected on ${drifted.length} ${word}\n\n`);
 			for (const o of drifted) {
@@ -70860,12 +71585,14 @@ async function destroyCommand(stackArgs, options) {
 			const refs = stateRefsByName.get(stackName) ?? [];
 			const synthStack = appStacks.find((s) => s.stackName === stackName);
 			const synthRegion = synthStack?.region;
-			if (synthStack?.terminationProtection === true) if (options.removeProtection) logger.warn(`Stack ${stackName} has terminationProtection: true — bypassing because --remove-protection set`);
-			else {
-				const err = new StackTerminationProtectionError(stackName);
-				logger.error(`  ✗ ${err.message}`);
-				totalErrors++;
-				continue;
+			if (synthStack?.terminationProtection === true) {
+				if (options.removeProtection) logger.warn(`Stack ${stackName} has terminationProtection: true — bypassing because --remove-protection set`);
+				else {
+					const err = new StackTerminationProtectionError(stackName);
+					logger.error(`  ✗ ${err.message}`);
+					totalErrors++;
+					continue;
+				}
 			}
 			let stackTargetRegion;
 			if (refs.length === 0) {
@@ -75121,7 +75848,7 @@ async function stateListCommand(options) {
 * shape; plain `tree` renders `tree(1)`-style box-drawing.
 */
 async function renderTreeMode(refs, stateBackend, asJson) {
-	const roots = buildStackTree(await Promise.all(refs.map(async (ref) => {
+	const entries = await Promise.all(refs.map(async (ref) => {
 		if (!ref.region) return { stackName: ref.stackName };
 		let state;
 		try {
@@ -75139,7 +75866,8 @@ async function renderTreeMode(refs, stateBackend, asJson) {
 			...state?.parentLogicalId !== void 0 && { parentLogicalId: state.parentLogicalId },
 			...state?.parentRegion !== void 0 && { parentRegion: state.parentRegion }
 		};
-	})));
+	}));
+	const roots = buildStackTree(entries);
 	if (asJson) {
 		process.stdout.write(`${JSON.stringify(stackTreeToJson(roots), null, 2)}\n`);
 		return;
@@ -75905,11 +76633,12 @@ async function listAssetStorageMarkers(s3, bucket) {
 	for (const key of keys) {
 		const region = key.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
 		try {
-			const marker = parseBootstrapMarker(await (await s3.send(new GetObjectCommand({
+			const body = await (await s3.send(new GetObjectCommand({
 				Bucket: bucket,
 				Key: key,
 				...await expectedOwnerParam(s3)
-			}))).Body?.transformToString() ?? "", key);
+			}))).Body?.transformToString() ?? "";
+			const marker = parseBootstrapMarker(body, key);
 			entries.push({
 				region,
 				assetBucket: marker.assetBucket,
@@ -76131,7 +76860,7 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 * Shared rather than constructed per resource because nothing writes to it:
 * `redactSecretsForState` only reads its argument.
 */
-const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+const NO_RECORDED_SECRETS$1 = /* @__PURE__ */ new Map();
 /**
 * Warn before `cdkd state orphan` force-releases a lock that is still LIVE.
 *
@@ -76244,7 +76973,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 						unsupported++;
 						return;
 					}
-					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+					resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS$1, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 					refreshed++;
 				} catch (err) {
 					failed++;
@@ -76254,6 +76983,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 			await Promise.all(tasks);
 		});
 		state.lastModified = Date.now();
+		if (refreshed > 0) delete state.skippedOutputs;
 		const saveOptions = { expectedEtag: etag };
 		if (migrationPending) saveOptions.migrateLegacy = true;
 		await stateBackend.saveState(stackName, region, state, saveOptions);
@@ -76454,8 +77184,10 @@ async function rollbackCommand(stackArg, options) {
 	let stackAwsClients;
 	try {
 		let ref;
-		if (stackArg) ref = resolveSingleRegion(stackArg, await setup.stateBackend.listStacks(), options.stackRegion);
-		else {
+		if (stackArg) {
+			const refs = await setup.stateBackend.listStacks();
+			ref = resolveSingleRegion(stackArg, refs, options.stackRegion);
+		} else {
 			const candidates = await findJournalCandidates(setup.stateBackend, setup.prefix);
 			const scoped = options.stackRegion ? candidates.filter((c) => c.region === options.stackRegion) : candidates;
 			if (scoped.length === 0) {
@@ -76508,11 +77240,13 @@ async function rollbackCommand(stackArg, options) {
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
 				const segment = journal.segments[s];
 				logger.info(`\n  Segment ${s + 1}/${journal.segments.length} (${segment.reason}${segment.runId ? `, run ${segment.runId}` : ""}):`);
-				if (segment.failedOperations && segment.failedOperations.length > 0) if (options.revertFailed) {
-					const failedPlan = planFailedOps(segment.failedOperations, planStateView);
-					for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
-					applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
-				} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+				if (segment.failedOperations && segment.failedOperations.length > 0) {
+					if (options.revertFailed) {
+						const failedPlan = planFailedOps(segment.failedOperations, planStateView);
+						for (const item of failedPlan) logger.info(failedActionLabel(item, options.skipFinalSnapshot === true));
+						applyFailedPlanToPreview(failedPlan, planStateView, options.skipFinalSnapshot === true);
+					} else for (const fop of segment.failedOperations) logger.info(`  - (left as-is) ${fop.logicalId} (${fop.resourceType}) — its ${fop.changeType} FAILED mid-deploy; pass --revert-failed to attempt reverting it`);
+				}
 				const plan = planRollback(segment.operations, planStateView, orphanLogicalIds);
 				for (const item of plan) logger.info(actionLabel(item, options.skipFinalSnapshot === true));
 				applyPlanToPreview(plan, planStateView, options.skipFinalSnapshot === true);
@@ -76541,8 +77275,9 @@ async function rollbackCommand(stackArg, options) {
 			};
 			let currentEtag = stateData.etag;
 			const saveState = async () => {
+				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
-					...baseState,
+					...carriedState,
 					version: 9,
 					region,
 					resources: { ...stateResources },
@@ -76686,10 +77421,7 @@ function applyPlanToPreview(plan, previewState, skipFinalSnapshot) {
 				break;
 			case "revert":
 			case "reverse-replacement":
-			case "reverse-replacement-readopt":
-				if (op.previousState) previewState[op.logicalId] = op.previousState;
-				break;
-			default: break;
+			case "reverse-replacement-readopt": if (op.previousState) previewState[op.logicalId] = op.previousState;
 		}
 	}
 }
@@ -76709,10 +77441,7 @@ function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 			case "orphan-failed-create-retain":
 				delete previewState[op.logicalId];
 				break;
-			case "revert-failed-update":
-				if (op.previousState) previewState[op.logicalId] = op.previousState;
-				break;
-			default: break;
+			case "revert-failed-update": if (op.previousState) previewState[op.logicalId] = op.previousState;
 		}
 	}
 }
@@ -77491,7 +78220,7 @@ function looksLikeEcrHostWithForeignSuffix(imageUri) {
 *   a foreign-bucket refusal like the create / teardown sides.
 */
 /** Default `--older-than` when the flag is not passed. */
-const DEFAULT_OLDER_THAN_MS = 720 * 60 * 60 * 1e3;
+const DEFAULT_OLDER_THAN_MS = 2592e6;
 /** S3 `DeleteObjects` accepts at most 1,000 keys per call. */
 const S3_DELETE_BATCH_SIZE = 1e3;
 /** ECR `BatchDeleteImage` accepts at most 100 image ids per call. */
@@ -77512,7 +78241,7 @@ function parseOlderThan(value) {
 	if (!match) throw new Error(`Invalid --older-than "${value}": expected <number>d or <number>h (e.g. 30d, 12h)`);
 	const num = Number(match[1]);
 	if (!Number.isFinite(num) || num <= 0) throw new Error(`Invalid --older-than "${value}": must be greater than zero`);
-	const multiplier = match[2] === "d" ? 1440 * 60 * 1e3 : 3600 * 1e3;
+	const multiplier = match[2] === "d" ? 864e5 : 36e5;
 	return Math.round(num * multiplier);
 }
 /**
@@ -77879,7 +78608,8 @@ async function scanReferencedAssets(stateBackend, marker, logger) {
 		} catch (error) {
 			const described = describeStateKey(key, STATE_FILE_SUFFIX, DEFAULT_STATE_PREFIX);
 			const regionMatch = /^(\S+) \((\S+)\)$/.exec(described);
-			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
+			const inspectHint = regionMatch ? `cdkd state show ${regionMatch[1]} --stack-region ${regionMatch[2]}` : `cdkd state show ${described}`;
+			throw new CdkdError(`State file '${key}' is not valid JSON — aborting: gc must know every referenced asset before deleting anything, and this file's references are unreadable. Repair or remove the corrupt state file ('${inspectHint}' to inspect), then re-run.`, "GC_STATE_UNREADABLE", error);
 		}
 		collectAssetReferences(parsed, marker, refs);
 	}
@@ -78094,9 +78824,9 @@ function formatBytes(bytes) {
 /** Age of a timestamp relative to now, in whole days (or hours under 1d). */
 function formatAge(date) {
 	const ageMs = Date.now() - date.getTime();
-	const days = Math.floor(ageMs / (1440 * 60 * 1e3));
+	const days = Math.floor(ageMs / 864e5);
 	if (days >= 1) return `${days}d old`;
-	return `${Math.max(0, Math.floor(ageMs / (3600 * 1e3)))}h old`;
+	return `${Math.max(0, Math.floor(ageMs / 36e5))}h old`;
 }
 /**
 * Interactive confirmation for the deletion. Follows the repo's
@@ -78591,9 +79321,10 @@ async function rewriteResourceReferences(state, orphanLogicalIds, providerRegist
 	}
 	const newOutputs = {};
 	for (const [name, value] of Object.entries(state.outputs ?? {})) newOutputs[name] = await rewriteValue(value, `outputs.${name}`, `<output:${name}>`, orphanSet, fetcher, rewrites, unresolvable);
+	const { skippedOutputs: _droppedByOrphanRewrite, ...carriedState } = state;
 	return {
 		state: {
-			...state,
+			...carriedState,
 			resources: newResources,
 			outputs: newOutputs,
 			lastModified: Date.now()
@@ -78717,20 +79448,21 @@ async function rewriteSubTemplate(template, ownerLogicalId, pathPrefix, orphanSe
 			continue;
 		}
 		const dot = inner.indexOf(".");
-		if (dot < 0) if (orphanSet.has(inner)) {
-			const replaced = fetcher.ref(inner);
-			rewrites.push({
-				logicalId: ownerLogicalId,
-				path: pathPrefix,
-				kind: "sub",
-				before: m[0],
-				after: replaced,
-				orphanLogicalId: inner
-			});
-			out += replaced;
-			didChange = true;
-		} else out += m[0];
-		else {
+		if (dot < 0) {
+			if (orphanSet.has(inner)) {
+				const replaced = fetcher.ref(inner);
+				rewrites.push({
+					logicalId: ownerLogicalId,
+					path: pathPrefix,
+					kind: "sub",
+					before: m[0],
+					after: replaced,
+					orphanLogicalId: inner
+				});
+				out += replaced;
+				didChange = true;
+			} else out += m[0];
+		} else {
 			const target = inner.slice(0, dot);
 			const attribute = inner.slice(dot + 1);
 			if (orphanSet.has(target)) {
@@ -79118,13 +79850,14 @@ async function publishAssetsCommand(stacks, options) {
 			region: baseRegion,
 			...options.profile && { profile: options.profile }
 		});
-		const resolver = new AssetModeResolver(new S3StateBackend(markerClients.s3, {
+		const backend = new S3StateBackend(markerClients.s3, {
 			bucket,
 			prefix: options.statePrefix
 		}, {
 			region: baseRegion,
 			...options.profile && { profile: options.profile }
-		}), accountId, { ...options.profile && { profile: options.profile } });
+		});
+		const resolver = new AssetModeResolver(backend, accountId, { ...options.profile && { profile: options.profile } });
 		markerAccess = {
 			resolver,
 			dispose: () => markerClients.destroy()
@@ -79454,13 +80187,15 @@ async function importCommand(stackArg, options) {
 		const existingState = existingResult?.state ?? null;
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
-		if (existingState) if (!selectiveMode) {
-			if (!options.force) throw new Error(`State already exists for stack '${stackInfo.stackName}' (${targetRegion}). Auto / whole-stack import rebuilds the entire resource map from the template, which would drop any state entry not re-imported. Pass --force to confirm. To add specific resources without affecting unlisted ones, use --resource <id>=<physicalId> (selective merge — no --force needed).`);
-		} else {
-			const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
-			if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
-			const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
-			logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
+		if (existingState) {
+			if (!selectiveMode) {
+				if (!options.force) throw new Error(`State already exists for stack '${stackInfo.stackName}' (${targetRegion}). Auto / whole-stack import rebuilds the entire resource map from the template, which would drop any state entry not re-imported. Pass --force to confirm. To add specific resources without affecting unlisted ones, use --resource <id>=<physicalId> (selective merge — no --force needed).`);
+			} else {
+				const conflicts = [...overrides.keys()].filter((id) => Object.prototype.hasOwnProperty.call(existingState.resources, id));
+				if (conflicts.length > 0 && !options.force) throw new Error(`Selective import would overwrite resource(s) already in state: ${conflicts.join(", ")}. Pass --force to confirm the overwrite, or remove these IDs from --resource / --resource-mapping.`);
+				const preservedCount = Object.keys(existingState.resources).filter((id) => !overrides.has(id)).length;
+				logger.info(`Merging into existing state for ${stackInfo.stackName} (${targetRegion}): preserving ${preservedCount} unlisted resource(s)` + (conflicts.length > 0 ? `, overwriting ${conflicts.length} listed entry(ies)` : ""));
+			}
 		}
 		for (const overrideId of overrides.keys()) if (!templateLogicalIds.has(overrideId)) throw new Error(`--resource / --resource-mapping references logical ID '${overrideId}' which is not in the synthesized template for stack '${stackInfo.stackName}'. Available IDs: ${[...templateLogicalIds].join(", ")}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
@@ -79528,8 +80263,7 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger);
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -79962,14 +80696,90 @@ function defaultOnlyParameterTemplate(template) {
 * already-stored, which on the v3 baseline is already resolved-shape
 * from a prior import / deploy, so re-resolving is a no-op.
 *
+* RETURNS the logical ids for which an `observedProperties` baseline must NOT
+* be captured, because this walk cannot vouch that the persisted `properties`
+* still SPELL the dynamic reference the template had.
+* `captureObservedForImportedResources` refuses to write a baseline for those
+* (issue [#2828](https://github.com/go-to-k/cdkd/issues/2828) review); the
+* redaction it performs is POSITION-based, so a bag that no longer spells the
+* reference gives it no evidence and the DECRYPTED readback is persisted in
+* the clear.
+*
+* The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
+* decision a review round paid for. Two arms:
+*
+*  - **Resolution THREW** — refuse, unconditionally. A throw means the
+*    resolver could not finish, so nothing about the persisted bag is
+*    trustworthy evidence. This is BEHAVIOURALLY IDENTICAL to the arm this PR
+*    first shipped: two attempts to sharpen it in between each shipped a leak
+*    (the wrapped-complete-token shape, then the
+*    reference-sourced-from-outside-the-bag shape), and saying so is the
+*    strongest available form of "every sharpening leaked". The arm's own
+*    comment carries both measurements.
+*  - **Resolution SUCCEEDED but LOST an opener.** An `Fn::If` whose condition
+*    was DOWNGRADED resolves without throwing and selects the branch AWS did
+*    not take, so `properties` hold the false-branch literal and no reference
+*    at all. The downgrade needs a parameter with NO `Default` — `cdkd import`
+*    accepts no parameter VALUES from the user, but a `Default`-carrying
+*    parameter IS bound (issue #2321's retry), so only an unbindable one leaves
+*    `evaluateConditions` catching per condition and recording `false`.
+*
+*    ARM 2 IS KNOWN OVER-BROAD for a PUBLIC `{{resolve:ssm:...}}` reference: a
+*    `String` / `StringList` parameter is stored RESOLVED (issue #1901), so its
+*    opener disappears across the resolve and the resource is refused although
+*    nothing was ever secret, costing it a drift baseline on a common config
+*    pattern. Threading the resolve's own `recordedSecretValues` into the
+*    capture corrects it -- measured on issue
+*    [#2852](https://github.com/go-to-k/cdkd/issues/2852), which carries that
+*    remedy -- because a populated map makes absence from it real evidence of
+*    a public parameter, exactly as the deploy path already relies on.
+*
+* The cost of a false refusal is one resource's drift baseline until its next
+* deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
+* unmeasurable bag refuses too.
+*
+* WHAT CAN STILL GO WRONG. No claim is made here about what this closes, and
+* that is deliberate: successive review rounds falsified a closure claim, then
+* a closed-set list, then a "reduces" claim -- the mechanism survived every
+* round of measurement and the SENTENCES about it did not. What follows states only
+* the DANGER direction, which can become false only once the residue is gone.
+*
+* PLAINTEXT CAN STILL BE PERSISTED by this capture. Known ways, each with its
+* issue and none of them proven to be all of them:
+*
+*  - the resolve drops a reference, or trades one away, in a manner the opener
+*    comparison below cannot see --
+*    [#2850](https://github.com/go-to-k/cdkd/issues/2850);
+*  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
+*    the reference, so no opener exists in any template this walk is handed --
+*    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
+*  - `redactSecretsForState` cannot PAIR the readback against the source and
+*    returns the bag unchanged: a reshaped container, an identity key AWS
+*    normalised, a readback key the source lacks, an array whose anchors do not
+*    corroborate -- [#2852](https://github.com/go-to-k/cdkd/issues/2852), which
+*    carries the measured probe table;
+*  - the readback holds a secret with NO counterpart in the source at all, set
+*    out of band -- [#2868](https://github.com/go-to-k/cdkd/issues/2868), filed
+*    as a remit question rather than a defect in this mechanism.
+*
+* WHY NO EXHAUSTIVE LIST IS OFFERED, as mechanism rather than framing: this
+* redaction's only evidence is a POST-HOC comparison between the persisted bag
+* and the readback, so anything that comparison cannot see is trusted.
+* Establishing more needs PROVENANCE carried out of the resolver or the
+* deployer, which is where the structural remedy for all of the above lives.
+*
+* The set is returned rather than recorded on the state, because it describes
+* THIS run's resolution and nothing downstream of the save has any use for it.
+*
 * Exported for unit testing — internal to the command flow otherwise. The
 * masking this walk applies (issue #2803) is only provable against the REAL
 * resolver, since the plaintext reaches the message through the resolver's
 * own throw rather than through anything this function writes.
 */
 async function resolveImportedProperties(stackState, template, region, stateBackend, logger) {
+	const unsafeObservedBaselineLogicalIds = /* @__PURE__ */ new Set();
 	const entries = Object.entries(stackState.resources);
-	if (entries.length === 0) return;
+	if (entries.length === 0) return unsafeObservedBaselineLogicalIds;
 	const resolver = new IntrinsicFunctionResolver(region);
 	let parameters = {};
 	let conditions = {};
@@ -80004,8 +80814,9 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	};
 	for (const [logicalId, resource] of entries) {
 		const recordedSecretValues = /* @__PURE__ */ new Map();
+		const unresolvedProperties = resource.properties ?? {};
+		let threw = false;
 		try {
-			const unresolvedProperties = resource.properties ?? {};
 			const resolved = await resolver.resolve(unresolvedProperties, {
 				...baseContext,
 				recordedSecretValues
@@ -80013,7 +80824,46 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(resolved, recordedSecretValues, unresolvedProperties) : resolved;
 		} catch (err) {
 			logger.warn(`Failed to resolve intrinsics in Properties for imported resource '${logicalId}' (${resource.resourceType}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}. State will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource via 'cdkd state orphan'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+			threw = true;
+		}
+		if (threw) {
+			unsafeObservedBaselineLogicalIds.add(logicalId);
+			continue;
 		}
+		const rawOpeners = countDynamicReferenceOpeners(unresolvedProperties);
+		const persistedOpeners = countDynamicReferenceOpeners(resource.properties);
+		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners) unsafeObservedBaselineLogicalIds.add(logicalId);
+	}
+	return unsafeObservedBaselineLogicalIds;
+}
+/** The opener every dynamic reference starts with, secret-bearing or not. */
+const DYNAMIC_REFERENCE_OPENER = "{{resolve:";
+/**
+* How many dynamic-reference OPENERS a property bag carries, counted over its
+* JSON serialization rather than by walking string leaves — which is the whole
+* point on the RAW side: a token assembled by `Fn::Join` is SPLIT across array
+* elements, so `{{resolve:secretsmanager:` survives as a fragment that no scan
+* for a COMPLETE token would see. `secretValueFromJson` renders exactly that
+* shape, so the split form is the common one, not the exotic one.
+*
+* `undefined` when the bag cannot be serialized. Callers treat that as "cannot
+* vouch for this bag" rather than as zero — the only safe direction, since the
+* cost of a false refusal is a drift baseline and the cost of a false pass is a
+* plaintext secret in `state.json`.
+*/
+function countDynamicReferenceOpeners(bag) {
+	let text;
+	try {
+		text = JSON.stringify(bag ?? {}) ?? "";
+	} catch {
+		return;
+	}
+	let count = 0;
+	for (let from = 0;;) {
+		const at = text.indexOf(DYNAMIC_REFERENCE_OPENER, from);
+		if (at === -1) return count;
+		count++;
+		from = at + 10;
 	}
 }
 function printSummary(rows) {
@@ -80105,6 +80955,14 @@ function collectMultiple(value, previous) {
 	return [...previous ?? [], value];
 }
 /**
+* The empty secrets map the observed-capture redaction below passes. Shared
+* and module-level because `redactSecretsForState` only ever READS its map,
+* and because an empty one is not an oversight here but the POSITION-only
+* configuration the call site's note argues for — the same constant
+* `cdkd state refresh-observed` passes for the same reason.
+*/
+const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
+/**
 * Populate `observedProperties` for every resource in a freshly-built
 * import StackState by calling the matching provider's
 * `readCurrentState`. Mirrors what `cdkd deploy` does after each
@@ -80123,11 +80981,25 @@ function collectMultiple(value, previous) {
 * (incremental rollout — see `ResourceProvider.readCurrentState`'s
 * doc-comment) keep `observedProperties: undefined`; the drift comparator
 * falls back to `properties` for those, matching pre-v3 behavior.
+*
+* Exported for unit testing -- internal to the command flow otherwise. The
+* input-space matrix drives THIS function rather than replaying its
+* `redactSecretsForState` call by hand, so a change to the arguments it passes
+* cannot leave that fence green.
+*
+* Every captured bag is REDACTED before it lands on the record, and a resource
+* whose redaction POSITION SOURCE is unusable is skipped entirely — see the
+* call site's own note (issue
+* [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
-async function captureObservedForImportedResources(stackState, providerRegistry, logger) {
+async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds) {
 	const entries = Object.entries(stackState.resources);
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
+		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
+			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
+			return;
+		}
 		try {
 			const provider = providerRegistry.getProviderFor({
 				resourceType: resource.resourceType,
@@ -80135,9 +81007,9 @@ async function captureObservedForImportedResources(stackState, providerRegistry,
 			}).provider;
 			if (!provider.readCurrentState) return;
 			const observed = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(stackState, logicalId));
-			if (observed !== void 0) resource.observedProperties = observed;
+			if (observed !== void 0) resource.observedProperties = redactSecretsForState(observed, NO_RECORDED_SECRETS, resource.properties ?? {}, STATE_SOURCED_READBACK_RULES);
 		} catch (err) {
-			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.message : String(err)} — drift will fall back to template properties for this resource until the next successful deploy.`);
+			logger.debug(`observedProperties capture for imported ${logicalId} (${resource.resourceType}) failed: ${err instanceof Error ? err.name : typeof err} — drift will fall back to template properties for this resource until the next successful deploy.`);
 		}
 	}));
 }
@@ -80307,8 +81179,7 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger);
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger);
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -80551,10 +81422,11 @@ async function loadBootstrapContainerRepo(synthRegion, opts) {
 			bucket: stateBucket,
 			prefix: opts.statePrefix
 		};
-		const { body, resolvedKey } = await readBootstrapMarkerBody(new S3StateBackend(awsClients.s3, stateConfig, {
+		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			...clientRegion !== void 0 && { region: clientRegion },
 			...opts.profile !== void 0 && { profile: opts.profile }
-		}), rawRegion, { logPrefix: prefix });
+		});
+		const { body, resolvedKey } = await readBootstrapMarkerBody(stateBackend, rawRegion, { logPrefix: prefix });
 		if (body === null) {
 			const rawKey = getBootstrapMarkerKey(rawRegion);
 			logger.debug(`${prefix}: no bootstrap marker at '${resolvedKey}'${rawKey !== resolvedKey ? ` (nor '${rawKey}')` : ""} in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
@@ -80727,14 +81599,15 @@ var S3LocalStateProvider = class {
 		this.opts = opts;
 	}
 	async load(stackName, synthRegion) {
-		const loaded = await loadStateForStack(stackName, synthRegion, {
+		const loadOpts = {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stackRegion !== void 0 && { stackRegion: this.opts.stackRegion },
 			...this.opts.rawStackRegion !== void 0 && { rawStackRegion: this.opts.rawStackRegion },
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
-		});
+		};
+		const loaded = await loadStateForStack(stackName, synthRegion, loadOpts);
 		if (!loaded) return void 0;
 		const outputs = {};
 		for (const [k, v] of Object.entries(loaded.state.outputs ?? {})) if (typeof v === "string") outputs[k] = v;
@@ -80747,12 +81620,13 @@ var S3LocalStateProvider = class {
 		};
 	}
 	async buildCrossStackResolver(consumerRegion) {
-		const built = await buildCrossStackResolver(consumerRegion, {
+		const buildOpts = {
 			statePrefix: this.opts.statePrefix,
 			...this.opts.stateBucket !== void 0 && { stateBucket: this.opts.stateBucket },
 			...this.opts.region !== void 0 && { region: this.opts.region },
 			...this.opts.profile !== void 0 && { profile: this.opts.profile }
-		});
+		};
+		const built = await buildCrossStackResolver(consumerRegion, buildOpts);
 		if (!built) return void 0;
 		this.disposers.push(built.dispose);
 		return built.resolver;
@@ -82551,7 +83425,7 @@ async function runDetached(opts) {
 	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
-			maxBuffer: 10 * 1024 * 1024,
+			maxBuffer: 10485760,
 			env: dockerSpawnEnvWithSensitive(passthroughEnv)
 		});
 		return stdout.trim();
@@ -82785,7 +83659,7 @@ const ASSUMED_ROLE_CACHE = /* @__PURE__ */ new Map();
 */
 const CALLER_IDENTITY_CACHE = /* @__PURE__ */ new Map();
 /** 5-minute safety margin against the recorded STS expiration timestamp. */
-const STS_CREDENTIAL_SAFETY_MARGIN_MS = 300 * 1e3;
+const STS_CREDENTIAL_SAFETY_MARGIN_MS = 3e5;
 function isCredentialFresh(creds) {
 	if (!creds.expiration) return false;
 	return creds.expiration.getTime() - Date.now() > STS_CREDENTIAL_SAFETY_MARGIN_MS;
@@ -82893,7 +83767,8 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 		};
 	} catch (err) {
 		if (err instanceof LocalInvokeBuildError$1) throw err;
-		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${err instanceof Error ? err.message : String(err)}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
+		const reason = err instanceof Error ? err.message : String(err);
+		throw new LocalInvokeBuildError$1(`Failed to assume role ${roleArn} for ECR pull: ${reason}. Verify the role exists and its trust policy permits the caller's identity to assume it.`);
 	} finally {
 		sts.destroy();
 	}
@@ -83513,7 +84388,8 @@ function attachWebSocketServer(opts) {
 * route table.
 */
 async function handleManagementRequest(req, res, registry) {
-	if (parseConnectionsPath(req.url ?? "") === null) return false;
+	const url = req.url ?? "";
+	if (parseConnectionsPath(url) === null) return false;
 	await handleConnectionsRequest({
 		req,
 		res,
@@ -83781,8 +84657,9 @@ function createContainerPool(specs, options) {
 				readOnly: true
 			}] : optMount;
 			const containerCodePath = resolveRuntimeCodeMountPath(spec.lambda.runtime);
+			const image = resolveRuntimeImage(spec.lambda.runtime);
 			containerId = await runDetached({
-				image: resolveRuntimeImage(spec.lambda.runtime),
+				image,
 				mounts: [{
 					hostPath: spec.codeDir,
 					containerPath: containerCodePath,
@@ -85682,7 +86559,7 @@ async function createNetworkAndSidecar(args) {
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
 		const { stdout } = await execFileAsync$2(getDockerCmd(), sidecarArgs, {
-			maxBuffer: 10 * 1024 * 1024,
+			maxBuffer: 10485760,
 			env: dockerSpawnEnvWithSensitive(sidecarSensitiveEnv)
 		});
 		return stdout.trim();
@@ -86055,7 +86932,7 @@ async function runEcsTask(task, options, state) {
 		try {
 			const sensitiveEnv = dockerEnvs.get(container.name);
 			const { stdout } = await execFileAsync$1(getDockerCmd(), args, {
-				maxBuffer: 10 * 1024 * 1024,
+				maxBuffer: 10485760,
 				env: dockerSpawnEnvWithSensitive(sensitiveEnv)
 			});
 			id = stdout.trim();
@@ -86146,9 +87023,7 @@ async function awaitDependencies(container, started) {
 				if (code !== 0) throw new EcsTaskRunnerError(`Container '${container.name}' requires dependency '${dep.containerName}' to exit 0, but it exited ${code}.`);
 				break;
 			}
-			case "HEALTHY":
-				await waitForContainerHealthy(entry.id, dep.containerName);
-				break;
+			case "HEALTHY": await waitForContainerHealthy(entry.id, dep.containerName);
 		}
 	}
 }
@@ -86161,7 +87036,7 @@ async function awaitDependencies(container, started) {
 */
 async function waitForContainerHealthy(containerId, displayName) {
 	const logger = getLogger().child("ecs-runner");
-	const deadline = Date.now() + 300 * 1e3;
+	const deadline = Date.now() + 3e5;
 	let lastStatus = "";
 	const inspectArgs = [
 		"inspect",
@@ -86190,7 +87065,7 @@ async function waitForContainerHealthy(containerId, displayName) {
 async function waitForContainerExit(containerId) {
 	const waitArgs = ["wait", containerId];
 	try {
-		const { stdout } = await execFileAsync$1(getDockerCmd(), waitArgs, { maxBuffer: 1024 * 1024 });
+		const { stdout } = await execFileAsync$1(getDockerCmd(), waitArgs, { maxBuffer: 1048576 });
 		const code = Number.parseInt(stdout.trim(), 10);
 		return Number.isFinite(code) ? code : 1;
 	} catch (err) {
@@ -86389,11 +87264,12 @@ function buildDockerRunArgs(opts) {
 	for (const mp of container.mountPoints) {
 		const v = volumeByName.get(mp.sourceVolume);
 		if (!v) continue;
-		if (v.kind === "host") if (v.hostPath) {
-			const ro = mp.readOnly ? ":ro" : "";
-			args.push("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
-		} else args.push("-v", mp.containerPath);
-		else {
+		if (v.kind === "host") {
+			if (v.hostPath) {
+				const ro = mp.readOnly ? ":ro" : "";
+				args.push("-v", `${v.hostPath}:${mp.containerPath}${ro}`);
+			} else args.push("-v", mp.containerPath);
+		} else {
 			const name = v.dockerVolumeName ?? v.name;
 			const ro = mp.readOnly ? ":ro" : "";
 			args.push("-v", `${name}:${mp.containerPath}${ro}`);
@@ -86418,7 +87294,8 @@ function buildDockerRunArgs(opts) {
 		applyOverrideMap(finalEnv, overrides["Parameters"]);
 		applyOverrideMap(finalEnv, overrides[container.name]);
 	}
-	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]));
+	const sensitiveKeys = /* @__PURE__ */ new Set([...SENSITIVE_ENV_KEYS, ...secrets.map((s) => s.name)]);
+	const { flags, sensitiveEnv, collisions } = partitionSensitiveEnv(finalEnv, sensitiveKeys);
 	args.push(...flags);
 	if (container.user) args.push("--user", container.user);
 	if (container.privileged) args.push("--privileged");
@@ -86533,16 +87410,20 @@ async function localRunTaskCommand(target, options) {
 		const { context: imageContext, stateRecordRegion } = await buildEcsImageResolutionContext$1(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(target, stacks, imageContext);
 		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
-		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
+		const taskStack = stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack;
+		const taskNeeds = detectEcsImageResolutionNeeds(taskStack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
 			const consumerRegion = resolveEcsConsumerRegion(stateRecordRegion, options, task.stack.region);
 			const resolver = await stateProvider.buildCrossStackResolver(consumerRegion);
-			if (resolver) await applyCrossStackResolverToTask(task, {
-				resources: imageContext?.stateResources ?? {},
-				...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
-				consumerRegion,
-				crossStackResolver: resolver
-			});
+			if (resolver) {
+				const subContext = {
+					resources: imageContext?.stateResources ?? {},
+					...imageContext?.pseudoParameters && { pseudoParameters: imageContext.pseudoParameters },
+					consumerRegion,
+					crossStackResolver: resolver
+				};
+				await applyCrossStackResolverToTask(task, subContext);
+			}
 		} else if (!stateProvider && taskNeeds.needsCrossStackResolver) logger.warn("Container Environment / Secrets entries contain Fn::ImportValue / Fn::GetStackOutput intrinsics. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state.");
 		sigintHandler = () => {
 			sigintCount += 1;
@@ -87082,7 +87963,7 @@ async function softReloadAgentContainer(containerId, newAssetSourceDir) {
 		`${containerId}:${workdirDest}`
 	];
 	try {
-		await execFileAsync(dockerCmd, cpArgs, { maxBuffer: 64 * 1024 * 1024 });
+		await execFileAsync(dockerCmd, cpArgs, { maxBuffer: 67108864 });
 	} catch (err) {
 		throw new CdkdError(`softReloadAgentContainer: docker cp into '${containerId}:${workdir}' failed: ${describeDockerExecFailure(err, cpArgs)}.`, "LOCAL_INVOKE_AGENTCORE_WATCH_SOFT_RELOAD_CP_FAILED");
 	}
@@ -87621,8 +88502,9 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 	}
 	const region = canonicalizeRegion(options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region);
 	if (!region) throw new CdkdError("--sigv4: no region resolved for the AgentCore signing scope. Pass --region <region>, set AWS_REGION, or use --from-cfn-stack with a region-bound stack.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_REGION");
+	const credentials = await resolveHostCredentialsForSigV4(options, resolved, loaded, region);
 	const signed = await signAgentCoreInvocation({
-		credentials: await resolveHostCredentialsForSigV4(options, resolved, loaded, region),
+		credentials,
 		region,
 		host,
 		port,
@@ -88742,15 +89624,16 @@ async function localInvokeCommand(target, options) {
 		}
 		let resolvedAssumeRoleArn;
 		if (typeof options.assumeRole === "string") resolvedAssumeRoleArn = options.assumeRole;
-		else if (options.assumeRole === true) if (!stateForRoleHint) logger.warn("--assume-role passed without an ARN, but no cdkd state was loaded. Pair it with --from-state, or pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
-		else {
-			const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
-			if (arn) {
-				resolvedAssumeRoleArn = arn;
-				logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
-			} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
-		}
-		else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
+		else if (options.assumeRole === true) {
+			if (!stateForRoleHint) logger.warn("--assume-role passed without an ARN, but no cdkd state was loaded. Pair it with --from-state, or pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.");
+			else {
+				const arn = resolveExecutionRoleArnFromState(stateForRoleHint, lambda.logicalId);
+				if (arn) {
+					resolvedAssumeRoleArn = arn;
+					logger.info(`--assume-role: auto-resolved execution role from cdkd state: ${arn}`);
+				} else logger.warn(`--assume-role: could not resolve the execution role ARN from cdkd state for '${lambda.logicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
+			}
+		} else maybeSuggestAssumeRole(options, stateForRoleHint, lambda.logicalId);
 		const event = await readEvent(options);
 		const dockerEnv = {
 			AWS_LAMBDA_FUNCTION_NAME: lambda.logicalId,
@@ -88807,7 +89690,8 @@ async function localInvokeCommand(target, options) {
 		};
 		process.on("SIGINT", sigintHandler);
 		await waitForRieReady(containerHost, hostPort, 5e3);
-		const result = await invokeRie(containerHost, hostPort, event, Math.max(3e4, lambda.timeoutSec * 2 * 1e3));
+		const invokeTimeoutMs = Math.max(3e4, lambda.timeoutSec * 2 * 1e3);
+		const result = await invokeRie(containerHost, hostPort, event, invokeTimeoutMs);
 		await new Promise((resolveDelay) => setTimeout(resolveDelay, 250));
 		process.stdout.write(`${result.raw}\n`);
 	} finally {
@@ -89526,4 +90410,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BPeZLD0q.js.map
+//# sourceMappingURL=program-BXH3FeeV.js.map