@go-to-k/cdkd 0.290.1 → 0.290.3

package/dist/{program-CnTfNj2k.js → program-CoRRfEe_.js}

@@ -1,8 +1,8 @@
-import { $ as getCurrentResourceSecrets, $n as validateAssetBucketName, $t as findActionableSilentDrops, A as planOrphanAdoption, An as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ar as warnDeprecatedNoPrefixCliFlag, At as resolveExplicitPhysicalId, B as bold, Bn as WorkGraph, Br as derivePartitionAndUrlSuffix, Bt as requireConfigObject, C as createPreDeleteFinalSnapshot, Ci as markNonRetryable, Cn as S3StateBackend, Cr as resolveAutoAssetStorage, Ct as coerceParameterTypedValue, D as makeCanonicalizePropertiesFn, Dn as forceQuitRecoveryClause, Dr as resolveStateBucketWithDefaultAndSource, Dt as refStateLookupFromResource, E as unsupportedFinalSnapshotError, En as buildLockContentionMessage, Er as resolveStateBucketWithDefault, Et as parameterTypeMayLoseSecretIdentity, F as WARM_THROUGHPUT_MEMBERS, Fn as orphansAfterRollback, Fr as uploadCfnTemplate, Ft as configIntegerRefusal, G as yellow, Gn as AssetModeResolver, Gr as AwsClients, Gt as s3BucketArn, H as gray, Hn as createAssetRedirectResolver, Hr as processStackMessages, Ht as classifyReplaySecretRegion, I as coerceWarmThroughput$1, In as orphansCarriedFrom, Ir as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, It as configStringRefusal, J as exportAliasCollisionScrubWarning, Jn as ensureAssetStorage, Jr as setAwsClients, Jt as s3BucketRegionalDomainName, K as collectDeclaredOutputNames, Kn as BOOTSTRAP_MARKER_PREFIX, Kr as getAwsClients, Kt as s3BucketDomainName, L as isWarmThroughputDecrease, Ln as shouldRetainResource, Lr as expectedOwnerParam, Lt as readConfigString, M as isStatefulRecreateTargetForReplace, Mn as exportNamesCarriedFrom, Mr as CFN_TEMPLATE_URL_LIMIT, Mt as coerceCfnBoolean, N as isStatefulRecreateTargetSync, Nn as importableOutputKeys, Nr as MIGRATE_TMP_PREFIX, Nt as coerceCfnInteger, O as extractDeploymentEventError, On as formatLockExpiry, Or as resolveUseCdkBootstrapAssets, Ot as WAFv2WebACLProvider, P as renderStatefulReason, Pn as importableOutputs, Pr as findLargeInlineResources, Pt as configBooleanRefusal, Q as secretSafeKeyDisplay, Qn as readBootstrapMarkerBody, Qr as CrossAccountSecretRefusalError, Qt as INTRINSIC_KEYS, R as toFiniteNumber, Rn as AssetPublisher, Rr as PARTITION_TABLE, Rt as replayWarn, S as ccRoutedFinalSnapshotError, Si as isTransientServerError, Sn as LockManager, Sr as resolveApp, St as cfnRefValueFromPhysicalId, T as refusesFinalSnapshot, Ti as retryClassificationText, Tn as buildForceUnlockCommand, Tr as resolveSkipPrefix, Tt as isUnboundTemplateParameter, U as green, Un as loadPublishableAssetManifest, Ut as producerRegionsFromState, V as cyan, Vn as buildAssetRedirectMap, Vr as AssemblyReader, Vt as requireConfigString, W as red, Wn as rewriteTemplateAssetReferences, Wr as resolveBucketRegion, Wt as withSharedDrainBudget, X as secretBearing, Xn as isCrossRegionRedirect, Xr as CdkdError, Xt as applyRoleArnIfSet, Y as isExportAliasCollision, Yn as getBootstrapMarkerKey, Yt as s3BucketWebsiteUrl, Z as secretBearingStateKeyWarning, Zn as parseBootstrapMarker, Zt as DiffCalculator, _ as isSecretBearingReferenceString, _i as normalizeAwsError, _n as maskSecretsInText, _r as getDockerImageBySourceHash, _t as deleteSkipReason, a as DeploymentEventsStore, an as STATE_SOURCED_BASELINE_RULES, ar as describeDockerExecFailure, at as createMaskedRetryLogger, b as PRE_DELETE_SNAPSHOT_TYPES, bi as isRetryableTransientError, bn as redactSecretsForState, br as getDefaultStateBucketName, bt as IntrinsicFunctionResolver, c as replayFailedOperations, ci as ProvisioningError, cn as TEMPLATE_SOURCED_RULES, cr as formatDockerLoginError, ct as beginCommandInterruptScope, d as updatePartialReason, di as StackHasActiveImportsError, dn as dynamicReferenceTokens, dr as redactDockerArgvValues, dt as isInterruptedWaitError, ei as DeployCancelledError, en as findSilentDropProperties, er as validateContainerRepoName, et as IAMRoleProvider, f as withResourceDeadline, fi as StackTerminationProtectionError, fn as errorCauseChain, fr as runDockerForeground, ft as startInterruptWatch, g as bagHoldsSecretExpression, gn as maskSecretsInError, gr as AssetManifestLoader, gt as deleteIndeterminateGuards, h as computeImplicitDeleteEdges, hn as markSameGenerationBag, hr as stripControlChars, ht as UNSPECIFIED_SKIP_REASON, i as DeploymentEventsReader, ii as LocalStartServiceError, in as TemplateParser, ir as describeDockerCapturedOutput, it as wouldReturnToSdkProvider, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as DEFAULT_STATE_PREFIX, jr as CFN_TEMPLATE_BODY_LIMIT, jt as assertRegionMatch, k as makeSiblingClaimReader, kn as shellQuote, kr as stateBucketExistenceConfirmed, kt as normalizeAwsTagsToCfn, l as replayRollback, li as ResourceTimeoutError, ln as carriesSecretMask, lr as getDockerCmd, lt as endCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mn as isSingleDynamicReferenceToken, mr as escapeRegExp, mt as slowCcOperationTimeoutMs, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as IntrinsicResolutionRefusalError, nn as withRetry, nr as describeAwsFailure, nt as clearOnUpdateRemoval, o as planFailedOps, oi as NestedStackChildDirectDestroyError, on as STATE_SOURCED_CROSS_GENERATION_RULES, or as describeDockerFailure, ot as maskDeep, p as maskingRetryLogger, pn as identityKeyFor, pr as runDockerStreaming, pt as CloudControlProvider, q as collectPublishedOutputNames, qn as assertAssetBucketRegion, qr as resetAwsClients, qt as s3BucketDualStackDomainName, r as DeployEngine, ri as LocalInvokeBuildError$1, rn as DagBuilder, rr as buildDockerImage, rt as ProviderRegistry, s as planRollback, si as PartialFailureError, sn as STATE_SOURCED_READBACK_RULES, sr as dockerSpawnEnvWithSensitive, st as maskerOrIdentity, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as DynamicReferenceRegionAmbiguousError, tn as describeTypeWithThrottleRetry, tr as buildDenyExternalAccessPolicy, tt as collectInlinePolicyNamesManagedBySiblings, u as updatePartialMessage, ui as ResourceUpdateNotSupportedError, un as createSecretMasker, ur as partitionSensitiveEnv, ut as interruptWatchListenerCount, v as bindingSkippedOutputs, vi as withErrorHandling, vn as recordMaskOnlyValue, vr as Synthesizer, vt as disableInstanceApiTermination, w as isFinalSnapshotError, wi as markRedactedCause, wn as rebuildClientForBucketRegion, wr as resolveCaptureObservedState, wt as getAccountInfo, x as buildFinalSnapshotIdentifier, xi as isThrottlingError, xn as scrubResourceRecord, xr as getLegacyStateBucketName, xt as carriesDynamicReference, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as isMarkedNonRetryable, yn as recoverMaskedOutput, yr as synthesisStatusMessage, yt as isTerminationProtectionPropagationError, z as formatResourceLine, zn as stringifyValue, zr as canonicalizeRegion, zt as requireConfigArray } from "./deploy-engine-aYUEGRRl.js";
-import { _ as withSkipPrefix, b as displaySafe, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as truncateCodePoints, y as UNRENDERABLE } from "./logger-DTEUzYP_.js";
+import { $ as secretSafeKeyDisplay, $n as parseBootstrapMarker, $t as DiffCalculator, A as planOrphanAdoption, An as formatLockExpiry, Ar as resolveUseCdkBootstrapAssets, At as WAFv2WebACLProvider, B as formatResourceLine, Bn as AssetPublisher, Br as PARTITION_TABLE, Bt as replayWarn, C as createPreDeleteFinalSnapshot, Ci as isThrottlingError, Cn as scrubResourceRecord, Cr as getLegacyStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as retryClassificationText, Dn as buildForceUnlockCommand, Dr as resolveSkipPrefix, Dt as parameterTypeMayLoseSecretIdentity, E as unsupportedFinalSnapshotError, Ei as markRedactedCause, En as rebuildClientForBucketRegion, Er as resolveCaptureObservedState, Et as isUnboundTemplateParameter, F as WARM_THROUGHPUT_MEMBERS, Fn as importableOutputKeys, Fr as MIGRATE_TMP_PREFIX, Ft as coerceCfnInteger, G as red, Gn as loadPublishableAssetManifest, Gt as producerRegionsFromState, H as cyan, Hn as WorkGraph, Hr as derivePartitionAndUrlSuffix, Ht as requireConfigObject, I as coerceWarmThroughput$1, In as importableOutputs, Ir as findLargeInlineResources, It as configBooleanRefusal, J as collectPublishedOutputNames, Jn as BOOTSTRAP_MARKER_PREFIX, Jr as getAwsClients, Jt as s3BucketDomainName, K as yellow, Kn as rewriteTemplateAssetReferences, Kr as resolveBucketRegion, Kt as withSharedDrainBudget, L as isWarmThroughputDecrease, Ln as orphansAfterRollback, Lr as uploadCfnTemplate, Lt as configIntegerRefusal, M as isStatefulRecreateTargetForReplace, Mn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Mr as warnDeprecatedNoPrefixCliFlag, Mt as resolveExplicitPhysicalId, N as isStatefulRecreateTargetSync, Nn as DEFAULT_STATE_PREFIX, Nr as CFN_TEMPLATE_BODY_LIMIT, Nt as assertRegionMatch, O as extractDeploymentEventError, On as buildLockContentionMessage, Or as resolveStateBucketWithDefault, Ot as refStateLookupFromResource, P as renderStatefulReason, Pn as exportNamesCarriedFrom, Pr as CFN_TEMPLATE_URL_LIMIT, Pt as coerceCfnBoolean, Q as secretBearingStateKeyWarning, Qn as isCrossRegionRedirect, Qr as CdkdError, Qt as applyRoleArnIfSet, R as toCfnInteger, Rn as orphansCarriedFrom, Rr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Rt as configStringRefusal, S as ccRoutedFinalSnapshotError, Si as isRetryableTransientError, Sn as redactSecretsForState, Sr as getDefaultStateBucketName, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as markNonRetryable, Tn as S3StateBackend, Tr as resolveAutoAssetStorage, Tt as getAccountInfo, U as gray, Un as buildAssetRedirectMap, Ur as AssemblyReader, Ut as requireConfigString, V as bold, Vn as stringifyValue, Vr as canonicalizeRegion, Vt as requireConfigArray, W as green, Wn as createAssetRedirectResolver, Wr as processStackMessages, Wt as classifyReplaySecretRegion, X as isExportAliasCollision, Xn as ensureAssetStorage, Xr as setAwsClients, Xt as s3BucketRegionalDomainName, Y as exportAliasCollisionScrubWarning, Yn as assertAssetBucketRegion, Yr as resetAwsClients, Yt as s3BucketDualStackDomainName, Z as secretBearing, Zn as getBootstrapMarkerKey, Zt as s3BucketWebsiteUrl, _ as isSecretBearingReferenceString, _n as markSameGenerationBag, _r as stripControlChars, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as LocalInvokeBuildError$1, an as DagBuilder, ar as buildDockerImage, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as withErrorHandling, bn as recordMaskOnlyValue, br as Synthesizer, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, ci as NestedStackChildDirectDestroyError, cn as STATE_SOURCED_CROSS_GENERATION_RULES, cr as describeDockerFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ResourceTimeoutError, dn as carriesSecretMask, dr as getDockerCmd, dt as interruptWatchListenerCount, ei as CrossAccountSecretRefusalError, en as INTRINSIC_KEYS, er as readBootstrapMarkerBody, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceUpdateNotSupportedError, fn as createSecretMasker, fr as partitionSensitiveEnv, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as isSingleDynamicReferenceToken, gr as escapeRegExp, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hn as identityKeyFor, hr as runDockerStreaming, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as IntrinsicResolutionRefusalError, in as withRetry, ir as describeAwsFailure, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as shellQuote, jr as stateBucketExistenceConfirmed, jt as normalizeAwsTagsToCfn, k as makeSiblingClaimReader, kn as forceQuitRecoveryClause, kr as resolveStateBucketWithDefaultAndSource, kt as isSettledInstanceState, l as replayRollback, li as PartialFailureError, ln as STATE_SOURCED_READBACK_RULES, lr as dockerSpawnEnvWithSensitive, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackTerminationProtectionError, mn as errorCauseChain, mr as runDockerForeground, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as DeployCancelledError, nn as findSilentDropProperties, nr as validateContainerRepoName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalStartServiceError, on as TemplateParser, or as describeDockerCapturedOutput, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as StackHasActiveImportsError, pn as dynamicReferenceTokens, pr as redactDockerArgvValues, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as AssetModeResolver, qr as AwsClients, qt as s3BucketArn, r as DeployEngine, ri as DynamicReferenceRegionAmbiguousError, rn as describeTypeWithThrottleRetry, rr as buildDenyExternalAccessPolicy, rt as clearOnUpdateRemoval, s as planRollback, sn as STATE_SOURCED_BASELINE_RULES, sr as describeDockerExecFailure, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as findActionableSilentDrops, tr as validateAssetBucketName, tt as IAMRoleProvider, u as updatePartialMessage, ui as ProvisioningError, un as TEMPLATE_SOURCED_RULES, ur as formatDockerLoginError, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as maskSecretsInError, vr as AssetManifestLoader, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isTransientServerError, wn as LockManager, wr as resolveApp, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as isMarkedNonRetryable, xn as recoverMaskedOutput, xr as synthesisStatusMessage, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yi as normalizeAwsError, yn as maskSecretsInText, yr as getDockerImageBySourceHash, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as shouldRetainResource, zr as expectedOwnerParam, zt as readConfigString } from "./deploy-engine-0Wg4MwP2.js";
+import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-DTli1mA9.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-e05iqtU_.js";
+import { t as getCdkdVersion } from "./version-BTao4oxo.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-RLnpBIKj.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -26,9 +26,9 @@ import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateCacheClus
 import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$7, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ListTagsCommand as ListTagsCommand$1, ResourceNotFoundException as ResourceNotFoundException$8, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
-import { basename, dirname, isAbsolute, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, HostedZoneAlreadyExists, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
@@ -246,7 +246,7 @@ function parseContextOptions(contextArgs) {
 const commonOptions = [
 	new Option("--verbose", "Enable verbose logging").default(false),
 	new Option("--profile <profile>", "AWS profile"),
-	new Option("--role-arn <arn>", "IAM role ARN to assume for AWS API calls (env: CDKD_ROLE_ARN); the role MUST have admin-equivalent permissions because cdkd issues raw service API calls and does not route through CloudFormation, so CDK CLI deploy-roles will NOT work"),
+	new Option("--role-arn <arn>", "IAM role ARN to assume for AWS API calls (env: CDKD_ROLE_ARN); the role needs the actions for the resource types you deploy plus the bookkeeping actions cdkd itself issues, because cdkd makes raw service API calls and does not route through CloudFormation, so CDK CLI deploy-roles will NOT work. Do not combine with --profile: the SDK then ignores the assumed role"),
 	new Option("-y, --yes", "Automatically answer interactive prompts with the recommended response (e.g. confirm destroy)").default(false)
 ];
 /**
@@ -23208,7 +23208,43 @@ function deepEqual$1(a, b) {
 //#endregion
 //#region src/provisioning/providers/logs-loggroup-provider.ts
 /**
-* Refuse a `RetentionInDays` the send path cannot USE (issue [#2521]).
+* Whether a raw `RetentionInDays` is CloudFormation's spelling of "no
+* retention" — the shapes the send path SKIPS on create and routes to
+* `DeleteRetentionPolicy` on update, rather than refusing.
+*
+* MEASURED, not read off the docs (issue
+* [#2699](https://github.com/go-to-k/cdkd/issues/2699), live CloudFormation
+* A/B on `AWS::Logs::LogGroup`, us-east-1, 2026-09-14; the full table is on
+* `toCfnInteger` in `../dynamodb-warm-throughput.ts`): an ABSENT property, an
+* EMPTY string and a WHITESPACE-ONLY string are all accepted by CloudFormation
+* and all REMOVE the live retention policy. Nothing else in the falsy family
+* is: `false`, `0`, `"0"` and `null` are every one REJECTED (the first three by
+* the Logs handler, `null` at `update-stack` itself), so routing them here
+* would make cdkd delete a live retention on a template CloudFormation refuses
+* to deploy. They go to {@link assertUsableRetention}.
+*
+* The ONE cdkd-side exception is a numeric `0` when `desiredFromAwsReadback`
+* is set. `0` is what {@link LogsLogGroupProvider.readCurrentState} records for
+* a log group with no retention policy — cdkd's OWN never-expire spelling,
+* persisted into `observedProperties` at every deploy — and `cdkd drift
+* --revert` hands `update()` that baseline as the DESIRED bag. Reverting a
+* console-added retention on a never-expiring log group is therefore desired
+* `0` over live `30`, and it must reach the delete arm; refusing it would leave
+* `--revert` unable to undo exactly the drift it reports. `UpdateContext`'s
+* own contract licenses this reading and nothing wider: the flag says every
+* value in the bag describes what AWS held, so `0` there is a report of "no
+* retention", not a template's request. On the template path `0` stays
+* refused, matching CloudFormation. `"0"` is never cdkd-produced (the readback
+* writes a number) and is refused everywhere.
+*/
+function isAbsentRetention(raw, desiredFromAwsReadback) {
+	if (raw === void 0) return true;
+	if (typeof raw === "string" && raw.trim() === "") return true;
+	return desiredFromAwsReadback && raw === 0;
+}
+/**
+* Refuse a `RetentionInDays` the send path cannot USE (issues [#2521],
+* [#2698], [#2699]).
 *
 * **The scope of this refusal is a TEST, not a paragraph.** Every review round
 * on issue [#2521] found a hole in a PROSE statement of it — a coercible
@@ -23225,56 +23261,72 @@ function deepEqual$1(a, b) {
 * not cover; do not restate the rule here, because a fourth restatement is
 * the thing that keeps being wrong.
 *
-* THREE refusal CASES across TWO `throw` statements — the non-finite guard
-* clause at the top of the body has its own, and the other two share the
-* second, differing only in the `detail` clause. Only the WHY of each:
-*
-*  - **a non-finite NUMBER** (`NaN`, `Infinity`, `-Infinity`). It sits ahead
-*    of the falsy return because `NaN` is FALSY: without it that value exits
-*    early, fails the `> 0` send test and reaches `DeleteRetentionPolicy`,
-*    while its two siblings — truthy — were already refused. Leaving one
-*    member of a family out is the inconsistency the negative arm below
-*    introduced, so the arm names the family.
-*  - **not a number at all** (`'  '`, `'abc'`, `[]`, `{}`, `true`). The
-*    pre-coercion code tested `if (properties['RetentionInDays'])` and handed
-*    the raw value to `PutRetentionPolicyCommand`, so CloudWatch Logs rejected
-*    it. Refusing moves that rejection one layer earlier and names the
-*    property.
+* What IS stated here is the RULE the rows pin, because since issues #2698 /
+* #2699 it is a measurement rather than a guess: the value is read through
+* `toCfnInteger` — CloudFormation's own Integer grammar, `optional sign +
+* decimal digits`, surrounding whitespace trimmed — and anything that grammar
+* rejects is refused here where CloudFormation would have refused it at
+* deploy time. The pre-#2698 reader was `Number()`, which FORWARDED `'0x1e'`
+* as 30 and `'30.5'` as 30.5 on a template CloudFormation rejects outright.
+* Five refusal ARMS, each with its own `detail` clause; only the WHY of each:
+*
+*  - **a non-finite NUMBER** (`NaN`, `Infinity`, `-Infinity`). Unreachable in
+*    production — both bags are `JSON.parse` output, which cannot express one —
+*    and kept as defence so the family is named whole. Sits BEFORE the null /
+*    type arms because `NaN` is a number whose siblings were already refused.
+*  - **`null`**. CloudFormation rejects it at `update-stack` (`'null' values
+*    are not allowed in templates`), and cdkd's own resolver never
+*    manufactures one for this key: an `AWS::NoValue` — bare or as an `Fn::If`
+*    branch — OMITS the property (`intrinsic-function-resolver.ts`,
+*    `resolveValue`'s object arm), so `null` arriving here is a literal the
+*    template wrote, not cdkd's spelling of absent. Issue #2521 left it in the
+*    delete arm on the guess that it was; the measurement settled it.
+*  - **not a CloudFormation Integer at all** (`'abc'`, `'0x1e'`, `'1e3'`,
+*    `'30.5'`, `[]`, `{}`, `true`, `false`). The pre-coercion code handed the
+*    raw value to `PutRetentionPolicyCommand` and CloudWatch Logs rejected it;
+*    refusing moves that rejection one layer earlier and names the property.
+*    `false` joined this arm with #2699 — it was in the delete arm before, on
+*    the same guess as `null`.
+*  - **ZERO** (`0`, `'0'`). The Logs handler rejects it by enum (`Valid values
+*    are: [1, 3, 5, ...]`), so it is not CloudFormation's never-expire — the
+*    ABSENT property or an empty string is. Numeric `0` under
+*    `desiredFromAwsReadback` never reaches this arm; see
+*    {@link isAbsentRetention} for why that one is cdkd's own spelling.
 *  - **a NEGATIVE number** (`-1`, `'-1'`). It coerces, so a refusal gated on
 *    coercibility alone let it through; it then failed the `> 0` send test and
 *    fell into the UPDATE path's `else`, which issues
 *    `DeleteRetentionPolicy` — a template typo SILENTLY REMOVING a live
 *    retention where the old code sent `-1` and failed loudly.
 *
-* The FALSY values pass through, as they did before — `0`, `''`, `false`,
-* `null` and absent; `NaN` is the one exception, refused above because it is a
-* malformed number rather than a spelling of "no retention".
-*
-* `'0'` is TRUTHY, so it reaches this function and passes too: zero is
-* what {@link LogsLogGroupProvider.readCurrentState} records for a group with
-* no retention policy, and CloudFormation coerces `'0'` to `0`, so routing the
-* string to the same arm as the number is the consistency the coercion is for.
-* On the UPDATE path against a live positive retention that is a real change —
-* it DELETES where the old code sent and was rejected — and `UPDATE_MATRIX`
-* pins it.
-*
 * The message names the value's TYPE and never the value. A provider's
 * `properties` bag arrives with dynamic references already RESOLVED, so a
 * `{{resolve:secretsmanager:...}}` scalar is PLAINTEXT by the time it reaches
-* here, and this function has no masker to thread — `create()` takes no
-* `CreateContext` and `applyUpdate` no `UpdateContext`
+* here, and this function has no masker threaded
 * (`.claude/rules/provider-masking.md`). Interpolating it as
 * `${JSON.stringify(raw)}` was the first draft and
 * `vp run audit:provider-secret-mask:check` refused it — but read that as one
 * SPELLING being fenced, not the rule: the critic's population is
 * interpolated `JSON.stringify` calls, so a bare `${raw}` here would leave it
 * green. Do not put the value back without threading the capability first.
+*
+* The caller decides the ABSENT family FIRST, through {@link isAbsentRetention},
+* and never calls this for one: an absent value is not an error, and the
+* readback-only reading of `0` lives in that predicate rather than here, so
+* the zero arm below can stay unconditional.
 */
 function assertUsableRetention(raw, coerced, logicalId, resourceType) {
-	if (typeof raw === "number" && !Number.isFinite(raw)) throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); the template declares a non-finite number`, resourceType, logicalId);
-	if (!raw) return;
-	if (coerced !== void 0 && coerced >= 0) return;
-	throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a non-negative number or a numeric string (CloudFormation coerces '30' to 30); ${coerced === void 0 ? `the template's value is of type ${Array.isArray(raw) ? "array" : typeof raw} and does not parse as a finite number` : "the template declares a negative number"}`, resourceType, logicalId);
+	const detail = (() => {
+		if (typeof raw === "number" && !Number.isFinite(raw)) return "the template declares a non-finite number";
+		if (raw === null) return "the template declares null, which CloudFormation rejects ('null' values are not allowed in templates); to declare no retention, omit the property";
+		if (coerced === void 0) {
+			if (typeof raw === "string") return "the template declares a string that is not a CloudFormation Integer (hex, exponent and decimal-point spellings are rejected, as they are by CloudFormation)";
+			return `the template's value is of type ${Array.isArray(raw) ? "array" : typeof raw}`;
+		}
+		if (coerced === 0) return "the template declares zero, which CloudWatch Logs rejects; to declare no retention, omit the property or declare an empty string";
+		if (coerced < 0) return "the template declares a negative number";
+	})();
+	if (detail === void 0) return;
+	throw new ProvisioningError(`${logicalId} (${resourceType}): RetentionInDays must be a positive CloudFormation Integer (optional sign then decimal digits, as a number or a string — 30 or '30'); ${detail}`, resourceType, logicalId);
 }
 /**
 * AWS CloudWatch Logs LogGroup Provider
@@ -23333,7 +23385,7 @@ var LogsLogGroupProvider = class {
 	/**
 	* Create a CloudWatch Logs log group
 	*/
-	async create(logicalId, resourceType, properties) {
+	async create(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating log group ${logicalId}`);
 		const logGroupName = properties["LogGroupName"] || `/cdkd/${generateResourceName(logicalId, {
 			maxLength: 506,
@@ -23358,8 +23410,17 @@ var LogsLogGroupProvider = class {
 			}
 			try {
 				const rawRetention = properties["RetentionInDays"];
-				const retentionInDays = toFiniteNumber(rawRetention);
-				assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+				let retentionInDays = toCfnInteger(rawRetention);
+				if (!isAbsentRetention(rawRetention, false)) try {
+					assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+				} catch (refusal) {
+					if (context?.replayingState !== true || !(refusal instanceof ProvisioningError)) throw refusal;
+					const legacyReading = toFiniteNumber(rawRetention);
+					if (legacyReading !== void 0 && Number.isInteger(legacyReading) && legacyReading > 0) {
+						retentionInDays = legacyReading;
+						this.logger.warn(`${refusal.message}. This create replays a cdkd state record (rollback) written by a cdkd that read the value as ${legacyReading} and applied it, so the retention is RESTORED as ${legacyReading} days rather than refused. Fix the template spelling and re-deploy.`);
+					} else this.logger.warn(`${refusal.message}. This create replays a cdkd state record (rollback), so the retention is SKIPPED rather than refused: the log group is re-created with no retention policy. Re-apply it by hand (aws logs put-retention-policy) or fix the template and re-deploy.`);
+				}
 				if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 					logGroupName,
 					retentionInDays
@@ -23390,7 +23451,12 @@ var LogsLogGroupProvider = class {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
 					this.logger.debug(`Cleaned up partially-created log group ${logicalId} (${logGroupName}) after wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. Manual deletion may be required before the next deploy: aws logs delete-log-group --log-group-name '${logGroupName}'`);
+					const deleteCommand = renderDisableCommand({
+						before: "aws logs delete-log-group --log-group-name",
+						identifier: logGroupName
+					});
+					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
+					this.logger.warn(`Failed to clean up partially-created log group ${logicalId} (${logGroupName}): ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}. ${manualStep}`);
 				}
 				throw innerError;
 			}
@@ -23428,32 +23494,40 @@ var LogsLogGroupProvider = class {
 	* fall back to replacement, so swallowing it into a ProvisioningError would
 	* turn a recoverable class change into a hard failure.
 	*/
-	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		try {
-			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties);
+			return await this.applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context);
 		} catch (error) {
 			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update log group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties) {
+	async applyUpdate(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating log group ${logicalId}: ${physicalId}`);
 		const normalizeClass = (v) => typeof v === "string" && v.length > 0 ? v : "STANDARD";
 		const prevClass = normalizeClass(previousProperties["LogGroupClass"]);
 		const nextClass = normalizeClass(properties["LogGroupClass"]);
 		if (prevClass !== nextClass) {
 			const replaceFlags = "--replace --force-stateful-recreation";
-			const remedy = isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]) ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. Then disable deletion protection — \`aws logs put-log-group-deletion-protection --log-group-identifier '${physicalId}' --no-deletion-protection-enabled\`, or via the console — and re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
+			const deletionProtected = isTruthyCfnBoolean(previousProperties["DeletionProtectionEnabled"]);
+			const disableCommand = renderDisableCommand({
+				before: "aws logs put-log-group-deletion-protection --log-group-identifier",
+				identifier: physicalId,
+				after: "--no-deletion-protection-enabled"
+			});
+			const disableStep = disableCommand ? `Then disable deletion protection — \`${disableCommand}\`, or via the console — and re-deploy with ${replaceFlags}` : `${UNNAMEABLE_ID_CLAUSE} Then re-deploy with ${replaceFlags}`;
+			const remedy = deletionProtected ? `cdkd's recorded properties for this log group carry DeletionProtectionEnabled, so ${replaceFlags} alone will NOT succeed while AWS still has it on: the replacement normally deletes the log group, AWS refuses that delete while protection is on, and cdkd deploy has no --remove-protection flag to clear it (only cdkd destroy and cdkd state destroy act on one). Read "Deletion protection blocks a replacement" in docs/cli-deploy-safety.md BEFORE you disable anything: whether disabling helps at all, and what the flag ends up as, depend on your UpdateReplacePolicy and on whether the deploy completes — neither of which this refusal can see. ${disableStep} to delete + recreate the log group under the new class (its stored log events are lost). Setting DeletionProtectionEnabled: false in the template does NOT clear it in the same deploy: this refusal fires before that property is applied, so that route needs its own deploy with the LogGroupClass change reverted. Or revert the LogGroupClass change and keep the current class.` : `Re-deploy with ${replaceFlags} to delete + recreate the log group under the new class (its stored log events are lost), or revert the LogGroupClass change.`;
 			throw new ResourceUpdateNotSupportedError("AWS::Logs::LogGroup", logicalId, `the LogGroupClass ('${prevClass}' -> '${nextClass}') cannot be changed after creation. ${remedy} Note --force-stateful-recreation has NO per-resource granularity: it clears the data guard for every replacement target in the run`);
 		}
 		const rawRetention = properties["RetentionInDays"];
 		const rawPreviousRetention = previousProperties["RetentionInDays"];
 		const renderedRetention = JSON.stringify(rawRetention);
 		const sameRawRetention = Object.is(rawRetention, rawPreviousRetention) || renderedRetention !== void 0 && renderedRetention !== "null" && renderedRetention === JSON.stringify(rawPreviousRetention);
-		const retentionInDays = toFiniteNumber(rawRetention);
-		const oldRetentionInDays = toFiniteNumber(rawPreviousRetention);
-		if (!sameRawRetention) assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
+		const retentionInDays = toCfnInteger(rawRetention);
+		const oldRetentionInDays = toCfnInteger(rawPreviousRetention);
+		const desiredFromAwsReadback = context?.desiredFromAwsReadback === true;
+		if (!sameRawRetention && !isAbsentRetention(rawRetention, desiredFromAwsReadback)) assertUsableRetention(rawRetention, retentionInDays, logicalId, resourceType);
 		const newKmsKeyId = properties["KmsKeyId"];
 		if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
 			if (newKmsKeyId) await this.logsClient.send(new AssociateKmsKeyCommand({
@@ -23463,7 +23537,8 @@ var LogsLogGroupProvider = class {
 			else await this.logsClient.send(new DisassociateKmsKeyCommand({ logGroupName: physicalId }));
 			this.logger.debug(`Updated KMS key association for log group ${physicalId}`);
 		}
-		if (retentionInDays !== oldRetentionInDays || !sameRawRetention && Boolean(rawPreviousRetention) && oldRetentionInDays === void 0) {
+		const previousRetentionUnknown = !sameRawRetention && Boolean(rawPreviousRetention) && !isAbsentRetention(rawPreviousRetention, false) && oldRetentionInDays === void 0;
+		if (retentionInDays !== oldRetentionInDays || previousRetentionUnknown) {
 			if (retentionInDays !== void 0 && retentionInDays > 0) await this.logsClient.send(new PutRetentionPolicyCommand({
 				logGroupName: physicalId,
 				retentionInDays
@@ -26663,17 +26738,18 @@ function canonicalizeSgInlineRuleProtocols(properties) {
 * `definedAttributes` then drops the `undefined` members; it keeps `''`, so the
 * pending-window normalization has to happen HERE, where the state is known.
 *
-* The residual that follows from the pending rule: a `--no-wait` create of an
-* instance in a PRIVATE subnet omits the public pair, and nothing later writes
-* it -- a no-change deploy's auto-refresh touches `observedProperties`, never
-* `attributes` -- so `Fn::GetAtt [.., PublicIp]` takes the resolver's live arm,
-* finds no address, and degrades to the instance id with a warning until the
-* next `update()` of that instance records the known-empty pair. Tracked on
-* go-to-k/cdkd#3096.
+* What follows from the pending rule: a `--no-wait` create of an instance in
+* a PRIVATE subnet omits the public pair, and nothing later writes it -- a
+* no-change deploy's auto-refresh touches `observedProperties`, never
+* `attributes` -- so `Fn::GetAtt [.., PublicIp]` takes the resolver's live arm
+* on every resolution. That arm applies THIS SAME three-state rule at read
+* time (issue #3096): a settled instance's missing public member resolves to
+* the known `''`, while a still-`pending` one is REFUSED rather than degraded
+* to the instance id, and nothing is cached so the next deploy re-reads.
 */
 function describedInstanceAttributes(instanceId, instance) {
 	const stateName = instance?.State?.Name;
-	const settled = stateName !== void 0 && stateName !== "pending";
+	const settled = isSettledInstanceState(stateName);
 	const publicMember = (value) => settled ? value ?? "" : value || void 0;
 	return definedAttributes({
 		InstanceId: instanceId,
@@ -70465,7 +70541,7 @@ async function resolveStateSecretExpressions(props, resolvers, secrets, options)
 			return out;
 		}
 		if (v !== null && typeof v === "object") {
-			const out = {};
+			const out = Object.create(null);
 			for (const [k, val] of Object.entries(v)) out[k] = await walk(val, path === "" ? k : `${path}.${k}`);
 			return out;
 		}
@@ -70863,29 +70939,74 @@ function buildReadCurrentStateContext(state, excludedLogicalId) {
 * The read counterpart of {@link setAtPath}, and it parses the same subset:
 * the drift comparator only synthesizes paths through plain objects.
 */
+/**
+* Read a dotted path out of a bag, OWN keys only.
+*
+* Own keys, because the bag is `JSON.parse`d state, whose one exotic key is an
+* OWN `__proto__` (issue #2899's class): on a plain object a bare
+* `cursor['__proto__']` read for a segment the bag does NOT own answers with
+* `Object.prototype` — an inherited value that the `--accept` post-write check
+* below would then compare against the accepted one. `undefined` is the answer
+* "the bag has nothing here", which is what an absent segment means.
+*
+* Exported, like `setAtPath`, as a test seam only: a `__proto__` path cannot
+* reach either through the command today (the comparison chain's normalisers
+* drop the key on both sides — issue #3121), so the own-key rule is pinned on
+* the helpers directly.
+*/
 function getAtPath(source, path) {
 	if (path.length === 0) return source;
 	let cursor = source;
 	for (const segment of path.split(".")) {
 		if (cursor === null || typeof cursor !== "object" || Array.isArray(cursor)) return void 0;
+		if (!hasOwnKey(cursor, segment)) return void 0;
 		cursor = cursor[segment];
 	}
 	return cursor;
 }
+/**
+* Write a dotted path into a bag as OWN keys.
+*
+* `Object.defineProperty` rather than assignment, and a null-prototype
+* intermediate node (issue #2899's class): the target is `JSON.parse`d state
+* cloned by `runAccept`, a plain object, and a drifted top-level key literally
+* named `__proto__` (which `JSON.parse` yields as an ordinary own key and the
+* comparator enumerates like any other) would be ASSIGNED as the prototype —
+* the accepted value silently dropped from the baseline while the summary
+* counts it recorded. Defining it makes it the own data property the record
+* round-trips through `JSON.stringify`.
+*/
 function setAtPath(target, path, value) {
 	if (path.length === 0) return;
 	const segments = path.split(".");
 	let cursor = target;
 	for (let i = 0; i < segments.length - 1; i++) {
 		const key = segments[i];
-		const next = cursor[key];
+		const next = ownValue(cursor, key);
 		if (next === void 0 || next === null || typeof next !== "object" || Array.isArray(next)) {
-			const fresh = {};
-			cursor[key] = fresh;
+			const fresh = Object.create(null);
+			defineOwnKey(cursor, key, fresh);
 			cursor = fresh;
 		} else cursor = next;
 	}
-	cursor[segments[segments.length - 1]] = value;
+	defineOwnKey(cursor, segments[segments.length - 1], value);
+}
+/** Own-key membership: `in` reads the prototype chain, which a `JSON.parse`d bag never means. */
+function hasOwnKey(target, key) {
+	return Object.prototype.hasOwnProperty.call(target, key);
+}
+/** An own-key read: `undefined` for an inherited name (`__proto__`, `constructor`, ...). */
+function ownValue(target, key) {
+	return hasOwnKey(target, key) ? target[key] : void 0;
+}
+/** An ordinary (writable, enumerable, configurable) own data property — never the prototype. */
+function defineOwnKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		writable: true,
+		enumerable: true,
+		configurable: true
+	});
 }
 /**
 * `--accept`: state ← AWS.
@@ -70956,14 +71077,14 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 					setAtPath(newBaseline, change.path, change.awsValue);
 					accepted.push(change);
 				}
-				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, STATE_SOURCED_READBACK_RULES);
+				const redactedBaseline = redactSecretsForState(newBaseline, outcome.secrets, existing.properties ?? {}, hasObserved ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES);
 				let recordedChanges = 0;
 				for (const change of accepted) {
 					if (deepEqualUnordered(getAtPath(redactedBaseline, change.path), change.awsValue)) {
 						recordedChanges++;
 						continue;
 					}
-					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — cdkd state holds an unresolved '{{resolve:...}}' reference at that property, and the reference wins over an accepted value. Change the template if that reference is wrong.`);
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): '${change.path}' was NOT recorded — after redaction cdkd state holds a different value at that property. Usually an unresolved '{{resolve:...}}' reference sits there and wins over an accepted value (change the template if that reference is wrong); a readback value cdkd cannot compare is never called recorded.`);
 				}
 				if (recordedChanges > 0) acceptedResourceCount++;
 				resources[outcome.logicalId] = hasObserved ? {
@@ -71104,10 +71225,10 @@ function findRevertPreservedTagKeys(drifts, desiredProperties, awsProperties) {
 		if (topLevelKey) driftedTopLevelKeys.add(topLevelKey);
 	}
 	for (const key of driftedTopLevelKeys) {
-		if (!(key in desiredProperties)) continue;
+		if (!hasOwnKey(desiredProperties, key)) continue;
 		if (!isTagListKey(key)) continue;
 		const desiredValue = desiredProperties[key];
-		const awsValue = awsProperties[key];
+		const awsValue = ownValue(awsProperties, key);
 		if (!(isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0) || !isCfnTagList(awsValue)) continue;
 		const baselineKeys = new Set(tagKeys(desiredValue));
 		for (const tagKey of tagKeys(awsValue)) if (!baselineKeys.has(tagKey) && isServiceManagedTagKey(tagKey)) preserved.add(`${key}.${tagKey}`);
@@ -71163,8 +71284,8 @@ function findRevertUnbaselinedAwsKeys(drifts, desiredProperties, awsProperties)
 		if (topLevelKey) driftedTopLevelKeys.add(topLevelKey);
 	}
 	for (const key of driftedTopLevelKeys) {
-		if (!(key in desiredProperties)) continue;
-		collectMissingPaths(awsProperties[key], desiredProperties[key], key, missing, isTagListKey(key) ? isServiceManagedTagKey : void 0);
+		if (!hasOwnKey(desiredProperties, key)) continue;
+		collectMissingPaths(ownValue(awsProperties, key), desiredProperties[key], key, missing, isTagListKey(key) ? isServiceManagedTagKey : void 0);
 	}
 	return [...missing].sort();
 }
@@ -71220,7 +71341,7 @@ function collectMissingPaths(awsValue, desiredValue, path, out, isPreservedKey)
 	}
 	for (const [key, value] of Object.entries(awsValue)) {
 		const childPath = `${path}.${key}`;
-		if (!(key in desiredValue)) {
+		if (!hasOwnKey(desiredValue, key)) {
 			out.add(childPath);
 			continue;
 		}
@@ -71345,8 +71466,8 @@ function mergeUntemplatedValue(awsValue, desiredValue) {
 	if (!isPlainRecord(awsValue) || !isPlainRecord(desiredValue)) return desiredValue;
 	if (!hasPlainPrototype(awsValue) || !hasPlainPrototype(desiredValue)) return desiredValue;
 	const merged = Object.create(null);
-	for (const [key, value] of Object.entries(awsValue)) merged[key] = key in desiredValue ? mergeUntemplatedValue(value, desiredValue[key]) : value;
-	for (const [key, value] of Object.entries(desiredValue)) if (!(key in awsValue)) merged[key] = value;
+	for (const [key, value] of Object.entries(awsValue)) merged[key] = hasOwnKey(desiredValue, key) ? mergeUntemplatedValue(value, desiredValue[key]) : value;
+	for (const [key, value] of Object.entries(desiredValue)) if (!hasOwnKey(awsValue, key)) merged[key] = value;
 	return merged;
 }
 /**
@@ -71404,7 +71525,7 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 		if (typeof value === "string" && value.includes("{{resolve:")) {
 			if (!isSingleDynamicReferenceToken(value)) return value;
 			if (live === void 0) return value;
-			return live;
+			return typeof live === "string" ? live : value;
 		}
 		if (Array.isArray(value)) {
 			const liveItems = pairedLiveItems(value, live, isTokenOrMaskLeaf, carriesTokenOrMask, true);
@@ -71414,7 +71535,7 @@ function preserveLiveValuesAtUnresolvedTokens(send, awsProperties) {
 			if (!hasPlainPrototype(value)) return value;
 			const liveObject = isPlainRecord(live) ? live : void 0;
 			const out = Object.create(null);
-			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject?.[k]);
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, liveObject === void 0 ? void 0 : ownValue(liveObject, k));
 			return out;
 		}
 		return value;
@@ -71649,7 +71770,7 @@ function pairedLiveItems(send, live, wildcardLeaf = isMaskLeaf, carriesWildcard
 		for (const item of live) byIdentity.set(item[key], item);
 		return send.map((item) => {
 			const identity = item[key];
-			return wildcardLeaf(identity) ? void 0 : byIdentity.get(identity);
+			return isTokenOrMaskLeaf(identity) ? void 0 : byIdentity.get(identity);
 		});
 	}
 	if (live.length !== send.length) return void 0;
@@ -71843,12 +71964,13 @@ function corroboratedLeafCount(send, live, wildcardLeaf = isMaskLeaf) {
 * masked VALUES the walk writes still come from `send` — only the evidence
 * source changes. Defaults to `send` (self-corroboration, the pre-round-4
 * behaviour) for a caller with no sibling pass; a structural mismatch between
-* the two bags — which the token pass CAN produce, by returning the live
-* CONTAINER AWS holds over a whole-token string leaf — refuses the masks
-* beneath it rather than falling back to the fabricable bag. That refusal is
-* a deliberate fail-closed cost, not a reachable loss: the mismatching
-* subtree is live-derived and carries no mask, so nothing preservable is
-* refused today.
+* the two bags refuses the masks beneath it rather than falling back to the
+* fabricable bag. Until issue #2920 the token pass COULD produce one, by
+* returning the live CONTAINER AWS holds over a whole-token string leaf; it
+* now copies only a string, so no sibling pass produces the mismatch today.
+* The refusal is KEPT as a deliberate fail-closed cost rather than retired on
+* that reachability argument: a bag that disagrees with its evidence source is
+* exactly where falling back would hand the fabricable bag back.
 *
 * Returns the input bag BY IDENTITY when it holds no mask — checked FIRST via
 * {@link carriesSecretMask}, so a mask-free revert (the ordinary case) pays
@@ -71884,7 +72006,7 @@ function preserveLiveValuesAtMaskedLeaves(send, awsProperties, secrets, corrobor
 			const liveObject = isPlainRecord(live) ? live : void 0;
 			const corrObject = isPlainRecord(corr) ? corr : void 0;
 			const out = Object.create(null);
-			for (const [k, v] of Object.entries(value)) out[k] = walk(v, corrObject?.[k], liveObject?.[k], path === "" ? k : `${path}.${k}`);
+			for (const [k, v] of Object.entries(value)) out[k] = walk(v, corrObject === void 0 ? void 0 : ownValue(corrObject, k), liveObject === void 0 ? void 0 : ownValue(liveObject, k), path === "" ? k : `${path}.${k}`);
 			return out;
 		}
 		return value;
@@ -71955,13 +72077,13 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
 		if (!topLevelKey) continue;
-		if (topLevelKey in desiredProperties) {
+		if (hasOwnKey(desiredProperties, topLevelKey)) {
 			const desiredValue = desiredProperties[topLevelKey];
-			const awsValue = awsProperties[topLevelKey];
-			if (preserveUntemplated) result[topLevelKey] = mergeUntemplatedValue(awsValue, desiredValue);
+			const awsValue = ownValue(awsProperties, topLevelKey);
+			if (preserveUntemplated) defineOwnKey(result, topLevelKey, mergeUntemplatedValue(awsValue, desiredValue));
 			else {
 				const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
-				result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+				defineOwnKey(result, topLevelKey, isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue);
 			}
 		}
 	}
@@ -71992,7 +72114,7 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 * too. That is represented by an explicit `undefined` value, which the caller
 * turns into a `delete` — a plain `{...baseline, ...delta}` spread would leave
 * an `undefined`-valued key in the JSON instead. Presence is decided by
-* `key in effective`, NOT by comparing against `undefined`: a provider that
+* OWN-key membership in `effective`, NOT by comparing against `undefined`: a provider that
 * delivers an explicit `undefined` and one that omits the key both mean "AWS
 * does not hold it", while a key whose value genuinely IS `null` on both sides
 * must not read as a drop.
@@ -72005,17 +72127,34 @@ function buildRevertNewProperties(drifts, desiredProperties, awsProperties, opti
 * prevent.
 */
 function collectNarrowedTopLevelKeys(sent, effective) {
-	const delta = {};
+	const delta = Object.create(null);
 	for (const key of /* @__PURE__ */ new Set([...Object.keys(sent), ...Object.keys(effective)])) {
-		const inSent = key in sent;
-		const inEffective = key in effective;
+		const inSent = hasOwnKey(sent, key);
+		const inEffective = hasOwnKey(effective, key);
 		if (inSent && inEffective && deepEqualUnordered(sent[key], effective[key])) continue;
 		if (!inSent && !inEffective) continue;
 		delta[key] = inEffective ? effective[key] : void 0;
 	}
 	return delta;
 }
-/** Deep equality that does not depend on object key ORDER. */
+/**
+* Deep equality that does not depend on object key ORDER.
+*
+* A NON-PLAIN object (`Date`, `Uint8Array`, `Map`, a class instance) on either
+* side compares UNEQUAL unless it is the same object (issue
+* [#2897](https://github.com/go-to-k/cdkd/issues/2897)): its own enumerable
+* keys are `[]`, so the key walk below reported any two `Date`s equal —
+* `0 === 0` — which HID a narrowing in {@link collectNarrowedTopLevelKeys}
+* (the changed value never reached `observedProperties`, leaving the baseline
+* stale there) and SUPPRESSED `runAccept`'s "was NOT recorded" warning. Same
+* guard, same reason as `secret-redaction.ts`'s `deepEqualJsonValue` and the
+* corroboration count above. Reachable: `sent` descends from
+* `buildRevertNewProperties`, which copies `readCurrentState`'s RAW SDK return
+* with no JSON round-trip, and `effective` is a provider's own echo. The
+* direction is deliberate — a value cdkd cannot compare is a value it must not
+* call unchanged, and for the narrowing that means the provider's echo is
+* recorded (the truthful answer) rather than silently kept stale.
+*/
 function deepEqualUnordered(a, b) {
 	if (a === b) return true;
 	if (a == null || b == null) return a === b;
@@ -72024,6 +72163,7 @@ function deepEqualUnordered(a, b) {
 		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
 		return a.every((v, i) => deepEqualUnordered(v, b[i]));
 	}
+	if (!hasPlainPrototype(a) || !hasPlainPrototype(b)) return false;
 	const ao = a;
 	const bo = b;
 	const ak = Object.keys(ao);
@@ -72184,7 +72324,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					try {
 						if (updateResult?.effectiveProperties) {
 							const delta = collectNarrowedTopLevelKeys(newProperties, updateResult.effectiveProperties);
-							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, STATE_SOURCED_READBACK_RULES));
+							if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES));
 						}
 					} catch (captureErr) {
 						logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
@@ -72211,14 +72351,14 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					const newBaseline = JSON.parse(JSON.stringify(baselineSource ?? {}));
 					let changed = false;
 					for (const [key, value] of Object.entries(delta)) {
-						if (!Object.prototype.hasOwnProperty.call(newBaseline, key)) continue;
+						if (!hasOwnKey(newBaseline, key)) continue;
 						if (value === void 0) {
 							delete newBaseline[key];
 							changed = true;
 							continue;
 						}
 						if (!hasObserved) continue;
-						newBaseline[key] = value;
+						defineOwnKey(newBaseline, key, value);
 						changed = true;
 					}
 					if (!changed) continue;
@@ -74274,11 +74414,25 @@ async function resolveIdentifierValue(entry, ctx, deps) {
 	try {
 		return entry.resolve(ctx);
 	} catch (stateOnlyError) {
-		if (!entry.backfill || !deps) throw stateOnlyError;
-		return await entry.backfill(ctx, deps);
+		if (entry.backfill && deps) return await entry.backfill(ctx, deps);
+		if (carriesSecretMask(ctx.attributes[entry.field])) throw new Error(maskedIdentifierAttributeReason(entry.field, ctx.logicalId));
+		throw stateOnlyError;
 	}
 }
 /**
+* The refusal for a recorded identifier attribute that holds the redaction
+* mask (issue [#2932](https://github.com/go-to-k/cdkd/issues/2932)) — the
+* `attributes` twin of the `properties` blocker in {@link buildImportPlan},
+* scoped to the ONE position `cdkd export` reads out of that bag rather than
+* to the whole bag. Widening it to any masked attribute would block every
+* Cloud-Control-imported record permanently: since issue #2847 that import
+* masks each writable model key BY DESIGN, so the population exports fine
+* today and would never stop being blocked by a re-import.
+*/
+function maskedIdentifierAttributeReason(field, logicalId) {
+	return `cdkd state holds only the redaction mask ('***') at attributes.${field} for '${logicalId}', and that attribute is the value cdkd export reads as this resource type's CloudFormation import identifier (${field}); nothing masked may reach the exported template, since CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. The mask is what 'cdkd import' writes for a Cloud Control model key it could not certify as read-only — every key when cloudformation:DescribeType was unavailable. Re-deploying does NOT clear it. Repair the record with 'cdkd import <stack> --resource ${logicalId}=<physicalId> --force' after granting cloudformation:DescribeType, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.`;
+}
+/**
 * Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
 * identifier is an ARN cdkd records in `attributes` under the SAME name as the
 * `primaryIdentifier` field.
@@ -75151,6 +75305,14 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			continue;
 		}
 		const propertiesOverlay = resolved.propertiesOverlay ?? resolved.resourceIdentifier;
+		if (carriesSecretMask(resolved.resourceIdentifier) || carriesSecretMask(propertiesOverlay)) {
+			blocked.push({
+				logicalId,
+				resourceType,
+				reason: `the CloudFormation import identifier cdkd resolved for this resource is the redaction mask ('***'), so the exported template would declare the mask as the resource's identity — CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. cdkd state holds only the mask where the identifier should be (a masked attribute, or a masked physical id). Repair the record ('cdkd import <stack> --resource ${logicalId}=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.`
+			});
+			continue;
+		}
 		const unrepresentable = unrepresentableOverlayFields(raw, propertiesOverlay);
 		if (unrepresentable.length > 0) {
 			for (const u of unrepresentable) blocked.push({
@@ -78522,10 +78684,14 @@ function snapshotNote(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
 * worse than a forged diagnostic: the plan preview below is what the user
 * CONFIRMS against, so a planted journal could forge the plan rows themselves.
 *
-* The ASCII allowlist, because every value it guards has a known charset: a
+* `displayIdent`, because every value it guards has a known charset: a
 * logical id, a CFn resource type, a change type, a run id, a segment reason,
-* a stack name, an AWS region. Call it for those; `grep safe(` answers the
-* scope and this comment does not.
+* a stack name, an AWS region. The ASCII allowlist, a length cap, and -- since
+* issue #3092 -- a visible boundary: an all-ASCII id such as
+* `X (AWS::RDS::DBInstance) -- already reverted` survives the allowlist and
+* plants this preview's own annotation wording inside a real row, so a value
+* that is not a plain identifier renders JSON-quoted. Call it for those;
+* `grep safe(` answers the scope and this comment does not.
 *
 * NOT for a value that is about to be USED rather than shown -- the preview
 * indexes `previewState` by the RAW `op.logicalId`, and sanitising a lookup
@@ -78538,7 +78704,7 @@ function snapshotNote(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
 * answers how many; a count written here was wrong on its first revision.
 */
 function safe(value) {
-	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+	return displayIdent(value);
 }
 /**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
@@ -83846,7 +84012,7 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 * **Order is preserved**: `Properties.Layers` is iterated left-to-right
 * and the resulting `ResolvedLambdaLayer[]` carries the same order. The
 * caller (`local-invoke.ts`'s `materializeLambdaLayers` and
-* `local-start-api.ts`'s server-boot pre-merge) `cpSync`-merges every
+* `local-start-api.ts`'s server-boot pre-merge) merges every
 * entry into one host tmpdir in template order to honor AWS's
 * "last-layer-wins" file-collision semantics — Docker rejects multiple
 * bind mounts at the same target so cdkd cannot rely on overlay
@@ -84117,6 +84283,110 @@ function notFoundError$1(target, stack, resources) {
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
 
+//#endregion
+//#region src/local/layer-tree-copy.ts
+/**
+* Merge one Lambda Layer's asset tree into the directory that will be
+* bind-mounted at `/opt`, with AWS's "last layer wins" semantic and with
+* symlinks kept VERBATIM (issue #3106).
+*
+* Why this is a hand-written walk and not `cpSync`. The merge used to be
+* `cpSync(src, dest, { recursive: true, force: true })`, and every
+* `cpSync`-shaped repair of it was measured wrong in some direction:
+*
+*   - Without `verbatimSymlinks: true` (the default), `cpSync` rewrites a
+*     RELATIVE link target to the ABSOLUTE path of the source on the host —
+*     `bin/rel-link -> real.sh` arrives as `-> <cdk.out>/asset.<hash>/bin/
+*     real.sh`, which is dangling inside the container, where only `dest`
+*     is mounted. Measured on Node 22.12 / 24.21.
+*   - WITH `verbatimSymlinks: true`, Node's C++ `cpSync` (every release
+*     after 22.12) throws `EEXIST` when a later layer carries a symlink at a
+*     path an earlier layer already placed one — `nodejs/node_modules/.bin/
+*     <tool>` in two layers built from the same dependency is the ordinary
+*     case. Measured by the go-to-k/cdkd#3118 review on 22.23 / 24.15 /
+*     24.21; the JS implementation on 22.12 does not throw, which is why
+*     the floor alone did not show it.
+*   - A `cpSync` + `readdirSync({ recursive: true })` pair was worse:
+*     the recursive readdir DESCENDS INTO directory symlinks on every Node
+*     after 22.12 (not on 22.12), so a cyclic link (`sub/up -> ..`, or a
+*     pnpm-style `node_modules`) hung the merge, and an absolute link to a
+*     host directory made the walk delete and write INSIDE that host
+*     directory. And `cpSync`'s `force` writes THROUGH a destination that
+*     is already a directory symlink, so a later layer's real directory
+*     landed in the earlier layer's link target — on the host, when the
+*     link was absolute. Same review, same versions.
+*
+* So the walk is explicit and recurses only on a real directory (`d_type`,
+* via `Dirent.isDirectory()`, which reports a directory symlink as a
+* symlink on 22.12 and 24.21 alike). Per entry, "last layer wins" is applied
+* the same way for every kind: whatever sits at the destination path that is
+* not of the same kind is removed first — a link, a file, or a whole
+* directory an earlier layer placed — then the entry lands. A symlink is
+* recreated with the SOURCE's own target string and never resolved, so an
+* absolute link stays absolute and a dangling one stays dangling, exactly as
+* AWS extracts the layer ZIP into `/opt`; nothing is ever written through a
+* link. A file is copied with `cpSync` (single file, `force`), which is what
+* preserves the mode bits, so a layer's `bin/<script>` keeps its `+x` — the
+* property the `local-invoke-layers` fixture executes through.
+*
+* The ROOT may itself be a symlink (an asset dir handed over through a link
+* passes `resolveAssetCodePath`'s `statSync`). `readdirSync` follows a root
+* link by itself, so the `realpathSync` is not what makes that case work,
+* and it does not move where a dangling or looping root fails either (the
+* first `readdirSync` raises the same `ENOENT` / `ELOOP` naming the asset
+* path); it only keeps every path the walk joins real.
+*
+* Bound, stated rather than handled: a FIFO or a socket inside a layer
+* makes the single-file `cpSync` throw (`ERR_FS_CP_FIFO_PIPE` /
+* `ERR_FS_CP_SOCKET`, immediately, never blocking) where the old recursive
+* copy skipped it in silence on some releases. CDK's own asset staging
+* cannot stage such an entry, so no real layer carries one.
+*
+* Both layer merges (`cdkd local invoke` and `cdkd local start-api`) call
+* this; keep them on the one helper rather than re-spelling copy options.
+*/
+function copyLayerTreeLastWins(src, dest) {
+	mkdirSync(dest, { recursive: true });
+	copyDirLastWins(realpathSync(src), dest);
+}
+function copyDirLastWins(fromDir, toDir) {
+	for (const entry of readdirSync(fromDir, { withFileTypes: true })) {
+		const from = join(fromDir, entry.name);
+		const to = join(toDir, entry.name);
+		if (entry.isSymbolicLink()) {
+			removeUnless(to, "symlink");
+			symlinkSync(readlinkSync(from), to);
+		} else if (entry.isDirectory()) {
+			removeUnless(to, "directory");
+			mkdirSync(to, { recursive: true });
+			copyDirLastWins(from, to);
+		} else {
+			removeUnless(to, "file");
+			cpSync(from, to, { force: true });
+		}
+	}
+}
+/**
+* Clear the destination path unless what is there is already of `kind`. A
+* directory is kept so a later layer MERGES into it; a file is kept because
+* `cpSync` overwrites it in place; a symlink is always replaced (its target
+* string comes from the later layer).
+*/
+function removeUnless(to, kind) {
+	let st;
+	try {
+		st = lstatSync(to);
+	} catch {
+		return;
+	}
+	if (kind === "directory" && st.isDirectory()) return;
+	if (kind === "file" && st.isFile()) return;
+	rmSync(to, {
+		recursive: true,
+		force: true
+	});
+}
+
 //#endregion
 //#region src/local/ecs-task-resolver.ts
 function detectEcsImageResolutionNeeds(stack) {
@@ -87533,12 +87803,12 @@ async function resolveLocalBuildPlan$1(lambda) {
 *     when the entry is a same-stack asset. Literal-ARN entries always
 *     pre-materialize first.
 *   - 2+ layers → copy each into a fresh tmpdir IN ORDER (later
-*     layers overwrite earlier files via `cpSync({force: true})`),
+*     layers overwrite earlier files via `copyLayerTreeLastWins`),
 *     bind-mount the tmpdir at `/opt`. Records the tmpdir in
 *     `layerTmpDirs` so `shutdown(...)` removes it.
 *
 * Issue #448: literal-ARN entries (`{kind: 'arn', ...}`) are downloaded
-* + unzipped via `lambda:GetLayerVersion` BEFORE the cpSync-merge
+* + unzipped via `lambda:GetLayerVersion` BEFORE the merge
 * branches run. Every per-ARN tmpdir is also recorded in `layerTmpDirs`
 * so the same shutdown path cleans it up — even for the single-layer
 * fast path that bind-mounts the dir directly.
@@ -87568,10 +87838,15 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 	}
 	if (flat.length === 1) return flat[0].assetPath;
 	const dir = mkdtempSync(path.join(tmpdir(), "cdkd-local-start-api-layers-"));
-	for (const layer of flat) cpSync(layer.assetPath, dir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of flat) copyLayerTreeLastWins(layer.assetPath, dir);
+	} catch (error) {
+		rmSync(dir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	layerTmpDirs.add(dir);
 	return dir;
 }
@@ -91522,7 +91797,7 @@ async function resolveZipImagePlan(lambda, options) {
 *   - Stage 2: the resulting `{logicalId, assetPath}[]` list (in
 *     template order — ARN entries surface their `arn` as the
 *     `logicalId` for log lines) is handed to the existing
-*     `materializeLambdaLayers` `cpSync`-merge path. AWS's "last layer
+*     `materializeLambdaLayers` merge path. AWS's "last layer
 *     wins" file-collision semantic is preserved across both layer
 *     kinds because the merge step is unchanged.
 */
@@ -91590,7 +91865,7 @@ function resolveTmpfsForLambda(lambda) {
 *      than copying since CDK has already unzipped the asset.
 *   3. **Multiple layers**: copies each layer's contents into a fresh
 *      tmpdir IN ORDER (later layers overwrite earlier files via
-*      `cpSync({force: true})`), then bind-mounts the merged tmpdir at
+*      `copyLayerTreeLastWins`), then bind-mounts the merged tmpdir at
 *      `/opt`. Returns `{ mount, tmpDir: <path> }` so the caller can
 *      `rmSync` the tmpdir on cleanup.
 *
@@ -91607,10 +91882,15 @@ function materializeLambdaLayers(layers) {
 		readOnly: true
 	} };
 	const tmpDir = mkdtempSync(path.join(tmpdir(), "cdkd-local-invoke-layers-"));
-	for (const layer of layers) cpSync(layer.assetPath, tmpDir, {
-		recursive: true,
-		force: true
-	});
+	try {
+		for (const layer of layers) copyLayerTreeLastWins(layer.assetPath, tmpDir);
+	} catch (error) {
+		rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	}
 	return {
 		mount: {
 			hostPath: tmpDir,
@@ -92177,4 +92457,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CnTfNj2k.js.map
+//# sourceMappingURL=program-CoRRfEe_.js.map