@go-to-k/cdkd 0.290.24 → 0.290.26

package/dist/{deploy-engine-BcNBidfy.js → deploy-engine-CbIc5Y73.js}

@@ -1,6 +1,6 @@
 import { C as displaySafe, S as displayIdent, b as STACK_REF_MAX_CODE_POINTS, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-CkHVgzLx.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-PsB8OjhM.js";
+import { t as getCdkdVersion } from "./version-yD49aCCv.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -59,6 +59,191 @@ var __exportAll = (all, no_symbols) => {
 	return target;
 };
 
+//#endregion
+//#region src/utils/aws-failure-text.ts
+/**
+* Appended to a redacted summary so the withheld half is still reachable.
+*
+* EXPORTED for the TESTS, and that is now its only reason. It was exported
+* because `cloud-control-provider.ts`'s `abandonWait` reduced on its own wider
+* predicate and had to compose this sentence by hand; issue
+* [#3297](https://github.com/go-to-k/cdkd/issues/3297) removed that predicate
+* and the hand-copy with it, so no `src/` file spells this literal twice. The
+* remaining importer is `cloud-control-wait-abandoned.test.ts`, which asserts
+* the ABSENCE of the pointer and would silently stop discriminating if it
+* hard-coded the words instead.
+*/
+const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
+/**
+* The summary {@link describeAwsFailure} builds for an `Error` it is reducing.
+*
+* UN-exported by issue [#3297](https://github.com/go-to-k/cdkd/issues/3297).
+* It was exported for one caller — `cloud-control-provider.ts`, whose own
+* authorship predicate was WIDER than this module's, so the helper handed it
+* raw text for a shape it wanted reduced and it had to build this string
+* itself. That predicate is gone and so is the divergence, leaving the export
+* with no callers and a doc citing one that no longer exists. Keep it private:
+* a re-export is the signal that a second predicate has appeared.
+*/
+function redactedAwsFailureSummary(error) {
+	return `${error.name || "Error"}. ${VERBOSE_POINTER}`;
+}
+/**
+* Whether AWS wrote this failure's message.
+*
+* Keyed on a real SERVICE signal: `$fault`, which every modeled
+* `@smithy/smithy-client` `ServiceException` carries, or a NUMERIC
+* `$metadata.httpStatusCode`, which only a deserialized RESPONSE has. Nothing
+* under `src/` sets either, so a match cannot be a cdkd-authored error.
+*
+* **`$metadata` PRESENCE is deliberately NOT the signal, and an earlier
+* revision of this function used it** (issue
+* [#3297](https://github.com/go-to-k/cdkd/issues/3297)). `@smithy/core`'s retry
+* middleware stamps `$metadata = {attempts, totalRetryDelay}` onto EVERY error
+* it gives up on — socket errors included — and creates the object when it is
+* absent. Measured against a real `CloudControlClient` pointed at a closed
+* port:
+*
+*     name 'Error', code 'ECONNREFUSED', $fault undefined,
+*     message 'connect ECONNREFUSED 127.0.0.1:1',
+*     $metadata { attempts: 3, totalRetryDelay: 58 }
+*
+* So the old predicate classified a plain transport failure as AWS-authored and
+* reduced it to its `name` — which for a socket error is the bare token
+* `Error`, carrying no diagnosis at all. That deleted `connect ECONNREFUSED
+* <ip>:443`, the exact wording issue
+* [#3236](https://github.com/go-to-k/cdkd/issues/3236) was REPORTED with, from
+* the only durable record of the outage.
+*
+* The `CredentialsProviderError` name is the third arm because credential
+* resolution carries NEITHER signal — identity is resolved by
+* `httpAuthSchemeMiddleware` at step `serialize`, which WRAPS retry's
+* `finalizeRequest`, so an escaping credential error never enters retry's catch
+* (measured, and the mechanism is why: retry CREATES `$metadata` when absent,
+* so an error arriving without one proves it bypassed retry). It is also the
+* shape whose message carries the most: `@aws-sdk/credential-provider-process`
+* wraps EVERY exec failure in it, so the text interpolates the helper's ARGV
+* and its stderr.
+*
+* **Its siblings are deliberately NOT matched, and the reasons differ per class
+* rather than being one rule.** `@smithy/property-provider` exports a family of
+* three — `ProviderError`, and its subclasses `CredentialsProviderError` and
+* `TokenProviderError` — plus `@smithy/credential-provider-imds`'s
+* `InstanceMetadataV1FallbackError`, the only subclass OF
+* `CredentialsProviderError` in the installed tree. (All four set `name`; an
+* earlier revision read "the only subclass that overrides `name`", which is
+* false of the three siblings.) Each was read rather than reasoned about,
+* because the answers go BOTH ways:
+*
+*  - `TokenProviderError` must NOT be reduced. Its message IS the remedy —
+*    `Token is expired. To refresh this SSO session run 'aws sso login' with
+*    the corresponding profile.` — so reducing it to a wire name would delete
+*    the fix instruction. A revision matching the whole `*ProviderError` suffix
+*    did exactly that. The benefit is not realized on the Cloud Control poll
+*    path today, and claiming otherwise was measured false:
+*    `@aws-sdk/credential-provider-sso` catches every token failure and
+*    rethrows it as a `CredentialsProviderError`, so the shape cannot escape a
+*    SigV4 client there. The carve-out is a rule about the FAMILY, kept because
+*    the rewrap is upstream behaviour that can change.
+*  - `ProviderError` (the base) and `InstanceMetadataV1FallbackError` carry
+*    connectivity and CONFIG wording respectively — the IMDS one interpolates
+*    three fixed literals naming config keys, with no argv, stderr, profile
+*    value or identity in it. Both are more useful raw.
+*
+* So string EQUALITY is right here, and right by enumeration rather than by
+* assumption. Re-check the list when the SDK major moves; do not widen it to a
+* suffix. The specific mechanism to re-check is `ProviderError.from()`, which
+* does `Object.assign(new this(...), error)` — that copies a SOURCE error's own
+* `name` over the class field and would defeat string equality outright. It has
+* ZERO call sites anywhere in `node_modules` today, which is the only reason
+* equality is safe rather than merely correct-looking.
+*
+* `$response` is gone with the `$metadata` disjunct, and the reason is NOT the
+* obvious one -- an earlier revision of this comment said it "is only ever set
+* on a `ServiceException`, which carries `$fault` anyway", and review measured
+* that false. `@smithy/core`'s `deserializerMiddleware` stamps `$response` on
+* ANY error escaping the deserializer, and the very next line reads
+* `if (!("$metadata" in error))`, i.e. the library explicitly handles the
+* `$response`-without-`$metadata` shape (a `JSON.parse` `SyntaxError` out of
+* `parseJsonBody`). What actually preserves the verdict is the SIBLING line in
+* that same catch: `error.$metadata = { httpStatusCode: response.statusCode,
+* ... }`, so the `httpStatusCode` disjunct subsumes `$response` for every
+* response the middleware can read. The residual is a `response` failing
+* `HttpResponse.isInstance`, or a throw inside that block's own
+* `catch (ignored)` -- shapes with no HTTP status at all, which are not service
+* rejections and should not be reduced.
+*
+* A transport-level failure (a socket timeout, a DNS error) reaches a caller
+* with neither signal, and that is the correct answer rather than a gap: those
+* messages are written by the HTTP layer and name a host, never a caller.
+*/
+function isAwsAuthoredFailure(error) {
+	const candidate = error;
+	return candidate.$fault !== void 0 || typeof candidate.$metadata?.httpStatusCode === "number" || error.name === "CredentialsProviderError";
+}
+/**
+* Exactly what `String(value)` produces, without the throw.
+*
+* `String(value)` is the only spelling that carries an `Error`'s NAME as well
+* as its message (`"AccessDenied: User ... is not authorized"`), and several
+* call sites depend on that: four build a persisted `outcome: 'partial'`
+* reason where the wire code is the discriminator an operator reads first.
+* {@link describeAwsFailure}'s `detail` is the MESSAGE only, so it is NOT a
+* drop-in for the bare form -- substituting it silently deletes the code.
+* Measured, after a sweep did exactly that at nine sites.
+*
+* So this is the 1:1 replacement: same output for every value `String` can
+* convert, and a stable sentence for the ones it cannot. A null-prototype
+* object throws `TypeError: Cannot convert object to primitive value`, and an
+* object with a hostile or `null` `toString` throws whatever it likes -- inside
+* a catch, that replaces the failure being reported.
+*
+* Use `describeAwsFailure(x).detail` where the site previously read
+* `x instanceof Error ? x.message : String(x)`; use THIS where it read a bare
+* `String(x)`.
+*
+* NOT a substitute for `displaySafe` in `display-safe.ts`, which guards the
+* same coercion and answers differently on purpose -- it falls back to
+* `Object.prototype.toString` and, more importantly, SANITISES the result for a
+* terminal. Anything about to be rendered or logged goes through that one; this
+* one is for the text a catch is about to record.
+*/
+function safeStringify$1(value) {
+	try {
+		return String(value);
+	} catch {
+		return "a value that could not be converted to text";
+	}
+}
+/**
+* Describe a caught failure for a thrown message. See {@link AwsFailureText}.
+*/
+function describeAwsFailure(error) {
+	if (error instanceof Error) {
+		if (!isAwsAuthoredFailure(error)) return {
+			summary: error.message,
+			detail: error.message,
+			redacted: false
+		};
+		return {
+			summary: redactedAwsFailureSummary(error),
+			detail: error.message,
+			redacted: true
+		};
+	}
+	let detail;
+	try {
+		detail = String(error);
+	} catch {
+		detail = "a value that could not be converted to text";
+	}
+	return {
+		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
+		detail,
+		redacted: true
+	};
+}
+
 //#endregion
 //#region src/deployment/retryable-errors.ts
 /**
@@ -722,7 +907,7 @@ function isRetryableTransientError(error, message) {
 * classify.
 */
 function retryClassificationText(error) {
-	const top = error instanceof Error ? error.message : String(error);
+	const top = describeAwsFailure(error).detail;
 	if (!hasRedactedCause(error)) return top;
 	const parts = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -7360,7 +7545,7 @@ function repairSpawnRefusal(text, args, maskedArgs) {
 * error would only say "Command failed with exit code N".
 */
 function describeDockerExecFailure(error, args) {
-	const message = thrownMessageText(error) || safeStringify$1(error);
+	const message = thrownMessageText(error) || safeStringify(error);
 	const stderrText = capturedStreamText(error, "stderr");
 	return redactDockerArgvInText(stderrText ? `${message}\n${stderrText}` : message, args);
 }
@@ -7403,7 +7588,7 @@ function thrownMessageText(error) {
 * two of these call sites are in `cleanupEcsRun`, where an exception aborts
 * the remaining volume / network teardown and leaks real Docker resources.
 */
-function safeStringify$1(error) {
+function safeStringify(error) {
 	try {
 		return String(error);
 	} catch {
@@ -7429,7 +7614,7 @@ function safeStringify$1(error) {
 * wrapper text needs the status as well.
 */
 function describeDockerFailure(error, args) {
-	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify$1(error), args);
+	return redactDockerArgvInText(capturedStreamText(error, "stderr") || thrownMessageText(error) || safeStringify(error), args);
 }
 /**
 * A `cause` that is safe to CHAIN onto a wrapper error, for a caller that
@@ -7896,191 +8081,6 @@ var DockerAssetPublisher = class {
 	}
 };
 
-//#endregion
-//#region src/utils/aws-failure-text.ts
-/**
-* Appended to a redacted summary so the withheld half is still reachable.
-*
-* EXPORTED for the TESTS, and that is now its only reason. It was exported
-* because `cloud-control-provider.ts`'s `abandonWait` reduced on its own wider
-* predicate and had to compose this sentence by hand; issue
-* [#3297](https://github.com/go-to-k/cdkd/issues/3297) removed that predicate
-* and the hand-copy with it, so no `src/` file spells this literal twice. The
-* remaining importer is `cloud-control-wait-abandoned.test.ts`, which asserts
-* the ABSENCE of the pointer and would silently stop discriminating if it
-* hard-coded the words instead.
-*/
-const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
-/**
-* The summary {@link describeAwsFailure} builds for an `Error` it is reducing.
-*
-* UN-exported by issue [#3297](https://github.com/go-to-k/cdkd/issues/3297).
-* It was exported for one caller — `cloud-control-provider.ts`, whose own
-* authorship predicate was WIDER than this module's, so the helper handed it
-* raw text for a shape it wanted reduced and it had to build this string
-* itself. That predicate is gone and so is the divergence, leaving the export
-* with no callers and a doc citing one that no longer exists. Keep it private:
-* a re-export is the signal that a second predicate has appeared.
-*/
-function redactedAwsFailureSummary(error) {
-	return `${error.name || "Error"}. ${VERBOSE_POINTER}`;
-}
-/**
-* Whether AWS wrote this failure's message.
-*
-* Keyed on a real SERVICE signal: `$fault`, which every modeled
-* `@smithy/smithy-client` `ServiceException` carries, or a NUMERIC
-* `$metadata.httpStatusCode`, which only a deserialized RESPONSE has. Nothing
-* under `src/` sets either, so a match cannot be a cdkd-authored error.
-*
-* **`$metadata` PRESENCE is deliberately NOT the signal, and an earlier
-* revision of this function used it** (issue
-* [#3297](https://github.com/go-to-k/cdkd/issues/3297)). `@smithy/core`'s retry
-* middleware stamps `$metadata = {attempts, totalRetryDelay}` onto EVERY error
-* it gives up on — socket errors included — and creates the object when it is
-* absent. Measured against a real `CloudControlClient` pointed at a closed
-* port:
-*
-*     name 'Error', code 'ECONNREFUSED', $fault undefined,
-*     message 'connect ECONNREFUSED 127.0.0.1:1',
-*     $metadata { attempts: 3, totalRetryDelay: 58 }
-*
-* So the old predicate classified a plain transport failure as AWS-authored and
-* reduced it to its `name` — which for a socket error is the bare token
-* `Error`, carrying no diagnosis at all. That deleted `connect ECONNREFUSED
-* <ip>:443`, the exact wording issue
-* [#3236](https://github.com/go-to-k/cdkd/issues/3236) was REPORTED with, from
-* the only durable record of the outage.
-*
-* The `CredentialsProviderError` name is the third arm because credential
-* resolution carries NEITHER signal — identity is resolved by
-* `httpAuthSchemeMiddleware` at step `serialize`, which WRAPS retry's
-* `finalizeRequest`, so an escaping credential error never enters retry's catch
-* (measured, and the mechanism is why: retry CREATES `$metadata` when absent,
-* so an error arriving without one proves it bypassed retry). It is also the
-* shape whose message carries the most: `@aws-sdk/credential-provider-process`
-* wraps EVERY exec failure in it, so the text interpolates the helper's ARGV
-* and its stderr.
-*
-* **Its siblings are deliberately NOT matched, and the reasons differ per class
-* rather than being one rule.** `@smithy/property-provider` exports a family of
-* three — `ProviderError`, and its subclasses `CredentialsProviderError` and
-* `TokenProviderError` — plus `@smithy/credential-provider-imds`'s
-* `InstanceMetadataV1FallbackError`, the only subclass OF
-* `CredentialsProviderError` in the installed tree. (All four set `name`; an
-* earlier revision read "the only subclass that overrides `name`", which is
-* false of the three siblings.) Each was read rather than reasoned about,
-* because the answers go BOTH ways:
-*
-*  - `TokenProviderError` must NOT be reduced. Its message IS the remedy —
-*    `Token is expired. To refresh this SSO session run 'aws sso login' with
-*    the corresponding profile.` — so reducing it to a wire name would delete
-*    the fix instruction. A revision matching the whole `*ProviderError` suffix
-*    did exactly that. The benefit is not realized on the Cloud Control poll
-*    path today, and claiming otherwise was measured false:
-*    `@aws-sdk/credential-provider-sso` catches every token failure and
-*    rethrows it as a `CredentialsProviderError`, so the shape cannot escape a
-*    SigV4 client there. The carve-out is a rule about the FAMILY, kept because
-*    the rewrap is upstream behaviour that can change.
-*  - `ProviderError` (the base) and `InstanceMetadataV1FallbackError` carry
-*    connectivity and CONFIG wording respectively — the IMDS one interpolates
-*    three fixed literals naming config keys, with no argv, stderr, profile
-*    value or identity in it. Both are more useful raw.
-*
-* So string EQUALITY is right here, and right by enumeration rather than by
-* assumption. Re-check the list when the SDK major moves; do not widen it to a
-* suffix. The specific mechanism to re-check is `ProviderError.from()`, which
-* does `Object.assign(new this(...), error)` — that copies a SOURCE error's own
-* `name` over the class field and would defeat string equality outright. It has
-* ZERO call sites anywhere in `node_modules` today, which is the only reason
-* equality is safe rather than merely correct-looking.
-*
-* `$response` is gone with the `$metadata` disjunct, and the reason is NOT the
-* obvious one -- an earlier revision of this comment said it "is only ever set
-* on a `ServiceException`, which carries `$fault` anyway", and review measured
-* that false. `@smithy/core`'s `deserializerMiddleware` stamps `$response` on
-* ANY error escaping the deserializer, and the very next line reads
-* `if (!("$metadata" in error))`, i.e. the library explicitly handles the
-* `$response`-without-`$metadata` shape (a `JSON.parse` `SyntaxError` out of
-* `parseJsonBody`). What actually preserves the verdict is the SIBLING line in
-* that same catch: `error.$metadata = { httpStatusCode: response.statusCode,
-* ... }`, so the `httpStatusCode` disjunct subsumes `$response` for every
-* response the middleware can read. The residual is a `response` failing
-* `HttpResponse.isInstance`, or a throw inside that block's own
-* `catch (ignored)` -- shapes with no HTTP status at all, which are not service
-* rejections and should not be reduced.
-*
-* A transport-level failure (a socket timeout, a DNS error) reaches a caller
-* with neither signal, and that is the correct answer rather than a gap: those
-* messages are written by the HTTP layer and name a host, never a caller.
-*/
-function isAwsAuthoredFailure(error) {
-	const candidate = error;
-	return candidate.$fault !== void 0 || typeof candidate.$metadata?.httpStatusCode === "number" || error.name === "CredentialsProviderError";
-}
-/**
-* Exactly what `String(value)` produces, without the throw.
-*
-* `String(value)` is the only spelling that carries an `Error`'s NAME as well
-* as its message (`"AccessDenied: User ... is not authorized"`), and several
-* call sites depend on that: four build a persisted `outcome: 'partial'`
-* reason where the wire code is the discriminator an operator reads first.
-* {@link describeAwsFailure}'s `detail` is the MESSAGE only, so it is NOT a
-* drop-in for the bare form -- substituting it silently deletes the code.
-* Measured, after a sweep did exactly that at nine sites.
-*
-* So this is the 1:1 replacement: same output for every value `String` can
-* convert, and a stable sentence for the ones it cannot. A null-prototype
-* object throws `TypeError: Cannot convert object to primitive value`, and an
-* object with a hostile or `null` `toString` throws whatever it likes -- inside
-* a catch, that replaces the failure being reported.
-*
-* Use `describeAwsFailure(x).detail` where the site previously read
-* `x instanceof Error ? x.message : String(x)`; use THIS where it read a bare
-* `String(x)`.
-*
-* NOT a substitute for `displaySafe` in `display-safe.ts`, which guards the
-* same coercion and answers differently on purpose -- it falls back to
-* `Object.prototype.toString` and, more importantly, SANITISES the result for a
-* terminal. Anything about to be rendered or logged goes through that one; this
-* one is for the text a catch is about to record.
-*/
-function safeStringify(value) {
-	try {
-		return String(value);
-	} catch {
-		return "a value that could not be converted to text";
-	}
-}
-/**
-* Describe a caught failure for a thrown message. See {@link AwsFailureText}.
-*/
-function describeAwsFailure(error) {
-	if (error instanceof Error) {
-		if (!isAwsAuthoredFailure(error)) return {
-			summary: error.message,
-			detail: error.message,
-			redacted: false
-		};
-		return {
-			summary: redactedAwsFailureSummary(error),
-			detail: error.message,
-			redacted: true
-		};
-	}
-	let detail;
-	try {
-		detail = String(error);
-	} catch {
-		detail = "a value that could not be converted to text";
-	}
-	return {
-		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
-		detail,
-		redacted: true
-	};
-}
-
 //#endregion
 //#region src/utils/deny-external-access-policy.ts
 /**
@@ -9534,6 +9534,44 @@ function isReadableBag(container) {
 	return typeof container === "object" && container !== null && !Array.isArray(container);
 }
 /**
+* What KIND of value a record's `region` field holds, as a bounded token safe
+* to print at default verbosity (issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328)).
+*
+* The VALUE is never safe there: a body region is chosen by anyone able to
+* write that key, and a line reading `body region 'eu-west-1'` hands an
+* operator a region to aim a destructive re-run at — the misdirection half of
+* that issue. Its kind is the answer to "what is wrong with this record"
+* without being the answer to "which region should I use", and the result is
+* one of TEN fixed strings (`null`, `an array`, and an article plus each of
+* `typeof`'s eight), so no input can forge a line through it.
+*
+* `probeLegacyState` reaches the same JUDGEMENT one field over and does NOT
+* call this — it renders a bare `typeof` into a sentence a unit case pins
+* verbatim (`'region' is number, not a string`). Two spellings of a bounded
+* token, deliberately not collapsed: the two are not interchangeable strings,
+* and changing that one is a message change with its own fence.
+*
+* `null` and arrays are named rather than left as `object`, the way
+* `parseStateBody` names its own refused roots — `typeof null` is `'object'`,
+* which would report the two most likely hand-edit shapes as the same thing.
+* The article is computed because `a object` reads as a defect in the very
+* diagnostic the reader is being asked to trust.
+*
+* HOME: this module rather than beside either caller, for the reason
+* {@link isReadableBag}'s note gives — `src/state/s3-state-backend.ts`
+* (`adoptKeyRegion`, which produces the divergence) and
+* `src/state/malformed-resources-bag.ts` (the destroy refusal that renders it)
+* both need it, and the second is imported by modules that `vi.mock` the
+* first wholesale.
+*/
+function describeRegionValueKind(value) {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "an array";
+	const type = typeof value;
+	return `${/^[aeiou]/.test(type) ? "an" : "a"} ${type}`;
+}
+/**
 * The keys of `state.outputs` an `Fn::ImportValue` may bind to (issue
 * [#2193](https://github.com/go-to-k/cdkd/issues/2193)) — THE predicate
 * behind "what does this stack export". Four readers used to answer that
@@ -10287,6 +10325,11 @@ var S3StateBackend = class {
 	*
 	* Note: S3 returns ETag with surrounding quotes (e.g., `"abc123"`). We
 	* preserve the quotes — they are required for `IfMatch` conditions.
+	*
+	* On the region-scoped path the returned `state.region` is ALWAYS the
+	* region of the key it was read from, whatever the body said — see
+	* {@link adoptKeyRegion}, which also reports a body that disagreed via
+	* `divergentBodyRegion`.
 	*/
 	async getState(stackName, region) {
 		await this.ensureClientForBucket();
@@ -10303,11 +10346,13 @@ var S3StateBackend = class {
 			if (!response.Body) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no body`);
 			if (!response.ETag) throw new StateError(`State file for stack '${shownStackName}' (${shownRegionName}) has no ETag`);
 			const bodyString = await response.Body.transformToString();
-			const state = this.parseStateBody(bodyString, stackName);
+			const parsed = this.parseStateBody(bodyString, stackName);
+			const { state, divergentBodyRegion } = this.adoptKeyRegion(parsed, region, shownStackName, shownRegionName);
 			this.logger.debug(`Retrieved state: ${shownStackName} (${shownRegionName}), ETag: ${response.ETag}`);
 			return {
 				state,
-				etag: response.ETag
+				etag: response.ETag,
+				...divergentBodyRegion !== void 0 && { divergentBodyRegion }
 			};
 		} catch (error) {
 			if (!isNoSuchKey(error)) {
@@ -10869,6 +10914,83 @@ var S3StateBackend = class {
 	displayName(stackName) {
 		return displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>";
 	}
+	/**
+	* Make the S3 KEY's region the region of the record read from it, and report
+	* a body that named a different one.
+	*
+	* The key is the authority, and that is not a new rule: `saveState`
+	* normalizes the body it writes against the same `region` argument
+	* `getStateKey` builds the key from, and has done since `83e5ddb66` — the
+	* commit that introduced the region-scoped layout (schema v2, PR
+	* [#57](https://github.com/go-to-k/cdkd/pull/57)). Key and body therefore
+	* agree by construction for every record any cdkd version has ever written,
+	* so this makes the READ symmetric with a write rule that already held
+	* rather than inventing a second one — and a divergence means the record was
+	* written by something that is not cdkd.
+	*
+	* It is not cosmetic. `region` is what `destroy-runner.ts` locks, saves and
+	* `deleteState`s against (`state.region ?? ctx.baseRegion`), and what
+	* `DeleteContext.expectedRegion` carries so a provider can tell "the
+	* resource is genuinely gone" from "I looked in the wrong region"
+	* (`src/provisioning/region-check.ts`). A divergent body aimed all of that
+	* at a region the record does not live in, and `cdkd state destroy` reported
+	* `✓ State deleted` having deleted nothing (issue
+	* [#3328](https://github.com/go-to-k/cdkd/issues/3328)). Normalizing HERE
+	* fixes every consumer at once, with no region threaded through any of them.
+	*
+	* REFUSING instead was rejected deliberately: this is the shared read path
+	* for deploy, destroy, rollback AND the recovery commands (`cdkd state
+	* orphan`, `cdkd state destroy`), which is the same reason `parseStateBody`
+	* validates nothing inside a well-formed root. A refusal would strand the
+	* record it was asked to clean up, leaving `aws s3 rm` as the only remedy.
+	*
+	* It REPLACES rather than defaults, which is the half `??` cannot do:
+	* `state.region ?? ctx.baseRegion` falls through only for `null` /
+	* `undefined`, so a `"region": ""` built the key `cdkd/<stack>//state.json`
+	* and a `"region": 123` reached `acquireLock` / `deleteState` as a region.
+	*
+	* **An ABSENT region is normalized too, and silently.** A body carrying no
+	* `region` makes no claim to contradict, and the key it was read from names
+	* one — which is the answer `legacyProbeBelongsTo` already gives one layout
+	* over, where a body naming no region belongs to ANY region (issue
+	* [#2550](https://github.com/go-to-k/cdkd/issues/2550)): "any region" plus
+	* "read under this key" is this key's region. It is also strictly better than
+	* what absence used to reach, which was `ctx.baseRegion` at the destroy —
+	* the CLI's region, which need not be the key's at all.
+	*
+	* **`null` and `''` are NOT folded in with absent here, unlike in
+	* `legacyProbeBelongsTo`**, and the difference is the key: the legacy key
+	* names no region, so a falsy field there has to mean "any". This key names
+	* one, so nothing needs inferring and the only question left is whether the
+	* body AGREES — which `null` and `''` do not. They are also two of the shapes
+	* `export.ts`'s nested-child refusal keys on, and folding them in would drop
+	* that refusal silently.
+	*
+	* The divergent value is REPORTED to the caller rather than only logged
+	* because one caller refuses on it: `walkCdkdStateStackTree` (`export.ts`)
+	* fails a nested child whose recorded region is not its parent's, and
+	* normalizing the state without reporting would have made that refusal
+	* unreachable rather than fixed.
+	*/
+	adoptKeyRegion(state, region, shownStackName, shownRegionName) {
+		const raw = state.region;
+		if (raw === region) return { state };
+		if (raw === void 0) return { state: {
+			...state,
+			region
+		} };
+		const kind = describeRegionValueKind(raw);
+		this.logger.warn(`State record for stack '${shownStackName}' carries a 'region' of its own (${kind}) that is not the region of the S3 key it was read from ('${shownRegionName}'). cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Continuing against '${shownRegionName}' — the key is authoritative. Re-run with --verbose to see the recorded value, where it has one to show.`);
+		const shownBodyRegion = truncateCodePoints(displaySafe(raw, { asciiOnly: true }), 255);
+		this.logger.debug(`State record for stack '${shownStackName}' carries body region ` + (shownBodyRegion.text === "" ? `${kind}, which renders as nothing — its kind above is the whole of it.` : `'${shownBodyRegion.text}'${shownBodyRegion.truncated ? " [cut]" : ""}.`));
+		return {
+			state: {
+				...state,
+				region
+			},
+			divergentBodyRegion: raw
+		};
+	}
 	async probeLegacyState(stackName) {
 		try {
 			const response = await this.s3Client.send(new GetObjectCommand({
@@ -10957,6 +11079,15 @@ var S3StateBackend = class {
 				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' has region '${displaySafe(state.region, { asciiOnly: true }) || "<unrenderable>"}', not '${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}' — skipping legacy fallback.`);
 				return null;
 			}
+			const legacyRegion = state.region;
+			if (legacyRegion !== void 0 && (typeof legacyRegion !== "string" || legacyRegion === "")) {
+				this.logger.debug(`Legacy state for stack '${this.displayName(stackName)}' names no usable region (${describeRegionValueKind(legacyRegion)}); reading it as region-less.`);
+				const { region: _dropped, ...withoutRegion } = state;
+				return {
+					state: withoutRegion,
+					etag: response.ETag
+				};
+			}
 			return {
 				state,
 				etag: response.ETag
@@ -17847,7 +17978,7 @@ async function withRetry(operation, logicalId, opts = {}) {
 		return await operation();
 	} catch (error) {
 		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
+		const message = describeAwsFailure(error).detail;
 		const classifyText = retryClassificationText(error);
 		if (isMarkedNonRetryable(error)) throw error;
 		const retryable = opts.isRetryable ? opts.isRetryable(classifyText, error) : isRetryableTransientError(error, classifyText);
@@ -20971,18 +21102,26 @@ function malformedStateRefusalMessage(stackName, region) {
 * **That remedy is a TEMPLATE, not a substituted command, and the asymmetry
 * with the `cdkd state show` line above it is the point.** `state orphan`
 * DELETES a record; `state show` reads one. The `region` this function is
-* handed comes from `destroy-runner.ts`'s
-* `state.region ?? ctx.baseRegion`, and `state.region` is RECORD-BODY content
-* that `getState` does not check against the key it loaded from — measured
-* 2026-09-17: a record planted at `.../us-east-1/state.json` carrying
-* `"region": "eu-west-1"` rendered a pasteable
-* `cdkd state orphan <stack> --stack-region eu-west-1`, aiming a destructive
-* command at a DIFFERENT region's record for the same stack. That is the
-* misdirection class {@link stackClause} records for stack names, one field
-* over. Substituting into the read-only `state show` line is the pre-existing
-* behaviour of {@link malformedStateDetail} and is left alone; what this lane
-* must not add is a destructive one. The divergence itself — the runner also
-* LOCKS and DELETES against the body region — is go-to-k/cdkd#3328.
+* handed comes from `destroy-runner.ts`'s `state.region ?? ctx.baseRegion` —
+* which WAS record-body content `getState` did not check against the key it
+* loaded from, measured 2026-09-17: a record planted at
+* `.../us-east-1/state.json` carrying `"region": "eu-west-1"` rendered a
+* pasteable `cdkd state orphan <stack> --stack-region eu-west-1`, aiming a
+* destructive command at a DIFFERENT region's record for the same stack. That
+* is the misdirection class {@link stackClause} records for stack names, one
+* field over. Substituting into the read-only `state show` line is the
+* pre-existing behaviour of {@link malformedStateDetail} and is left alone;
+* what this lane must not add is a destructive one.
+*
+* **go-to-k/cdkd#3328 closed the BODY half of that, and the template stays
+* anyway** — the measurement above is now history, not a live repro.
+* `S3StateBackend.getState` normalizes a region-scoped record's `region` to
+* its KEY's and warns on a body that disagreed, so `state.region` reaching
+* this function is the key's region. But the key is an S3 KEY SEGMENT, which
+* is bucket-plantable in its own right (`cdkd/<stack>/<anything>/state.json`
+* lists as a region), and a legacy record still falls through to
+* `ctx.baseRegion`. So the value is still not this process's own, and a
+* DELETING command built from it is still the thing not to hand over.
 *
 * **A template is not enough on its own, because the name the reader would
 * type into it comes from the clause ABOVE.** `safeIdentifier` composes
@@ -21007,9 +21146,16 @@ function malformedStateRefusalMessage(stackName, region) {
 * "with the stack and region this message NAMES", which is the attacker's
 * region (review round 2 of go-to-k/cdkd#3332: templating had removed the
 * paste, not the aim). The arm therefore points at the record's S3 KEY, which
-* `getState` resolved and a record body cannot forge, and says outright that
-* the region printed above is body-derived and need not match it. The
-* divergence is go-to-k/cdkd#3328.
+* `getState` resolved and a record body cannot forge.
+*
+* Since go-to-k/cdkd#3328 the printed region IS that key's — `getState`
+* normalizes a region-scoped record's `region` to the key's region and warns
+* on a body that disagreed — so the arm no longer has to warn the reader that
+* the two may differ, and its text no longer does. It still says WHERE the
+* region comes from and still sends the reader to `cdkd state list --long` to
+* confirm the key, because a key segment is itself bucket-plantable and
+* because a LEGACY record has no key region at all, in which case the value
+* printed is the CLI's own and `--stack-region` must be omitted.
 *
 * **The cap this arm measures against is `STACK_REF_MAX_CODE_POINTS`, not the
 * 128 every other text in this module uses**, and it is threaded rather than
@@ -21027,7 +21173,7 @@ function malformedStateRefusalMessage(stackName, region) {
 function malformedDestroyResourcesRefusalMessage(stackName, region) {
 	const cap = STACK_REF_MAX_CODE_POINTS;
 	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(region, cap) === region;
-	return `${exact ? malformedStateDetail(stackName, region, cap) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is read from the record's own BODY, which need not match its key. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
+	return `${exact ? malformedStateDetail(stackName, region, cap) : `${stackClause(void 0, void 0)} ${MALFORMED_RESOURCES_DIAGNOSIS}`} This command DELETES state, so it refuses rather than continuing: the resource map IS the list of what to delete, so an unreadable one counts as ZERO resources and the run takes the empty-stack fast path, which removes state.json and reports success while every resource the record named is still live in AWS and no longer referenced by anything. Reading the bag as EMPTY is that same outcome rather than an alternative to it, so there is no repair available here. Repair or remove the record first. ${exact ? "To drop the record deliberately and leave the live resources standing, run 'cdkd state orphan' against the stack and the region THE RECORD'S S3 KEY holds — spelled out rather than pasteable, because that command DELETES a record and the region printed above is the one cdkd was pointed at, not a value cdkd owns. Confirm the key with 'cdkd state list --long' — a legacy record shows none, and for one of those the flag must be OMITTED or it selects nothing — then: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what is printed above is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`}`;
 }
 /**
 * For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `resources`
@@ -21049,6 +21195,89 @@ function refuseMalformedResourcesForDestroy(state, stackName, region) {
 	if (hasReadableResources(state)) return;
 	throw markNonRetryable(new CdkdError(malformedDestroyResourcesRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
 }
+/** The code a destroy refusal over a body/key region divergence carries. */
+const STATE_REGION_DIVERGED = "STATE_REGION_DIVERGED";
+/**
+* The DESTROY refusal text for a record whose BODY names a different region
+* than the KEY it was read from, while it still lists resources (issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328), review round 1).
+*
+* **This is the one case where adopting the key is not enough, and it is a
+* consequence of adopting it rather than an argument against.**
+* `S3StateBackend.getState` replaces the body's `region` with the key's, which
+* is right for the key math, the lock and the record's own identity — cdkd
+* stamps the key's region into every body it writes, so a divergence means
+* another writer. But WHERE THE RESOURCES ARE is a different question, and a
+* divergent record is the one shape that gives two answers to it. cdkd cannot
+* tell which half is honest:
+*
+* - the BODY lies (a planted field, the misdirection this issue is about) —
+*   the resources are in the key's region and acting there is correct;
+* - the KEY lies (an `aws s3 cp` between region prefixes, a restore, a
+*   third-party writer) — the resources are in the body's region, and acting
+*   in the key's finds NOTHING.
+*
+* The second one is not a wash, it is silent data loss: `destroy-runner.ts`
+* reads a `*NotFound` from a provider as ALREADY DELETED (`deletedCount++`,
+* the row dropped from the record), so a whole stack of live resources would
+* be reported destroyed and `deleteState` would then remove the only record
+* naming them. `assertRegionMatch` — the guard that exists to stop exactly
+* that inference — cannot fire, because after normalization
+* `DeleteContext.expectedRegion` and the client region are the same value by
+* construction.
+*
+* So the refusal is narrow by design and its trigger is the CONJUNCTION:
+* divergent AND at least one resource. **A resource-less record is
+* deliberately NOT refused** — there is nothing to orphan, and that is the
+* issue's own measured repro plus the `cdkd state destroy` recovery path the
+* read-side decision exists to protect. The read path still refuses NOTHING:
+* `cdkd state show`, `cdkd state list` and `cdkd state orphan` all keep
+* working on the very record this refuses to DELETE FROM, which is what keeps
+* it fixable.
+*
+* The remedy is a TEMPLATE, never a substituted command, for the reason
+* {@link malformedDestroyResourcesRefusalMessage} records — the region reaching
+* this builder is an S3 key SEGMENT, which anyone able to write the bucket
+* chooses. (NOT "because cdkd does not know which region belongs in the flag",
+* which an earlier revision said and which is false for this flag:
+* `--stack-region` on `state orphan` selects the RECORD, and the key's region
+* is exactly that.) The body's region is not printed at all — its KIND is, the
+* bounded token {@link describeRegionValueKind} produces, for the reason
+* `getState`'s warn gives.
+*
+* And the target-naming half is GATED on both identifiers rendering EXACTLY,
+* the second half of that sibling's rule: a template is not enough on its own,
+* because the name the reader types into it comes from the clause ABOVE.
+*/
+function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount) {
+	const cap = STACK_REF_MAX_CODE_POINTS;
+	const exact = safeIdentifier(stackName, cap) === stackName && safeIdentifier(keyRegion, cap) === keyRegion;
+	const lists = resourceCount === void 0 ? "its resources map cannot be read" : `it still lists ${resourceCount} resource${resourceCount === 1 ? "" : "s"}`;
+	const kind = describeRegionValueKind(divergentBodyRegion);
+	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
+	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: cdkd state orphan <stack> --stack-region <region>" : `This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records as stored with 'cdkd state list --long', which prints a name needing sanitizing in quoted form, and act on the one whose key matches. Inspect it with: ${inspectCommand(void 0, void 0)}`;
+	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
+}
+/**
+* Refuse a destroy over a record whose body region diverged from its key's,
+* while it still lists resources — see
+* {@link divergentRecordRegionRefusalMessage} for why the conjunction is the
+* trigger and why a resource-less record is not refused.
+*
+* CALL IT AT THE TOP OF THE DESTROY, **above the `resourceCount` fast path**,
+* for the placement reason {@link refuseMalformedResourcesForDestroy} gives —
+* and BELOW that call, because this one reads the bag's SIZE and only that
+* guard proves the bag can be read at all.
+*
+* `divergentBodyRegion` is `S3StateBackend.getState`'s report, `undefined` on
+* every record that agreed with its key — which is every record cdkd wrote.
+*/
+function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion) {
+	if (divergentBodyRegion === void 0) return;
+	const resourceCount = isReadableBag(state.resources) ? Object.keys(state.resources).length : void 0;
+	if (resourceCount === 0) return;
+	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount), STATE_REGION_DIVERGED));
+}
 /**
 * The DEPLOY refusal text for the `resources` bag (issue
 * [#3161](https://github.com/go-to-k/cdkd/issues/3161)).
@@ -21560,10 +21789,12 @@ function stackClause(stackName, region) {
 *
 * **It diverges from {@link malformedDestroyResourcesRefusalMessage}, which
 * keeps `cdkd state orphan` a template on purpose, and the difference is where
-* the identity comes from.** That builder is reached with a record-derived
-* REGION (`state.region ?? ctx.baseRegion` in `destroy-runner.ts`) -- its stack
-* name is the caller's, so the region alone is what would aim a destructive
-* command using a value the record supplied. This one is reached only with the caller's
+* the identity comes from.** That builder is reached with a REGION cdkd read
+* off the state bucket (`state.region ?? ctx.baseRegion` in
+* `destroy-runner.ts`; since go-to-k/cdkd#3328 the first operand is the S3
+* KEY's region rather than the record body's, which is a key SEGMENT and so
+* still plantable) -- its stack name is the caller's, so the region alone is
+* what would aim a destructive command using a value cdkd does not own. This one is reached only with the caller's
 * synthesized stack and `pickStackRegion`'s answer, so substituting is safe and
 * omitting the region is the wider action. Two opposite precedents in one
 * module; neither is the general rule.
@@ -22639,6 +22870,21 @@ var DiffCalculator = class DiffCalculator {
 * The three environment variables that carry a static AWS identity into a child
 * process or container. Spelled once here so a forwarding site and the fence
 * that watches it cannot disagree about the population.
+*
+* That claim is only true while the population is IMPORTED, and for one release
+* it was not: every `forwardAwsEnv` body hardcoded its own array and
+* `local-surface-env-identity.test.ts` hardcoded the quoted literal, so the
+* constant guaranteed nothing and a fourth key added here would have reached
+* neither (issue [#3250](https://github.com/go-to-k/cdkd/issues/3250) item 4).
+* Every forwarding site now spreads this array and the fence treats the
+* constant's NAME as one of its site shapes, with a floor per spelling — so a
+* site quietly going back to a local copy drops out of one shape's count while
+* the other stays green, which is the failure that floor exists to report.
+*
+* Derive the readers with
+* `grep -rn AWS_CREDENTIAL_ENV_KEYS src tests`, never from a list written here:
+* a list of call sites in a doc comment is the shape that went stale in the
+* first place.
 */
 const AWS_CREDENTIAL_ENV_KEYS = [
 	"AWS_ACCESS_KEY_ID",
@@ -22686,6 +22932,25 @@ function callerEnvCredentials() {
 	return getPreAssumeEnvCredentials();
 }
 /**
+* Is the credential triple currently in `process.env` cdkd's OWN `--role-arn`
+* assumed role rather than the caller's?
+*
+* For a site that has to EXPLAIN a `callerEnvCredentials()` miss, not for one
+* that has to act on it. `undefined` from that function is ambiguous to a USER
+* in exactly one direction: with a role assumed, `AWS_ACCESS_KEY_ID` is visibly
+* set — cdkd set it — so an error telling them to set it is advice they have
+* already followed, and the real reason is that cdkd refuses to act as the role
+* here (issue [#3250](https://github.com/go-to-k/cdkd/issues/3250) item 5).
+*
+* Do not branch BEHAVIOUR on this. The three-way decision belongs to
+* `callerEnvCredentials` / `applyCallerIdentityCredentials`, which distinguish
+* "no role assumed" from "a role assumed over a caller who had nothing" — a
+* distinction this boolean deliberately collapses.
+*/
+function envCredentialsAreAssumedRole() {
+	return getAssumedRoleCredentials() !== void 0;
+}
+/**
 * Correct an environment bag that was populated by copying `process.env`, so it
 * carries the CALLER's identity rather than a `--role-arn` assumed role's.
 *
@@ -32160,7 +32425,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-CHeJf5zw.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-7KM2pV3Q.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -36308,8 +36573,8 @@ var IAMRoleProvider = class {
 					this.logger.warn(`Skipped deleting old role ${physicalId} during replacement: ${deleteResult.reason}. The old role may be orphaned and require manual cleanup.`);
 				}
 			} catch (error) {
-				orphanReason = `old role ${physicalId} could not be deleted: ${safeStringify(error)}`;
-				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${safeStringify(error)}. The old role may be orphaned and require manual cleanup.`);
+				orphanReason = `old role ${physicalId} could not be deleted: ${safeStringify$1(error)}`;
+				this.logger.warn(`Failed to delete old role ${physicalId} during replacement: ${safeStringify$1(error)}. The old role may be orphaned and require manual cleanup.`);
 			}
 			const base = {
 				physicalId: createResult.physicalId,
@@ -38526,6 +38791,23 @@ function makeSiblingClaimReader(params) {
 //#endregion
 //#region src/types/deployment-events.ts
 /**
+* Structured deployment-event types (issue #808).
+*
+* cdkd's CloudFormation `DescribeStackEvents` equivalent: every deploy /
+* destroy run appends one JSONL line per lifecycle event to
+* `s3://{bucket}/{prefix}/{stackName}/{region}/deployments/{runId}.jsonl`,
+* plus a small `deployments/index.json` listing the last N runs.
+*
+* Deliberately a SEPARATE key family from `state.json` — no state schema
+* bump is involved (state stays at its current version), and event files
+* survive `cdkd destroy` (state deletion does not touch `deployments/`),
+* so post-mortem context is available even after the stack is gone.
+*
+* SECURITY: events carry error + metadata ONLY. Resource properties are
+* never recorded here (they may contain secrets); properties already live
+* in state.json.
+*/
+/**
 * Walk an error's `.cause` chain (bounded) and extract metadata for a
 * deployment event. The outermost error supplies `name` / `message`
 * (matching what the user sees in the log); the innermost AWS-SDK-shaped
@@ -38535,7 +38817,7 @@ function makeSiblingClaimReader(params) {
 function extractDeploymentEventError(err) {
 	if (!(err instanceof Error)) return {
 		name: "UnknownError",
-		message: String(err)
+		message: safeStringify$1(err)
 	};
 	const result = {
 		name: err.name || "Error",
@@ -38707,7 +38989,7 @@ const PRE_DELETE_SNAPSHOT_TIMEOUT_MS = 36e5;
 /** Post-snapshot settle budget for a Redshift cluster before its delete. */
 const REDSHIFT_CLUSTER_SETTLE_TIMEOUT_MS = 12e5;
 function errMsg(error) {
-	return error instanceof Error ? error.message : String(error);
+	return describeAwsFailure(error).detail;
 }
 function isVolumeNotFound(error) {
 	return (error instanceof Error ? error.name : "") === "InvalidVolume.NotFound" || errMsg(error).includes("InvalidVolume.NotFound");
@@ -45154,5 +45436,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, isCdkdError as $i, scrubResourceRecord as $n, Synthesizer as $r, s3BucketArn as $t, extractDeploymentEventError as A, setAwsClients as Ai, repairMalformedResourcesForReadOnly as An, isCrossRegionRedirect as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LocalStartServiceError as Bi, TEMPLATE_SOURCED_RULES as Bn, describeDockerExecFailure as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, AssemblyReader as Ci, refuseMalformedOutputs as Cn, loadPublishableAssetManifest as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, AwsClients as Di, refuseMalformedState as Dn, assertAssetBucketRegion as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, resolveBucketRegion as Ei, refuseMalformedResourcesForDestroy as En, BOOTSTRAP_MARKER_PREFIX as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, DependencyError as Fi, DagBuilder as Fn, buildDenyExternalAccessPolicy as Fr, isSettledInstanceState as Ft, gray as G, ProvisioningError as Gi, identityKeyFor as Gn, partitionSensitiveEnv as Gr, readConfigString as Gt, formatResourceLine as H, MalformedProducerRecordRefusalError as Hi, createSecretMasker as Hn, dockerSpawnEnvWithSensitive as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DeployCancelledError as Ii, TemplateParser as In, describeAwsFailure as Ir, WAFv2WebACLProvider as It, yellow as J, StackHasActiveImportsError as Ji, maskSecretsInError as Jn, runDockerStreaming as Jr, requireConfigObject as Jt, green as K, ResourceTimeoutError as Ki, isSingleDynamicReferenceToken as Kn, redactDockerArgvValues as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DynamicReferenceRegionAmbiguousError as Li, STATE_SOURCED_BASELINE_RULES as Ln, safeStringify as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, CdkdError as Mi, findSilentDropProperties as Mn, readBootstrapMarkerBody as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, ConfigError as Ni, describeTypeWithThrottleRetry as Nn, validateAssetBucketName as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, getAwsClients as Oi, repairMalformedOutputsForReadOnly as On, ensureAssetStorage as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, CrossAccountSecretRefusalError as Pi, withRetry as Pn, validateContainerRepoName as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, formatError as Qi, redactSecretsForState as Qn, getDockerImageBySourceHash as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, IntrinsicResolutionRefusalError as Ri, STATE_SOURCED_CROSS_GENERATION_RULES as Rn, buildDockerImage as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, derivePartitionAndUrlSuffix as Si, refuseMalformedNestedChildOutputs as Sn, createAssetRedirectResolver as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, clearBucketRegionCache as Ti, refuseMalformedResourcePropertiesForOrphan as Tn, AssetModeResolver as Tr, carriesDynamicReference as Tt, bold as U, NestedStackChildDirectDestroyError as Ui, dynamicReferenceTokens as Un, formatDockerLoginError as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LockError as Vi, carriesSecretMask as Vn, describeDockerFailure as Vr, coerceCfnInteger as Vt, cyan as W, PartialFailureError as Wi, errorCauseChain as Wn, getDockerCmd as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StateError as Xi, recordMaskOnlyValue as Xn, stripControlChars as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StackTerminationProtectionError as Yi, maskSecretsInText as Yn, escapeRegExp$1 as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, SynthesisError as Zi, recoverMaskedOutput as Zn, AssetManifestLoader as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as _i, malformedRenderedContainersWarning as _n, shouldRetainResource as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isTransientServerError as aa, resolveCaptureObservedState as ai, applyCallerIdentityCredentials as an, forceQuitRecoveryClause as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, PARTITION_TABLE as bi, malformedStateRefusalMessage as bn, WorkGraph as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, retryClassificationText as ca, resolveStateBucketWithDefaultAndSource as ci, INTRINSIC_KEYS as cn, CUSTOM_RESOURCE_RESPONSE_PREFIX as cr, createMaskedRetryLogger as ct, updatePartialReason as d, warnDeprecatedNoPrefixCliFlag as di, hasReadableResources as dn, hasReadableExportSet as dr, beginCommandInterruptScope as dt, normalizeAwsError as ea, synthesisStatusMessage as ei, s3BucketDomainName as en, LockManager as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, CFN_TEMPLATE_BODY_LIMIT as fi, malformedExportNamesWarning as fn, importableOutputKeys as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, uploadCfnTemplate as gi, malformedOutputsWarning as gn, orphansCarriedFrom as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, findLargeInlineResources as hi, malformedOutputsRefusalMessage as hn, orphansAfterRollback as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isThrottlingError as ia, resolveAutoAssetStorage as ii, applyRoleArnIfSet as in, buildLockContentionMessage as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, AssetError as ji, findActionableSilentDrops as jn, parseBootstrapMarker as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, resetAwsClients as ki, repairMalformedResourcePropertiesForReadOnly as kn, getBootstrapMarkerKey as kr, getAccountInfo as kt, replayRollback as l, __exportAll as la, resolveUseCdkBootstrapAssets as li, STATE_RESOURCES_MALFORMED as ln, DEFAULT_STATE_PREFIX as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, MIGRATE_TMP_PREFIX as mi, malformedLocalOutputsWarning as mn, isReadableBag as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isMarkedNonRetryable as na, getLegacyStateBucketName as ni, s3BucketRegionalDomainName as nn, rebuildClientForBucketRegion as nr, getCurrentResourceSecrets as nt, planFailedOps as o, markNonRetryable as oa, resolveSkipPrefix as oi, callerEnvCredentials as on, formatLockExpiry as or, ProviderRegistry as ot, maskingRetryLogger as p, CFN_TEMPLATE_URL_LIMIT as pi, malformedExportSourceWarning as pn, importableOutputs as pr, interruptWatchListenerCount as pt, red as q, ResourceUpdateNotSupportedError as qi, markSameGenerationBag as qn, runDockerForeground as qr, requireConfigArray as qt, DeployEngine as r, isRetryableTransientError as ra, resolveApp as ri, s3BucketWebsiteUrl as rn, buildForceUnlockCommand as rr, IAMRoleProvider as rt, planRollback as s, markRedactedCause as sa, resolveStateBucketWithDefault as si, DiffCalculator as sn, shellQuote as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, withErrorHandling as ta, getDefaultStateBucketName as ti, s3BucketDualStackDomainName as tn, S3StateBackend as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, stateBucketExistenceConfirmed as ui, hasReadableOutputs as un, exportNamesCarriedFrom as ur, maskerOrIdentity as ut, keptWholeReasonText as v, decodeListingKey as vi, malformedResourcePropertiesWarning as vn, AssetPublisher as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, processStackMessages as wi, refuseMalformedOutputsForDestroy as wn, rewriteTemplateAssetReferences as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, canonicalizeRegion as xi, producerRecordKey as xn, buildAssetRedirectMap as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, expectedOwnerParam as yi, malformedResourcesWarning as yn, stringifyValue as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, LocalInvokeBuildError as zi, STATE_SOURCED_READBACK_RULES as zn, describeDockerCapturedOutput as zr, assertRegionMatch as zt };
-//# sourceMappingURL=deploy-engine-BcNBidfy.js.map
+export { secretBearing as $, formatError as $i, recordMaskOnlyValue as $n, getDockerImageBySourceHash as $r, s3BucketArn as $t, extractDeploymentEventError as A, resetAwsClients as Ai, refuseMalformedState as An, assertAssetBucketRegion as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, LocalInvokeBuildError as Bi, STATE_SOURCED_BASELINE_RULES as Bn, describeDockerCapturedOutput as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, derivePartitionAndUrlSuffix as Ci, producerRecordKey as Cn, WorkGraph as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, resolveBucketRegion as Di, refuseMalformedOutputsForDestroy as Dn, rewriteTemplateAssetReferences as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, clearBucketRegionCache as Ei, refuseMalformedOutputs as En, loadPublishableAssetManifest as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, CrossAccountSecretRefusalError as Fi, findSilentDropProperties as Fn, readBootstrapMarkerBody as Fr, isSettledInstanceState as Ft, gray as G, PartialFailureError as Gi, createSecretMasker as Gn, getDockerCmd as Gr, readConfigString as Gt, formatResourceLine as H, LockError as Hi, STATE_SOURCED_READBACK_RULES as Hn, describeDockerFailure as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, DependencyError as Ii, describeTypeWithThrottleRetry as In, validateAssetBucketName as Ir, WAFv2WebACLProvider as It, yellow as J, ResourceUpdateNotSupportedError as Ji, identityKeyFor as Jn, runDockerForeground as Jr, requireConfigObject as Jt, green as K, ProvisioningError as Ki, dynamicReferenceTokens as Kn, partitionSensitiveEnv as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, DeployCancelledError as Li, withRetry as Ln, validateContainerRepoName as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, AssetError as Mi, repairMalformedResourcePropertiesForReadOnly as Mn, getBootstrapMarkerKey as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, CdkdError as Ni, repairMalformedResourcesForReadOnly as Nn, isCrossRegionRedirect as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, AwsClients as Oi, refuseMalformedResourcePropertiesForOrphan as On, AssetModeResolver as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, ConfigError as Pi, findActionableSilentDrops as Pn, parseBootstrapMarker as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, SynthesisError as Qi, maskSecretsInText as Qn, AssetManifestLoader as Qr, withSharedDrainBudget as Qt, coerceWarmThroughput as R, DynamicReferenceRegionAmbiguousError as Ri, DagBuilder as Rn, buildDenyExternalAccessPolicy as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, canonicalizeRegion as Si, malformedStateRefusalMessage as Sn, stringifyValue as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, processStackMessages as Ti, refuseMalformedNestedChildOutputs as Tn, createAssetRedirectResolver as Tr, carriesDynamicReference as Tt, bold as U, MalformedProducerRecordRefusalError as Ui, TEMPLATE_SOURCED_RULES as Un, dockerSpawnEnvWithSensitive as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, LocalStartServiceError as Vi, STATE_SOURCED_CROSS_GENERATION_RULES as Vn, describeDockerExecFailure as Vr, coerceCfnInteger as Vt, cyan as W, NestedStackChildDirectDestroyError as Wi, carriesSecretMask as Wn, formatDockerLoginError as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, StackTerminationProtectionError as Xi, markSameGenerationBag as Xn, escapeRegExp$1 as Xr, classifyReplaySecretRegion as Xt, collectDeclaredOutputNames as Y, StackHasActiveImportsError as Yi, isSingleDynamicReferenceToken as Yn, runDockerStreaming as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, StateError as Zi, maskSecretsInError as Zn, stripControlChars as Zr, producerRegionsFromState as Zt, isSecretBearingReferenceString as _, uploadCfnTemplate as _i, malformedOutputsRefusalMessage as _n, isReadableBag as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, isThrottlingError as aa, resolveAutoAssetStorage as ai, AWS_CREDENTIAL_ENV_KEYS as an, rebuildClientForBucketRegion as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, expectedOwnerParam as bi, malformedResourcePropertiesWarning as bn, shouldRetainResource as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, markRedactedCause as ca, resolveStateBucketWithDefault as ci, envCredentialsAreAssumedRole as cn, forceQuitRecoveryClause as cr, createMaskedRetryLogger as ct, updatePartialReason as d, safeStringify$1 as da, stateBucketExistenceConfirmed as di, STATE_RESOURCES_MALFORMED as dn, CUSTOM_RESOURCE_RESPONSE_PREFIX as dr, beginCommandInterruptScope as dt, isCdkdError as ea, Synthesizer as ei, s3BucketDomainName as en, recoverMaskedOutput as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, __exportAll as fa, warnDeprecatedNoPrefixCliFlag as fi, hasReadableOutputs as fn, DEFAULT_STATE_PREFIX as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, findLargeInlineResources as gi, malformedLocalOutputsWarning as gn, importableOutputs as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, MIGRATE_TMP_PREFIX as hi, malformedExportSourceWarning as hn, importableOutputKeys as hr, startInterruptWatch as ht, DeploymentEventsReader as i, isRetryableTransientError as ia, resolveApp as ii, applyRoleArnIfSet as in, S3StateBackend as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, setAwsClients as ji, repairMalformedOutputsForReadOnly as jn, ensureAssetStorage as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, getAwsClients as ki, refuseMalformedResourcesForDestroy as kn, BOOTSTRAP_MARKER_PREFIX as kr, getAccountInfo as kt, replayRollback as l, retryClassificationText as la, resolveStateBucketWithDefaultAndSource as li, DiffCalculator as ln, formatLockExpiry as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, CFN_TEMPLATE_URL_LIMIT as mi, malformedExportNamesWarning as mn, hasReadableExportSet as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, withErrorHandling as na, getDefaultStateBucketName as ni, s3BucketRegionalDomainName as nn, scrubResourceRecord as nr, getCurrentResourceSecrets as nt, planFailedOps as o, isTransientServerError as oa, resolveCaptureObservedState as oi, applyCallerIdentityCredentials as on, buildForceUnlockCommand as or, ProviderRegistry as ot, maskingRetryLogger as p, CFN_TEMPLATE_BODY_LIMIT as pi, hasReadableResources as pn, exportNamesCarriedFrom as pr, interruptWatchListenerCount as pt, red as q, ResourceTimeoutError as qi, errorCauseChain as qn, redactDockerArgvValues as qr, requireConfigArray as qt, DeployEngine as r, isMarkedNonRetryable as ra, getLegacyStateBucketName as ri, s3BucketWebsiteUrl as rn, LockManager as rr, IAMRoleProvider as rt, planRollback as s, markNonRetryable as sa, resolveSkipPrefix as si, callerEnvCredentials as sn, buildLockContentionMessage as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, normalizeAwsError as ta, synthesisStatusMessage as ti, s3BucketDualStackDomainName as tn, redactSecretsForState as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, describeAwsFailure as ua, resolveUseCdkBootstrapAssets as ui, INTRINSIC_KEYS as un, shellQuote as ur, maskerOrIdentity as ut, keptWholeReasonText as v, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as vi, malformedOutputsWarning as vn, orphansAfterRollback as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, AssemblyReader as wi, refuseDivergentRecordRegionForDestroy as wn, buildAssetRedirectMap as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, PARTITION_TABLE as xi, malformedResourcesWarning as xn, AssetPublisher as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, decodeListingKey as yi, malformedRenderedContainersWarning as yn, orphansCarriedFrom as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, IntrinsicResolutionRefusalError as zi, TemplateParser as zn, buildDockerImage as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-CbIc5Y73.js.map