@go-to-k/cdkd 0.290.32 → 0.290.34

package/dist/{program-DdmCUgOP.js → program-Dh1J573K.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as recordMaskOnlyValue, $r as AssetManifestLoader, $t as s3BucketArn, A as extractDeploymentEventError, Ai as getAwsClients, An as refuseMalformedState, Ar as BOOTSTRAP_MARKER_PREFIX, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as IntrinsicResolutionRefusalError, Bn as STATE_SOURCED_BASELINE_RULES, Br as buildDockerImage, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as canonicalizeRegion, Cn as producerRecordKey, Cr as stringifyValue, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Dn as refuseMalformedOutputsForDestroy, Dr as loadPublishableAssetManifest, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as processStackMessages, En as refuseMalformedOutputs, Er as createAssetRedirectResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as findSilentDropProperties, Fr as parseBootstrapMarker, Ft as isSettledInstanceState, G as gray, Gi as NestedStackChildDirectDestroyError, Gn as createSecretMasker, Gr as formatDockerLoginError, Gt as readConfigString, H as formatResourceLine, Hi as LocalStartServiceError, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerExecFailure, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as CrossAccountSecretRefusalError, In as describeTypeWithThrottleRetry, Ir as readBootstrapMarkerBody, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceTimeoutError, Jn as identityKeyFor, Jr as redactDockerArgvValues, Jt as requireConfigObject, K as green, Ki as PartialFailureError, Kn as dynamicReferenceTokens, Kr as getDockerCmd, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Ln as withRetry, Lr as validateAssetBucketName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as setAwsClients, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as ensureAssetStorage, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as repairMalformedResourcesForReadOnly, Nr as getBootstrapMarkerKey, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resolveBucketRegion, On as refuseMalformedResourcePropertiesForOrphan, Or as rewriteTemplateAssetReferences, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CdkdError, Pn as findActionableSilentDrops, Pr as isCrossRegionRedirect, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as stripControlChars, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DeployCancelledError, Rn as DagBuilder, Rr as validateContainerRepoName, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as PARTITION_TABLE, Sn as malformedStateRefusalMessage, Sr as AssetPublisher, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as AssemblyReader, Tn as refuseMalformedNestedChildOutputs, Tr as buildAssetRedirectMap, Tt as carriesDynamicReference, U as bold, Un as TEMPLATE_SOURCED_RULES, Ur as describeDockerFailure, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalInvokeBuildError$1, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerCapturedOutput, Vt as coerceCfnInteger, W as cyan, Wi as MalformedProducerRecordRefusalError, Wn as carriesSecretMask, Wr as dockerSpawnEnvWithSensitive, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackHasActiveImportsError, Xn as markSameGenerationBag, Xr as runDockerStreaming, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as ResourceUpdateNotSupportedError, Yn as isSingleDynamicReferenceToken, Yr as runDockerForeground, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zi as StackTerminationProtectionError, Zn as maskSecretsInError, Zr as escapeRegExp, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as findLargeInlineResources, _n as malformedOutputsRefusalMessage, _r as importableOutputs, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isRetryableTransientError, ai as resolveApp, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as decodeListingKey, bn as malformedResourcePropertiesWarning, br as orphansCarriedFrom, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markNonRetryable, ci as resolveSkipPrefix, cn as envCredentialsAreAssumedRole, cr as buildLockContentionMessage, ct as createMaskedRetryLogger, d as updatePartialReason, da as describeAwsFailure, di as resolveUseCdkBootstrapAssets, dn as STATE_RESOURCES_MALFORMED, dr as shellQuote, dt as beginCommandInterruptScope, ei as getDockerImageBySourceHash, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fa as safeStringify, fi as stateBucketExistenceConfirmed, fn as hasReadableOutputs, fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as MIGRATE_TMP_PREFIX, gn as malformedLocalOutputsWarning, gr as importableOutputKeys, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as CFN_TEMPLATE_URL_LIMIT, hn as malformedExportSourceWarning, hr as hasReadableExportSet, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isMarkedNonRetryable, ii as getLegacyStateBucketName, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as resetAwsClients, jn as repairMalformedOutputsForReadOnly, jr as assertAssetBucketRegion, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as AwsClients, kn as refuseMalformedResourcesForDestroy, kr as AssetModeResolver, kt as getAccountInfo, l as replayRollback, la as markRedactedCause, li as resolveStateBucketWithDefault, ln as DiffCalculator, lr as forceQuitRecoveryClause, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_BODY_LIMIT, mn as malformedExportNamesWarning, mr as exportNamesCarriedFrom, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as normalizeAwsError, ni as synthesisStatusMessage, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isThrottlingError, oi as resolveAutoAssetStorage, on as applyCallerIdentityCredentials, or as UNREPRODUCIBLE_LOCK_CLAUSE, ot as ProviderRegistry, p as maskingRetryLogger, pi as warnDeprecatedNoPrefixCliFlag, pn as hasReadableResources, pr as DEFAULT_STATE_PREFIX, pt as interruptWatchListenerCount, q as red, qi as ProvisioningError, qn as errorCauseChain, qr as partitionSensitiveEnv, qt as requireConfigArray, r as DeployEngine, ra as withErrorHandling, ri as getDefaultStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as isTransientServerError, si as resolveCaptureObservedState, sn as callerEnvCredentials, sr as buildForceUnlockCommand, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as Synthesizer, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as retryClassificationText, ui as resolveStateBucketWithDefaultAndSource, un as INTRINSIC_KEYS, ur as formatLockExpiry, ut as maskerOrIdentity, v as keptWholeReasonText, vi as uploadCfnTemplate, vn as malformedOutputsWarning, vr as isReadableBag, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as derivePartitionAndUrlSuffix, wn as refuseDivergentRecordRegionForDestroy, wr as WorkGraph, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as expectedOwnerParam, xn as malformedResourcesWarning, xr as shouldRetainResource, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yn as malformedRenderedContainersWarning, yr as orphansAfterRollback, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as DynamicReferenceRegionAmbiguousError, zn as TemplateParser, zr as buildDenyExternalAccessPolicy, zt as assertRegionMatch } from "./deploy-engine-CfOsVRQB.js";
+import { $ as isExportAliasCollision, $n as maskSecretsInText, $r as stripControlChars, $t as withSharedDrainBudget, A as makeCanonicalizePropertiesFn, Ai as AwsClients, An as refuseMalformedResourcesForDestroy, Ar as AssetModeResolver, At as getAccountInfo, B as isWarmThroughputDecrease, Bi as DynamicReferenceRegionAmbiguousError, Bn as TemplateParser, Br as buildDenyExternalAccessPolicy, Bt as assertRegionMatch, C as PRE_DELETE_SNAPSHOT_TYPES, Ci as PARTITION_TABLE, Cn as malformedStateRefusalMessage, Cr as AssetPublisher, Ct as disableInstanceApiTermination, D as isFinalSnapshotError, Di as processStackMessages, Dn as refuseMalformedOutputs, Dr as createAssetRedirectResolver, Dt as carriesFetchableDynamicReference, E as createPreDeleteFinalSnapshot, Ei as AssemblyReader, En as refuseMalformedNestedChildOutputs, Er as buildAssetRedirectMap, Et as carriesDynamicReference, F as isStatefulRecreateTargetForReplace, Fi as CdkdError, Fn as findActionableSilentDrops, Fr as isCrossRegionRedirect, Ft as refStateLookupFromResource, G as cyan, Gi as MalformedProducerRecordRefusalError, Gn as carriesSecretMask, Gr as dockerSpawnEnvWithSensitive, Gt as configStringRefusal, H as toFiniteNumber, Hi as LocalInvokeBuildError$1, Hn as STATE_SOURCED_CROSS_GENERATION_RULES, Hr as describeDockerCapturedOutput, Ht as coerceCfnInteger, I as isStatefulRecreateTargetSync, In as findSilentDropProperties, Ir as parseBootstrapMarker, It as isSettledInstanceState, J as red, Ji as ProvisioningError, Jn as errorCauseChain, Jr as partitionSensitiveEnv, Jt as requireConfigArray, K as gray, Ki as NestedStackChildDirectDestroyError, Kn as createSecretMasker, Kr as formatDockerLoginError, Kt as readConfigString, L as renderStatefulReason, Li as CrossAccountSecretRefusalError, Ln as describeTypeWithThrottleRetry, Lr as readBootstrapMarkerBody, Lt as WAFv2WebACLProvider, M as makeSiblingClaimReader, Mi as resetAwsClients, Mn as repairMalformedOutputsForReadOnly, Mr as assertAssetBucketRegion, Mt as isNamelessDynamicReferenceError, N as planOrphanAdoption, Ni as setAwsClients, Nn as repairMalformedResourcePropertiesForReadOnly, Nr as ensureAssetStorage, Nt as isUnboundTemplateParameter, O as refusesFinalSnapshot, On as refuseMalformedOutputsForDestroy, Or as loadPublishableAssetManifest, Ot as cfnRefValueFromPhysicalId, P as MULTI_REGION_RECREATE_BLOCKED_TYPES, Pn as repairMalformedResourcesForReadOnly, Pr as getBootstrapMarkerKey, Pt as parameterTypeMayLoseSecretIdentity, Q as exportAliasCollisionScrubWarning, Qi as StackTerminationProtectionError, Qn as maskSecretsInError, Qr as escapeRegExp, Qt as producerRegionsFromState, R as WARM_THROUGHPUT_MEMBERS, Rn as withRetry, Rr as validateAssetBucketName, Rt as normalizeAwsTagsToCfn, S as ATOMIC_FINAL_SNAPSHOT_TYPES, Si as expectedOwnerParam, Sn as malformedResourcesWarning, Sr as shouldRetainResource, St as deleteSkipReason, T as ccRoutedFinalSnapshotError, Ti as derivePartitionAndUrlSuffix, Tn as refuseDivergentRecordRegionForDestroy, Tr as WorkGraph, Tt as IntrinsicFunctionResolver, U as formatResourceLine, Ui as LocalStartServiceError, Un as STATE_SOURCED_READBACK_RULES, Ur as describeDockerExecFailure, Ut as configBooleanRefusal, V as toCfnInteger, Vi as IntrinsicResolutionRefusalError, Vn as STATE_SOURCED_BASELINE_RULES, Vr as buildDockerImage, Vt as coerceCfnBoolean, W as bold, Wn as TEMPLATE_SOURCED_RULES, Wr as describeDockerFailure, Wt as configIntegerRefusal, X as collectDeclaredOutputNames, Xi as ResourceUpdateNotSupportedError, Xn as isSingleDynamicReferenceToken, Xr as runDockerForeground, Xt as requireConfigString, Y as yellow, Yi as ResourceTimeoutError, Yn as identityKeyFor, Yr as redactDockerArgvValues, Yt as requireConfigObject, Z as collectPublishedOutputNames, Zi as StackHasActiveImportsError, Zn as markSameGenerationBag, Zr as runDockerStreaming, Zt as classifyReplaySecretRegion, _ as bagHoldsSecretExpression, _i as MIGRATE_TMP_PREFIX, _n as malformedLocalOutputsWarning, _r as importableOutputKeys, _t as CloudControlProvider, a as DeploymentEventsStore, aa as isMarkedNonRetryable, ai as getLegacyStateBucketName, an as applyRoleArnIfSet, ar as S3StateBackend, at as collectInlinePolicyNamesManagedBySiblings, b as mergeNoChangeOutputs, bi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, bn as malformedRenderedContainersWarning, br as orphansAfterRollback, bt as UNSPECIFIED_SKIP_REASON, c as replayFailedOperations, ca as isTransientServerError, ci as resolveCaptureObservedState, cn as callerEnvCredentials, cr as buildForceUnlockCommand, ct as wouldReturnToSdkProvider, d as updatePartialMessage, da as retryClassificationText, di as resolveStateBucketWithDefaultAndSource, dn as INTRINSIC_KEYS, dr as formatLockExpiry, dt as maskerOrIdentity, ea as SynthesisError, ei as AssetManifestLoader, en as s3BucketArn, er as recordMaskOnlyValue, et as secretBearing, f as updatePartialReason, fa as describeAwsFailure, fi as resolveUseCdkBootstrapAssets, fn as STATE_RESOURCES_MALFORMED, fr as shellQuote, ft as beginCommandInterruptScope, g as computeImplicitDeleteEdges, gi as CFN_TEMPLATE_URL_LIMIT, gn as malformedExportSourceWarning, gr as hasReadableExportSet, gt as startInterruptWatch, h as IMPLICIT_DELETE_DEPENDENCIES, hi as CFN_TEMPLATE_BODY_LIMIT, hn as malformedExportNamesWarning, hr as exportNamesCarriedFrom, ht as isInterruptedWaitError, i as DeploymentEventsReader, ia as withErrorHandling, ii as getDefaultStateBucketName, in as s3BucketWebsiteUrl, ir as LockManager, it as IAMRoleProvider, j as extractDeploymentEventError, ji as getAwsClients, jn as refuseMalformedState, jr as BOOTSTRAP_MARKER_PREFIX, jt as isImpossibleEmptyStoredAttribute, k as unsupportedFinalSnapshotError, ki as resolveBucketRegion, kn as refuseMalformedResourcePropertiesForOrphan, kr as rewriteTemplateAssetReferences, kt as coerceParameterTypedValue, l as replayRollback, la as markNonRetryable, li as resolveSkipPrefix, ln as envCredentialsAreAssumedRole, lr as buildLockContentionMessage, lt as createMaskedRetryLogger, m as maskingRetryLogger, mi as warnDeprecatedNoPrefixCliFlag, mn as hasReadableResources, mr as DEFAULT_STATE_PREFIX, mt as interruptWatchListenerCount, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as Synthesizer, nn as s3BucketDualStackDomainName, nr as redactSecretsForState, nt as secretSafeKeyDisplay, o as planFailedOps, oa as isRetryableTransientError, oi as resolveApp, on as AWS_CREDENTIAL_ENV_KEYS, or as rebuildClientForBucketRegion, ot as clearOnUpdateRemoval, p as withResourceDeadline, pa as safeStringify, pi as stateBucketExistenceConfirmed, pn as hasReadableOutputs, pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, pt as endCommandInterruptScope, q as green, qi as PartialFailureError, qn as dynamicReferenceTokens, qr as getDockerCmd, qt as replayWarn, r as DeployEngine, ra as normalizeAwsError, ri as synthesisStatusMessage, rn as s3BucketRegionalDomainName, rr as scrubResourceRecord, rt as getCurrentResourceSecrets, s as planRollback, sa as isThrottlingError, si as resolveAutoAssetStorage, sn as applyCallerIdentityCredentials, sr as UNREPRODUCIBLE_LOCK_CLAUSE, st as ProviderRegistry, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as getDockerImageBySourceHash, tn as s3BucketDomainName, tr as recoverMaskedOutput, tt as secretBearingStateKeyWarning, u as resolveReplacementOldType, ua as markRedactedCause, ui as resolveStateBucketWithDefault, un as DiffCalculator, ur as forceQuitRecoveryClause, ut as maskDeep, v as isSecretBearingReferenceString, vi as findLargeInlineResources, vn as malformedOutputsRefusalMessage, vr as importableOutputs, vt as isWaitAbandonedError, w as buildFinalSnapshotIdentifier, wi as canonicalizeRegion, wn as producerRecordKey, wr as stringifyValue, wt as isTerminationProtectionPropagationError, x as bindingSkippedOutputs, xi as decodeListingKey, xn as malformedResourcePropertiesWarning, xr as orphansCarriedFrom, xt as deleteIndeterminateGuards, y as keptWholeReasonText, yi as uploadCfnTemplate, yn as malformedOutputsWarning, yr as isReadableBag, yt as slowCcOperationTimeoutMs, z as coerceWarmThroughput$1, zi as DeployCancelledError, zn as DagBuilder, zr as validateContainerRepoName, zt as resolveExplicitPhysicalId } from "./deploy-engine-efiVJ-rX.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-BX4pJk0T.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-F41ektvu.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BuEvX2d9.js";
+import { t as getCdkdVersion } from "./version-CpyoQ3PO.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTxYWlwu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2758,16 +2758,13 @@ const EMPTY_ALLOW_SET$1 = /* @__PURE__ */ new Set();
 * is spelled once, or the note could name ids the validator does not refuse.
 *
 * The two are NOT the same set, and deliberately so. The refusal fires when
-* EITHER the state record or the template says nested, because the two types
-* select different halves of the destructive path: the TEMPLATE's type picks
-* the provider that deletes the old resource (a Type change emits an UPDATE
-* carrying `resourceType: desiredResource.Type`, which is what
-* `oldDeleteProvider` resolves from), while the STATE's type is what
-* `NestedStackProvider` owns and derives `<parent>~<logicalId>` from. The note
-* keys on the TEMPLATE alone, because it is telling the user what their current
-* template contains. Which type governs was argued from plausibility twice and
-* settled by reading `analyzer/diff-calculator.ts` and `deploy-engine.ts`'s
-* `oldDeleteProvider`; do not re-derive it from either name. Other modules spell it
+* EITHER the state record or the template says nested, because a recreate has
+* two halves with two types (issue #2668): the STATE's type routes the delete
+* of the old resource — `NestedStackProvider` derives `<parent>~<logicalId>`
+* from it — and the TEMPLATE's type routes the create, which for a nested row
+* is a whole child-stack deploy. Either half alone is outside what a recreate
+* is built for. The note keys on the TEMPLATE alone, because it is telling the
+* user what their current template contains. Other modules spell it
 * for themselves rather than sharing one export: the only EXPORTED copy lives
 * in `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
 * from the deployment layer would invert the dependency direction. (No count of
@@ -3382,6 +3379,297 @@ function analyzePinCcApiReachability(pinnedLogicalIds, stacks) {
 	};
 }
 
+//#endregion
+//#region src/utils/nested-template-cycle.ts
+/**
+* Static, READ-ONLY validation of a nested-template tree, run BEFORE anything
+* is deployed from it (issue go-to-k/cdkd#3247).
+*
+* `NestedStackProvider` follows `Metadata['aws:asset:path']` from one nested
+* template to the next and runs a whole child `DeployEngine` per level. A
+* relative path that resolves back onto the same nesting chain therefore
+* DEPLOYS every level of the cycle until S3's key limit stops it. Threading an
+* ancestor chain through the provider's recursion would only refuse at the
+* first repeat, by which point every level above it is already provisioned.
+* Everything the walk follows is on disk before the first child engine exists,
+* so the whole subtree is validated up front instead.
+*
+* Two properties are copied from the `cdkd diff --recursive` guard (issue
+* go-to-k/cdkd#3239), because re-deriving them gets them wrong:
+*
+* - The refused shape is a repeat along ONE root-to-node chain, never a repeat
+*   anywhere in the tree: two sibling rows may name the same child template,
+*   and that diamond is a legitimate assembly.
+* - It is a refusal, not a depth cap. A cyclic assembly has no correct deploy.
+*
+* `Condition`s are deliberately NOT evaluated: a row whose condition would be
+* false at deploy time still counts. A self-including template that terminates
+* through a condition is refused here exactly as the diff walk refuses it, so
+* the two commands agree about which assemblies are well-formed.
+*
+* A leaf apart from `display-safe.ts`, so any layer may import it.
+*/
+const NESTED_STACK_TYPE$1 = "AWS::CloudFormation::Stack";
+/**
+* Same predicate `NestedStackProvider` applies per level. The `startsWith('/')`
+* arm covers a POSIX-style absolute path consumed on Windows, where
+* `path.isAbsolute` alone answers `false`.
+*/
+function isAbsoluteAssetPath(p) {
+	return path.isAbsolute(p) || p.startsWith("/");
+}
+/**
+* What "the same template" means ON A CHAIN: the file's name inside its REAL
+* directory.
+*
+* The directory is `realpath`ed because a symlinked DIRECTORY (`d -> .`) makes
+* every level's joined path a new, longer string (`d/a.json`, `d/d/a.json`,
+* ...) for one and the same file, which a comparison of resolved path strings
+* never sees repeat. There are finitely many (real directory, name) pairs, so
+* an endless descent must repeat one, however it is spelled.
+*
+* It is NOT what decides a template's children. Those resolve LEXICALLY
+* against the directory the template was reached in (`path.join` folds `d/..`
+* without following the link), so one identity reached through two spellings
+* can have two different subtrees. That is why the clean-subtree memo in
+* `findNestedTemplateTreeDefect` is keyed on the lexical path instead, and why
+* an identity repeat is a conservative refusal rather than an exact one: with
+* a symlinked directory AND a `..` row it can refuse a tree that would have
+* terminated. Such an assembly is hand-built by definition.
+*
+* Falls back to `path.resolve` for a directory that does not exist; the walk
+* stops there anyway.
+*/
+function templateIdentity(templatePath) {
+	const dir = path.dirname(templatePath);
+	let realDir;
+	try {
+		realDir = fs.realpathSync(dir);
+	} catch {
+		realDir = path.resolve(dir);
+	}
+	return path.join(realDir, path.basename(templatePath));
+}
+/**
+* The nested-stack rows of a parsed template that name a child template file.
+*
+* THE ONE SPELLING, shared by this module's walk and by
+* `NestedStackProvider.indexGrandchildTemplates`, because the walk is only a
+* guard if it follows exactly the rows the deploy follows. Two hand-written
+* copies disagreed on an ARRAY-valued `Resources`: `Object.entries` indexes an
+* array as `'0'`, `'1'`, ..., the deploy followed those rows, and a walk that
+* skipped them accepted a cyclic tree. So this takes whatever `Object.entries`
+* takes, and does not pre-judge the container's shape.
+*/
+function listNestedTemplateRows(template) {
+	if (template === null || typeof template !== "object") return [];
+	const resources = template.Resources;
+	if (resources === null || resources === void 0) return [];
+	const rows = [];
+	for (const [logicalId, resource] of Object.entries(resources)) {
+		const row = resource;
+		if (row?.Type !== NESTED_STACK_TYPE$1) continue;
+		const assetPath = row.Metadata?.["aws:asset:path"];
+		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
+		rows.push({
+			logicalId,
+			assetPath
+		});
+	}
+	return rows;
+}
+/**
+* The rows of the template FILE at `templatePath`. Unreadable or unparseable
+* input yields `undefined`: reporting that is the job of the site that
+* actually loads the template, with its own message, and a walk that cannot
+* descend cannot loop.
+*/
+function readNestedRows(templatePath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(templatePath, "utf-8"));
+	} catch {
+		return;
+	}
+	return listNestedTemplateRows(parsed);
+}
+/**
+* Deeper than this cannot deploy at all, so it is refused rather than walked.
+* A child's state key is `cdkd/<root>~<id>~<id>.../<region>/state.json`; each
+* level adds at least two bytes (`~` plus a one-character logical id) and S3
+* caps a key at 1024 bytes. The bound exists so a hostile chain of tens of
+* thousands of DISTINCT templates is a readable refusal instead of a
+* `RangeError` from the recursion below. It is not a cycle heuristic: a cycle
+* is refused at its first repeat, long before this.
+*/
+const MAX_NESTING_DEPTH = 512;
+/**
+* Rows the walk will follow before it refuses the tree as too large.
+*
+* The clean-subtree memo is keyed on the LEXICAL path (it has to be, see
+* `templateIdentity`), and symlinked directories give one file arbitrarily
+* many lexical spellings: with `d1 -> .` and `d2 -> .`, rows naming
+* `t.json`, `d1/t.json` and `d2/t.json` at every level multiply the spellings
+* per level while no chain ever repeats an identity. Such a walk is finite but
+* exponential, so it needs a budget rather than a better key. Far above any
+* real assembly: a CDK app's nested templates number in the tens, and a memo
+* hit costs one row, not a subtree.
+*/
+const MAX_ROWS_FOLLOWED = 1e4;
+/**
+* Walk every nested template reachable from `nestedTemplates` (logical id ->
+* template file path, the shape `AssemblyReader` and the provider's own
+* per-level index produce) and return the first defect, or `undefined` when
+* the tree is well-formed.
+*
+* `ancestorTemplatePaths` seeds the chain with templates ABOVE the entry rows,
+* for a caller that knows them. Detection does not depend on it: a cycle
+* through an unseeded ancestor is followed once around and refused when it
+* re-enters the first template the walk did see.
+*/
+function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = []) {
+	const onChain = /* @__PURE__ */ new Set();
+	for (const p of ancestorTemplatePaths) onChain.add(templateIdentity(p));
+	const clean = /* @__PURE__ */ new Set();
+	const chain = [];
+	let rowsFollowed = 0;
+	const visit = (logicalId, templatePath) => {
+		if (typeof templatePath !== "string") return void 0;
+		const identity = templateIdentity(templatePath);
+		const lexical = path.resolve(templatePath);
+		chain.push({
+			logicalId,
+			templatePath: identity
+		});
+		try {
+			if (onChain.has(identity)) return {
+				kind: "cycle",
+				chain: [...chain]
+			};
+			if (chain.length > 512) return {
+				kind: "too-deep",
+				chain: [...chain]
+			};
+			if (++rowsFollowed > 1e4) return {
+				kind: "too-large",
+				chain: [...chain]
+			};
+			if (clean.has(lexical)) return void 0;
+			const rows = readNestedRows(templatePath);
+			if (rows === void 0) return void 0;
+			onChain.add(identity);
+			try {
+				const dir = path.dirname(templatePath);
+				for (const row of rows) {
+					if (isAbsoluteAssetPath(row.assetPath)) return {
+						kind: "absolute-path",
+						chain: [...chain],
+						logicalId: row.logicalId,
+						assetPath: row.assetPath
+					};
+					const defect = visit(row.logicalId, path.join(dir, row.assetPath));
+					if (defect) return defect;
+				}
+			} finally {
+				onChain.delete(identity);
+			}
+			clean.add(lexical);
+			return;
+		} finally {
+			chain.pop();
+		}
+	};
+	for (const [logicalId, templatePath] of Object.entries(nestedTemplates)) {
+		const defect = visit(logicalId, templatePath);
+		if (defect) return defect;
+	}
+}
+/** Hops rendered in full before the middle of a long chain is elided. */
+const MAX_RENDERED_HOPS = 8;
+/**
+* `'A' (/x/a.json) -> 'B' (/x/b.json)`. Every interpolation goes through
+* `displaySafe`: this text exists FOR a hand-modified assembly, so a logical id
+* (a template key) and a path (derived from `aws:asset:path`) are both
+* attacker-controlled, and a bare `Error` message is not sanitized downstream.
+* A long chain keeps both ends, since the entry row and the closing row are
+* the two a reader needs.
+*/
+function renderChain(chain) {
+	const hop = (h) => `'${displaySafe(h.logicalId)}' (${displaySafe(h.templatePath)})`;
+	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" -> ");
+	const keep = MAX_RENDERED_HOPS / 2;
+	return [
+		...chain.slice(0, keep).map(hop),
+		`... ${chain.length - 8} more ...`,
+		...chain.slice(-4).map(hop)
+	].join(" -> ");
+}
+/**
+* The refusal text for a defect found under `stackName`. `action` completes
+* "Refusing to ..." so each caller states what it declined to do.
+*/
+function renderNestedTemplateTreeDefect(defect, stackName, action) {
+	const provenance = `CDK emits an acyclic nested template tree with relative asset paths, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
+	const owner = (chain) => {
+		const ids = chain.slice(0, -1).map((h) => h.logicalId);
+		const keep = MAX_RENDERED_HOPS / 2;
+		const shown = ids.length <= MAX_RENDERED_HOPS ? ids : [
+			...ids.slice(0, keep),
+			`...${ids.length - 8} more...`,
+			...ids.slice(-4)
+		];
+		return displaySafe([stackName, ...shown].join("~"));
+	};
+	if (defect.kind === "cycle") {
+		const closing = defect.chain[defect.chain.length - 1];
+		return `The nested template tree under stack '${displaySafe(stackName)}' contains a cycle: ${renderChain(defect.chain)}. Nested stack '${displaySafe(closing.logicalId)}' (declared in stack '${owner(defect.chain)}') resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
+	}
+	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
+	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']='${displaySafe(defect.assetPath)}' which is absolute. ${provenance}`;
+}
+
+//#endregion
+//#region src/cli/commands/nested-template-preflight.ts
+/**
+* Refuse a malformed nested-template tree (a cycle, an absolute
+* `aws:asset:path` below the top level, a chain too deep or a tree too large
+* to deploy) for every SELECTED stack, before `cdkd deploy` does anything a
+* refusal would have to undo (issue go-to-k/cdkd#3449).
+*
+* `NestedStackProvider` runs the same walk per nested-stack row
+* (go-to-k/cdkd#3247), which is the earliest point the provider owns: by then
+* the stack's assets are published, its lock is held, and any root resource
+* that does not depend on the nested row may already be created and must be
+* rolled back. Everything the walk reads is on disk as soon as synth returns,
+* so the CLI asks first and the deploy never starts. The provider call stays
+* as the guard for a context this command did not build.
+*
+* Read-only and synchronous: a few file reads per nested template, none at all
+* for a stack without nested-stack rows. One walk covers all of a stack's
+* top-level rows, so the walker's row budget is per STACK here and per row in
+* the provider; no CDK-generated assembly comes near either.
+*
+* The root template's own path is not seeded into the walk (`StackInfo` does
+* not carry it). Detection does not depend on the seed: a child that points
+* back at the root template is followed once around and refused when the walk
+* re-enters the first nested template it saw.
+*
+* `SynthesisError` because the defect is in the synthesized assembly, like the
+* absolute-path refusal `AssemblyReader` raises for a top-level row.
+* `markNonRetryable` because the message carries template-controlled text the
+* substring-matching retry classifier must never read, wherever the error ends
+* up being caught.
+*/
+function refuseMalformedNestedTemplateTrees(stacks) {
+	for (const stack of stacks) {
+		if (!stack.nestedTemplates) continue;
+		const defect = findNestedTemplateTreeDefect(stack.nestedTemplates);
+		if (!defect) continue;
+		throw markNonRetryable(new SynthesisError(renderNestedTemplateTreeDefect(defect, stack.stackName, "start the deploy; nothing has been published or provisioned")));
+	}
+}
+
 //#endregion
 //#region src/cli/commands/confirm-prompt.ts
 /**
@@ -26356,7 +26644,8 @@ var SSMParameterProvider = class {
 	* question cdkd can answer correctly — and would hand `cdkd drift` a baseline
 	* AWS does not hold. Dropping the `Arn` instead degrades to the resolver's LOUD
 	* `*Arn` shape-guard failure, which is exactly the pre-fix behavior, and the
-	* resource's next UPDATE re-records it. A loud missing value beats a quiet
+	* resource's next UPDATE re-records it (as does the deploy engine's re-read
+	* on a `Fn::GetAtt` miss, issue #1852). A loud missing value beats a quiet
 	* wrong one — the same reasoning the `fabricated`-account arm above applies.
 	*
 	* Two honest bounds on that "next update re-records it". `getAccountInfo`
@@ -41121,10 +41410,14 @@ var RDSProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -42714,10 +43007,14 @@ var DocDBProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -43357,10 +43654,14 @@ var NeptuneProvider = class {
 	async importDBInstance(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBInstanceIdentifier");
 		if (explicit) try {
-			await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }));
+			const described = (await this.getClient().send(new DescribeDBInstancesCommand$2({ DBInstanceIdentifier: explicit }))).DBInstances?.[0];
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({
+					"Endpoint.Address": described?.Endpoint?.Address,
+					"Endpoint.Port": stringifyIfAssigned(described?.Endpoint?.Port),
+					Arn: described?.DBInstanceArn
+				})
 			};
 		} catch (err) {
 			if (err.name === "DBInstanceNotFoundFault") return null;
@@ -48076,7 +48377,7 @@ var AppSyncProvider = class {
 				return await this.buildAppSyncArn(suffix, regionOverride);
 			} catch (error) {
 				if (!omitArnOnFailure) throw error;
-				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+				this.logger.warn(`Imported ${resourceType} (${physicalId}) but its ARN attribute was NOT recorded: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update — or a later deploy that needs the attribute and re-reads it from AWS — heals the record.`);
 				return;
 			}
 		};
@@ -48164,7 +48465,7 @@ var AppSyncProvider = class {
 		try {
 			return await this.childRefAttributes(resourceType, physicalId, region, true) ?? {};
 		} catch (error) {
-			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update heals the record.`);
+			this.logger.warn(`Imported ${resourceType} (${physicalId}) but could not build its ARN attribute: ${describeAwsFailure(error).detail}. Ref will resolve to the compound physical id, and Fn::GetAtt on the ARN will fail, until the resource's next update — or a later deploy that needs the attribute and re-reads it from AWS — heals the record.`);
 			return {};
 		}
 	}
@@ -61118,6 +61419,64 @@ var S3VectorsProvider = class {
 //#endregion
 //#region src/provisioning/providers/s3-directory-bucket-provider.ts
 /**
+* What `delete()` throws for a non-empty bucket with no auto-empty opt-in
+* (issue [#1344](https://github.com/go-to-k/cdkd/issues/1344)), with the bucket
+* name rendered safely (issue
+* [#3270](https://github.com/go-to-k/cdkd/issues/3270)).
+*
+* `bucketName` on the delete path is the STATE-borne physical id, which for
+* this type is the TEMPLATE-chosen name, and this message is THROWN from
+* `delete()` — so it reaches the operator's terminal AND the durable
+* `deployments/*.jsonl` store. It used to interpolate the name BARE into
+* `aws s3 rm s3://<name> --recursive`, so a name carrying `;`, a backtick,
+* `$(...)` or a newline APPENDED a command to a recursive delete when pasted.
+*
+* The command goes through the shared `renderDisableCommand`
+* (`displaySafe(asciiOnly)`, then `shellQuote`, then SUPPRESS the whole command
+* when sanitizing CHANGED the value, since a command naming the sanitized name
+* would empty a DIFFERENT bucket). Three things are specific to this site:
+*
+*  - **The quoted unit is the ASSEMBLED `s3://<name>` argument**, not the name:
+*    `aws s3 rm` has no `--bucket <name>` form, and quoting only the name would
+*    put a quote in the middle of a word. `shellQuote` leaves `:` and `/` bare,
+*    so a clean name renders exactly as before.
+*  - **The NAME is compared against its own sanitized form HERE, before the
+*    shared renderer sees it.** The renderer's changed-by-sanitizing test runs
+*    over the assembled argument, where the `s3://` prefix shields a LEADING
+*    space of the name from the sanitizer's trim — so without this check a
+*    padded name would be shown in a command while the prose beside it named
+*    the trimmed one.
+*  - **A name containing `/` is suppressed here**, which the shared renderer
+*    cannot know to do: `s3://a/b` addresses the prefix `b` in bucket `a`, a
+*    DIFFERENT bucket, and both characters pass sanitizing and quoting
+*    unchanged. An empty name is suppressed for the same reason (`s3://` names
+*    no bucket at all).
+*  - **No `maskSecrets` is passed.** `DeleteContext` carries no masker by
+*    contract (issue [#2007](https://github.com/go-to-k/cdkd/issues/2007) tracks
+*    the threading), and an identity masker would claim a check that never ran.
+*
+* The PROSE name goes through `displayIdent`, because this message is
+* persisted: a control byte or a newline in it would otherwise forge lines in
+* the events store even with the command suppressed. A clean name is a plain
+* identifier, which `displayIdent` renders unchanged.
+*
+* The caller marks the refusal NON-RETRYABLE: it is a deterministic verdict,
+* and `delete()` wraps it in a message carrying the LOGICAL id, which the
+* destroy runner and the deploy engine's replacement delete classify as
+* "already deleted" by SUBSTRING (`NotFoundException` there, a bare `NotFound`
+* here). A logical id containing the needle would otherwise have its non-empty
+* bucket read as gone; both classifiers skip a marked error.
+*/
+function notEmptyRefusalMessage(bucketName) {
+	const command = bucketName !== "" && !bucketName.includes("/") && displaySafe(bucketName, { asciiOnly: true }) === bucketName ? renderDisableCommand({
+		before: "aws s3 rm",
+		identifier: `s3://${bucketName}`,
+		after: "--recursive"
+	}) : "";
+	const remedy = command ? `Delete all objects first (e.g. ${command}) and destroy again.` : "Delete all objects first, via the console, and destroy again: the bucket name cdkd recorded cannot be reproduced safely on a command line, so any command shown here would act on a different bucket.";
+	return `bucket ${displayIdent(bucketName)} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. ${remedy}`;
+}
+/**
 * SDK Provider for AWS::S3Express::DirectoryBucket
 *
 * Uses S3 SDK directly for S3 Express Directory Bucket operations.
@@ -61362,7 +61721,7 @@ var S3DirectoryBucketProvider = class {
 		} catch (error) {
 			const msg = describeAwsFailure(error).detail;
 			if (msg.includes("not empty") || msg.includes("BucketNotEmpty")) {
-				if (!allowAutoEmpty) throw new Error(`bucket ${bucketName} is not empty. Matching CloudFormation, cdkd does not delete a non-empty directory bucket without an explicit opt-in. Delete all objects first (e.g. aws s3 rm s3://${bucketName} --recursive) and destroy again.`);
+				if (!allowAutoEmpty) throw markNonRetryable(new Error(notEmptyRefusalMessage(bucketName)));
 				this.logger.info(`Directory bucket ${bucketName} not empty (attempt ${attempt}/${maxAttempts}), emptying (auto-delete opt-in present)...`);
 				await this.emptyBucket(bucketName);
 				continue;
@@ -63497,7 +63856,7 @@ function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedC
 * `path.isAbsolute()` alone. Exported for unit testing.
 */
 function isAbsoluteCrossPlatform$1(p) {
-	return path.isAbsolute(p) || p.startsWith("/");
+	return isAbsoluteAssetPath(p);
 }
 /**
 * Provider for `AWS::CloudFormation::Stack` — cdkd's recursive nested-stack
@@ -63584,14 +63943,14 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' under parent '${ctx.parentStackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
-		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' under parent '${displaySafe(ctx.parentStackName)}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
+		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
+		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
-		const grandchildTemplates = this.indexGrandchildTemplates(childTemplate, childTemplatePath);
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
-		this.logger.info(`Deploying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Deploying nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
@@ -63604,14 +63963,14 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' on update.`);
-		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' on update.`);
+		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
+		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
-		const grandchildTemplates = this.indexGrandchildTemplates(childTemplate, childTemplatePath);
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
-		this.logger.info(`Updating nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Updating nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
 		const updatedOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
 		return {
@@ -63627,12 +63986,12 @@ var NestedStackProvider = class {
 		const childRegion = ctx.parentRegion;
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
 		if (!childStateData) {
-			this.logger.debug(`Nested stack ${childStackName} has no state — treating delete as idempotent success.`);
+			this.logger.debug(`Nested stack ${displaySafe(childStackName)} has no state — treating delete as idempotent success.`);
 			return;
 		}
 		refuseMalformedResourcesForDestroy(childStateData.state, childStackName, childRegion);
 		const resourceCount = Object.keys(childStateData.state.resources).length;
-		this.logger.info(`Destroying nested stack ${childStackName} (logicalId=${logicalId}, ${resourceCount} resource(s))`);
+		this.logger.info(`Destroying nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
 		const childCtx = {
 			...ctx,
 			parentStackName: childStackName,
@@ -63668,12 +64027,12 @@ var NestedStackProvider = class {
 			if (childResult.interrupted) causes.push("was interrupted");
 			return {
 				outcome: "skipped",
-				reason: `nested stack ${childStackName} ${causes.join(" and ")}`
+				reason: `nested stack ${displaySafe(childStackName)} ${causes.join(" and ")}`
 			};
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
-		throw new Error(`AWS::CloudFormation::Stack: attribute '${attributeName}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
+		throw new Error(`AWS::CloudFormation::Stack: attribute '${displaySafe(attributeName)}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
 		const inheritedSecrets = getCurrentResourceSecrets();
@@ -63724,7 +64083,7 @@ var NestedStackProvider = class {
 	*/
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
-		if (!childStateData) throw new Error(`Child stack state '${childStackName}' not found after deploy — NestedStackProvider invariant violated.`);
+		if (!childStateData) throw new Error(`Child stack state '${displaySafe(childStackName)}' not found after deploy — NestedStackProvider invariant violated.`);
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
@@ -63749,6 +64108,40 @@ var NestedStackProvider = class {
 	requireDeployContext(ctx, op) {
 		if (!ctx.nestedTemplates || !ctx.dagBuilder || !ctx.diffCalculator) throw new Error(`NestedStackProvider.${op}: deploy-mode context fields (nestedTemplates / dagBuilder / diffCalculator) are missing. This usually means a destroy-mode entry point called into create/update by mistake.`);
 	}
+	/**
+	* Validate the WHOLE nested-template subtree under this row before the first
+	* child engine is built (issue go-to-k/cdkd#3247).
+	*
+	* Up front rather than as an ancestor chain threaded through the recursion,
+	* because here a level is not a read, it is a DEPLOY: refusing at the first
+	* repeat would leave every level above it provisioned, with a state record
+	* each, for the rollback to unwind. Every file the recursion would follow is
+	* already on disk, so the top-most row's call sees the entire cycle and
+	* nothing below it ever starts. Deeper levels re-run the same walk over
+	* their own (already proven) subtree; it is a few file reads next to a
+	* deploy, and it keeps the guard independent of who built the context.
+	*
+	* This is the earliest point THIS FILE owns. The parent stack's other
+	* resources may already be in flight when its nested-stack row is
+	* dispatched; they are unwound by the parent's ordinary rollback. No level of
+	* the cyclic tree is deployed.
+	*
+	* It also reports an absolute `aws:asset:path` at ANY depth, for the same
+	* reason: `indexGrandchildTemplates` refuses one too, but only on reaching
+	* that level, after the levels above it deployed. That check stays as the
+	* per-level backstop.
+	*
+	* `markNonRetryable`: the verdict is computed from files no retry changes,
+	* while the message carries template-controlled text (logical ids, paths)
+	* that the SUBSTRING-matching retry classifier would otherwise read. Latent
+	* while `disableOuterRetry` is set, and declared anyway, like the sibling
+	* marks in this file.
+	*/
+	refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath) {
+		const defect = findNestedTemplateTreeDefect({ [logicalId]: childTemplatePath });
+		if (!defect) return;
+		throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: ${renderNestedTemplateTreeDefect(defect, ctx.parentStackName, "deploy any level of it")}`));
+	}
 	deriveChildStackName(parentStackName, nestedLogicalId) {
 		return `${parentStackName}~${nestedLogicalId}`;
 	}
@@ -63793,35 +64186,50 @@ var NestedStackProvider = class {
 	* points at `[2]` rather than at the whole parameter.
 	*/
 	refuseNonScalarParameter(k, offender, where) {
-		throw new Error(`NestedStackProvider: child Parameter '${k}'${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
+		throw new Error(`NestedStackProvider: child Parameter '${displaySafe(k)}'${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
 	}
+	/**
+	* The child template as the child engine deploys it, plus the grandchild
+	* template paths indexed from it.
+	*
+	* The index is taken BEFORE the asset-reference rewrite, and returning both
+	* from here is what keeps that order from being undone by a caller. The
+	* rewrite walks every string in the template, `Metadata['aws:asset:path']`
+	* included, and a path segment that spells a bootstrap bucket name is
+	* rewritten like any other occurrence. `aws:asset:path` is a LOCAL file
+	* path, never an asset-storage reference; indexing after the rewrite made
+	* the deploy follow a different file than the one
+	* `refuseMalformedNestedTemplateTree` had validated from the raw file, which
+	* is a way around that guard (issue go-to-k/cdkd#3247).
+	*/
 	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+			throw new Error(`Failed to read nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
 		let template;
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+			throw new Error(`Failed to parse nested template at ${displaySafe(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 		}
+		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
 			const n = rewriteTemplateAssetReferences(template, assetRedirect);
-			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${templatePath}`);
+			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${displaySafe(templatePath)}`);
 		}
-		return template;
+		return {
+			template,
+			grandchildTemplates
+		};
 	}
 	indexGrandchildTemplates(childTemplate, childTemplatePath) {
 		const dir = path.dirname(childTemplatePath);
-		const result = {};
-		for (const [grandLogicalId, resource] of Object.entries(childTemplate.Resources ?? {})) {
-			if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
-			const assetPath = resource.Metadata?.["aws:asset:path"];
-			if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-			if (isAbsoluteCrossPlatform$1(assetPath)) throw new Error(`NestedStackProvider: nested-stack '${grandLogicalId}' has Metadata['aws:asset:path']='${assetPath}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		const result = Object.create(null);
+		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
+			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
 			result[grandLogicalId] = path.join(dir, assetPath);
 		}
 		return result;
@@ -64873,6 +65281,7 @@ async function deployCommand(stacks, options) {
 			strict: options.strict === true,
 			ignoreErrors: options.ignoreErrors === true
 		});
+		refuseMalformedNestedTemplateTrees(targetStacks);
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({
@@ -81497,6 +81906,15 @@ function safeRoleArn(value) {
 * the Snapshot label would otherwise promise a final snapshot the run is about
 * to skip — a data-loss-relevant lie in the one preview the user reads.
 */
+/**
+* The type(s) a reversed replacement touches (issue #2668): `NEW -> OLD` when
+* the replacement changed the resource's `Type` — the replay deletes the first
+* and re-creates the second — and the single type otherwise.
+*/
+function replacementTypes(op) {
+	const routing = resolveReplacementOldType(op);
+	return routing.ok && routing.oldType !== op.resourceType ? `${safe(op.resourceType)} -> ${safe(routing.oldType)}` : safe(op.resourceType);
+}
 function actionLabel(item, skipFinalSnapshot) {
 	const { op, action, replacement } = item;
 	const rep = replacement ? " [replacement occurred, best-effort revert]" : "";
@@ -81506,11 +81924,15 @@ function actionLabel(item, skipFinalSnapshot) {
 		case "orphan-retain": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [DeletionPolicy Retain — left in AWS]`;
 		case "orphan-flag": return `  - orphan   ${safe(op.logicalId)} (${safe(op.resourceType)}) [--orphan]`;
 		case "revert": return `  - revert   ${safe(op.logicalId)} (${safe(op.resourceType)})${rep}`;
-		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-create old resource, delete new]`;
-		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${safe(op.resourceType)}) [delete new, re-adopt retained old resource]`;
+		case "reverse-replacement": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked — REFUSED instead if the re-create collides with the name the retained resource still holds]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-create old resource, delete new]`;
+		case "reverse-replacement-readopt": return item.retainsNewResource ? `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [re-adopt retained old resource; new one RETAINED (UpdateReplacePolicy: Retain) and left untracked]` : `  - reverse-replace ${safe(op.logicalId)} (${replacementTypes(op)}) [delete new, re-adopt retained old resource]`;
 		case "unrecoverable-delete": return `  - (cannot restore) ${safe(op.logicalId)} (${safe(op.resourceType)}) — was DELETED, unrecoverable`;
 		case "skip-mismatch": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — physical id changed, needs manual attention`;
 		case "skip-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no longer in state`;
+		case "refuse-replacement-routing": {
+			const routing = resolveReplacementOldType(op);
+			return `  - (REFUSED) ${safe(op.logicalId)} (${safe(op.resourceType)}) — cannot reverse the replacement: ${routing.ok ? "its old type could not be routed" : routing.reason}`;
+		}
 		case "skip-already-done": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — already reverted`;
 	}
 }
@@ -81530,6 +81952,7 @@ function failedActionLabel(item, skipFinalSnapshot) {
 		case "skip-failed-unknown": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed CREATE recorded no physical id`;
 		case "skip-failed-noop": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — failed ${safe(op.changeType)} left nothing to revert`;
 		case "skip-failed-absent": return `  - skip     ${safe(op.logicalId)} (${safe(op.resourceType)}) — no previous state available`;
+		case "skip-failed-type-change": return `  - skip     ${safe(op.logicalId)} (${safe(op.previousState?.resourceType)} -> ${safe(op.resourceType)}) — failed Type change is a replacement, no in-place revert exists`;
 	}
 }
 /**
@@ -95615,4 +96038,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DdmCUgOP.js.map
+//# sourceMappingURL=program-Dh1J573K.js.map