@go-to-k/cdkd 0.291.17 → 0.291.18

package/dist/{program-hXXls0hg.js → program-DxyHPT8E.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as findLargeInlineResources, $n as repairMalformedOutputsForReadOnly, $r as WorkGraph, $t as replayWarn, A as createPreDeleteFinalSnapshot, Aa as setAwsClients, Ai as runDockerStreaming, An as malformedOrphansRefusalMessage, Ar as scrubResourceRecord, At as isTerminationProtectionPropagationError, B as isStatefulRecreateTargetSync, Ba as LocalStartServiceError, Bi as resolveApp, Bn as refuseMalformedNestedChildOutputs, Br as DEFAULT_STATE_PREFIX, Bt as parameterTypeMayLoseSecretIdentity, C as namesAnyDeclaredParameter, Ca as resolveAssemblyPath, Ci as formatDockerLoginError, Cn as hasReadableOutputs, Cr as maskSecretsInError, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as getAwsClients, Di as partitionSensitiveEnv, Dn as malformedExportSourceWarning, Dr as recordMaskOnlyValuesIn, Dt as deleteSkipReason, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as AwsClients, Ei as isMalformedEnvKey, En as malformedExportNamesWarning, Er as recordMaskOnlyValue, Et as deleteIndeterminateGuards, F as extractDeploymentEventError, Fi as getDockerImageBySourceHash, Fn as malformedResourceEntriesWarning, Fr as buildForceUnlockCommand, Ft as coerceParameterTypedValue, G as toCfnInteger, Ga as ProvisioningError, Gi as resolveStateBucketWithDefaultAndSource, Gn as refuseMalformedOutputsForDestroy, Gr as importableOutputKeys, Gt as resolveExplicitPhysicalId, H as WARM_THROUGHPUT_MEMBERS, Ha as MalformedProducerRecordRefusalError, Hi as resolveCaptureObservedState, Hn as refuseMalformedOrphansForDestroy, Hr as hasReadableExportSet, Ht as isSettledInstanceState, I as makeSiblingClaimReader, Ia as DeployCancelledError, Ii as Synthesizer, In as malformedResourcePropertiesWarning, Ir as buildLockContentionMessage, It as getAccountInfo, J as bold, Ja as StackHasActiveImportsError, Ji as warnDeprecatedNoPrefixCliFlag, Jn as refuseMalformedResourceEntriesForOrphan, Jr as orphansAfterRollback, Jt as coerceCfnInteger, K as toFiniteNumber, Ka as ResourceTimeoutError, Ki as resolveUseCdkBootstrapAssets, Kn as refuseMalformedResourceAttributesForOrphan, Kr as importableOutputs, Kt as assertRegionMatch, L as planOrphanAdoption, La as DynamicReferenceRegionAmbiguousError, Li as synthesisStatusMessage, Ln as malformedResourcesWarning, Lr as forceQuitRecoveryClause, Lt as isImpossibleEmptyStoredAttribute, M as refusesFinalSnapshot, Ma as CdkdError, Mi as escapeRegExp, Mn as malformedOutputsRefusalMessage, Mr as S3StateBackend, Mt as carriesDynamicReference, N as unsupportedFinalSnapshotError, Ni as stripControlChars, Nn as malformedOutputsWarning, Nr as rebuildClientForBucketRegion, Nt as carriesFetchableDynamicReference, O as buildFinalSnapshotIdentifier, Oa as resetAwsClients, Oi as redactDockerArgvValues, On as malformedLocalOutputsWarning, Or as recoverMaskedOutput, Ot as isWaitAbandonedError, P as makeCanonicalizePropertiesFn, Pa as CrossAccountSecretRefusalError, Pi as AssetManifestLoader, Pn as malformedRenderedContainersWarning, Pr as UNREPRODUCIBLE_LOCK_CLAUSE, Pt as cfnRefValueFromPhysicalId, Q as red, Qi as MIGRATE_TMP_PREFIX, Qn as repairMalformedOrphansForReadOnly, Qr as stringifyValue, Qt as readConfigString, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as IntrinsicResolutionRefusalError, Ri as getDefaultStateBucketName, Rn as malformedStateRefusalMessage, Rr as formatLockExpiry, Rt as isNamelessDynamicReferenceError, S as computeParameterTaint, Sa as renderAssemblyPathEscape, Si as finchSecretArgvRefusal, Sn as hasReadableOrphans, Sr as markSameGenerationBag, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as resolveBucketRegion, Ti as isDockerClientEnvKey, Tn as isReadableResourceEntry, Tr as pathCrossesDottedKey, Tt as UNSPECIFIED_SKIP_REASON, U as coerceWarmThroughput$1, Ua as NestedStackChildDirectDestroyError, Ui as resolveSkipPrefix, Un as refuseMalformedOrphansForOrphan, Ur as hasReasonlessBaselineRefusal, Ut as WAFv2WebACLProvider, V as renderStatefulReason, Vi as resolveAutoAssetStorage, Vn as refuseMalformedOrphans, Vr as exportNamesCarriedFrom, Vt as refStateLookupFromResource, W as isWarmThroughputDecrease, Wa as PartialFailureError, Wi as resolveStateBucketWithDefault, Wn as refuseMalformedOutputs, Wr as hasUnverifiableParameterRefusal, Wt as normalizeAwsTagsToCfn, X as gray, Xi as CFN_TEMPLATE_BODY_LIMIT, Xn as refuseMalformedResourcesForDestroy, Xr as shouldRetainResource, Xt as configIntegerRefusal, Y as cyan, Ya as StackTerminationProtectionError, Yi as ssmResolvedValueType, Yn as refuseMalformedResourcePropertiesForOrphan, Yr as orphansCarriedFrom, Yt as configBooleanRefusal, Z as green, Za as SynthesisError, Zi as CFN_TEMPLATE_URL_LIMIT, Zn as refuseMalformedState, Zr as AssetPublisher, Zt as configStringRefusal, _ as bagHoldsSecretExpression, _a as hasPlainPrototype, _i as resolveDockerContextDirectory, _n as INTRINSIC_KEYS, _r as dynamicReferenceTokens, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as producerRecordKey, ai as BOOTSTRAP_MARKER_PREFIX, an as withSharedDrainBudget, ao as isRetryableTransientError, ar as findActionableSilentDrops, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as absoluteAssemblyPathEscape, bi as describeDockerFailure, bn as UNREADABLE_RESOURCES_MAP_ROW, br as isSingleDynamicReferenceToken, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as PARTITION_TABLE, ci as getBootstrapMarkerKey, cn as s3BucketDualStackDomainName, co as markNonRetryable, cr as withRetry, ct as IAMRoleProvider, d as updatePartialMessage, da as AssemblyReader, di as readBootstrapMarkerBody, dn as applyRoleArnIfSet, do as describeAwsFailure, dr as STATE_SOURCED_BASELINE_RULES, dt as definedAttributes, ea as uploadCfnTemplate, ei as buildAssetRedirectMap, en as requireConfigArray, eo as normalizeAwsError, er as repairMalformedResourceEntriesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as failedStageNote, fi as validateAssetBucketName, fn as AWS_CREDENTIAL_ENV_KEYS, fo as safeStringify, fr as STATE_SOURCED_CROSS_GENERATION_RULES, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as hasOwnKey, gi as buildDockerImage, gn as DiffCalculator, gr as createSecretMasker, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as defineOwnKey, hi as assertCdkLocalDockerContextContained, hn as envCredentialsAreAssumedRole, hr as carriesSecretMask, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as producerCoordinateKey, ii as AssetModeResolver, in as producerRegionsFromState, io as isMarkedNonRetryable, ir as safeStackName, it as secretBearing, j as isFinalSnapshotError, ji as warnFinchArgvExposure, jn as malformedOrphansWarning, jr as LockManager, jt as IntrinsicFunctionResolver, k as ccRoutedFinalSnapshotError, ka as runWithStackAwsClients, ki as runDockerForeground, kn as malformedOrphanRecordsWarning, kr as redactSecretsForState, kt as disableInstanceApiTermination, l as replayRollback, la as canonicalizeRegion, li as isCrossRegionRedirect, ln as s3BucketRegionalDomainName, lo as markRedactedCause, lr as DagBuilder, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as processStackMessages, mi as buildDenyExternalAccessPolicy, mn as callerEnvCredentials, mr as TEMPLATE_SOURCED_RULES, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as injectiveKey, ni as loadPublishableAssetManifest, nn as requireConfigString, no as pasteableCommand, nr as repairMalformedResourcesForReadOnly, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as decodeListingKey, oi as assertAssetBucketRegion, on as s3BucketArn, oo as isThrottlingError, or as findSilentDropProperties, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as globMatches, pi as validateContainerRepoName, pn as applyCallerIdentityCredentials, pr as STATE_SOURCED_READBACK_RULES, pt as ProviderRegistry, q as formatResourceLine, qa as ResourceUpdateNotSupportedError, qi as stateBucketExistenceConfirmed, qn as refuseMalformedResourceEntries, qr as isReadableBag, qt as coerceCfnBoolean, r as DeployEngine, ra as injectiveKeyPrefix, ri as rewriteTemplateAssetReferences, rn as classifyReplaySecretRegion, ro as shellQuote, rr as safeRegion, rt as isExportAliasCollision, s as planRollback, sa as expectedOwnerParam, si as ensureAssetStorage, sn as s3BucketDomainName, so as isTransientServerError, sr as describeTypeWithThrottleRetry, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ti as createAssetRedirectResolver, tn as requireConfigObject, to as withErrorHandling, tr as repairMalformedResourcePropertiesForReadOnly, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as derivePartitionAndUrlSuffix, ui as parseBootstrapMarker, un as s3BucketWebsiteUrl, uo as retryClassificationText, ur as TemplateParser, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as nullPrototypeRecord, vi as describeDockerCapturedOutput, vn as STATE_RESOURCES_MALFORMED, vr as errorCauseChain, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wi as getDockerCmd, wn as hasReadableResources, wr as maskSecretsInText, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as displayAssemblyPath, xi as dockerSpawnEnvWithSensitive, xn as displayLogicalId, xr as isUncertifiedBaselineMaskPosition, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as ownValue, yi as describeDockerExecFailure, yn as UNREADABLE_ORPHANS_CONTAINER_ROW, yr as identityKeyFor, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as LocalInvokeBuildError$1, zi as getLegacyStateBucketName, zn as refuseDivergentRecordRegionForDestroy, zr as CUSTOM_RESOURCE_RESPONSE_PREFIX, zt as isUnboundTemplateParameter } from "./deploy-engine-xxVOQPPr.js";
-import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
+import { $ as yellow, $a as NestedStackChildDirectDestroyError, $i as resolveSkipPrefix, $n as refuseMalformedOutputsForDestroy, $r as hasReadableExportSet, $t as readConfigString, A as createPreDeleteFinalSnapshot, Aa as absoluteAssemblyPathEscape, Ai as describeDockerFailure, An as malformedExportSourceWarning, Ar as identityKeyFor, At as disableInstanceApiTermination, B as isStatefulRecreateTargetSync, Ba as setAwsClients, Bi as runDockerStreaming, Bn as malformedResourceEntriesWarning, Br as redactSecretsForState, Bt as isUnboundTemplateParameter, C as namesAnyDeclaredParameter, Ca as globMatches, Ci as validateAssetBucketName, Cn as displayLogicalId, Cr as STATE_SOURCED_CROSS_GENERATION_RULES, Ct as CloudControlProvider, D as PRE_DELETE_SNAPSHOT_TYPES, Da as hasPlainPrototype, Di as resolveDockerContextDirectory, Dn as isReadableOrphanRecord, Dr as createSecretMasker, Dt as deleteIndeterminateGuards, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as hasOwnKey, Ei as buildDockerImage, En as hasReadableResources, Er as carriesSecretMask, Et as UNSPECIFIED_SKIP_REASON, F as extractDeploymentEventError, Fa as resolveBucketRegion, Fi as isDockerClientEnvKey, Fn as malformedOrphansRefusalMessage, Fr as maskSecretsInText, Ft as cfnRefValueFromPhysicalId, G as toCfnInteger, Gi as getDockerImageBySourceHash, Gn as refuseDivergentRecordRegionForDestroy, Gr as UNREPRODUCIBLE_LOCK_CLAUSE, Gt as normalizeAwsTagsToCfn, H as WARM_THROUGHPUT_MEMBERS, Ha as CdkdError, Hi as escapeRegExp, Hn as malformedResourcesWarning, Hr as LockManager, Ht as refStateLookupFromResource, I as makeSiblingClaimReader, Ia as AwsClients, Ii as isMalformedEnvKey, In as malformedOrphansWarning, Ir as pathCrossesDottedKey, It as coerceParameterTypedValue, J as bold, Ja as IntrinsicResolutionRefusalError, Ji as getDefaultStateBucketName, Jn as refuseMalformedOrphanRecordsForDestroy, Jr as forceQuitRecoveryClause, Jt as coerceCfnBoolean, K as toFiniteNumber, Ka as DeployCancelledError, Ki as Synthesizer, Kn as refuseMalformedNestedChildOutputs, Kr as buildForceUnlockCommand, Kt as resolveExplicitPhysicalId, L as planOrphanAdoption, La as getAwsClients, Li as partitionSensitiveEnv, Ln as malformedOutputsRefusalMessage, Lr as recordMaskOnlyValue, Lt as getAccountInfo, M as refusesFinalSnapshot, Ma as renderAssemblyPathEscape, Mi as finchSecretArgvRefusal, Mn as malformedOrphanRecordsRefusalMessage, Mr as isUncertifiedBaselineMaskPosition, Mt as IntrinsicFunctionResolver, N as unsupportedFinalSnapshotError, Na as resolveAssemblyPath, Ni as formatDockerLoginError, Nn as malformedOrphanRecordsWarning, Nr as markSameGenerationBag, Nt as carriesDynamicReference, O as buildFinalSnapshotIdentifier, Oa as nullPrototypeRecord, Oi as describeDockerCapturedOutput, On as isReadableResourceEntry, Or as dynamicReferenceTokens, Ot as deleteSkipReason, P as makeCanonicalizePropertiesFn, Pi as getDockerCmd, Pn as malformedOrphanRowsKeptWarning, Pr as maskSecretsInError, Pt as carriesFetchableDynamicReference, Q as red, Qa as MalformedProducerRecordRefusalError, Qi as resolveCaptureObservedState, Qn as refuseMalformedOutputs, Qr as exportNamesCarriedFrom, Qt as configStringRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as resetAwsClients, Ri as redactDockerArgvValues, Rn as malformedOutputsWarning, Rr as recordMaskOnlyValuesIn, Rt as isImpossibleEmptyStoredAttribute, S as computeParameterTaint, Sa as failedStageNote, Si as readBootstrapMarkerBody, Sn as deployRefusesOrphanRowsReason, So as safeStringify, Sr as STATE_SOURCED_BASELINE_RULES, St as startInterruptWatch, T as resourcesNamingDeclaredParameter, Ta as defineOwnKey, Ti as buildDenyExternalAccessPolicy, Tn as hasReadableOutputs, Tr as TEMPLATE_SOURCED_RULES, Tt as ccProtectionRegistryTypes, U as coerceWarmThroughput$1, Ui as stripControlChars, Un as malformedStateRefusalMessage, Ur as S3StateBackend, Ut as isSettledInstanceState, V as renderStatefulReason, Vi as warnFinchArgvExposure, Vn as malformedResourcePropertiesWarning, Vr as scrubResourceRecord, Vt as parameterTypeMayLoseSecretIdentity, W as isWarmThroughputDecrease, Wa as CrossAccountSecretRefusalError, Wi as AssetManifestLoader, Wn as previewableOrphanRecords, Wr as rebuildClientForBucketRegion, Wt as WAFv2WebACLProvider, X as gray, Xa as LocalStartServiceError, Xi as resolveApp, Xn as refuseMalformedOrphansForDestroy, Xr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as configBooleanRefusal, Y as cyan, Ya as LocalInvokeBuildError$1, Yi as getLegacyStateBucketName, Yn as refuseMalformedOrphans, Yr as formatLockExpiry, Yt as coerceCfnInteger, Z as green, Zi as resolveAutoAssetStorage, Zn as refuseMalformedOrphansForOrphan, Zr as DEFAULT_STATE_PREFIX, Zt as configIntegerRefusal, _ as bagHoldsSecretExpression, _a as expectedOwnerParam, _i as assertAssetBucketRegion, _n as DiffCalculator, _o as isTransientServerError, _r as findSilentDropProperties, _t as maskerOrIdentity, a as DeploymentEventsStore, aa as ssmResolvedValueType, ai as orphansAfterRollback, an as producerRegionsFromState, ao as StackTerminationProtectionError, ar as refuseMalformedState, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as derivePartitionAndUrlSuffix, bi as isCrossRegionRedirect, bn as UNREADABLE_ORPHANS_CONTAINER_ROW, bo as retryClassificationText, br as DagBuilder, bt as interruptWatchListenerCount, c as replayFailedOperations, ca as MIGRATE_TMP_PREFIX, ci as AssetPublisher, cn as s3BucketDomainName, cr as repairMalformedOutputsForReadOnly, ct as IAMRoleProvider, d as updatePartialMessage, da as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as buildAssetRedirectMap, dn as s3BucketWebsiteUrl, do as withErrorHandling, dr as repairMalformedResourcesForReadOnly, dt as definedAttributes, ea as resolveStateBucketWithDefault, ei as hasReasonlessBaselineRefusal, en as replayWarn, eo as PartialFailureError, er as refuseMalformedResourceAttributesForOrphan, et as collectDeclaredOutputNames, f as updatePartialReason, fa as injectiveKey, fi as createAssetRedirectResolver, fn as applyRoleArnIfSet, fo as pasteableCommand, fr as safeRegion, ft as stringifyIfAssigned, g as computeImplicitDeleteEdges, ga as decodeListingKey, gi as BOOTSTRAP_MARKER_PREFIX, gn as envCredentialsAreAssumedRole, go as isThrottlingError, gr as findActionableSilentDrops, gt as maskDeep, h as IMPLICIT_DELETE_DEPENDENCIES, ha as producerRecordKey, hi as AssetModeResolver, hn as callerEnvCredentials, ho as isRetryableTransientError, hr as unreadableOrphanRecords, ht as createMaskedRetryLogger, i as DeploymentEventsReader, ia as warnDeprecatedNoPrefixCliFlag, ii as isReadableBag, in as classifyReplaySecretRegion, io as StackHasActiveImportsError, ir as refuseMalformedResourcesForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as displayAssemblyPath, ji as dockerSpawnEnvWithSensitive, jn as malformedLocalOutputsWarning, jr as isSingleDynamicReferenceToken, jt as isTerminationProtectionPropagationError, k as ccRoutedFinalSnapshotError, ka as ownValue, ki as describeDockerExecFailure, kn as malformedExportNamesWarning, kr as errorCauseChain, kt as isWaitAbandonedError, l as replayRollback, la as findLargeInlineResources, li as stringifyValue, ln as s3BucketDualStackDomainName, lr as repairMalformedResourceEntriesForReadOnly, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as producerCoordinateKey, mi as rewriteTemplateAssetReferences, mn as applyCallerIdentityCredentials, mo as isMarkedNonRetryable, mr as unpreviewableOrphanRecords, mt as wouldReturnToSdkProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveUseCdkBootstrapAssets, ni as importableOutputKeys, nn as requireConfigObject, no as ResourceTimeoutError, nr as refuseMalformedResourceEntriesForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as CFN_TEMPLATE_BODY_LIMIT, oi as orphansCarriedFrom, on as withSharedDrainBudget, or as repairMalformedOrphanRecordsForReadOnly, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as injectiveKeyPrefix, pi as loadPublishableAssetManifest, pn as AWS_CREDENTIAL_ENV_KEYS, po as shellQuote, pr as safeStackName, pt as ProviderRegistry, q as formatResourceLine, qa as DynamicReferenceRegionAmbiguousError, qi as synthesisStatusMessage, qn as refuseMalformedOrphanRecords, qr as buildLockContentionMessage, qt as assertRegionMatch, r as DeployEngine, ra as stateBucketExistenceConfirmed, ri as importableOutputs, rn as requireConfigString, ro as ResourceUpdateNotSupportedError, rr as refuseMalformedResourcePropertiesForOrphan, rt as isExportAliasCollision, s as planRollback, sa as CFN_TEMPLATE_URL_LIMIT, si as shouldRetainResource, sn as s3BucketArn, so as SynthesisError, sr as repairMalformedOrphansForReadOnly, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as resolveStateBucketWithDefaultAndSource, ti as hasUnverifiableParameterRefusal, tn as requireConfigArray, to as ProvisioningError, tr as refuseMalformedResourceEntries, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as uploadCfnTemplate, ui as WorkGraph, un as s3BucketRegionalDomainName, uo as normalizeAwsError, ur as repairMalformedResourcePropertiesForReadOnly, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as PARTITION_TABLE, vi as ensureAssetStorage, vn as INTRINSIC_KEYS, vo as markNonRetryable, vr as describeTypeWithThrottleRetry, vt as beginCommandInterruptScope, w as reachableDivergentParameters, wa as processStackMessages, wi as validateContainerRepoName, wn as hasReadableOrphans, wr as STATE_SOURCED_READBACK_RULES, wt as slowCcOperationTimeoutMs, x as bindingSkippedOutputs, xa as AssemblyReader, xi as parseBootstrapMarker, xn as UNREADABLE_RESOURCES_MAP_ROW, xo as describeAwsFailure, xr as TemplateParser, xt as isInterruptedWaitError, y as keptWholeReasonText, ya as canonicalizeRegion, yi as getBootstrapMarkerKey, yn as STATE_RESOURCES_MALFORMED, yo as markRedactedCause, yr as withRetry, yt as endCommandInterruptScope, z as isStatefulRecreateTargetForReplace, za as runWithStackAwsClients, zi as runDockerForeground, zn as malformedRenderedContainersWarning, zr as recoverMaskedOutput, zt as isNamelessDynamicReferenceError } from "./deploy-engine-BwDlgFRs.js";
+import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-DMRkEtU2.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHM7_WdJ.js";
+import { t as getCdkdVersion } from "./version-CJkb2usU.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DR5gOGbi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -284,6 +284,51 @@ function describeStateKey(key, suffix = STATE_FILE_SUFFIX, knownPrefix) {
 */
 const STATE_KEY_MAX_CODE_POINTS = STACK_REF_MAX_CODE_POINTS + 64;
 
+//#endregion
+//#region src/provisioning/remove-protection-types.ts
+/**
+* The resource types whose SDK provider's `delete()` flips a protection flag
+* off under `DeleteContext.removeProtection` (issue
+* [#2660](https://github.com/go-to-k/cdkd/issues/2660)).
+*
+* This is the ONE list the `--remove-protection` help strings render from, on
+* `cdkd destroy` and `cdkd state destroy`. The Cloud Control half comes from
+* {@link ccProtectionRegistryTypes}. Both copies of the help were hand-written
+* before, and two types the providers honour (`AWS::EMR::Cluster`,
+* `AWS::DynamoDB::GlobalTable`) were missing from both.
+*
+* `tests/unit/provisioning/remove-protection-types.test.ts` binds this list to
+* the provider tree in both directions: each type's registered provider reads
+* `removeProtection`, and each provider file that reads it registers at least
+* one type here. A new provider gaining the flip fails that test until its type
+* is added.
+*/
+const SDK_REMOVE_PROTECTION_TYPES = [
+	"AWS::Logs::LogGroup",
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBCluster",
+	"AWS::DocDB::DBCluster",
+	"AWS::Neptune::DBCluster",
+	"AWS::Neptune::DBInstance",
+	"AWS::DynamoDB::Table",
+	"AWS::DynamoDB::GlobalTable",
+	"AWS::EC2::Instance",
+	"AWS::Cognito::UserPool",
+	"AWS::AutoScaling::AutoScalingGroup",
+	"AWS::ElasticLoadBalancingV2::LoadBalancer",
+	"AWS::EMR::Cluster"
+];
+/** Every type `--remove-protection` covers: the SDK list, then the Cloud Control registry. */
+function removeProtectionTypes() {
+	return [...SDK_REMOVE_PROTECTION_TYPES, ...ccProtectionRegistryTypes()];
+}
+/** The types as the help prints them: `A, B, and C`. */
+function removeProtectionTypeList() {
+	const types = removeProtectionTypes();
+	if (types.length < 2) return types.join("");
+	return `${types.slice(0, -1).join(", ")}, and ${types[types.length - 1]}`;
+}
+
 //#endregion
 //#region src/cli/options.ts
 /**
@@ -1127,7 +1172,7 @@ function effectiveAssumeRoleArn(logicalId, opt) {
 */
 const destroyOptions = [
 	new Option("-f, --force", "Do not ask for confirmation before destroying the stacks").default(false),
-	new Option("--remove-protection", "Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers stack-level terminationProtection (CDK property) and resource-level protection on AWS::Logs::LogGroup, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::DocDB::DBCluster, AWS::Neptune::DBCluster, AWS::Neptune::DBInstance, AWS::DynamoDB::Table, AWS::EC2::Instance, AWS::Cognito::UserPool, AWS::AutoScaling::AutoScalingGroup, AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::DSQL::Cluster, AWS::NeptuneGraph::Graph, AWS::SMSVOICE::ProtectConfiguration, AWS::VerifiedPermissions::PolicyStore, AWS::EKS::Cluster, AWS::RDS::GlobalCluster, and AWS::DocDB::GlobalCluster.").default(false),
+	new Option("--remove-protection", `Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers stack-level terminationProtection (CDK property) and resource-level protection on ${removeProtectionTypeList()}.`).default(false),
 	allowUnsupportedTypesOption
 ];
 /**
@@ -2392,12 +2437,12 @@ function countDeployableResources(template) {
 */
 function resolveVerboseTemplatePath(outputDir, stackName) {
 	const resolved = resolveAssemblyPath(outputDir, `${stackName}.template.json`);
-	if (!resolved.contained) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template to a path that ${renderAssemblyPathEscape(resolved, outputDir, "write it")}`);
+	if (!resolved.contained) throw new SynthesisError(`Stack ${displayStackName(stackName)} would write its template to a path that ${renderAssemblyPathEscape(resolved, outputDir, "write it")}`);
 	let linked = false;
 	try {
 		linked = lstatSync(resolved.path).isSymbolicLink();
 	} catch {}
-	if (linked) throw new SynthesisError(`Stack '${displaySafe(stackName)}' would write its template over a symbolic link at ${displayAssemblyPath(resolved.path)}. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
+	if (linked) throw new SynthesisError(`Stack ${displayStackName(stackName)} would write its template over a symbolic link at ${displayAssemblyPath(resolved.path)}. cdkd writes a stack's template as a regular file beside the assembly; a symbolic link there redirects the write to wherever it points, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to write it.`);
 	return resolved.path;
 }
 /**
@@ -3789,15 +3834,16 @@ function findNestedTemplateTreeDefect(nestedTemplates, ancestorTemplatePaths = [
 /** Hops rendered in full before the middle of a long chain is elided. */
 const MAX_RENDERED_HOPS = 8;
 /**
-* `'A' (/x/a.json) -> 'B' (/x/b.json)`. Every interpolation goes through
-* `displaySafe`: this text exists FOR a hand-modified assembly, so a logical id
+* `A (/x/a.json) -> B (/x/b.json)`. The logical id renders through
+* `displayIdent` and the path through `displayAssemblyPath`, each supplying its
+* own boundary: this text exists FOR a hand-modified assembly, so a logical id
 * (a template key) and a path (derived from `aws:asset:path`) are both
 * attacker-controlled, and a bare `Error` message is not sanitized downstream.
 * A long chain keeps both ends, since the entry row and the closing row are
 * the two a reader needs.
 */
 function renderChain(chain) {
-	const hop = (h) => `'${displaySafe(h.logicalId)}' (${displayAssemblyPath(h.templatePath)})`;
+	const hop = (h) => `${displayIdent(h.logicalId)} (${displayAssemblyPath(h.templatePath)})`;
 	if (chain.length <= MAX_RENDERED_HOPS) return chain.map(hop).join(" -> ");
 	const keep = MAX_RENDERED_HOPS / 2;
 	return [
@@ -3815,21 +3861,19 @@ function renderNestedTemplateTreeDefect(defect, stackName, action) {
 	const owner = (chain) => {
 		const ids = chain.slice(0, -1).map((h) => h.logicalId);
 		const keep = MAX_RENDERED_HOPS / 2;
-		const shown = ids.length <= MAX_RENDERED_HOPS ? ids : [
-			...ids.slice(0, keep),
-			`...${ids.length - 8} more...`,
-			...ids.slice(-4)
-		];
-		return displaySafe([stackName, ...shown].join("~"));
+		if (ids.length <= MAX_RENDERED_HOPS) return displayStackName([stackName, ...ids].join("~"));
+		const head = displayStackName([stackName, ...ids.slice(0, keep)].join("~"));
+		const tail = displayStackName(ids.slice(-4).join("~"));
+		return `${head}~...${ids.length - 8} more...~${tail}`;
 	};
 	if (defect.kind === "cycle") {
 		const closing = defect.chain[defect.chain.length - 1];
-		return `The nested template tree under stack '${displaySafe(stackName)}' contains a cycle: ${renderChain(defect.chain)}. Nested stack '${displaySafe(closing.logicalId)}' (declared in stack '${owner(defect.chain)}') resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
+		return `The nested template tree under stack ${displayStackName(stackName)} contains a cycle: ${renderChain(defect.chain)}. Nested stack ${displayIdent(closing.logicalId)} (declared in stack ${owner(defect.chain)}) resolves to a template that is already on that nesting chain, so its Metadata['aws:asset:path'] closes a cycle. ${provenance}`;
 	}
-	if (defect.kind === "too-large") return `The nested template tree under stack '${displaySafe(stackName)}' has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
-	if (defect.kind === "too-deep") return `The nested template tree under stack '${displaySafe(stackName)}' nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
-	if (defect.kind === "escaping-path") return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
-	return `The nested template tree under stack '${displaySafe(stackName)}' has nested stack '${displaySafe(defect.logicalId)}' (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
+	if (defect.kind === "too-large") return `The nested template tree under stack ${displayStackName(stackName)} has more than ${MAX_ROWS_FOLLOWED} nested-stack rows to follow (the walk stopped at ${renderChain(defect.chain)}). That is far beyond any CDK-generated assembly. Symlinked directories can give one template file many paths, which multiplies the tree without ever repeating on one chain. Refusing to ${action}.`;
+	if (defect.kind === "too-deep") return `The nested template tree under stack ${displayStackName(stackName)} nests more than ${512} levels deep: ${renderChain(defect.chain)}. No tree that deep can deploy, because each level lengthens the child's state key and S3 caps a key at 1024 bytes. ${provenance}`;
+	if (defect.kind === "escaping-path") return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which ${renderAssemblyPathEscape(defect.escape, defect.dir, action)}`;
+	return `The nested template tree under stack ${displayStackName(stackName)} has nested stack ${displayIdent(defect.logicalId)} (reached through ${renderChain(defect.chain)}) with Metadata['aws:asset:path']=${displayAssemblyPath(defect.assetPath)} which is absolute. ${provenance}`;
 }
 
 //#endregion
@@ -4598,8 +4642,8 @@ var ExportIndexStore = class {
 	*/
 	warnOnForeignOverwrite(existing, exportName, stackName, producerRegion) {
 		if (!existing || existing.producerStack === stackName) return;
-		const safeName = displaySafe(exportName);
-		this.logger.warn(`Export '${safeName}' is published by both '${existing.producerStack}' (${existing.producerRegion}) and '${stackName}' (${producerRegion}); the exports index keeps the latest writer, so an Fn::ImportValue on it binds to whichever deployed last. CloudFormation refuses a second producer of the same export name — rename one of the two exports. (If '${existing.producerStack}' predates cdkd's state schema v9, this is its stale entry for a plain output of that name, and its next deploy clears it.)`);
+		const theirs = displayStackName(existing.producerStack);
+		this.logger.warn(`Export ${displayIdent(exportName)} is published by both ${theirs} (${displayIdent(existing.producerRegion)}) and ${displayStackName(stackName)} (${displayIdent(producerRegion)}); the exports index keeps the latest writer, so an Fn::ImportValue on it binds to whichever deployed last. CloudFormation refuses a second producer of the same export name — rename one of the two exports. (If ${theirs} predates cdkd's state schema v9, this is its stale entry for a plain output of that name, and its next deploy clears it.)`);
 	}
 	async applyPatch(exportName, entry, requireOwner) {
 		await this.ensureLoaded();
@@ -4607,7 +4651,7 @@ var ExportIndexStore = class {
 		if (requireOwner) {
 			const current = this.loadState.entries.get(exportName);
 			if (!current || current.producerStack !== requireOwner.producerStack || current.producerRegion !== requireOwner.producerRegion) {
-				this.logger.warn(`Exports index entry ownership changed under a patch; refusing to write it. Expected producer '${displaySafe(requireOwner.producerStack)}' (${displaySafe(requireOwner.producerRegion)}), found ${current ? `'${displaySafe(current.producerStack)}' (${displaySafe(current.producerRegion)})` : "no entry"}.`);
+				this.logger.warn(`Exports index entry ownership changed under a patch; refusing to write it. Expected producer ${displayStackName(requireOwner.producerStack)} (${displayIdent(requireOwner.producerRegion)}), found ${current ? `${displayStackName(current.producerStack)} (${displayIdent(current.producerRegion)})` : "no entry"}.`);
 				return false;
 			}
 		}
@@ -5862,10 +5906,10 @@ var IAMInstanceProfileProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "InstanceProfileName");
 		if (explicit) try {
-			await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: explicit }));
+			const resp = await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({ Arn: resp.InstanceProfile?.Arn })
 			};
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return null;
@@ -7199,10 +7243,10 @@ var IAMUserGroupProvider = class {
 	async importUser(input) {
 		const explicit = resolveExplicitPhysicalId(input, "UserName");
 		if (explicit) try {
-			await this.iamClient.send(new GetUserCommand({ UserName: explicit }));
+			const resp = await this.iamClient.send(new GetUserCommand({ UserName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({ Arn: resp.User?.Arn })
 			};
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return null;
@@ -7213,10 +7257,10 @@ var IAMUserGroupProvider = class {
 	async importGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "GroupName");
 		if (explicit) try {
-			await this.iamClient.send(new GetGroupCommand({ GroupName: explicit }));
+			const resp = await this.iamClient.send(new GetGroupCommand({ GroupName: explicit }));
 			return {
 				physicalId: explicit,
-				attributes: {}
+				attributes: definedAttributes({ Arn: resp.Group?.Arn })
 			};
 		} catch (err) {
 			if (err instanceof NoSuchEntityException) return null;
@@ -13868,6 +13912,29 @@ function isSnsTopicArnList(value) {
 */
 const LAMBDA_CLEANUP_DELETE_MAX_ATTEMPTS = 3;
 /**
+* Refuse `CodeSigningConfigArn` / `RuntimeManagementConfig` on a
+* container-image function (`PackageType: Image`), BEFORE any Lambda call.
+* AWS rejects both there with `InvalidParameterValueException`: the image
+* carries its own runtime, so there are no runtime-management controls, and
+* Lambda code signing does not apply to images (issue
+* [#1894](https://github.com/go-to-k/cdkd/issues/1894)). The READ side skips
+* the matching `Get*` calls for the same reason (see `readCurrentState`). Without it the create either
+* fails on `CreateFunction` (code signing) or creates the function, fails the
+* post-create `PutRuntimeManagementConfig` and deletes it again; the update
+* fails part-way through on the Put.
+*
+* Unconditional, including on a rollback replay (`replayingState`): AWS
+* rejects the combination every time, so no state record can carry it and a
+* downgraded warning could only report success over a call that then fails
+* (the `.claude/rules/provider-replay-and-refusals.md` exception).
+*/
+function refuseImageFunctionUnsupported(logicalId, resourceType, properties, physicalId) {
+	if (properties["PackageType"] !== "Image") return;
+	const declared = [properties["CodeSigningConfigArn"] !== void 0 ? "CodeSigningConfigArn" : void 0, properties["RuntimeManagementConfig"] !== void 0 ? "RuntimeManagementConfig" : void 0].filter((key) => key !== void 0);
+	if (declared.length === 0) return;
+	throw markNonRetryable(new ProvisioningError(`Lambda function ${logicalId} is a container-image function (PackageType: Image), and AWS rejects ${declared.join(" and ")} on one: an image carries its own runtime and Lambda code signing does not apply to images. Remove ${declared.length === 1 ? "it" : "them"} from the function's properties.`, resourceType, logicalId, physicalId));
+}
+/**
 * Pick the inline-code filename for a Lambda runtime.
 *
 * CloudFormation's `Code.ZipFile` auto-zips inline code into a file named
@@ -13962,6 +14029,7 @@ var LambdaFunctionProvider = class {
 		const role = properties["Role"];
 		if (!code) throw new ProvisioningError(`Code is required for Lambda function ${logicalId}`, resourceType, logicalId);
 		if (!role) throw new ProvisioningError(`Role is required for Lambda function ${logicalId}`, resourceType, logicalId);
+		refuseImageFunctionUnsupported(logicalId, resourceType, properties);
 		try {
 			let tags;
 			if (properties["Tags"]) {
@@ -14112,6 +14180,7 @@ var LambdaFunctionProvider = class {
 		const mask = maskerOrIdentity(context?.maskSecrets);
 		const debug = (message) => this.logger.debug(mask(message));
 		this.logger.debug(`Updating Lambda function ${logicalId}: ${physicalId}`);
+		refuseImageFunctionUnsupported(logicalId, resourceType, properties, physicalId);
 		try {
 			const configFields = [
 				"Role",
@@ -27953,10 +28022,17 @@ var SSMParameterProvider = class {
 		if (explicit) {
 			this.refuseUnwritableParameterId(input, explicit);
 			try {
-				const arn = (await this.ssmClient.send(new GetParameterCommand({ Name: explicit }))).Parameter?.ARN;
+				const resp = await this.ssmClient.send(new GetParameterCommand({ Name: explicit }));
+				const arn = resp.Parameter?.ARN;
+				const declared = input.properties?.["Value"];
+				const literalValue = typeof declared === "string" && !declared.includes("{{resolve:");
 				return {
 					physicalId: explicit,
-					attributes: { ...arn !== void 0 && { Arn: arn } }
+					attributes: definedAttributes({
+						Type: resp.Parameter?.Type,
+						...literalValue && { Value: resp.Parameter?.Value },
+						Arn: arn
+					})
 				};
 			} catch (err) {
 				if (err instanceof ParameterNotFound) return null;
@@ -28701,6 +28777,39 @@ var EventBridgeBusProvider = class {
 	}
 };
 
+//#endregion
+//#region src/utils/ipv4-cidr.ts
+/**
+* Return the host-bit-cleared form of an IPv4 CIDR (`100.68.0.18/18` ->
+* `100.68.0.0/18`), or `undefined` when the input is not an IPv4 CIDR at all
+* (an IPv6 CIDR, a `pl-…` prefix-list id, or anything malformed).
+*
+* AWS rewrites a non-canonical CIDR on `CreateRoute`, so a route id that
+* spells the template's CIDR can differ from the destination AWS reports
+* (issue #1771). `EC2Provider`'s import compares through this (issue #3661).
+* `src/cli/commands/export.ts` still carries a private copy of the same
+* function; fold it onto this one once the open PR holding that file lands.
+*/
+function canonicalizeIpv4Cidr$1(value) {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(value);
+	if (!match) return void 0;
+	const octets = [
+		match[1],
+		match[2],
+		match[3],
+		match[4]
+	].map(Number);
+	const prefixLength = Number(match[5]);
+	if (prefixLength > 32 || octets.some((octet) => octet > 255)) return void 0;
+	const network = ((octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0 & (prefixLength === 0 ? 0 : 4294967295 << 32 - prefixLength >>> 0)) >>> 0;
+	return `${[
+		network >>> 24,
+		network >>> 16 & 255,
+		network >>> 8 & 255,
+		network & 255
+	].join(".")}/${prefixLength}`;
+}
+
 //#endregion
 //#region src/provisioning/providers/idempotency-token.ts
 /**
@@ -30225,12 +30334,16 @@ var EC2Provider = class {
 			try {
 				const ingressRules = properties["SecurityGroupIngress"];
 				const egressRules = properties["SecurityGroupEgress"];
-				const firstRejection = (await Promise.allSettled([
-					this.applyTags(groupId, properties, logicalId),
-					this.authorizeInlineIngress(groupId, ingressRules),
-					this.applyInlineEgress(groupId, egressRules)
-				])).find((r) => r.status === "rejected");
-				if (firstRejection) throw firstRejection.reason;
+				let firstRejection;
+				const recordRejection = (branch) => branch.catch((error) => {
+					firstRejection ??= { error };
+				});
+				await Promise.all([
+					recordRejection(this.applyTags(groupId, properties, logicalId)),
+					recordRejection(this.authorizeInlineIngress(groupId, ingressRules)),
+					recordRejection(this.applyInlineEgress(groupId, egressRules))
+				]);
+				if (firstRejection !== void 0) throw firstRejection.error;
 			} catch (innerError) {
 				try {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
@@ -31572,12 +31685,14 @@ var EC2Provider = class {
 	*   id, and records cdkd's composite `<groupId>|<ipProtocol>|<fromPort>|<toPort>`
 	*   plus the rule id as the `Id` attribute (issue #1761).
 	*
-	* The remaining EC2 types this provider creates (RouteTable, Route,
-	* InternetGateway, VPCGatewayAttachment, NetworkAcl, NetworkAclEntry,
-	* SubnetRouteTableAssociation, SubnetNetworkAclAssociation, Instance) return
-	* `null` — Routes and associations are derived from their parent, and the
-	* typical adoption story is "find the VPC, cdkd reconstructs the rest at
-	* deploy time".
+	* - RouteTable, Route, InternetGateway, VPCGatewayAttachment, NetworkAcl,
+	*   NetworkAclEntry, SubnetRouteTableAssociation, SubnetNetworkAclAssociation,
+	*   Instance (issue #3661) — they used to return `null` on the premise that
+	*   cdkd reconstructs them at deploy time, which `--migrate-from-cloudformation`
+	*   breaks: the CloudFormation stack is retired with them live, and the
+	*   re-create duplicates or conflicts. VPCGatewayAttachment and
+	*   NetworkAclEntry rebuild cdkd's composite from the template, since
+	*   CloudFormation's id for them does not carry it.
 	*
 	* There is no `aws:cdk:path` tag lookup: AWS rejects `aws:`-prefixed tag
 	* writes, so that tag never exists on a real resource and a
@@ -31587,7 +31702,7 @@ var EC2Provider = class {
 	* physical-name property instead.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return this.verifyExplicit(input.logicalId, input.resourceType, input.knownPhysicalId);
+		if (input.knownPhysicalId) return this.verifyExplicit(input.logicalId, input.resourceType, input.knownPhysicalId, input.properties ?? {});
 		return null;
 	}
 	/**
@@ -32150,17 +32265,23 @@ var EC2Provider = class {
 			}
 		}
 	}
-	async verifyExplicit(logicalId, resourceType, physicalId) {
+	async verifyExplicit(logicalId, resourceType, physicalId, properties) {
 		try {
 			switch (resourceType) {
 				case "AWS::EC2::VPC": return (await this.ec2Client.send(new DescribeVpcsCommand({ VpcIds: [physicalId] }))).Vpcs?.[0] ? {
 					physicalId,
 					attributes: {}
 				} : null;
-				case "AWS::EC2::Subnet": return (await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [physicalId] }))).Subnets?.[0] ? {
-					physicalId,
-					attributes: {}
-				} : null;
+				case "AWS::EC2::Subnet": {
+					const subnet = (await this.ec2Client.send(new DescribeSubnetsCommand({ SubnetIds: [physicalId] }))).Subnets?.[0];
+					return subnet ? {
+						physicalId,
+						attributes: definedAttributes({
+							SubnetId: physicalId,
+							AvailabilityZone: subnet.AvailabilityZone
+						})
+					} : null;
+				}
 				case "AWS::EC2::SecurityGroup": {
 					const group = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ GroupIds: [physicalId] }))).SecurityGroups?.[0];
 					if (!group) return null;
@@ -32233,6 +32354,125 @@ var EC2Provider = class {
 						}
 					};
 				}
+				case "AWS::EC2::RouteTable":
+					if (!/^rtb-[0-9a-f]+$/.test(physicalId)) return null;
+					return (await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [physicalId] }))).RouteTables?.[0] ? {
+						physicalId,
+						attributes: { RouteTableId: physicalId }
+					} : null;
+				case "AWS::EC2::InternetGateway":
+					if (!/^igw-[0-9a-f]+$/.test(physicalId)) return null;
+					return (await this.ec2Client.send(new DescribeInternetGatewaysCommand({ InternetGatewayIds: [physicalId] }))).InternetGateways?.[0] ? {
+						physicalId,
+						attributes: { InternetGatewayId: physicalId }
+					} : null;
+				case "AWS::EC2::NetworkAcl":
+					if (!/^acl-[0-9a-f]+$/.test(physicalId)) return null;
+					return (await this.ec2Client.send(new DescribeNetworkAclsCommand({ NetworkAclIds: [physicalId] }))).NetworkAcls?.[0] ? {
+						physicalId,
+						attributes: { Id: physicalId }
+					} : null;
+				case "AWS::EC2::Route": {
+					const [routeTableId, destination, ...rest] = physicalId.split("|");
+					if (rest.length > 0 || !routeTableId || !destination) return null;
+					if (!/^rtb-[0-9a-f]+$/.test(routeTableId)) return null;
+					const resp = await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [routeTableId] }));
+					const wanted = canonicalizeIpv4Cidr$1(destination) ?? destination;
+					return resp.RouteTables?.[0]?.Routes?.some((r) => r.DestinationCidrBlock !== void 0 && (canonicalizeIpv4Cidr$1(r.DestinationCidrBlock) ?? r.DestinationCidrBlock) === wanted || r.DestinationIpv6CidrBlock === destination || r.DestinationPrefixListId === destination) ? {
+						physicalId,
+						attributes: {}
+					} : null;
+				}
+				case "AWS::EC2::VPCGatewayAttachment": {
+					const segments = physicalId.split("|");
+					if (segments.length !== 2) return null;
+					if (segments.includes("VGW") || properties["VpnGatewayId"] !== void 0) return null;
+					const vpcId = segments.find((seg) => /^vpc-[0-9a-f]+$/.test(seg)) ?? (typeof properties["VpcId"] === "string" ? properties["VpcId"] : void 0);
+					if (!vpcId || !/^vpc-[0-9a-f]+$/.test(vpcId)) return null;
+					const declared = segments.find((seg) => /^igw-[0-9a-f]+$/.test(seg)) ?? (typeof properties["InternetGatewayId"] === "string" ? properties["InternetGatewayId"] : void 0);
+					if (declared !== void 0 && !/^igw-[0-9a-f]+$/.test(declared)) return null;
+					const gateway = (await this.ec2Client.send(new DescribeInternetGatewaysCommand(declared ? { InternetGatewayIds: [declared] } : { Filters: [{
+						Name: "attachment.vpc-id",
+						Values: [vpcId]
+					}] }))).InternetGateways?.find((g) => g.Attachments?.some((a) => a.VpcId === vpcId && ["available", "attached"].includes(String(a.State))));
+					if (!gateway?.InternetGatewayId) return null;
+					const attachmentSegments = [{
+						name: "internetGatewayId",
+						value: gateway.InternetGatewayId
+					}, {
+						name: "vpcId",
+						value: vpcId
+					}];
+					const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, attachmentSegments);
+					if (refusal !== void 0) {
+						this.logger.warn(`${refusal} Skipping import.`);
+						return null;
+					}
+					return {
+						physicalId: packCompositeId(resourceType, logicalId, attachmentSegments),
+						attributes: {}
+					};
+				}
+				case "AWS::EC2::NetworkAclEntry": {
+					const own = /^(acl-[0-9a-f]+)\|(\d+)\|(true|false)$/.exec(physicalId);
+					const networkAclId = own ? own[1] : typeof properties["NetworkAclId"] === "string" ? properties["NetworkAclId"] : void 0;
+					const ruleNumber = own ? Number(own[2]) : Number(properties["RuleNumber"]);
+					const egress = own ? own[3] === "true" : properties["Egress"] === true || properties["Egress"] === "true";
+					if (!networkAclId || !/^acl-[0-9a-f]+$/.test(networkAclId)) return null;
+					if (!Number.isInteger(ruleNumber)) return null;
+					if (!(await this.ec2Client.send(new DescribeNetworkAclsCommand({ NetworkAclIds: [networkAclId] }))).NetworkAcls?.[0]?.Entries?.find((e) => e.RuleNumber === ruleNumber && (e.Egress ?? false) === egress)) return null;
+					const entrySegments = [
+						{
+							name: "networkAclId",
+							value: networkAclId
+						},
+						{
+							name: "ruleNumber",
+							value: ruleNumber
+						},
+						{
+							name: "egress",
+							value: egress
+						}
+					];
+					const refusal = compositeIdSeparatorRefusal(resourceType, logicalId, entrySegments);
+					if (refusal !== void 0) {
+						this.logger.warn(`${refusal} Skipping import.`);
+						return null;
+					}
+					return {
+						physicalId: packCompositeId(resourceType, logicalId, entrySegments),
+						attributes: {}
+					};
+				}
+				case "AWS::EC2::SubnetRouteTableAssociation":
+					if (!/^rtbassoc-[0-9a-f]+$/.test(physicalId)) return null;
+					return (await this.ec2Client.send(new DescribeRouteTablesCommand({ Filters: [{
+						Name: "association.route-table-association-id",
+						Values: [physicalId]
+					}] }))).RouteTables?.[0] ? {
+						physicalId,
+						attributes: {}
+					} : null;
+				case "AWS::EC2::SubnetNetworkAclAssociation":
+					if (!/^aclassoc-[0-9a-f]+$/.test(physicalId)) return null;
+					return (await this.ec2Client.send(new DescribeNetworkAclsCommand({ Filters: [{
+						Name: "association.association-id",
+						Values: [physicalId]
+					}] }))).NetworkAcls?.[0] ? {
+						physicalId,
+						attributes: { AssociationId: physicalId }
+					} : null;
+				case "AWS::EC2::Instance": {
+					if (!/^i-[0-9a-f]+$/.test(physicalId)) return null;
+					const instance = (await this.ec2Client.send(new DescribeInstancesCommand({ InstanceIds: [physicalId] }))).Reservations?.[0]?.Instances?.[0];
+					const state = instance?.State?.Name;
+					if (!instance || state === "terminated" || state === "shutting-down") return null;
+					return {
+						physicalId,
+						attributes: describedInstanceAttributes(physicalId, instance)
+					};
+				}
 				default: return null;
 			}
 		} catch (error) {
@@ -35799,13 +36039,28 @@ var CloudFrontOAIProvider = class {
 	*
 	* Users adopting an existing OAI should pass
 	* `--resource <logicalId>=<oaiId>` (e.g. `E1ABCDEF123456`).
+	*
+	* The override is read back (issue #3627): `S3CanonicalUserId` is the
+	* attribute an S3 bucket policy grants the OAI by, `create()` records it,
+	* and the resolver cannot build it from the id. Returns `null` when no OAI
+	* exists behind the id.
 	*/
 	async import(input) {
-		if (input.knownPhysicalId) return {
+		if (!input.knownPhysicalId) return null;
+		let resp;
+		try {
+			resp = await this.cloudFrontClient.send(new GetCloudFrontOriginAccessIdentityCommand({ Id: input.knownPhysicalId }));
+		} catch (err) {
+			if (err instanceof NoSuchCloudFrontOriginAccessIdentity) return null;
+			throw err;
+		}
+		return {
 			physicalId: input.knownPhysicalId,
-			attributes: { Id: input.knownPhysicalId }
+			attributes: definedAttributes({
+				Id: input.knownPhysicalId,
+				S3CanonicalUserId: resp.CloudFrontOriginAccessIdentity?.S3CanonicalUserId
+			})
 		};
-		return null;
 	}
 };
 
@@ -37933,20 +38188,24 @@ var AgentCoreEvaluatorProvider = class {
 	*/
 	async import(input) {
 		if (!input.knownPhysicalId) return null;
-		if (input.knownPhysicalId.includes(":evaluator/")) return {
-			physicalId: input.knownPhysicalId,
-			attributes: {
-				EvaluatorArn: input.knownPhysicalId,
-				EvaluatorId: evaluatorIdFromArn(input.knownPhysicalId)
-			}
-		};
-		const response = await this.client.send(new GetEvaluatorCommand({ evaluatorId: input.knownPhysicalId }));
+		const isArn = input.knownPhysicalId.includes(":evaluator/");
+		let response;
+		try {
+			response = await this.client.send(new GetEvaluatorCommand({ evaluatorId: evaluatorIdFromArn(input.knownPhysicalId) }));
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$6) return null;
+			throw err;
+		}
+		const evaluatorArn = isArn ? input.knownPhysicalId : response.evaluatorArn;
+		if (!evaluatorArn) return null;
 		return {
-			physicalId: response.evaluatorArn,
-			attributes: {
-				EvaluatorArn: response.evaluatorArn,
-				EvaluatorId: response.evaluatorId ?? input.knownPhysicalId
-			}
+			physicalId: evaluatorArn,
+			attributes: definedAttributes({
+				EvaluatorArn: evaluatorArn,
+				EvaluatorId: response.evaluatorId ?? evaluatorIdFromArn(input.knownPhysicalId),
+				Status: response.status,
+				CreatedAt: response.createdAt?.toISOString()
+			})
 		};
 	}
 };
@@ -40340,6 +40599,30 @@ const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
 /** @see LOAD_BALANCER_ATTRIBUTE_DEFAULTS — same rule, Listener key table. */
 const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
 /**
+* The attribute map a load balancer records, shared by `create()` and
+* `import()` (issue #3627).
+*/
+function loadBalancerAttributes(lb, lbArn) {
+	return definedAttributes({
+		DNSName: lb.DNSName,
+		CanonicalHostedZoneID: lb.CanonicalHostedZoneId,
+		LoadBalancerArn: lbArn,
+		LoadBalancerFullName: lbArn.split("/").slice(1).join("/"),
+		LoadBalancerName: lb.LoadBalancerName
+	});
+}
+/**
+* The attribute map a target group records, shared by `create()`,
+* `update()` and `import()` (issue #3627).
+*/
+function targetGroupAttributes(tg, tgArn) {
+	return definedAttributes({
+		TargetGroupArn: tgArn,
+		TargetGroupFullName: tgArn.split(":").pop(),
+		TargetGroupName: tg.TargetGroupName
+	});
+}
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -40597,13 +40880,7 @@ var ELBv2Provider = class {
 			}
 			return {
 				physicalId: lbArn,
-				attributes: {
-					DNSName: lb.DNSName,
-					CanonicalHostedZoneID: lb.CanonicalHostedZoneId,
-					LoadBalancerArn: lbArn,
-					LoadBalancerFullName: lbArn.split("/").slice(1).join("/"),
-					LoadBalancerName: lb.LoadBalancerName
-				}
+				attributes: loadBalancerAttributes(lb, lbArn)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -40840,11 +41117,7 @@ var ELBv2Provider = class {
 			}
 			return {
 				physicalId: tgArn,
-				attributes: {
-					TargetGroupArn: tgArn,
-					TargetGroupFullName: tgArn.split(":").pop()?.replace("targetgroup/", ""),
-					TargetGroupName: tg.TargetGroupName
-				}
+				attributes: targetGroupAttributes(tg, tgArn)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -40922,11 +41195,7 @@ var ELBv2Provider = class {
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: {
-					TargetGroupArn: physicalId,
-					TargetGroupFullName: physicalId.split(":").pop()?.replace("targetgroup/", ""),
-					TargetGroupName: tg?.TargetGroupName
-				}
+				attributes: targetGroupAttributes(tg ?? {}, physicalId)
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -41587,10 +41856,10 @@ var ELBv2Provider = class {
 	}
 	async importLoadBalancer(input) {
 		if (input.knownPhysicalId) try {
-			const resp = await this.getClient().send(new DescribeLoadBalancersCommand({ LoadBalancerArns: [input.knownPhysicalId] }));
-			return resp.LoadBalancers?.[0]?.LoadBalancerArn ? {
-				physicalId: resp.LoadBalancers[0].LoadBalancerArn,
-				attributes: {}
+			const lb = (await this.getClient().send(new DescribeLoadBalancersCommand({ LoadBalancerArns: [input.knownPhysicalId] }))).LoadBalancers?.[0];
+			return lb?.LoadBalancerArn ? {
+				physicalId: lb.LoadBalancerArn,
+				attributes: loadBalancerAttributes(lb, lb.LoadBalancerArn)
 			} : null;
 		} catch (err) {
 			if (this.isNotFoundError(err)) return null;
@@ -41600,10 +41869,10 @@ var ELBv2Provider = class {
 	}
 	async importTargetGroup(input) {
 		if (input.knownPhysicalId) try {
-			const resp = await this.getClient().send(new DescribeTargetGroupsCommand({ TargetGroupArns: [input.knownPhysicalId] }));
-			return resp.TargetGroups?.[0]?.TargetGroupArn ? {
-				physicalId: resp.TargetGroups[0].TargetGroupArn,
-				attributes: {}
+			const tg = (await this.getClient().send(new DescribeTargetGroupsCommand({ TargetGroupArns: [input.knownPhysicalId] }))).TargetGroups?.[0];
+			return tg?.TargetGroupArn ? {
+				physicalId: tg.TargetGroupArn,
+				attributes: targetGroupAttributes(tg, tg.TargetGroupArn)
 			} : null;
 		} catch (err) {
 			if (this.isNotFoundError(err)) return null;
@@ -49306,10 +49575,14 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	}
 	async importServiceResource(input) {
 		if (input.knownPhysicalId) try {
-			await this.getClient().send(new GetServiceCommand({ Id: input.knownPhysicalId }));
+			const resp = await this.getClient().send(new GetServiceCommand({ Id: input.knownPhysicalId }));
 			return {
 				physicalId: input.knownPhysicalId,
-				attributes: {}
+				attributes: definedAttributes({
+					Id: input.knownPhysicalId,
+					Arn: resp.Service?.Arn,
+					Name: resp.Service?.Name
+				})
 			};
 		} catch (err) {
 			if (err instanceof ServiceNotFound) return null;
@@ -56618,7 +56891,10 @@ var EFSProvider = class {
 			const ap = (await this.getClient().send(new DescribeAccessPointsCommand({ AccessPointId: input.knownPhysicalId }))).AccessPoints?.[0];
 			return ap?.AccessPointId ? {
 				physicalId: ap.AccessPointId,
-				attributes: {}
+				attributes: definedAttributes({
+					Arn: ap.AccessPointArn,
+					AccessPointId: ap.AccessPointId
+				})
 			} : null;
 		} catch (err) {
 			if (err instanceof AccessPointNotFound) return null;
@@ -64395,6 +64671,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const regionForState = state.region ?? ctx.baseRegion;
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState);
 	refuseMalformedOrphansForDestroy(state, stackName, regionForState);
+	refuseMalformedOrphanRecordsForDestroy(state, stackName, regionForState);
 	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
@@ -64448,6 +64725,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			if (recheck) {
 				refuseMalformedResourcesForDestroy(recheck.state, stackName, regionForState);
 				refuseMalformedOrphansForDestroy(recheck.state, stackName, regionForState);
+				refuseMalformedOrphanRecordsForDestroy(recheck.state, stackName, regionForState);
 			}
 			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
 			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
@@ -64472,13 +64750,13 @@ async function runDestroyForStack(stackName, state, ctx) {
 		if (consumers.length > 0) throw new StackHasActiveImportsError(stackName, regionForState, consumers);
 	}
 	logger.info(`\nResources to be deleted (${resourceCount}):`);
-	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${logicalId} (${resource.resourceType})`);
+	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${displaySafe(logicalId)} (${displaySafe(resource.resourceType)})`);
 	const protectedCount = ctx.removeProtection ? countProtectedResources(state) : 0;
 	const orphansAtDestroy = state.orphans ?? [];
 	if (orphansAtDestroy.length > 0) {
 		logger.info(`\n${orphansAtDestroy.length} resource(s) are still in AWS from an earlier failed deploy. cdkd left them there because their DeletionPolicy is Retain (CDK's RemovalPolicy.RETAIN), and has been tracking them so a later deploy of this stack could adopt them back instead of colliding with their names.`);
 		logger.info("Destroying this stack deletes that record. The resources stay in AWS, may continue to incur charges, and cdkd will no longer know about them:");
-		for (const entry of orphansAtDestroy) logger.info(`  - ${entry.logicalId} (${entry.state.resourceType})  ${entry.state.physicalId}`);
+		for (const entry of orphansAtDestroy) logger.info(`  - ${displaySafe(entry.logicalId)} (${displaySafe(entry.state.resourceType)})  ${displaySafe(entry.state.physicalId)}`);
 	}
 	if (!ctx.skipConfirmation) {
 		if (process.stdin.isTTY !== true) throw new CdkdError(`The destroy confirmation prompt for stack "${stackName}" cannot run in a non-interactive environment. Pass --yes / -y to confirm the destroy (cdkd destroy also accepts -f / --force), or run the command from a real terminal.`, "NON_INTERACTIVE_CONFIRM");
@@ -65158,7 +65436,7 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' under parent '${displaySafe(ctx.parentStackName)}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} under parent ${displayStackName(ctx.parentStackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -65178,7 +65456,7 @@ var NestedStackProvider = class {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${displaySafe(logicalId)}' on update.`);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack ${displayIdent(logicalId)} on update.`);
 		this.refuseMalformedNestedTemplateTree(ctx, logicalId, childTemplatePath);
 		const { template: childTemplate, grandchildTemplates } = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
@@ -65250,7 +65528,7 @@ var NestedStackProvider = class {
 		}
 	}
 	async getAttribute(_physicalId, _resourceType, attributeName) {
-		throw new Error(`AWS::CloudFormation::Stack: attribute '${displaySafe(attributeName)}' is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
+		throw new Error(`AWS::CloudFormation::Stack: attribute ${displayIdent(attributeName)} is not in the recorded Outputs map. Only 'Outputs.<Key>' references to declared Output names on the child template are supported.`);
 	}
 	async runChildDeploy(parentCtx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates) {
 		const inheritedSecrets = getCurrentResourceSecrets();
@@ -65301,7 +65579,7 @@ var NestedStackProvider = class {
 	*/
 	async readChildOutputsAsAttributes(ctx, childStackName, childRegion) {
 		const childStateData = await ctx.stateBackend.getState(childStackName, childRegion);
-		if (!childStateData) throw new Error(`Child stack state '${displaySafe(childStackName)}' not found after deploy — NestedStackProvider invariant violated.`);
+		if (!childStateData) throw new Error(`Child stack state ${displayStackName(childStackName)} not found after deploy — NestedStackProvider invariant violated.`);
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
@@ -65404,7 +65682,7 @@ var NestedStackProvider = class {
 	* points at `[2]` rather than at the whole parameter.
 	*/
 	refuseNonScalarParameter(k, offender, where) {
-		throw new Error(`NestedStackProvider: child Parameter '${displaySafe(k)}'${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
+		throw new Error(`NestedStackProvider: child Parameter ${displayIdent(k)}${where} resolved to a non-scalar value (type=${offender === null ? "null" : typeof offender}). Parameters must be scalars (string / number / boolean), or an ARRAY of them from a list-typed parameter, by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
 	}
 	/**
 	* The child template as the child engine deploys it, plus the grandchild
@@ -65447,9 +65725,9 @@ var NestedStackProvider = class {
 		const dir = path.dirname(childTemplatePath);
 		const result = Object.create(null);
 		for (const { logicalId: grandLogicalId, assetPath } of listNestedTemplateRows(childTemplate)) {
-			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
+			if (isAbsoluteCrossPlatform$1(assetPath)) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`));
 			const resolved = resolveAssemblyPath(dir, assetPath);
-			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`));
+			if (!resolved.contained) throw markNonRetryable(/* @__PURE__ */ new Error(`NestedStackProvider: nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`));
 			result[grandLogicalId] = resolved.path;
 		}
 		return result;
@@ -68566,13 +68844,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let stateForDiff = currentState;
 	const unreadableOrphans = [];
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
-		const readableOrphans = currentState.orphans.filter((record) => {
-			if (isReadableResourceEntry(record?.state)) return true;
-			const id = record?.logicalId;
-			unreadableOrphans.push(typeof id === "string" ? id : "");
-			return false;
-		});
-		if (unreadableOrphans.length > 0) logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans));
+		for (const id of unpreviewableOrphanRecords(currentState)) unreadableOrphans.push(id);
+		const readableOrphans = previewableOrphanRecords(currentState);
+		if (unreadableOrphans.length > 0) logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans, false));
+		let reportedByTheAdoptedPropertiesArm = [];
 		const plan = await options.previewOrphanAdoption({
 			...currentState,
 			orphans: readableOrphans
@@ -68589,11 +68864,18 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				}
 			};
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
+			reportedByTheAdoptedPropertiesArm = tornAdopted;
 			if (tornAdopted.length > 0) {
 				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
 		}
+		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
+		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
+		if (previewedRowsTheDeployRefuses.length > 0) {
+			logger.warn(malformedOrphanRowsKeptWarning(stackName, region, previewedRowsTheDeployRefuses));
+			deployRefusals.push(deployRefusesOrphanRowsReason(previewedRowsTheDeployRefuses));
+		}
 	}
 	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties);
 	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
@@ -69869,7 +70151,7 @@ async function scrubCommand(stacks, options) {
 		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
-		if (scrubbed.malformedOrphans) malformedOrphanRecords.push(stack.stackName);
+		if (scrubbed.malformedOrphans || scrubbed.malformedOrphanRows) malformedOrphanRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
 			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
@@ -70565,7 +70847,7 @@ function malformedRecordsAuditedError(stackNames, outputStackNames, orphanStackN
 	const parts = [];
 	if (stackNames.length > 0) parts.push(`${stackNames.length} stack(s) were audited with an EMPTY resource set because their state record has no readable 'resources' map: ${safeNames(stackNames)}. The report above describes their outputs only — nothing is known about their resources, so this run cannot certify them clean.`);
 	if (outputStackNames.length > 0) parts.push(`${outputStackNames.length} stack(s) were audited with an EMPTY outputs bag because their state record has no readable 'outputs' map: ${safeNames(outputStackNames)}. The report above describes their resources only — nothing is known about the values their outputs hold, and those values are what the exports index republishes to consumer stacks, so this run cannot certify them clean.`);
-	if (orphanStackNames.length > 0) parts.push(`${orphanStackNames.length} stack(s) were audited with an EMPTY orphan list because their state record has no readable 'orphans' list: ${safeNames(orphanStackNames)}. Nothing is known about resources an earlier failed deploy may have left live in AWS for them, so this run cannot certify them clean.`);
+	if (orphanStackNames.length > 0) parts.push(`${orphanStackNames.length} stack(s) were audited with an INCOMPLETE orphan list because their state record has no readable 'orphans' list, or a record inside it that no reader can use: ${safeNames(orphanStackNames)}. Whichever it was, the warning above names it per stack. Nothing is known about the resources those records describe — resources an earlier failed deploy may have left live in AWS — so this run cannot certify them clean.`);
 	return new ScrubRefusalError(`${parts.join(" ")} See the warnings above for the record to inspect.`, STATE_RESOURCES_MALFORMED);
 }
 /**
@@ -71977,9 +72259,23 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const outputSecrets = /* @__PURE__ */ new Map();
 	/**
 	* Needles derived from each rollback-orphan record's OWN recorded bag
-	* (issue go-to-k/cdkd#2943), keyed by logical id — per-record for the same
-	* reason `perResourceSecrets` is per-resource: one record's secret must not
-	* rewrite another's coinciding literal.
+	* (issue go-to-k/cdkd#2943) — per-record for the same reason
+	* `perResourceSecrets` is per-resource: one record's secret must not rewrite
+	* another's coinciding literal.
+	*
+	* Keyed by the row's INDEX in `orphans`, never by its `logicalId`
+	* (go-to-k/cdkd#3500 security review). Two rows sharing an id are a MALFORMED
+	* record — no cdkd writer produces one, since `orphansAfterRollback` keeps one
+	* row per id — and both arms of this command meet it before this map is read:
+	* a real run refuses the record and `--dry-run` drops every such row
+	* (go-to-k/cdkd#3643). The index keying stays as defense in depth, because it
+	* is still the only identity that cannot collide: on an id key the second row's
+	* empty map REPLACED the first row's filled one. Both halves broke: the first
+	* row's needles left the union that the rewrite and the error boundary read, and
+	* its own lookup returned the OTHER row's map, so where two rows resolve one
+	* plaintext through different expressions the wrong expression was written. The
+	* index is the only identity the collecting loop and the rewrite can agree on,
+	* since both walk `state.orphans` in order and neither reorders it.
 	*/
 	const orphanSecrets = /* @__PURE__ */ new Map();
 	const prePassFindings = {
@@ -72069,12 +72365,22 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			}
 		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
 		let malformedOrphans;
+		let malformedOrphanRows;
 		if (opts.dryRun) {
 			if (repairMalformedOrphansForReadOnly(state)) {
 				malformedOrphans = true;
 				logger.warn(malformedOrphansWarning(stack.stackName, region));
 			}
+			const droppedRows = repairMalformedOrphanRecordsForReadOnly(state);
+			if (droppedRows.length > 0) {
+				malformedOrphanRows = true;
+				logger.warn(malformedOrphanRecordsWarning(stack.stackName, region, droppedRows, true));
+			}
 		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		else {
+			const unreadableRows = unreadableOrphanRecords(state);
+			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedOrphanRecordsRefusalMessage(stack.stackName, region, unreadableRows), STATE_RESOURCES_MALFORMED);
+		}
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
 		const resolvers = new ScrubResolvers(region);
@@ -72157,9 +72463,9 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
 			}
-			for (const record of state.orphans ?? []) {
+			for (const [orphanIndex, record] of (state.orphans ?? []).entries()) {
 				const recordedSecretValues = /* @__PURE__ */ new Map();
-				orphanSecrets.set(record.logicalId, recordedSecretValues);
+				orphanSecrets.set(String(orphanIndex), recordedSecretValues);
 				const resolveInput = await pinCrossRegionSecrets({
 					properties: record.state.properties,
 					attributes: record.state.attributes ?? {},
@@ -72292,6 +72598,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				...malformedResources ? { malformedResources } : {},
 				...malformedOutputs ? { malformedOutputs } : {},
 				...malformedOrphans ? { malformedOrphans } : {},
+				...malformedOrphanRows ? { malformedOrphanRows } : {},
 				outputs: state.outputs,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
@@ -72310,8 +72617,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOrphans = (state.orphans ?? []).map((record) => {
-			const own = orphanSecrets.get(record.logicalId);
+		const newOrphans = (state.orphans ?? []).map((record, orphanIndex) => {
+			const own = orphanSecrets.get(String(orphanIndex));
 			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 			for (const [plaintext, expression] of own ?? []) needles.set(plaintext, expression);
 			if (needles.size === 0) return record;
@@ -72371,6 +72678,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			...malformedResources ? { malformedResources } : {},
 			...malformedOutputs ? { malformedOutputs } : {},
 			...malformedOrphans ? { malformedOrphans } : {},
+			...malformedOrphanRows ? { malformedOrphanRows } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
@@ -82939,7 +83247,7 @@ async function stateDestroyCommand(stackArgs, options) {
 * Create the `state destroy` subcommand.
 */
 function createStateDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'.").argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").option("--all", "Destroy every stack in the state bucket", false).option("--remove-protection", "Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers AWS::Logs::LogGroup, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::DocDB::DBCluster, AWS::Neptune::DBCluster, AWS::Neptune::DBInstance, AWS::DynamoDB::Table, AWS::EC2::Instance, AWS::Cognito::UserPool, AWS::AutoScaling::AutoScalingGroup, AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::DSQL::Cluster, AWS::NeptuneGraph::Graph, AWS::SMSVOICE::ProtectConfiguration, AWS::VerifiedPermissions::PolicyStore, AWS::EKS::Cluster, AWS::RDS::GlobalCluster, and AWS::DocDB::GlobalCluster.", false).addOption(stackRegionOption$1()).addHelpText("after", [
+	const cmd = new Command("destroy").description("Destroy a stack's AWS resources and remove its state record without requiring the CDK app. For removing only the state record (keeping AWS resources intact), use 'cdkd state orphan'.").argument("[stacks...]", "Stack name(s) to destroy (physical CloudFormation names)").option("--all", "Destroy every stack in the state bucket", false).option("--remove-protection", `Bypass deletion protection on protected resources by flipping the per-resource protection flag off in-place before delete. Covers ${removeProtectionTypeList()}.`, false).addOption(stackRegionOption$1()).addHelpText("after", [
 		"",
 		"Examples:",
 		"  cdkd state destroy MyStack",
@@ -83887,6 +84195,7 @@ async function rollbackCommand(stackArg, options) {
 			const baseState = stateData.state;
 			refuseMalformedState(baseState, stackName, region);
 			refuseMalformedOrphans(baseState, stackName, region);
+			refuseMalformedOrphanRecords(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
 			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
@@ -84546,23 +84855,45 @@ function createEventsPruneCommand() {
 * The two dual-stack forms carry a FIXED suffix, so their check is that literal
 * rather than the region's partition suffix — the TIGHTEST available check for
 * them, not a relaxation: `on.aws` is an AWS-owned domain, so unlike a captured
-* suffix it cannot be substituted by a host someone else owns. They are
-* accepted for ANY region rather than only the partitions AWS documents them
-* in, deliberately: under-accepting is precisely the issue #1764 failure (a
-* cdkd table lagging AWS made a GENUINE registry classify as public), and the
-* suffix being AWS-owned means the widening cannot point a `docker login`
-* anywhere but AWS.
-*/
+* suffix it cannot be substituted by a host someone else owns.
+*
+* The three non-plain forms are accepted only for a region in the `aws` /
+* `aws-us-gov` partitions (issue #3670):
+*
+* - `on.aws` is the dual-stack DNS of those two partitions; the others serve
+*   dual-stack under their own suffixes, which this table does not list.
+* - AWS's own endpoint data (botocore `endpoints.json`, service `ecr`) carries
+*   the `fips-dkr-<region>` registry endpoints in those two partitions only;
+*   `aws-cn`, the ISO partitions and `aws-eusc` list none. So
+*   `<acct>.dkr.ecr-fips.cn-north-1.amazonaws.com.cn` is not a host AWS serves
+*   either, although its suffix is the region's own.
+*
+* Such a host is refused rather than handed a `docker login`. An earlier
+* revision accepted `on.aws` for any region, reasoning that under-accepting
+* repeats the issue #1764 failure; that trade stops paying once the pull path
+* logs in to whatever host the reference names. The partition, not the six
+* FIPS regions, is the unit, so a new FIPS region in those partitions is not
+* refused before AWS documents it.
+*
+* `cdkd gc` builds its pattern from the LABELS and suffixes only and ignores
+* `partitions`, deliberately: over-matching there only ever KEEPS an asset.
+*/
+const COMMERCIAL_AND_GOVCLOUD = ["aws", "aws-us-gov"];
 const ECR_REGISTRY_HOST_FORMS = [
 	{ labels: "dkr.ecr" },
-	{ labels: "dkr.ecr-fips" },
+	{
+		labels: "dkr.ecr-fips",
+		partitions: COMMERCIAL_AND_GOVCLOUD
+	},
 	{
 		labels: "dkr-ecr",
-		fixedUrlSuffix: "on.aws"
+		fixedUrlSuffix: "on.aws",
+		partitions: COMMERCIAL_AND_GOVCLOUD
 	},
 	{
 		labels: "dkr-ecr-fips",
-		fixedUrlSuffix: "on.aws"
+		fixedUrlSuffix: "on.aws",
+		partitions: COMMERCIAL_AND_GOVCLOUD
 	}
 ];
 /**
@@ -84686,6 +85017,17 @@ function ecrRegistryHostPattern(segments) {
 * MESSAGE was written for the #1764 partition-gap case and now over-claims for a
 * form/suffix mispairing (`amazonaws.com` IS `us-east-1`'s partition suffix).
 * `src/local/ecs-task-resolver.ts` owns that wording; recorded on issue #1846.
+*
+* `<r>` above is a commercial region. Issue #3670 then scoped the three
+* non-plain forms to the `aws` / `aws-us-gov` partitions, flipping more
+* verdicts: `<a>.dkr-ecr[-fips].<r>.on.aws` and `<a>.dkr.ecr-fips.<r>.S` for an
+* `aws-cn`, ISO or `aws-eusc` `<r>` went from `p=ok d=f` to `p=und d=TRUE`, a
+* form / partition mispairing reported like the form / suffix ones. The same
+* issue added the region-SHAPE guard ({@link AWS_REGION_ID}), which refuses a
+* service-name "region" such as `s3` at both entry points. That guard also
+* flips the diagnostic the other way for such a label: `<a>.dkr.ecr.s3.F` went
+* from `p=und d=TRUE` to `p=und d=f`. A region-shaped label no partition knows
+* (`nz-north-1`) went from `p=ok d=f` to `p=und d=TRUE`.
 */
 const ECR_URI_HOST_REGEX = new RegExp(`^(\\d{12})\\.(${ECR_HOST_FORMS_LONGEST_FIRST.map((form) => escapeRegExp(form.labels)).join("|")})\\.([^.]+)\\.([^/]+)/`, "i");
 /**
@@ -84746,6 +85088,54 @@ const CANONICAL_REGION_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9-]*$/;
 */
 const CANONICAL_URL_SUFFIX = /^[A-Za-z0-9][A-Za-z0-9.-]*$/;
 /**
+* `<letters>(-<letters or digits>)+-<number>`: the generic shape every AWS
+* region id has had. A label matching it but not {@link AWS_REGION_ID} is a
+* region cdkd does not know yet, reported by the diagnostic rather than
+* silenced; `s3`, `lambda-url` and `s3-external-1` do not match it (the first
+* segment must be letters only).
+*/
+const GENERIC_REGION_SHAPE = /^[a-z]+(?:-[a-z0-9]+)+-\d+$/;
+/**
+* The SHAPE of an AWS region id, tested on the folded region AFTER the charset
+* guard above (issue #3670).
+*
+* The charset guard admits any `[A-Za-z0-9-]` label, so a SERVICE-name label
+* parsed as a region: `<acct>.dkr.ecr.s3.amazonaws.com` yielded the region
+* `s3`, whose partition falls back to commercial, so the suffix matched and the
+* host became a `docker login` target. Only TLS stopped the token there. A
+* region id is one of the partitions' region patterns, so anything else is not
+* a registry host this module recognizes.
+*
+* One alternative per partition, transcribed from each partition's
+* `regionRegex` in AWS's own endpoint data (botocore `partitions.json`, which
+* `@aws-sdk/util-endpoints` vendors), with `\w+` spelled `[a-z0-9]+`. That is
+* the same set once the charset guard has refused `_` and the fold has
+* lower-cased the segment:
+*
+* - `aws`: `^(us|eu|ap|sa|ca|me|af|il|mx)-\w+-\d+$`
+* - `aws-cn`: `^cn-\w+-\d+$`
+* - `aws-us-gov`: `^us-gov-\w+-\d+$`
+* - `aws-iso` / `-iso-b` / `-iso-e` / `-iso-f`: `^us-iso-`, `^us-isob-`,
+*   `^eu-isoe-`, `^us-isof-`, each followed by `\w+-\d+`
+* - `aws-eusc`: `^eusc-(de)-\w+-\d+$`, widened here to any `eusc-<cc>-` country
+*   code for the reason `PARTITION_TABLE` (`src/utils/aws-partition.ts`) gives
+*   for its own broader `eusc-` prefix: a future sovereign-cloud country falling
+*   through is the failure, and no other partition's regions begin `eusc-`.
+*
+* A future partition with a new prefix is refused until it is added here, the
+* same way `derivePartitionAndUrlSuffix` has to learn its suffix.
+*/
+const AWS_REGION_ID = new RegExp("^(?:" + [
+	"(?:us|eu|ap|sa|ca|me|af|il|mx)-[a-z0-9]+-\\d+",
+	"cn-[a-z0-9]+-\\d+",
+	"us-gov-[a-z0-9]+-\\d+",
+	"us-iso-[a-z0-9]+-\\d+",
+	"us-isob-[a-z0-9]+-\\d+",
+	"eu-isoe-[a-z0-9]+-\\d+",
+	"us-isof-[a-z0-9]+-\\d+",
+	"eusc-[a-z]+-[a-z0-9]+-\\d+"
+].join("|") + ")$");
+/**
 * The ONE case-normalization boundary of this module (issue #1786).
 *
 * DNS is case-INSENSITIVE, so `US-ISO-EAST-1.amazonaws.com` and
@@ -84790,11 +85180,21 @@ function matchEcrRegistryHost(imageUri) {
 	const form = ECR_HOST_FORM_BY_LABELS.get(m[2].toLowerCase());
 	if (!form) return void 0;
 	const region = m[3].toLowerCase();
+	if (!AWS_REGION_ID.test(region)) {
+		if (!GENERIC_REGION_SHAPE.test(region)) return void 0;
+		return {
+			accountId: m[1],
+			region,
+			suffix: m[4].toLowerCase(),
+			expectedSuffix: void 0
+		};
+	}
+	const partition = derivePartitionAndUrlSuffix(region);
 	return {
 		accountId: m[1],
 		region,
 		suffix: m[4].toLowerCase(),
-		expectedSuffix: (form.fixedUrlSuffix ?? derivePartitionAndUrlSuffix(region).urlSuffix).toLowerCase()
+		expectedSuffix: form.partitions && !form.partitions.includes(partition.partition) ? void 0 : (form.fixedUrlSuffix ?? partition.urlSuffix).toLowerCase()
 	};
 }
 /**
@@ -84824,7 +85224,7 @@ function matchEcrRegistryHost(imageUri) {
 function parseEcrRegistryHost(imageUri) {
 	const m = matchEcrRegistryHost(imageUri);
 	if (!m) return void 0;
-	if (m.suffix !== m.expectedSuffix) return void 0;
+	if (m.expectedSuffix === void 0 || m.suffix !== m.expectedSuffix) return void 0;
 	return {
 		accountId: m.accountId,
 		region: m.region
@@ -86504,7 +86904,7 @@ async function orphanCommand(pathArgs, options) {
 		const stackInfo = resolved.stack;
 		const orphanLogicalIds = resolved.logicalIds;
 		const { region: targetRegion, recordRegion } = await pickStackRegion(stateBackend, stackInfo.stackName, stackInfo.region, options.stackRegion);
-		logger.info(`Target: ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}); orphaning ${orphanLogicalIds.length} resource(s): ${displaySafeList(orphanLogicalIds)}`);
+		logger.info(`Target: ${displayStackName(stackInfo.stackName)} (${displayIdent(targetRegion)}); orphaning ${orphanLogicalIds.length} resource(s): ${displaySafeList(orphanLogicalIds)}`);
 		const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
 		const recovery = {
 			profile: options.profile,
@@ -86521,7 +86921,7 @@ async function orphanCommand(pathArgs, options) {
 		}
 		try {
 			const stateData = await stateBackend.getState(stackInfo.stackName, targetRegion);
-			if (!stateData) throw new Error(`No state found for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}). Nothing to orphan. (Did the stack get deployed?)`);
+			if (!stateData) throw new Error(`No state found for stack ${displayStackName(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}). Nothing to orphan. (Did the stack get deployed?)`);
 			const { state, etag, migrationPending } = stateData;
 			refuseMalformedState(state, stackInfo.stackName, recordRegion, recovery);
 			refuseMalformedOutputs(state, stackInfo.stackName, recordRegion, recovery);
@@ -86532,7 +86932,7 @@ async function orphanCommand(pathArgs, options) {
 			const missing = orphanLogicalIds.filter((id) => !Object.hasOwn(state.resources, id));
 			if (missing.length > 0) {
 				const have = displayIdentList(Object.keys(state.resources), ", ");
-				throw new Error(`Resource(s) not in state for stack '${displaySafe(stackInfo.stackName)}' (${displaySafe(targetRegion, { asciiOnly: true })}): ${displayIdentList(missing, ", ")}.\nAvailable logical IDs: ${have}`);
+				throw new Error(`Resource(s) not in state for stack ${displayStackName(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}): ${displayIdentList(missing, ", ")}.\nAvailable logical IDs: ${have}`);
 			}
 			const providerRegistry = new ProviderRegistry();
 			registerAllProviders(providerRegistry);
@@ -86551,7 +86951,7 @@ async function orphanCommand(pathArgs, options) {
 				return;
 			}
 			if (!options.yes && !options.force) {
-				if (!await confirmPrompt$1(`Orphan ${orphanLogicalIds.length} resource(s) from cdkd state for ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })})? AWS resources will NOT be deleted.`)) {
+				if (!await confirmPrompt$1(`Orphan ${orphanLogicalIds.length} resource(s) from cdkd state for ${displayStackName(stackInfo.stackName)} (${displayIdent(targetRegion)})? AWS resources will NOT be deleted.`)) {
 					logger.info("Orphan cancelled.");
 					return;
 				}
@@ -86560,7 +86960,7 @@ async function orphanCommand(pathArgs, options) {
 				expectedEtag: etag,
 				...migrationPending && { migrateLegacy: true }
 			});
-			logger.info(`Orphaned ${orphanLogicalIds.length} resource(s) from state: ${displaySafe(stackInfo.stackName)} (${displaySafe(targetRegion, { asciiOnly: true })}). AWS resources are still in AWS; cdkd will no longer manage them.`);
+			logger.info(`Orphaned ${orphanLogicalIds.length} resource(s) from state: ${displayStackName(stackInfo.stackName)} (${displayIdent(targetRegion)}). AWS resources are still in AWS; cdkd will no longer manage them.`);
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
 				logger.warn(`Failed to release lock: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`);
@@ -86599,12 +86999,12 @@ function resolveConstructPaths(paths, stacks) {
 			throw new Error(`Construct path '${p}': stack '${head}' not found in synthesized app. Available: ${available}`);
 		}
 		if (stack === void 0) stack = candidate;
-		else if (stack.stackName !== candidate.stackName) throw new Error(`All construct paths must reference the same stack. Got '${displaySafe(stack.stackName)}' and '${displaySafe(candidate.stackName)}'. Run 'cdkd orphan' once per stack.`);
+		else if (stack.stackName !== candidate.stackName) throw new Error(`All construct paths must reference the same stack. Got ${displayStackName(stack.stackName)} and ${displayStackName(candidate.stackName)}. Run 'cdkd orphan' once per stack.`);
 		const index = buildCdkPathIndex(candidate.template);
 		const matches = resolveCdkPathToLogicalIds(p, index);
 		if (matches.length === 0) {
 			const available = displayIdentList([...index.keys()].sort(), "\n  ");
-			throw new Error(`Construct path '${p}' not found in template for stack '${displaySafe(candidate.stackName)}'.\nAvailable paths:\n  ${available}`);
+			throw new Error(`Construct path '${p}' not found in template for stack ${displayStackName(candidate.stackName)}.\nAvailable paths:\n  ${available}`);
 		}
 		for (const { logicalId } of matches) if (!logicalIds.includes(logicalId)) logicalIds.push(logicalId);
 	}
@@ -86631,12 +87031,12 @@ async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 			region: synthRegion,
 			recordRegion: synthRegion
 		};
-		throw new Error(`No state found for stack '${displaySafe(stackName)}'. Run 'cdkd state list' to see available stacks.`);
+		throw new Error(`No state found for stack ${displayStackName(stackName)}. Run 'cdkd state list' to see available stacks.`);
 	}
 	if (flag) {
 		if (!refs.find((r) => r.region === flag)) {
 			const seen = displayRegionList(refs);
-			throw new Error(`No state found for stack '${displaySafe(stackName)}' in region '${flag}'. Available regions: ${seen}.`);
+			throw new Error(`No state found for stack ${displayStackName(stackName)} in region ${displayIdent(flag)}. Available regions: ${seen}.`);
 		}
 		return {
 			region: flag,
@@ -86657,7 +87057,7 @@ async function pickStackRegion(stateBackend, stackName, synthRegion, flag) {
 		};
 	}
 	const regions = displayRegionList(refs);
-	throw new Error(`Stack '${displaySafe(stackName)}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
+	throw new Error(`Stack ${displayStackName(stackName)} has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
 }
 function printRewriteSummary(rewrites, orphanLogicalIds) {
 	const logger = getLogger();
@@ -87303,7 +87703,10 @@ async function importCommand(stackArg, options) {
 		const existingState = existingResult?.state ?? null;
 		if (existingState) refuseMalformedState(existingState, stackInfo.stackName, targetRegion);
 		if (existingState) refuseMalformedOutputs(existingState, stackInfo.stackName, targetRegion);
-		if (existingState) refuseMalformedOrphans(existingState, stackInfo.stackName, targetRegion);
+		if (existingState) {
+			refuseMalformedOrphans(existingState, stackInfo.stackName, targetRegion);
+			refuseMalformedOrphanRecords(existingState, stackInfo.stackName, targetRegion);
+		}
 		const existingEtag = existingResult?.etag;
 		const migrationPending = existingResult?.migrationPending ?? false;
 		if (existingState) {
@@ -89657,12 +90060,12 @@ function resolveAssetCodeDirectory(opts) {
 	if (isAbsolute(assetPath)) {
 		const absolute = resolve(assetPath);
 		const escape = absoluteAssemblyPathEscape(assetOutdir, absolute);
-		if (escape !== void 0) getLogger().warn(`Lambda '${displaySafe(logicalId)}' has an absolute Metadata['aws:asset:path'] pointing outside the assembly: ${displayAssemblyPath(absolute)}` + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(escape.realPath)})` : "") + ". cdkd will bind-mount that directory into the container read-only, where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.");
+		if (escape !== void 0) getLogger().warn(`Lambda ${displayIdent(logicalId)} has an absolute Metadata['aws:asset:path'] pointing outside the assembly: ${displayAssemblyPath(absolute)}` + (escape.escape === "symlink" ? ` (through a symbolic link to ${displayAssemblyPath(escape.realPath)})` : "") + ". cdkd will bind-mount that directory into the container read-only, where the code in this assembly can read it. This is what cdk synth --no-staging emits, and is expected for it; if you did not synthesize with that flag, treat this assembly as untrusted.");
 		return absolute;
 	}
 	const resolved = resolveAssemblyPath(manifestDir, assetPath, { containWithin: assetOutdir });
 	if (!resolved.contained && resolved.escape === "lexical" && resolved.path === resolve(assetOutdir)) return resolved.path;
-	if (!resolved.contained) throw wrapError(`Lambda '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}`);
+	if (!resolved.contained) throw wrapError(`Lambda ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, assetOutdir, "mount it")}`);
 	return resolved.path;
 }
 /**
@@ -89691,9 +90094,8 @@ function resolveAssetCodeDirectory(opts) {
 * `process.cwd()` survives only for a `StackInfo` carrying NEITHER field, where
 * base and bound coincide again.
 *
-* Exported for `local-start-api.ts`'s copy of the caller, for the Docker
-* context check the ECS emulator commands run over cdk-local's `StackInfo`
-* (which is why it takes only the two fields it reads), and for unit testing.
+* Exported for `local-start-api.ts`'s copy of the caller, and for unit
+* testing.
 */
 function assetPathDirs(stack) {
 	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : stack.assetOutdir ?? process.cwd();
@@ -89719,7 +90121,7 @@ function assetPathDirs(stack) {
 */
 function resolveAssetCodePath$1(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has no Metadata['aws:asset:path']. cdkd local invoke needs this hint to find the local asset directory. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	const abs = resolveAssetCodeDirectory({
 		manifestDir,
@@ -89728,7 +90130,7 @@ function resolveAssetCodePath$1(stack, logicalId, resource) {
 		assetOutdir,
 		logicalId
 	});
-	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda '${displaySafe(logicalId)}' asset directory ${displayAssemblyPath(abs)} does not exist or is not a directory. Re-synthesize the app and retry.`);
+	if (!existsSync(abs) || !statSync(abs).isDirectory()) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} asset directory ${displayAssemblyPath(abs)} does not exist or is not a directory. Re-synthesize the app and retry.`);
 	return abs;
 }
 /**
@@ -90751,7 +91153,7 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 		account: ecrHost.accountId,
 		region: ecrHost.region
 	};
-	if (looksLikeEcrHostWithForeignSuffix(substituted)) getLogger().child("ecs-task-resolver").debug(`Image '${substituted}' has an ECR host shape but a URL suffix that does not belong to its region's partition; treating it as a public image (no docker login).`);
+	if (looksLikeEcrHostWithForeignSuffix(substituted)) getLogger().child("ecs-task-resolver").debug(`Image '${substituted}' has an ECR host shape, but that host form and suffix are not an ECR registry endpoint for its region; treating it as a public image (no docker login).`);
 	return {
 		kind: "public",
 		uri: substituted
@@ -91334,24 +91736,17 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * boundary, so a local-invoke build failure still surfaces with cdkd's exit code
 * / branding. `architectureToPlatform` is a pure helper (re-exported directly).
 *
-* The build context is CONTAINED twice, against one REQUIRED `assetOutdir`
-* bound (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)). The
-* engine refuses an escaping `source.directory` itself since cdk-local 0.149.3,
-* and the bound is FORWARDED to it: without one the engine narrows to the
-* manifest directory and refuses a `cdk.Stage` image's `../asset.<hash>`
-* (issue [#3597](https://github.com/go-to-k/cdkd/issues/3597)). cdkd still
-* refuses first, because the engine's refusal quotes the manifest value in a
-* boundary the value itself can close (go-to-k/cdk-local#758); once that
-* ships, go-to-k/cdkd#3652 drops cdkd's copy.
+* The build context is CONTAINED by the engine, against the REQUIRED
+* `assetOutdir` bound this shim forwards (issues
+* [#3503](https://github.com/go-to-k/cdkd/issues/3503),
+* [#3597](https://github.com/go-to-k/cdkd/issues/3597)): without one the
+* engine narrows to the manifest directory and refuses a `cdk.Stage` image's
+* `../asset.<hash>`. The engine refuses an escaping `source.directory` before
+* it spawns anything, and renders the value display-safe since cdk-local
+* 0.149.4, so cdkd carries no copy of the check (go-to-k/cdkd#3652).
 * See cdk-local's `src/local/docker-image-builder.ts`.
 */
 async function buildContainerImage$1(asset, cdkOutDir, options) {
-	assertCdkLocalDockerContextContained({
-		manifestDir: cdkOutDir,
-		source: asset.source,
-		assetOutdir: options.assetOutdir,
-		wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build the container image: ${message}`)
-	});
 	try {
 		return await buildContainerImage(asset, cdkOutDir, options);
 	} catch (e) {
@@ -91362,10 +91757,6 @@ async function buildContainerImage$1(asset, cdkOutDir, options) {
 
 //#endregion
 //#region src/local/ecr-puller.ts
-/** The URL suffix an ECR registry host uses in `region`'s partition (issue #1758). */
-function ecrUrlSuffix(region) {
-	return derivePartitionAndUrlSuffix(region).urlSuffix;
-}
 /**
 * Lower-case the REGISTRY HOST of an image reference and leave the repository
 * path and tag byte-identical.
@@ -91485,12 +91876,8 @@ function isCredentialFresh(creds) {
 * pass to `docker run`: the input with its registry HOST lower-cased and
 * its repository path + tag untouched (issue #1801). That is the SAME
 * spelling `docker pull` / `docker image inspect` were handed here, and
-* the same one the DERIVED `docker login` endpoint names — an
-* AWS-reported `proxyEndpoint` still wins over that fallback (it can be
-* a VPC-endpoint host), which is correct: AWS names the endpoint its own
-* token authenticates, and it reports it lower-cased. That precedence holds
-* only for the PLAIN host form: a FIPS or dual-stack pull logs in to its own
-* host, since `proxyEndpoint` always names the plain one (issue #1855).
+* the same one the `docker login` endpoint names, on every host form
+* (issues #1855 / #3670).
 */
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
@@ -91594,18 +91981,21 @@ async function assumeRoleForEcr(roleArn, callerRegion, logger) {
 }
 /**
 * Authenticate the local docker daemon against the target ECR registry.
-* Mirrors `DockerAssetPublisher.ecrLogin` but stays in this module so the
-* local-invoke path doesn't depend on the publisher's larger surface area.
-*
-* The login endpoint must name the host the PULL targets (issue #1855):
-* docker's credential store is keyed on the hostname verbatim, so a login to
-* the plain host followed by a pull from a FIPS or dual-stack host sends no
-* credentials (`no basic auth credentials`). `GetAuthorizationToken` reports
-* the PLAIN host as its `proxyEndpoint`, so that value, and the derived
-* fallback, are used only when the pull targets the plain form; every other
-* form logs in to `registryHost` itself. The token is registry-scoped, not
-* host-scoped: measured against real ECR, one token authenticated `/v2/` on
-* all four host forms `ECR_REGISTRY_HOST_FORMS` lists.
+* Kept apart from `DockerAssetPublisher.ecrLogin`, and it no longer mirrors it:
+* the publisher still prefers `proxyEndpoint`, which is right only because it
+* pushes to the CALLER's own registry, while a pull here can name any account
+* and any host form, so this one always logs in to the pull host.
+*
+* The login endpoint is ALWAYS the host the PULL targets (issues #1855 /
+* #3670): docker's credential store is keyed on the hostname verbatim, so a
+* login to any other host leaves the pull with no credentials (`no basic auth
+* credentials`). `GetAuthorizationToken`'s `proxyEndpoint` is therefore NOT
+* used. The request carries no `registryIds`, so it names the CALLER's default
+* registry on the plain host: the wrong host for a FIPS or dual-stack pull, and
+* the wrong ACCOUNT for a cross-account plain pull made on the caller's own
+* credentials (a repository-policy grant, no `--ecr-role-arn`). The token is
+* principal-scoped, not host-scoped: measured against real ECR, one token
+* authenticated `/v2/` on all four host forms `ECR_REGISTRY_HOST_FORMS` lists.
 */
 async function ecrLogin(client, target) {
 	const { accountId, region, registryHost } = target;
@@ -91614,8 +92004,7 @@ async function ecrLogin(client, target) {
 	if (!authData?.authorizationToken) throw new LocalInvokeBuildError$1("Failed to get ECR authorization token");
 	const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 	if (!username || password === void 0) throw new LocalInvokeBuildError$1("ECR authorization token has unexpected shape (missing username/password)");
-	const plainHost = `${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
-	const endpoint = registryHost === plainHost ? authData.proxyEndpoint || `https://${plainHost}` : `https://${registryHost}`;
+	const endpoint = `https://${registryHost}`;
 	const loginArgs = [
 		"login",
 		"--username",
@@ -93864,7 +94253,7 @@ function resolveImageLambda(args) {
 */
 function resolveAssetCodePath(stack, logicalId, resource) {
 	const assetPath = resource.Metadata?.["aws:asset:path"];
-	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda '${displaySafe(logicalId)}' has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
+	if (typeof assetPath !== "string" || assetPath.length === 0) throw new Error(`Lambda ${displayIdent(logicalId)} has no Metadata['aws:asset:path']. cdkd local start-api needs this hint to find the local asset directory. Re-synthesize the app and retry.`);
 	const { manifestDir, assetOutdir } = assetPathDirs(stack);
 	return resolveAssetCodeDirectory({
 		manifestDir,
@@ -95793,134 +96182,6 @@ function createLocalRunTaskCommand() {
 	return cmd;
 }
 
-//#endregion
-//#region src/cli/commands/emulator-docker-context.ts
-/**
-* Decorate an `EmulatorStrategy` so every Docker image asset the bundled
-* engine could build for this run is containment-checked BEFORE it builds one
-* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
-*
-* `cdkd local start-service` / `start-alb` hand the whole run to cdk-local's
-* `runEcsServiceEmulator`, which reads each stack's asset manifest itself —
-* for an ECS container image and for an ALB Lambda target's container image
-* alike. Since cdk-local 0.149.3 the engine refuses an escaping
-* `source.directory` at each build and each `--watch` soft reload
-* (go-to-k/cdkd#3597). This check stays in front of it, for the whole
-* assembly at once, because the engine's refusal quotes the assembly-chosen
-* value in a boundary the value can close (go-to-k/cdk-local#758);
-* go-to-k/cdkd#3652 removes it once that ships.
-*
-* `resolveBoots` is the seam because the engine calls it after every synth —
-* at boot, and again on every `--watch` reload — and before any image is
-* built on either path. A refusal at boot fails the command; on a reload the
-* engine logs it and keeps the previous replicas serving, which is the
-* fail-closed outcome.
-*
-* Every stack with a manifest is checked, not only the booted targets' stacks:
-* which stack a target resolves to is decided inside the engine, and the ALB
-* front door builds Lambda images from stacks no ECS boot names. An escaping
-* `source.directory` is never something a real `cdk synth` writes, so
-* refusing one anywhere in the assembly costs a legitimate run nothing, and
-* `cdkd deploy` refuses the same assembly.
-*/
-function containEmulatorDockerContexts(strategy) {
-	return {
-		...strategy,
-		resolveBoots: (stacks, chosenTargets) => {
-			assertEmulatorDockerContextsContained(stacks);
-			return strategy.resolveBoots(stacks, chosenTargets);
-		}
-	};
-}
-/**
-* The check itself, over the manifests the engine will read. Exported for
-* unit testing.
-*
-* It reads the SAME file the engine does — `<manifest dir>/<stackName>.assets.json`,
-* not `assetManifestPath` verbatim — and refuses a `stackName` that would
-* carry that filename out of the manifest directory, as cdkd's own
-* `AssetManifestLoader.loadManifest` does.
-*
-* A manifest that is absent, unreadable or not JSON is skipped: the engine
-* reads it again and reports that failure itself, before building anything.
-*/
-function assertEmulatorDockerContextsContained(stacks) {
-	for (const stack of stacks) {
-		if (!stack.assetManifestPath) continue;
-		const dirs = assetPathDirs(stack);
-		const { manifestDir } = dirs;
-		const assetOutdir = stack.assetOutdir === void 0 || stack.assetOutdir === "" ? dirs.assetOutdir : engineAssemblyRoot(stack.assetOutdir);
-		const manifestFile = resolveAssemblyPath(manifestDir, `${stack.stackName}.assets.json`);
-		if (!manifestFile.contained) throw new LocalInvokeBuildError$1(`Refusing to build container images: the asset manifest for stack '${displaySafe(stack.stackName)}' ${renderAssemblyPathEscape(manifestFile, manifestDir)}`);
-		const dockerImages = readDockerImages(manifestFile.path);
-		for (const [assetId, asset] of Object.entries(dockerImages)) {
-			const source = asset?.source;
-			if (source === null || typeof source !== "object") continue;
-			const { directory } = source;
-			if (typeof directory !== "string") continue;
-			assertCdkLocalDockerContextContained({
-				manifestDir,
-				source,
-				assetOutdir,
-				wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build container image asset '${displaySafe(assetId)}' of stack '${displaySafe(stack.stackName)}': ${message}`)
-			});
-		}
-	}
-}
-/**
-* The containment bound the ENGINE itself uses for a stack it synthesized: its
-* `assetOutdir`, climbed to the parent assembly when `--app` names a
-* `cdk.Stage` sub-assembly. cdk-local enumerates no Stage stacks from an app
-* root, so `--app cdk.out/assembly-<Stage>` is the only way these commands run
-* a Stage, and its assets are staged one level up as `../asset.<hash>`.
-*
-* A copy of cdk-local's `assemblyRootOf` (not exported by the package): climb
-* only while the directory is named `assembly-*` AND its parent's
-* `manifest.json` declares it as a `cdk:cloud-assembly` artifact, and WARN
-* whenever a climb happens, since the predicate is read from the tree being
-* judged. Deleted with this module by go-to-k/cdkd#3652.
-*/
-function engineAssemblyRoot(outdir) {
-	let dir = resolve(outdir);
-	let climbed = false;
-	for (;;) {
-		if (!basename(dir).startsWith("assembly-")) break;
-		const parent = dirname(dir);
-		if (parent === dir || !parentDeclaresNestedAssembly(parent, basename(dir))) break;
-		dir = parent;
-		climbed = true;
-	}
-	if (!climbed) return outdir;
-	if (!warnedDerivedRoots.has(dir)) {
-		warnedDerivedRoots.add(dir);
-		getLogger().warn(`${displayAssemblyPath(outdir)} is a cdk.Stage sub-assembly, so cdkd is treating its parent ${displayAssemblyPath(dir)} as the assembly root when it checks Docker build contexts — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named.`);
-	}
-	return dir;
-}
-const warnedDerivedRoots = /* @__PURE__ */ new Set();
-function parentDeclaresNestedAssembly(parent, child) {
-	try {
-		const artifacts = JSON.parse(readFileSync(join(parent, "manifest.json"), "utf-8")).artifacts;
-		if (artifacts === null || typeof artifacts !== "object") return false;
-		return Object.values(artifacts).some((a) => {
-			const art = a;
-			return art?.type === "cdk:cloud-assembly" && art.properties?.directoryName === child;
-		});
-	} catch {
-		return false;
-	}
-}
-function readDockerImages(manifestPath) {
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(manifestPath, "utf-8"));
-	} catch {
-		return {};
-	}
-	const dockerImages = parsed?.dockerImages;
-	return dockerImages !== null && typeof dockerImages === "object" ? dockerImages : {};
-}
-
 //#endregion
 //#region src/cli/commands/local-start-service.ts
 /**
@@ -95948,17 +96209,6 @@ function serviceStrategy() {
 	};
 }
 /**
-* The `EmulatorStrategy` `cdkd local start-service` runs with:
-* {@link serviceStrategy}, decorated by `containEmulatorDockerContexts` so the
-* engine's own Docker builds are containment-checked (issue
-* [#3503](https://github.com/go-to-k/cdkd/issues/3503)). A NAMED seam for the
-* same reason `buildAlbEmulatorStrategy` is one: inline in the action, the
-* decorator was deletable at its only call site.
-*/
-function buildServiceEmulatorStrategy() {
-	return containEmulatorDockerContexts(serviceStrategy());
-}
-/**
 * `cdkl start-service <Stack/Service>...` — run one or more `AWS::ECS::Service`
 * resources locally as a long-running emulator. Spins up DesiredCount task
 * replicas per service (clamped by --max-tasks) using the same per-task
@@ -95971,7 +96221,7 @@ function buildServiceEmulatorStrategy() {
 */
 function createLocalStartServiceCommand() {
 	const cmd = new Command("start-service").description("Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as `cdkd local run-task`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay (Issue #460). Omit <targets> in an interactive terminal to multi-select the ECS services from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, buildServiceEmulatorStrategy(), cdkdExtraStateProviders);
+		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
@@ -96903,12 +97153,12 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 	const manifest = await loader.loadManifest(cdkOutDir, resolved.stack.stackName);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey(fileAssets, code.codeAssetHash) : void 0;
-	if (!asset) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle (asset ${displaySafe(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
+	if (!asset) throw new CdkdError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} code bundle (asset ${displaySafe(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assemblyDir,
 		sink: "read that directory and build a local image from it"
 	});
-	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime '${displaySafe(resolved.logicalId)}' code bundle source ${displayAssemblyPath(sourceDir)} does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
+	if (!existsSync(sourceDir) || !statSync(sourceDir).isDirectory()) throw new CdkdError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} code bundle source ${displayAssemblyPath(sourceDir)} does not exist or is not a directory. Re-synthesize the app and retry.`, "LOCAL_INVOKE_AGENTCORE_CODE_SOURCE_MISSING");
 	return buildAgentCoreCodeImage({
 		sourceDir,
 		runtime: code.runtime,
@@ -97660,8 +97910,7 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 }
 /**
 * The `EmulatorStrategy` `cdkd local start-alb` runs with: cdk-local's ALB
-* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv} and then by
-* `containEmulatorDockerContexts` (issue go-to-k/cdkd#3503).
+* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv}.
 *
 * Extracted from the command's action for ONE reason, and it is the finding
 * that produced it: with the composition written inline in the `.action(...)`
@@ -97681,7 +97930,7 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 * can satisfy reads as coverage while providing none.
 */
 function buildAlbEmulatorStrategy(options) {
-	return containEmulatorDockerContexts(warnUnresolvedLambdaTargetEnv(albStrategy(options), options));
+	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
 }
 /**
 * `cdkl start-alb <Stack/Alb>` — Issue #86 v1. Names an
@@ -98819,4 +99068,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-hXXls0hg.js.map
+//# sourceMappingURL=program-DxyHPT8E.js.map