@go-to-k/cdkd 0.291.26 → 0.291.27

package/dist/{program-BALgPCWL.js → program-WCBWtvb0.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as CdkdError, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as markRedactedCause, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as pasteableCommand, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isThrottlingError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isRetryableTransientError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as displayAssemblyPath, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as getAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resolveBucketRegion, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as describeAwsFailure, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, No as safeStringify, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as isTransientServerError, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as withErrorHandling, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isMarkedNonRetryable, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as renderAssemblyPathEscape, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as describeFileReadFailure, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as resolveAssemblyPath, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as runWithStackAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as resetAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Za as setAwsClients, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as IntrinsicResolutionRefusalError, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as PartialFailureError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ProvisioningError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, go as StackTerminationProtectionError, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackHasActiveImportsError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as DynamicReferenceRegionAmbiguousError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as retryClassificationText, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markNonRetryable, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as MalformedProducerRecordRefusalError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as ResourceUpdateNotSupportedError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalInvokeBuildError$1, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceTimeoutError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as AwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DeployCancelledError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, so as LocalStartServiceError, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, to as CrossAccountSecretRefusalError, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as NestedStackChildDirectDestroyError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vo as SynthesisError, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as shellQuote, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as normalizeAwsError, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-BZps_IKn.js";
+import { $ as yellow, $a as CdkdError, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as isTransientServerError, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as commandHole, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isMarkedNonRetryable, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as withheldTargetClause, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fo as safeStringify, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as displayAssemblyPath, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as getAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resolveBucketRegion, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as markRedactedCause, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, No as retryClassificationText, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as isRetryableTransientError, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Po as describeAwsFailure, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as withErrorHandling, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as shellQuote, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as renderAssemblyPathEscape, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as describeFileReadFailure, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as resolveAssemblyPath, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as runWithStackAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as resetAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Za as setAwsClients, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as IntrinsicResolutionRefusalError, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as PartialFailureError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ProvisioningError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, go as StackTerminationProtectionError, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackHasActiveImportsError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as DynamicReferenceRegionAmbiguousError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as markNonRetryable, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as isThrottlingError, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as MalformedProducerRecordRefusalError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as ResourceUpdateNotSupportedError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalInvokeBuildError$1, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceTimeoutError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as AwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DeployCancelledError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, so as LocalStartServiceError, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, to as CrossAccountSecretRefusalError, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as NestedStackChildDirectDestroyError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vo as SynthesisError, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as pasteableCommand, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as normalizeAwsError, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-DIZztJy5.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
-import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BkoR4hMq.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dbqbr89e.js";
+import { n as awsClientDefaults, s as ambientRegion, u as formatAuthority } from "./aws-client-defaults-qSDe1fA_.js";
+import { t as getCdkdVersion } from "./version-CuKFdkKV.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CWCv370K.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3445,9 +3445,10 @@ async function findDownstreamConsumers(input) {
 			const got = await input.stateBackend.getState(ref.stackName, region);
 			if (!got) return null;
 			const out = [];
+			const producerRegion = canonicalizeRegion(input.producerRegion);
 			const imports = got.state.imports;
 			if (imports && imports.length > 0) {
-				for (const entry of imports) if (entry.sourceStack === input.producerStack && entry.sourceRegion === input.producerRegion) out.push({
+				for (const entry of imports) if (entry.sourceStack === input.producerStack && canonicalizeRegion(entry.sourceRegion) === producerRegion) out.push({
 					consumerStack: ref.stackName,
 					consumerRegion: region,
 					exportName: entry.exportName,
@@ -3456,7 +3457,7 @@ async function findDownstreamConsumers(input) {
 			}
 			const outputReads = got.state.outputReads;
 			if (outputReads && outputReads.length > 0) for (const entry of outputReads) {
-				if (entry.sourceRegion === input.producerRegion && producerNameIsUnresolved(entry.sourceStack)) {
+				if (canonicalizeRegion(entry.sourceRegion) === producerRegion && producerNameIsUnresolved(entry.sourceStack)) {
 					out.push({
 						consumerStack: ref.stackName,
 						consumerRegion: region,
@@ -3466,7 +3467,7 @@ async function findDownstreamConsumers(input) {
 					});
 					continue;
 				}
-				if (entry.sourceStack === input.producerStack && entry.sourceRegion === input.producerRegion) out.push({
+				if (entry.sourceStack === input.producerStack && canonicalizeRegion(entry.sourceRegion) === producerRegion) out.push({
 					consumerStack: ref.stackName,
 					consumerRegion: region,
 					exportName: entry.outputName,
@@ -28598,11 +28599,13 @@ var EventBridgeBusProvider = class {
 *
 * AWS rewrites a non-canonical CIDR on `CreateRoute`, so a route id that
 * spells the template's CIDR can differ from the destination AWS reports
-* (issue #1771). `EC2Provider`'s import compares through this (issue #3661).
-* `src/cli/commands/export.ts` still carries a private copy of the same
-* function; fold it onto this one once the open PR holding that file lands.
+* (issue #1771): the Cloud Control path records what AWS returned while the
+* template kept what the user wrote. Returning `undefined` for the shapes this
+* does not model is load-bearing — `cdkd export`'s route-id splitter reads it
+* to decide whether a divergence is conclusive or merely unexplained.
+* `EC2Provider`'s import compares through this too (issue #3661).
 */
-function canonicalizeIpv4Cidr$1(value) {
+function canonicalizeIpv4Cidr(value) {
 	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(value);
 	if (!match) return void 0;
 	const octets = [
@@ -32190,8 +32193,8 @@ var EC2Provider = class {
 					if (rest.length > 0 || !routeTableId || !destination) return null;
 					if (!/^rtb-[0-9a-f]+$/.test(routeTableId)) return null;
 					const resp = await this.ec2Client.send(new DescribeRouteTablesCommand({ RouteTableIds: [routeTableId] }));
-					const wanted = canonicalizeIpv4Cidr$1(destination) ?? destination;
-					return resp.RouteTables?.[0]?.Routes?.some((r) => r.DestinationCidrBlock !== void 0 && (canonicalizeIpv4Cidr$1(r.DestinationCidrBlock) ?? r.DestinationCidrBlock) === wanted || r.DestinationIpv6CidrBlock === destination || r.DestinationPrefixListId === destination) ? {
+					const wanted = canonicalizeIpv4Cidr(destination) ?? destination;
+					return resp.RouteTables?.[0]?.Routes?.some((r) => r.DestinationCidrBlock !== void 0 && (canonicalizeIpv4Cidr(r.DestinationCidrBlock) ?? r.DestinationCidrBlock) === wanted || r.DestinationIpv6CidrBlock === destination || r.DestinationPrefixListId === destination) ? {
 						physicalId,
 						attributes: {}
 					} : null;
@@ -64050,7 +64053,7 @@ var S3TablesProvider = class {
 		if (resolvedParts === "unparseable") throw new ProvisioningError(`applyTableTagsDiff: ${compositeIdFormatMessage(S3_TABLES_TABLE_ID_FORMAT, logicalId, physicalId)}. Cannot derive the table ARN for the tag update, and refusing to silently drop it.`, resourceType, logicalId, physicalId);
 		const { tableBucketARN, namespace, name } = resolvedParts;
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
-		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
+		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update. If the table was deleted out-of-band, drop just this resource's record with the command below, filling in the construct path the CDK app gave this resource — its aws:cdk:path Metadata entry in the synthesized template.\nClean up with: cdkd orphan ${commandHole("constructPath")}`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
 			await this.getClient().send(new UntagResourceCommand$24({
 				resourceArn,
@@ -65223,7 +65226,7 @@ async function scanActiveConsumers(producerStack, producerRegion, ctx) {
 		try {
 			const imports = (await ctx.stateBackend.getState(ref.stackName, region))?.state.imports;
 			if (!imports || imports.length === 0) return null;
-			const matches = imports.filter((entry) => entry.sourceStack === producerStack && entry.sourceRegion === producerRegion);
+			const matches = imports.filter((entry) => entry.sourceStack === producerStack && canonicalizeRegion(entry.sourceRegion) === canonicalizeRegion(producerRegion));
 			if (matches.length === 0) return null;
 			return matches.map((entry) => ({
 				consumerStack: ref.stackName,
@@ -65552,9 +65555,10 @@ var NestedStackProvider = class {
 		refuseMalformedNestedChildOutputs(childStateData.state, childStackName, childRegion);
 		const attributes = this.buildOutputsAttributes(childStateData.state.outputs ?? {});
 		const noEchoAttributeNames = [];
+		const identity = credentialFingerprint(ambientCredentialConfig());
 		for (const [outputKey, persisted] of Object.entries(childStateData.state.outputs ?? {})) {
 			if (!carriesSecretMask(persisted)) continue;
-			const recovered = recoverMaskedOutput(childStackName, childRegion, outputKey);
+			const recovered = recoverMaskedOutput(identity, childStackName, childRegion, outputKey);
 			if (recovered === void 0) continue;
 			const attributeName = this.outputAttributeName(outputKey);
 			attributes[attributeName] = recovered;
@@ -66681,7 +66685,8 @@ async function deployCommand(stacks, options) {
 	let deployInterrupted = false;
 	const topLevelSigintHandler = () => {
 		if (deployInterrupted) {
-			process.stderr.write("\nForce-quit: stack locks may not be released. If the next run reports a lock, run this for EACH stack it names (the region-qualified form — see the message that run prints): cdkd force-unlock <stackName> --stack-region <region>\n");
+			process.stderr.write(`
+Force-quit: stack locks may not be released. If the next run reports a lock, run this for EACH stack it names, in the region-qualified form — see the message that run prints.\nRelease with: cdkd force-unlock ${commandHole("stackName")} --stack-region ${commandHole("region")}\n`);
 			process.exit(130);
 		}
 		process.stderr.write("\nInterrupted — waiting for in-progress operations to complete...\n");
@@ -69964,10 +69969,11 @@ async function repairExportIndexForStack(store, stackName, producerRegion, outpu
 *
 * ORDERING: scrub matches the CURRENT resolved secret value against what state
 * holds, so run it BEFORE rotating. Once the secret is rotated, the value in
-* state no longer matches the current one and scrub cannot find it (it reports
-* "nothing to scrub"). A rotated-away stale value in state is invalidated by
-* the rotation, but to remove it, redeploy the stack (which rewrites the record
-* with the expression).
+* state no longer matches the current one and scrub cannot rewrite it. Only a
+* cross-stack read NAME left that way is REPORTED (go-to-k/cdkd#3382,
+* `findUnrepairedCrossStackReadNames`); elsewhere a rotated-away value is
+* invisible to scrub. To remove it, redeploy the stack (which rewrites the
+* record with the expression).
 */
 async function scrubCommand(stacks, options) {
 	const logger = getLogger();
@@ -70026,6 +70032,7 @@ async function scrubCommand(stacks, options) {
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
 	let totalStacksWithUnverifiableLeaves = 0;
+	let totalStacksWithUnrepairedReadNames = 0;
 	/**
 	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
 	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
@@ -70132,7 +70139,7 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${shownStack}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${shownStack}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && scrubbed.unrepairedReadNames === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${shownStack}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
 		if (scrubbed.malformedOrphans || scrubbed.malformedOrphanRows) malformedOrphanRecords.push(stack.stackName);
@@ -70145,6 +70152,10 @@ async function scrubCommand(stacks, options) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${shownStack} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
 		}
+		if (scrubbed.unrepairedReadNames > 0) {
+			totalStacksWithUnrepairedReadNames++;
+			logger.warn(`${scrubbed.unrepairedReadNames} cross-stack read name(s) in ${shownStack} hold a plaintext scrub could NOT repair (see the warnings above) — so this stack is not reported clean.`);
+		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
 			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${shownStack} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
@@ -70171,7 +70182,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${displayIdent(indexRegion)}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalStacksWithUnrepairedReadNames === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -70183,6 +70194,7 @@ async function scrubCommand(stacks, options) {
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
 	const leafNote = totalStacksWithUnverifiableLeaves > 0 ? ` ${totalStacksWithUnverifiableLeaves} stack(s) had a {{resolve:...}} scan ABANDONED mid-value, so part of their state was never examined (see the warnings above).` : "";
 	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read that could NOT be verified, so their imported values were not checked — see the warnings above for which read, why, and what to do about it.` : "";
+	const readNameNote = totalStacksWithUnrepairedReadNames > 0 ? ` ${totalStacksWithUnrepairedReadNames} stack(s) hold a cross-stack read name in plaintext that scrub could NOT repair, most likely a secret's value from before a rotation — see the warnings above.` : "";
 	const indexNote = (() => {
 		const parts = [];
 		if (totalIndexEntriesConverged > 0) parts.push(options.dryRun ? ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} differ from the producer's scrubbed state.outputs and would be converged to it (--dry-run, nothing written).` : ` ${totalIndexEntriesConverged} exports index entr${totalIndexEntriesConverged === 1 ? "y" : "ies"} converged to the producer's state.outputs value. exports.json is written with the same PutObject state.json is, so on a VERSIONED bucket the pre-repair body survives as a noncurrent version and stays readable with GetObject and a VersionId.`);
@@ -70191,8 +70203,8 @@ async function scrubCommand(stacks, options) {
 		return parts.join("");
 	})();
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${readNameNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${readNameNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
 		if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
@@ -70200,13 +70212,13 @@ async function scrubCommand(stacks, options) {
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote}`);
-	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${readNameNote}${leafNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${readNameNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (malformedRecords.length > 0 || malformedOutputRecords.length > 0 || malformedOrphanRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords, malformedOutputRecords, malformedOrphanRecords);
 	if (damagedProducerStacks.length > 0) throw damagedProducerRecordsError(damagedProducerStacks);
-	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
+	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnrepairedReadNames > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
 /**
 * Every secret plaintext this run recorded, from ANY position in the template
@@ -71441,6 +71453,134 @@ function buildExportOwnerIndex(templates) {
 	return owners;
 }
 /**
+* How a stored name relates to the REDACTED spelling of a name today's
+* template produced, with every `{{resolve:...}}` token standing for a
+* non-empty run of characters: `wildcard` when the stored name matches and at
+* least one token position holds TEXT rather than a whole token; `equal` when
+* it is that spelling exactly; `no` otherwise.
+*/
+/** The text between (and around) `tokens`, which are `value`'s own tokens in order. */
+function literalParts(value, tokens) {
+	const parts = [];
+	let cursor = 0;
+	for (const token of tokens) {
+		const at = value.indexOf(token, cursor);
+		parts.push(value.slice(cursor, at));
+		cursor = at + token.length;
+	}
+	parts.push(value.slice(cursor));
+	return parts;
+}
+function crossStackNameFit(stored, currentRedacted) {
+	if (typeof stored !== "string") return "no";
+	const tokens = dynamicReferenceTokens(currentRedacted);
+	if (tokens.length === 0) return stored === currentRedacted ? "equal" : "no";
+	const storedTokens = dynamicReferenceTokens(stored);
+	if (storedTokens.length === tokens.length && literalParts(stored, storedTokens).join("\0") === literalParts(currentRedacted, tokens).join("\0")) return storedTokens.every((t, i) => t === tokens[i]) ? "equal" : "no";
+	let pattern = "^";
+	let cursor = 0;
+	for (const token of tokens) {
+		const at = currentRedacted.indexOf(token, cursor);
+		pattern += `${escapeRegExp(currentRedacted.slice(cursor, at))}([\\s\\S]+)`;
+		cursor = at + token.length;
+	}
+	pattern += `${escapeRegExp(currentRedacted.slice(cursor))}$`;
+	const match = new RegExp(pattern).exec(stored);
+	if (!match) return "no";
+	return match.slice(1).map((f) => f ?? "").some((f) => {
+		const inner = dynamicReferenceTokens(f);
+		return !(inner.length === 1 && inner[0] === f);
+	}) ? "wildcard" : "no";
+}
+/**
+* The stored cross-stack read entries that still hold a plaintext this run
+* could not repair because the secret behind it has ROTATED (go-to-k/cdkd#3382).
+*
+* Scrub's needles are the secret's CURRENT value, so a name stored while the
+* secret held an earlier value matches none of them and the repair walk leaves
+* it alone. Nothing in the record says the name was secret-bearing, so the
+* verdict is taken from today's template instead. An entry is flagged when ALL
+* of these hold:
+*
+* - no read today's template performed REPRODUCES it (same identity key the
+*   deploy's union uses, on the redacted spelling). This is what keeps an
+*   ordinary import green even when it shares a producer — and even a name
+*   shape — with a secret-bearing one: this run re-read it and it matched;
+* - a read today's template performed from a position that can refuse has a
+*   name that carries a secret (its redacted spelling holds a token), reads
+*   the same producer (`imports[].sourceStack`, which is never redacted) in
+*   the same region;
+* - the stored entry FITS that read's name: every literal part equal, every
+*   token position filled by a non-empty run, and at least one position
+*   holding text rather than a whole token (a name built from two secrets with
+*   one rotated keeps its old half as text after the walk repairs the other).
+*   Every other field must equal the read's spelling.
+*
+* Residual, in the over-reporting direction: a stale entry left by a REMOVED
+* ordinary reference to the same producer whose name happens to fit a
+* secret-bearing read's shape is flagged too. Stale entries survive only a
+* deploy that changed nothing or failed — a deploy that updates the stack
+* replaces both lists — so that needs a removed read, no successful change
+* since, and a coincident shape. Reads made while evaluating `Conditions`
+* count as reproducing (the deploy records them too) but are never flagged
+* against, since the pre-pass does not walk conditions.
+*
+* `stored` is the POST-repair list, so an entry this run just rewrote carries
+* its token and is never flagged. `redact` is the same function the repair
+* walk used, so a performed read's spelling and a repaired stored one agree.
+*/
+function findUnrepairedCrossStackReadNames(stored, performed, redact) {
+	const found = [];
+	const region = (r) => canonicalizeRegion(String(r));
+	const currentImports = performed.imports.map(({ entry, canRefuse }) => ({
+		sourceStack: entry.sourceStack,
+		sourceRegion: region(entry.sourceRegion),
+		exportName: redact(entry.exportName),
+		canRefuse
+	}));
+	const importKey = (e) => JSON.stringify([
+		e.sourceStack,
+		region(e.sourceRegion),
+		e.exportName
+	]);
+	const reproducedImports = new Set(currentImports.map(importKey));
+	const secretImports = currentImports.filter((c) => c.canRefuse && dynamicReferenceTokens(c.exportName).length > 0);
+	(stored.imports ?? []).forEach((entry, index) => {
+		if (reproducedImports.has(importKey(entry))) return;
+		if (secretImports.some((c) => c.sourceStack === entry.sourceStack && c.sourceRegion === region(entry.sourceRegion) && crossStackNameFit(entry.exportName, c.exportName) === "wildcard")) found.push({
+			list: "imports",
+			index,
+			entry
+		});
+	});
+	const currentOutputReads = performed.outputReads.map(({ entry, canRefuse }) => ({
+		sourceStack: redact(entry.sourceStack),
+		sourceRegion: region(entry.sourceRegion),
+		outputName: redact(entry.outputName),
+		canRefuse
+	}));
+	const outputReadKey = (e) => JSON.stringify([
+		e.sourceStack,
+		region(e.sourceRegion),
+		e.outputName
+	]);
+	const reproducedOutputReads = new Set(currentOutputReads.map(outputReadKey));
+	const secretOutputReads = currentOutputReads.filter((c) => c.canRefuse && (dynamicReferenceTokens(c.sourceStack).length > 0 || dynamicReferenceTokens(c.outputName).length > 0));
+	(stored.outputReads ?? []).forEach((entry, index) => {
+		if (reproducedOutputReads.has(outputReadKey(entry))) return;
+		if (secretOutputReads.some((c) => {
+			if (c.sourceRegion !== region(entry.sourceRegion)) return false;
+			const fits = [crossStackNameFit(entry.sourceStack, c.sourceStack), crossStackNameFit(entry.outputName, c.outputName)];
+			return !fits.includes("no") && fits.includes("wildcard");
+		})) found.push({
+			list: "outputReads",
+			index,
+			entry
+		});
+	});
+	return found;
+}
+/**
 * Is this the issue #2134 refusal -- a `{{resolve:...}}` reference whose region
 * cdkd cannot establish?
 *
@@ -72163,6 +72303,14 @@ function makeCrossStackPrePass(deps) {
 				}
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
+			for (const entry of probe.recordedImports ?? []) findings.performedReads.imports.push({
+				entry,
+				canRefuse: nodeCanRefuse
+			});
+			for (const entry of probe.recordedOutputReads ?? []) findings.performedReads.outputReads.push({
+				entry,
+				canRefuse: nodeCanRefuse
+			});
 			const producer = recordedProducer(key, probe);
 			if (!producer) {
 				logger.debug(`Scrub of ${shownStackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
@@ -72278,7 +72426,11 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const orphanSecrets = /* @__PURE__ */ new Map();
 	const prePassFindings = {
 		unverifiable: [],
-		damagedProducerRecords: []
+		damagedProducerRecords: [],
+		performedReads: {
+			imports: [],
+			outputReads: []
+		}
 	};
 	/**
 	* Leaves whose dynamic-reference scan was ABANDONED mid-token (issue
@@ -72344,6 +72496,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				unverifiableReads: 0,
 				unverifiableProducerRecords: 0,
 				unverifiableLeaves: 0,
+				unrepairedReadNames: 0,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
 		}
@@ -72411,7 +72564,23 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			logger
 		});
 		try {
-			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
+			const conditionContext = {
+				...resolverContext(outputSecrets),
+				recordedImports: [],
+				recordedOutputReads: []
+			};
+			try {
+				conditions = await resolver.evaluateConditions(conditionContext);
+			} finally {
+				for (const entry of conditionContext.recordedImports ?? []) prePassFindings.performedReads.imports.push({
+					entry,
+					canRefuse: false
+				});
+				for (const entry of conditionContext.recordedOutputReads ?? []) prePassFindings.performedReads.outputReads.push({
+					entry,
+					canRefuse: false
+				});
+			}
 		} catch (err) {
 			logger.debug(`Condition evaluation skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
@@ -72593,6 +72762,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				unverifiableReads: prePassFindings.unverifiable.length,
 				unverifiableProducerRecords: prePassFindings.damagedProducerRecords.length,
 				unverifiableLeaves,
+				unrepairedReadNames: 0,
 				...malformedResources ? { malformedResources } : {},
 				...malformedOutputs ? { malformedOutputs } : {},
 				...malformedOrphans ? { malformedOrphans } : {},
@@ -72650,6 +72820,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				outputName
 			};
 		});
+		const unrepairedReadNames = findUnrepairedCrossStackReadNames({
+			imports: newImports,
+			outputReads: newOutputReads
+		}, prePassFindings.performedReads, redactCrossStackName);
+		for (const { list, index, entry } of unrepairedReadNames) {
+			const producer = list === "imports" ? `producer ${displayStackName(maskSecretsInText(entry.sourceStack, crossStackNeedles))}, ` : "";
+			logger.warn(`Scrub of ${shownStack}: state.${list}[${index}] (${producer}${displayIdent(String(entry.sourceRegion))}) holds a cross-stack read name in plaintext that has the shape of a secret-bearing read in today's template but not the secret's current value — most likely a value from before the secret was ROTATED. Scrub cannot repair it (it matches only the current value) and does not print it; treat that earlier value as exposed. A deploy that updates ${shownStack} rewrites this list from the reads it performs.`);
+		}
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 		emitAbandonedScanNotes();
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
@@ -72673,6 +72851,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			unverifiableReads: prePassFindings.unverifiable.length,
 			unverifiableProducerRecords: prePassFindings.damagedProducerRecords.length,
 			unverifiableLeaves,
+			unrepairedReadNames: unrepairedReadNames.length,
 			...malformedResources ? { malformedResources } : {},
 			...malformedOutputs ? { malformedOutputs } : {},
 			...malformedOrphans ? { malformedOrphans } : {},
@@ -74152,9 +74331,17 @@ async function driftCommand(stacks, options) {
 		const reports = [];
 		for (const ref of targetRefs) {
 			if (!ref.region) {
-				const migrate = stackCommandFor("cdkd deploy", ref.stackName, { patternMatched: true });
+				const migrate = pasteableCommand("cdkd deploy", [{
+					value: ref.stackName,
+					hole: "stack",
+					opts: {
+						patternMatched: true,
+						plainIdent: true
+					}
+				}]);
 				const identity = stackIdentityLine(ref.stackName);
-				throw new Error("A state record for this stack is a legacy one with no region, which drift cannot read. A cdkd write migrates it to the region-scoped layout; re-run drift detection after it." + (identity === void 0 ? "\nThe stack name is not printed here: a name is printed only when it renders exactly, is non-empty and fits the reference cap — this one fails at least one of those." : `\n${identity}`) + (migrate === void 0 ? `\nThe migrate command is not printed here: ${WITHHELD_COMMAND_REASON} List records as stored with 'cdkd state list --json' and migrate the one whose key matches.` : `\nMigrate with: ${migrate}`));
+				const clause = withheldTargetClause(migrate, "stack", "cdkd deploy");
+				throw new Error(`A state record for this stack is a legacy one with no region, which drift cannot read. A cdkd write migrates it to the region-scoped layout; re-run drift detection after it.\n${identity ?? clause.trimStart()}\nMigrate with: ${migrate.command}`);
 			}
 			const report = await runDriftForStack(ref.stackName, ref.region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair");
 			reports.push(report);
@@ -75307,7 +75494,8 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 				for (const change of outcome.changes) {
 					const refusal = acceptRefusalReason(change, outcome.maskedPaths);
 					if (refusal !== void 0) {
-						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed.`);
+						const revert = revertCommandLine(report.stackName, report.region);
+						logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): not accepting '${change.path}' — ${refusal}, so cdkd will not write it to ` + (revert === void 0 ? "state. Run 'cdkd drift --revert' for this stack to push the referenced value back to AWS, or re-deploy if the reference changed." : `state. Push the referenced value back to AWS with the command below, or re-deploy if the reference changed.\nRevert with: ${revert}`));
 						continue;
 					}
 					setAtPath(newBaseline, change.path, change.awsValue);
@@ -76706,7 +76894,8 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					await stateBackend.saveState(report.stackName, report.region, newState, saveOptions);
 					logger.info(`✓ State updated for ${report.stackName} (${report.region}): recorded the value the provider actually applied on ${recordedCount} resource(s).`);
 				} catch (err) {
-					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — re-run 'cdkd drift --revert' for this stack once the state write can succeed.`);
+					const revertAgain = revertCommandLine(report.stackName, report.region);
+					logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record the value the provider actually applied: ${err instanceof Error ? err.message : String(err)}. The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`));
 				}
 			}
 		} finally {
@@ -76721,7 +76910,7 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 	if (totalFailed > 0) summaryParts.push(`${totalFailed} failed`);
 	logger.info(`\nRevert summary: ${summaryParts.join(", ")}.`);
 	if (totalUnsupported > 0) logger.warn(`${totalUnsupported} resource(s) cannot be reverted in place — re-deploy the stack with cdkd deploy --replace, or destroy + redeploy to push the cdkd-state values back into AWS.`);
-	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} refused or unresolvable — those never reached provider.update; each per-resource message above names its cause and remedy, e.g. missing secretsmanager:GetSecretValue / ssm:GetParameter grants for an unresolvable reference). Re-run 'cdkd drift <stack>' to see the remaining drift, then 'cdkd drift <stack> --revert' to retry.`);
+	if (totalFailed > 0 || totalUnsupported > 0 || totalUnresolvable > 0) throw new PartialFailureError(`Revert completed with ${totalFailed + totalUnsupported + totalUnresolvable} resource error(s) (${totalFailed} AWS update failure(s), ${totalUnsupported} update-not-supported, ${totalUnresolvable} refused or unresolvable — those never reached provider.update; each per-resource message above names its cause and remedy, e.g. missing secretsmanager:GetSecretValue / ssm:GetParameter grants for an unresolvable reference). Re-run cdkd drift ${commandHole("stacks...")} to see the remaining drift, then cdkd drift ${commandHole("stacks...")} --revert to retry.`);
 }
 function humanTextSink(json) {
 	return json ? {
@@ -76775,6 +76964,53 @@ function printAcceptPlan(reports, out) {
 	}
 }
 /**
+* The gated `cdkd drift ... --revert` line for a block that also carries
+* untrusted values, or `undefined` when either identifier cannot be named.
+*
+* go-to-k/cdkd#3307's remedy for its sites 2 and 3, closed through
+* go-to-k/cdkd#3436's fold-in and on exactly the derivation site 4 uses.
+*
+* The corrected go-to-k/cdkd#3486 criterion says a rendered block carrying
+* untrusted values carries no pasteable command, and both of these blocks do —
+* a property path and a resource type at one, a state-write error message at
+* the other. What makes the command printable anyway is the rule `main` has
+* for naming a target BESIDE such a block
+* (`.claude/rules/state-malformed-containers.md`, go-to-k/cdkd#3328):
+* exactness keeps a space and a `:`, so an identifier can spell one of the
+* block's own labels and forge it once the terminal wraps, and the answer is
+* `isPasteableIdent` in CONJUNCTION with the command gate, on BOTH
+* identifiers.
+*
+* Withheld means NOT PRINTED rather than printed with a hole: both blocks
+* already display the stack name, so a hole beside it invites the operator to
+* fill it from a name the block shows — the misdirection the criterion
+* forbids. The prose keeps its own `for this stack` wording in that case,
+* which names no command to paste.
+*
+* `exact` is not consulted: `isPasteableIdent` is strictly stronger on every
+* arm of the gate — it starts at an alphanumeric so is never option-shaped,
+* admits no `*` or `/`, cannot be empty, and its `displayIdent` compare
+* carries both the alteration test and the cap.
+*/
+function mayNameTarget(stackName, region) {
+	return isPasteableIdent(stackName) && isPasteableIdent(region);
+}
+/**
+* The gated `cdkd drift ... --revert` line, or `undefined` when
+* {@link mayNameTarget} refuses either identifier.
+*/
+function revertCommandLine(stackName, region) {
+	if (!mayNameTarget(stackName, region)) return void 0;
+	return `${pasteableCommand("cdkd drift", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--stack-region",
+		value: region,
+		hole: "region"
+	}]).command} --revert`;
+}
+/**
 * Print the planned `provider.update` calls for `--revert` (no AWS calls).
 * One line per resource summarising how many property paths will be
 * overwritten on the AWS side.
@@ -76817,7 +77053,16 @@ function printRevertPlan(reports, out) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
 					for (const path of unbaselined) out.write(`        ${maskSecretsInText(path, o.secrets)}\n`);
-					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). Run 'cdkd state refresh-observed' for this stack (or re-deploy) to populate observedProperties if you want them reverted too.\n");
+					const refresh = mayNameTarget(report.stackName, report.region) ? pasteableCommand("cdkd state refresh-observed", [{
+						value: report.stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: report.region,
+						hole: "region"
+					}]) : void 0;
+					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). " + (refresh === void 0 ? "Re-deploy if you want them reverted too; this record's identity cannot be named safely in a command, so none is offered.\n" : "Populate observedProperties with the command below, or re-deploy, if you want them reverted too.\n"));
+					if (refresh !== void 0) out.write(`      Populate with: ${refresh.command}\n`);
 				}
 			}
 		}
@@ -76991,132 +77236,36 @@ function formatScalar(value) {
 	return JSON.stringify(value);
 }
 /**
-* Why a command is not printed, phrased as the RULE rather than as a claim
-* about the name (m19 of the go-to-k/cdkd#3486 review). This SUPERSEDES the
-* m4 / m10 wording, which said the constant should name every reason the gate
-* has "since naming one tells the operator something false about the others" —
-* the enumeration is what round 4 measured as the defect.
-*
-* The earlier wording was a four-way disjunction — "does not render exactly, is
-* empty, is too long, or ... an option or a pattern" — which is true, but three
-* of the four disjuncts are visibly FALSE of a name printed on the `Stack:`
-* line right above it: `--all` renders exactly, is non-empty and is short. A
-* reader checking the sentence against what they can see concludes the tool is
-* guessing.
-*
-* The leading-`-` clause is stated as the GATE rather than as a parse, because
-* the gate is wider than Commander: `--all` really is parsed as the flag, while
-* a BARE `-` Commander takes positionally (measured) and this refuses it
-* anyway. Writing "would be read as an option" would be false of that one name.
-*
-* Naming the ACTUAL reason needs the gate to return it, and deriving it here
-* from a second copy of the predicates is the exact defect go-to-k/cdkd#3499
-* closed one file over. So this states the rule and leaves the reason to the
-* go-to-k/cdkd#3436 fold-in, where `pasteableCommand` supplies it.
-*/
-const WITHHELD_COMMAND_REASON = "a name is printed in a command only when it renders exactly, is non-empty, fits the reference cap, does not begin with '-', and is not a 'cdkd deploy' pattern — this one fails at least one of those.";
-/**
-* Does `value` reach the terminal as itself — sanitizing changes nothing, and
-* the state-reference cap does not cut it?
-*
-* Module-private and shared by {@link stackCommandFor} and
-* {@link stackIdentityLine}: the identity line and the command it sits above
-* must agree about which names are safe to print, and two spellings of this
-* predicate is how they would come to disagree.
-*/
-function rendersExactly(value) {
-	if (value === "") return false;
-	const safe = displaySafe(value, { asciiOnly: true });
-	return safe === value && !truncateCodePoints(safe, 1152).truncated;
-}
-/**
 * The `Stack: '<name>'` line that carries a record's identity NEXT TO a
 * pasteable command, or `undefined` when the name cannot be printed at all.
 *
 * A labelled command line is a trusted-looking shape, and a stack name is an
 * S3 key segment `listStacks` validates only for non-emptiness — so a name
 * carrying a newline printed ABOVE one forges a second labelled line that the
-* operator has every reason to trust. The same gate as the command, on its own
-* line, shell-quoted: inside a sentence a `$(...)` name executes when the
-* phrase is pasted, and `displayIdent`'s JSON quotes would not stop that —
-* double quotes do not close command substitution.
-*
-* USED BY SITE 1 ALONE, deliberately. A labelled command line is only safe in
-* a block whose OTHER values are gated too, and site 1's block carries exactly
-* two: this identity and the command beside it. The blocks that also carry a
-* property path, a resource type, a state-write error message or an AWS
-* readback value cannot meet that bar
-* by sanitizing — an arbitrary value cannot be gated for exactness and still
-* printed — so they keep their command in prose and the whole class is
-* [#3436](https://github.com/go-to-k/cdkd/issues/3436)'s.
+* operator has every reason to trust.
+*
+* `isPasteableIdent`, not the command gate's exactness — M16 of the
+* go-to-k/cdkd#3613 review. The command gate answers the shell: a `$(...)`
+* name is inert inside `'...'`. This line answers what an operator READS: it
+* sits beside a labelled command, so it takes `isPasteableIdent` per
+* `state-malformed-containers.md` (go-to-k/cdkd#3328), which refuses the
+* space and the `:` exactness keeps — the characters a name uses to spell a
+* fake `Migrate with:` row once the terminal wraps. Since M17 the COMMAND
+* beside this line takes the same predicate (`pasteableCommand`'s
+* `plainIdent`), so `$(printf INJECTED)` is withheld from BOTH — an earlier
+* version of this comment recorded it as named by the command and withheld
+* here, which was true between M16 and M17 and left the command line as the
+* forgery's carrier.
+*
+* USED BY SITE 1 ALONE, deliberately. Sites 2–4 also print labelled commands
+* now (through `mayNameTarget`, `isPasteableIdent` on both identifiers), but
+* their blocks ALSO display the stack name in their own headers, so a separate
+* identity line there would be a second copy of a value the block already
+* shows. An earlier version of this comment said those sites "keep their
+* command in prose"; they did until this PR, and the sentence outlived it.
 */
 function stackIdentityLine(stackName, indent = "") {
-	return rendersExactly(stackName) ? `${indent}Stack: ${shellQuote(stackName)}` : void 0;
-}
-/**
-* A pasteable `cdkd ...` command addressing ONE state record, or `undefined`
-* when this stack name cannot be named safely — in which case the caller names
-* the command in prose and leaves the operator to supply the name.
-*
-* Every name these messages carry comes out of an S3 KEY (`listStacks`, and the
-* `report.stackName` derived from it), so it is as untrusted as a state record's
-* body (issue [#3307](https://github.com/go-to-k/cdkd/issues/3307)). Four gates,
-* and each closes a different failure:
-*
-* - SANITIZE, then compare against the RAW value. `displaySafe` drops the
-*   forgery class (C0 + DEL, `U+0085` and C1, `U+2028`/`U+2029`, the bidi
-*   overrides), so a name carrying one is never NAMED IN A COMMAND; and a name
-*   it ALTERED addresses a DIFFERENT record, the misdirection
-*   `malformedDestroyResourcesRefusalMessage` and `orphanCommandFor` already
-*   gate for. `asciiOnly` here rather than the denylist, because a stack name's
-*   charset is the S3 key's. What this does NOT do is sanitize the identity the
-*   surrounding prose prints: `report.stackName` reaches ~20 message sites in
-*   this file raw, which is the DISPLAY class go-to-k/cdkd#3232 records, not
-*   this gate's.
-* - CAP at `STACK_REF_MAX_CODE_POINTS`, the state-reference grammar, so a
-*   multi-kilobyte planted name cannot grow the pasted payload without bound,
-*   while a legitimate multi-level nested child (`Parent~Child~...`) still
-*   renders. It bounds the PAYLOAD and nothing more — a name at the cap still
-*   wraps across a terminal, which is `display-safe.ts`'s own caveat on the
-*   constant (go-to-k/cdkd#3179).
-* - SHELL-QUOTE, and print the command LAST and UNWRAPPED on its own labelled
-*   line. `shellQuote` is only as good as the quote context around it: inside
-*   prose `'...'` a quoted value turns the quoting inside out and a pasted span
-*   RUNS (measured in go-to-k/cdkd#3363; the class is go-to-k/cdkd#3436).
-* - REFUSE a name the COMMAND would read as something other than a name. A
-*   leading `-` is refused CONSERVATIVELY: `--all` survives sanitizing, the cap
-*   and quoting and is then parsed by Commander as the flag, addressing every
-*   stack. (A BARE `-` Commander takes positionally, so the refusal is wider
-*   than the parse — the gate is "starts with `-`", not "parses as an option".)
-*   And `cdkd deploy` matches its argument as a PATTERN
-*   (`src/cli/stack-matcher.ts`), where `*` is a wildcard and `/` selects by
-*   display path. `patternMatched` asks for the last two; `/` cannot arrive
-*   through a key (`listStacks` splits keys on it), so that half is defensive.
-*
-* **`region` and `flags` have NO production caller today, and neither does
-* `stackIdentityLine`'s `indent`** (M16 / m17 of the go-to-k/cdkd#3486 review;
-* the one call site is the legacy region-less refusal, which has no region by
-* definition and passes only `patternMatched`). They are kept, with their
-* cases, as the landing place for the three `cdkd drift` sites
-* go-to-k/cdkd#3436 owns — the `--stack-region` requirement go-to-k/cdkd#3307
-* states for `:6139` is exactly what `region` exists to satisfy. Read their
-* hazard-matrix cases as a SPECIFICATION for that landing, not as coverage of
-* a live path. `region` takes the same gates as the NAME — sanitize,
-* exactness, the cap, emptiness and the leading `-` — because a region is a
-* key SEGMENT, no more trusted than the name.
-*
-* Exported for `tests/unit/cli/drift.test.ts`, which drives the hazard matrix
-* through it directly; the one call site is driven through the CLI separately,
-* since what a site PASSES is not something a helper test can see.
-*/
-function stackCommandFor(command, stackName, opts = {}) {
-	if (!rendersExactly(stackName) || stackName.startsWith("-")) return void 0;
-	if (opts.patternMatched && (stackName.includes("*") || stackName.includes("/"))) return void 0;
-	if (opts.region !== void 0 && (!rendersExactly(opts.region) || opts.region.startsWith("-"))) return;
-	const parts = [command, shellQuote(stackName)];
-	if (opts.flags !== void 0) parts.push(opts.flags);
-	if (opts.region !== void 0) parts.push(`--stack-region ${shellQuote(opts.region)}`);
-	return parts.join(" ");
+	return isPasteableIdent(stackName) ? `${indent}Stack: ${shellQuote(stackName)}` : void 0;
 }
 /**
 * Reusable `--stack-region <region>` option (mirrors `state show`).
@@ -77496,7 +77645,7 @@ async function destroyCommand(stackArgs, options) {
 * Create destroy command
 */
 function createDestroyCommand() {
-	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", "After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so an object listing of the state bucket comes back empty. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: 'cdkd events prune <stack> --all'.", false).action(withErrorHandling(destroyCommand));
+	const cmd = new Command("destroy").description("Destroy all resources in the stack").argument("[stacks...]", "Stack name(s) to destroy. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Destroy all stacks", false).option("--purge-events", `After a clean destroy, also delete the stack's deployment-event history (issue #808 store) so an object listing of the state bucket comes back empty. Where the state bucket is versioned — which cdkd bootstrap enables — earlier versions of those keys survive and stay readable with GetObject and a VersionId. By default events survive destroy as post-mortem context. Skipped when the destroy fails or is interrupted (those events aid the retry). Equivalent for an already-destroyed stack: cdkd events prune ${commandHole("stack")} --all.`, false).action(withErrorHandling(destroyCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -78490,37 +78639,6 @@ function routeDestinationNormalizationIsModelled(value) {
 	return canonicalizeIpv4Cidr(value) !== void 0 || ROUTE_PREFIX_LIST_ID_PATTERN.test(value);
 }
 /**
-* Return the host-bit-cleared form of an IPv4 CIDR (`100.68.0.18/18` ->
-* `100.68.0.0/18`), or `undefined` when the input is not an IPv4 CIDR at all
-* (an IPv6 CIDR, a `pl-…` prefix-list id, or anything malformed).
-*
-* This exists to recognize the ONE benign reason an `AWS::EC2::Route`'s stored
-* destination can differ from its physicalId segment: AWS rewrites a
-* non-canonical CIDR on `CreateRoute`, and the Cloud Control path records what
-* AWS returned while the template kept what the user wrote. Returning
-* `undefined` for the shapes it does not model is load-bearing — the caller
-* uses it to decide whether a divergence is conclusive or merely unexplained.
-*/
-function canonicalizeIpv4Cidr(value) {
-	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/.exec(value);
-	if (!match) return void 0;
-	const octets = [
-		match[1],
-		match[2],
-		match[3],
-		match[4]
-	].map(Number);
-	const prefixLength = Number(match[5]);
-	if (prefixLength > 32 || octets.some((octet) => octet > 255)) return void 0;
-	const network = ((octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0 & (prefixLength === 0 ? 0 : 4294967295 << 32 - prefixLength >>> 0)) >>> 0;
-	return `${[
-		network >>> 24,
-		network >>> 16 & 255,
-		network >>> 8 & 255,
-		network & 255
-	].join(".")}/${prefixLength}`;
-}
-/**
 * Build a splitter for an `AWS::ApiGateway::*` child type whose CFn primary
 * identifier is the parent `RestApiId` plus one child field.
 *
@@ -79049,7 +79167,48 @@ async function resolveIdentifierValue(entry, ctx, deps) {
 * today and would never stop being blocked by a re-import.
 */
 function maskedIdentifierAttributeReason(field, logicalId) {
-	return `cdkd state holds only the redaction mask ('***') at attributes.${field} for '${logicalId}', and that attribute is the value cdkd export reads as this resource type's CloudFormation import identifier (${field}); nothing masked may reach the exported template, since CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. The mask is what 'cdkd import' writes for a Cloud Control model key it could not certify as read-only — every key when cloudformation:DescribeType was unavailable. Re-deploying does NOT clear it. Repair the record with 'cdkd import <stack> --resource ${logicalId}=<physicalId> --force' after granting cloudformation:DescribeType, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.`;
+	return `cdkd state holds only the redaction mask ('***') at attributes.${field} for ${isPasteableIdent(logicalId) ? logicalId : `this resource (its logical id is not a plain identifier; read it with 'cdkd state show')`}, and that attribute is the value cdkd export reads as this resource type's CloudFormation import identifier (${field}); nothing masked may reach the exported template, since CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. The mask is what 'cdkd import' writes for a Cloud Control model key it could not certify as read-only — every key when cloudformation:DescribeType was unavailable. Re-deploying does NOT clear it. Repair the record with the command below, after granting cloudformation:DescribeType, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.\nRepair with: ${importRepairCommand(logicalId)}`;
+}
+/**
+* The `cdkd import` line `maskedIdentifierAttributeReason` tells the operator
+* to run.
+*
+* It is a named helper for ONE caller on purpose. A SECOND site prints the same
+* remedy — `buildImportPlan`'s resolved-identifier refusal — written
+* independently, and it still carries go-to-k/cdkd#3363's shape: a prose
+* `'...'` span holding a `cdkd` verb AND an interpolation, its opening quote in
+* one concatenated literal and its interpolation in the next. The source fence
+* found it only once its `+` runs were folded; a grep for the gate's name never
+* would have.
+*
+* That site is NOT routed here, deliberately: `export.ts` is one of the
+* go-to-k/cdkd#3436 own-copy gates the maintainer asked to land in a follow-up
+* PR rather than widen go-to-k/cdkd#3613. The fence carries an EXEMPTION naming
+* it, so this helper gains its second caller in the PR that closes the site —
+* and the exemption goes stale in the same commit.
+*
+* The POSITIONAL is a hole on purpose, and the load-bearing half is what it is
+* NOT: an earlier cut passed the LOGICAL ID there, producing a command that
+* names a resource where `cdkd import`'s declared `[stack]` goes. No shape
+* check can see that — both spellings are equally well-formed to one — and only
+* reading the command can.
+*
+* It is a hole rather than a name because its caller,
+* {@link maskedIdentifierAttributeReason}, has no stack name in scope at all.
+* (`buildImportPlan` does have one, so when that site joins this helper it
+* could fill it — a separate change with its own gating question, and not a
+* reason to grow two spellings here.)
+*/
+function importRepairCommand(logicalId) {
+	const named = isPasteableIdent(logicalId);
+	return `${pasteableCommand("cdkd import", [{ hole: "stack" }, named ? {
+		flag: "--resource",
+		value: logicalId,
+		hole: "logicalId"
+	} : {
+		flag: "--resource",
+		hole: "logicalId"
+	}]).command}=${commandHole("physicalId")} --force`;
 }
 /**
 * Build the {@link CompositePhysicalIdIdentifier} for a type whose CFn
@@ -79623,7 +79782,7 @@ function safeDetail(value) {
 */
 function orphanCommandFor(stackName, region) {
 	const shownStack = safeSegment(stackName);
-	if (!(typeof stackName === "string" && shownStack === stackName && !stackName.startsWith("-") && typeof region === "string" && safeSegment(region) === region && !region.startsWith("-"))) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
+	if (!(typeof stackName === "string" && shownStack === stackName && !stackName.startsWith("-") && typeof region === "string" && safeSegment(region) === region && !region.startsWith("-"))) return `cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")} — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches`;
 	return `cdkd state orphan ${shellQuote(shownStack)} --stack-region ${shellQuote(safeSegment(region))}`;
 }
 /**
@@ -79981,7 +80140,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "cdkd state holds only the redaction mask ('***') for at least one property, and cdkd cannot re-derive the value. There are two ways a record comes to hold it. (1) A NoEcho custom-resource value: forcing the custom resource to update does NOT clear this — the handler supplies the value to the deploy and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again. (2) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask ('cdkd import <stack> --resource <logicalId>=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. Either way you can also export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274."
+				reason: `cdkd state holds only the redaction mask ('***') for at least one property, and cdkd cannot re-derive the value. There are two ways a record comes to hold it. (1) A NoEcho custom-resource value: forcing the custom resource to update does NOT clear this — the handler supplies the value to the deploy and cdkd re-masks it on the way into state, so the export still has nothing to declare. Stop setting NoEcho on that response and re-deploy, then export again. (2) The value was SPLICED from a masked record of ANOTHER resource — by 'cdkd orphan --force', or by 'cdkd import' resolving an Fn::GetAtt or a Ref over a value the Cloud Control fallback had masked. Repair the record that HOLDS the mask with cdkd import ${commandHole("stack")} --resource ${commandHole("logicalId")}=${commandHole("physicalId")} --force (granting cloudformation:DescribeType first if the import warned that it could not read the schema), then re-run whichever command wrote this property. Either way you can also export this stack without that resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2274.`
 			});
 			continue;
 		}
@@ -81596,7 +81755,7 @@ async function runPerStackImportLoop(args) {
 			}
 			if (stateDeletionFailures.length > 0) {
 				const lines = stateDeletionFailures.map((f) => `  - cdkd/${safeSegment(f.stackName)}/${safeSegment(f.region)}/state.json: ${safeDetail(f.reason)}`).join("\n");
-				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with 'cdkd state orphan <stack> --stack-region <region>' per record.`);
+				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with the command below, once per record.\nRecover with: cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")}`);
 			}
 			if (sessionIntrinsicSkipped.size > 0) {
 				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${safeSegment(cdkdName)} (${params.join(", ")})`).join("; ");
@@ -82038,6 +82197,25 @@ function safe$1(value) {
 	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
 }
 /**
+* `state resources` / `state show` refusing a legacy region-less record. The
+* name is the operator's own positional, rendered through `safe` in the prose;
+* the `cdkd deploy` beside the labelled line takes `plainIdent`, as
+* `refresh-observed`'s legacy refusal does (go-to-k/cdkd#3696), so all three
+* decide "may I name this target" by one predicate and explain a hole with the
+* gate's own reason.
+*/
+function legacyRecordRefusal(stackName) {
+	const migrate = pasteableCommand("cdkd deploy", [{
+		value: stackName,
+		hole: "stack",
+		opts: {
+			patternMatched: true,
+			plainIdent: true
+		}
+	}]);
+	return /* @__PURE__ */ new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.` + withheldTargetClause(migrate, "stack", "cdkd deploy") + `\nMigrate with: ${migrate.command}`);
+}
+/**
 * Resolve a stack name + optional region flag against the `listStacks` index
 * built up front. When a name resolves to multiple regions and the caller
 * didn't pin one, surface a clear error listing the candidates so the user
@@ -82289,11 +82467,7 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
-			value: stackName,
-			hole: "stack",
-			opts: { patternMatched: true }
-		}]).command}`);
+		if (!ref.region) throw legacyRecordRefusal(stackName);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
@@ -82500,11 +82674,7 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
-			value: stackName,
-			hole: "stack",
-			opts: { patternMatched: true }
-		}]).command}`);
+		if (!ref.region) throw legacyRecordRefusal(stackName);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
@@ -82944,7 +83114,7 @@ function createStateShowCommand() {
 async function stateOrphanCommand(stackArgs, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (stackArgs.length === 0) throw new Error("Stack name is required. Usage: cdkd state orphan <stack> [<stack>...]");
+	if (stackArgs.length === 0) throw new Error(`Stack name is required. Usage: cdkd state orphan ${commandHole("stacks...")}`);
 	const setup = await setupStateBackend(options);
 	try {
 		const refs = await setup.stateBackend.listStacks();
@@ -82972,11 +83142,15 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.yes && !options.force) {
 				const targetList = targets.map((t) => formatStackRefSafe(t)).join(", ");
-				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nDelete the actual resources instead with the command below.\nDestroy with: ${pasteableCommand("cdkd destroy", [{
+				const destroyCmd = pasteableCommand("cdkd destroy", [{
 					value: stackName,
 					hole: "stack",
-					opts: { patternMatched: true }
-				}]).command}\n\n`);
+					opts: {
+						patternMatched: true,
+						plainIdent: true
+					}
+				}]);
+				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nDelete the actual resources instead with the command below.` + withheldTargetClause(destroyCmd, "stack", "cdkd destroy") + `\nDestroy with: ${destroyCmd.command}\n\n`);
 				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(`Cancelled removal of state for stack: ${stackName}`);
 					continue;
@@ -83068,7 +83242,7 @@ async function stateDestroyCommand(stackArgs, options) {
 	}
 	validateResourceTimeouts(options);
 	setResolvedResourceTimeouts(options.resourceTimeout);
-	if (!options.all && stackArgs.length === 0) throw new Error("Stack name is required. Usage: cdkd state destroy <stack> [<stack>...] | --all");
+	if (!options.all && stackArgs.length === 0) throw new Error(`Stack name is required. Usage: cdkd state destroy ${commandHole("stacks...")} | --all`);
 	const setup = await setupStateBackend(options);
 	const providerRegistry = new ProviderRegistry();
 	registerAllProviders(providerRegistry);
@@ -83509,67 +83683,11 @@ function createStateInfoCommand() {
 }
 /**
 * The hole the legacy refusal's `cdkd deploy` prints for a name it cannot
-* name, and the key {@link withheldNameClause} reads the reason back by. ONE
+* name, and the key {@link withheldTargetClause} reads the reason back by. ONE
 * spelling so the two cannot drift apart (m22 of the go-to-k/cdkd#3499 review).
 */
 const STACK_HOLE = "stack";
 /**
-* The sentence for a name `pasteableCommand` would not print, rendered from the
-* REASON it gave rather than from a predicate of this site's own — M11 of the
-* go-to-k/cdkd#3499 review. Keying it on a second predicate got both directions
-* wrong at once: `Old;Stack` renders exactly, so a rendering-based clause called
-* a command that names it "not exact", and `--all` also renders exactly, so the
-* same clause said nothing above a hole the operator was then invited to fill
-* with the name printed beside it.
-*
-* THREE of the five reasons are reachable from this call site, and the other
-* two are bounded out by where the name comes from — an S3 key segment:
-*
-* - `altered`, `option-shaped` and `pattern-shaped` are all reachable: a
-*   planted key can spell a name any of those ways in a handful of bytes.
-* - `empty` is not. `listStacks` drops a key whose stack segment is empty
-*   (`s3-state-backend.ts`'s `if (!stackName) continue`), so `target.stackName`
-*   is non-empty by the time the refusal is built.
-* - `too-long` is not either, and the bound is not obvious: the cap is
-*   `STACK_REF_MAX_CODE_POINTS` (1152), while S3 caps the WHOLE key at 1024
-*   bytes, leaving at most 1008 for the name inside `cdkd/<name>/state.json`.
-*   A multi-byte character only lowers the code-point count further, so a name
-*   arriving through `listStacks` can never reach the cap.
-*
-* Both unreachable arms stay, and are covered, because the REASON is the
-* gate's and not this site's: `pasteableCommand` can return either to a caller
-* whose value comes from somewhere else. A missing arm is no longer a silent
-* fall-through — the `switch` below is exhaustive over `WithholdReason`, so
-* dropping one is a compile error (M13). What the cases buy on top of that is
-* the SENTENCE: the type checker knows an arm exists, not that it says the
-* right thing, and substituting one arm's text for another's is exactly the
-* disagreement M11 closed.
-*/
-function withheldNameClause(built) {
-	const reason = built.withheld.find((w) => w.hole === STACK_HOLE)?.reason;
-	if (reason === void 0) return "";
-	let why;
-	switch (reason) {
-		case "altered":
-			why = `does NOT render exactly, so another record may render identically`;
-			break;
-		case "empty":
-			why = `is empty`;
-			break;
-		case "too-long":
-			why = `is too long to print`;
-			break;
-		case "option-shaped":
-			why = "begins with a '-', so it is not safe to print as an argument to 'cdkd deploy' — a name like '--all' is parsed as the FLAG and targets every stack";
-			break;
-		case "pattern-shaped":
-			why = `would be read as a PATTERN by 'cdkd deploy', which can match other stacks`;
-			break;
-		default: throw new Error(`withheldNameClause: unhandled WithholdReason ${String(reason)}`);
-	}
-	return ` This record's name ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
-}
-/**
 * `cdkd state refresh-observed <stack>` command implementation.
 *
 * Walks every resource in the given stack(s) and refreshes its
@@ -83589,10 +83707,28 @@ function withheldNameClause(built) {
 *
 * Behavior:
 *  - Acquires a per-stack lock (scope: `state-refresh-observed`).
-*  - Calls every resource's `provider.readCurrentState` in parallel
-*    (Promise.all). Errors are swallowed per-resource and logged at
-*    debug — drift falls back to `properties` for that resource until
-*    the next call succeeds.
+*  - Calls `provider.readCurrentState` in parallel (Promise.all) for the
+*    resources that REACH it. FOUR paths do not, and review had to correct
+*    this sentence twice — first from "every resource", then from three arms
+*    to four. A resource whose record carries `observedBaselineRefused` (v10)
+*    is SKIPPED before the provider is consulted and warned about separately,
+*    since refreshing it could persist a resolved secret in plaintext. The
+*    other three all count as `unsupported`: a type
+*    `ProviderRegistry.shouldSkipResource` declines (returning before the
+*    lookup), a type with no registered provider, and a provider that does not
+*    implement `readCurrentState`. A per-resource failure is
+*    COUNTED and logged at
+*    `warn` naming the resource and the error, the rest of the stack is
+*    still refreshed and saved, and the affected resource keeps whatever
+*    `observedProperties` it already had (or none). So drift keeps
+*    comparing against that RETAINED baseline where one exists, and falls
+*    back to `properties` only where there is none — review caught the
+*    unqualified claim, which said it always falls back. The run
+*    then ends in `PartialFailureError` (exit 2) naming the count, which
+*    is what distinguishes it from a crash. (This block travelled here
+*    from `src/utils/pasteable-command.ts`, where it documented nothing;
+*    review measured that it also described the old, swallow-and-debug
+*    behaviour rather than the current one.)
 *  - Writes state with optimistic locking (`expectedEtag`).
 *  - Prints a per-stack summary: `N refreshed, M unsupported, K failed`.
 *
@@ -83608,7 +83744,7 @@ function withheldNameClause(built) {
 async function stateRefreshObservedCommand(stackArgs, options) {
 	const logger = getLogger();
 	if (options.verbose) logger.setLevel("debug");
-	if (!options.all && stackArgs.length === 0) throw new Error("Stack name is required. Usage: cdkd state refresh-observed <stack> [<stack>...] | --all");
+	if (!options.all && stackArgs.length === 0) throw new Error(`Stack name is required. Usage: cdkd state refresh-observed ${commandHole("stacks...")} | --all`);
 	const setup = await setupStateBackend(options);
 	const providerRegistry = new ProviderRegistry();
 	registerAllProviders(providerRegistry);
@@ -83659,13 +83795,16 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			}
 		}
 		for (const target of targets) if (!target.region) {
-			const stack = displayIdent(target.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+			const subject = isPasteableIdent(target.stackName) ? `Stack ${target.stackName}` : `A stack whose name is not a plain identifier (see 'cdkd state list --long')`;
 			const migrate = pasteableCommand("cdkd deploy", [{
 				value: target.stackName,
 				hole: STACK_HOLE,
-				opts: { patternMatched: true }
+				opts: {
+					patternMatched: true,
+					plainIdent: true
+				}
 			}]);
-			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + withheldNameClause(migrate) + `\nMigrate with: ${migrate.command}`);
+			throw new Error(`${subject} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + withheldTargetClause(migrate, STACK_HOLE, "cdkd deploy") + `\nMigrate with: ${migrate.command}`);
 		}
 		let totalRefreshed = 0;
 		let totalUnsupported = 0;
@@ -92177,7 +92316,7 @@ async function waitForRieReady(host, port, timeoutMs = 5e3) {
 		await setTimeout$1(100);
 	}
 	const tail = lastError instanceof Error ? `: ${lastError.message}` : "";
-	throw new Error(`RIE did not become ready on ${host}:${port} within ${timeoutMs}ms${tail}. The container may have exited early — check 'docker logs' output.`);
+	throw new Error(`RIE did not become ready on ${host} port ${port} within ${timeoutMs}ms${tail}. The container may have exited early — check 'docker logs' output.`);
 }
 /**
 * Issue a tiny HTTP request to confirm RIE's HTTP listener is up (not
@@ -92189,7 +92328,7 @@ async function httpProbe(host, port, timeoutMs) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		await (await fetch(`http://${host}:${port}/`, {
+		await (await fetch(`http://${formatAuthority(host, port)}/`, {
 			method: "POST",
 			headers: { "Content-Type": "application/json" },
 			body: "{}",
@@ -92231,7 +92370,7 @@ function isTransientNetworkError(err) {
 * the timeout in v1, but it's the right ballpark.
 */
 async function invokeRie(host, port, event, timeoutMs) {
-	const url = `http://${host}:${port}${INVOKE_PATH}`;
+	const url = `http://${formatAuthority(host, port)}${INVOKE_PATH}`;
 	const body = JSON.stringify(event ?? {});
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -93272,6 +93411,14 @@ function clampConcurrency(input) {
 //#endregion
 //#region src/cli/commands/local-start-api.ts
 /**
+* The `Server listening on <url>  (<label>)` ready banner. Integ fixtures
+* grep this prefix and read the port out of it, and users paste the URL into
+* curl / `wscat`, so an IPv6 host must be bracketed or the URL does not parse.
+*/
+function formatServerListeningBanner(scheme, host, port, pathSuffix, label) {
+	return `Server listening on ${scheme}://${formatAuthority(host, port)}${pathSuffix}  (${label})\n`;
+}
+/**
 * `cdkd local start-api` — long-running local HTTP server that maps
 * synthesized API routes to Lambda invocations against the AWS Lambda
 * Runtime Interface Emulator (Docker required).
@@ -93604,10 +93751,10 @@ async function localStartApiCommand(target, options) {
 	warnUnsupportedRoutes(allRoutes, logger);
 	warnSsrfRiskyIntegrations(allRoutes, logger);
 	logger.info(`Per-Lambda concurrency: ${perLambdaConcurrency} (override with --per-lambda-concurrency)`);
-	for (const { group, server } of servers) process.stdout.write(`Server listening on ${server.scheme}://${server.host}:${server.port}  (${group.displayName})\n`);
+	for (const { group, server } of servers) process.stdout.write(formatServerListeningBanner(server.scheme, server.host, server.port, "", group.displayName));
 	for (const ws of wsServers) {
 		const scheme = ws.server.scheme === "https" ? "wss" : "ws";
-		process.stdout.write(`Server listening on ${scheme}://${ws.server.host}:${ws.server.port}${ws.apiPath}  (${ws.api.apiLogicalId} (WebSocket API))\n`);
+		process.stdout.write(formatServerListeningBanner(scheme, ws.server.host, ws.server.port, ws.apiPath, `${ws.api.apiLogicalId} (WebSocket API)`));
 	}
 	process.stdout.write("^C to stop and clean up containers.\n");
 	let watcher;
@@ -94609,7 +94756,7 @@ function filterSpecsForGroup(group, allSpecs) {
 */
 function printPerServerRouteTables(servers) {
 	for (const { group, server } of servers) {
-		process.stdout.write(`\n${group.displayName}  (http://${server.host}:${server.port})\n`);
+		process.stdout.write(`\n${group.displayName}  (http://${formatAuthority(server.host, server.port)})\n`);
 		printRouteTable(group.routes);
 	}
 }
@@ -99144,4 +99291,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BALgPCWL.js.map
+//# sourceMappingURL=program-WCBWtvb0.js.map