@go-to-k/cdkd 0.291.27 → 0.291.28

package/dist/{program-WCBWtvb0.js → program-DP27UiVh.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as CdkdError, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as isTransientServerError, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as commandHole, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isMarkedNonRetryable, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as withheldTargetClause, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fo as safeStringify, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as displayAssemblyPath, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as getAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resolveBucketRegion, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as markRedactedCause, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, No as retryClassificationText, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as isRetryableTransientError, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Po as describeAwsFailure, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as withErrorHandling, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as shellQuote, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as renderAssemblyPathEscape, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as describeFileReadFailure, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as resolveAssemblyPath, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as runWithStackAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as resetAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Za as setAwsClients, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as IntrinsicResolutionRefusalError, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as PartialFailureError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ProvisioningError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, go as StackTerminationProtectionError, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackHasActiveImportsError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as DynamicReferenceRegionAmbiguousError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as markNonRetryable, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as isThrottlingError, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as MalformedProducerRecordRefusalError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as ResourceUpdateNotSupportedError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalInvokeBuildError$1, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceTimeoutError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as AwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DeployCancelledError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, so as LocalStartServiceError, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, to as CrossAccountSecretRefusalError, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as NestedStackChildDirectDestroyError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vo as SynthesisError, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as pasteableCommand, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as normalizeAwsError, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-DIZztJy5.js";
+import { $ as yellow, $a as setAwsClients, $i as getDockerImageBySourceHash, $n as refuseMalformedOrphanRecordsForDestroy, $r as buildForceUnlockCommand, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as ambientCredentialConfig, Ai as readBootstrapMarkerBody, An as hasReadableOutputs, Ao as withheldTargetClause, Ar as STATE_SOURCED_CROSS_GENERATION_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as nullPrototypeRecord, Bi as finchSecretArgvRefusal, Bn as malformedOrphansRefusalMessage, Br as markSameGenerationBag, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as producerRecordKey, Ci as AssetModeResolver, Cn as STATE_REGION_DIVERGED, Co as normalizeAwsError, Cr as prefetchCreateOnlyPropertyPaths, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as canonicalizeRegion, Di as getBootstrapMarkerKey, Dn as deployRefusesOrphanRowsReason, Do as plainOrDescribed, Dr as DagBuilder, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as PARTITION_TABLE, Ei as ensureAssetStorage, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as pasteableCommand, Er as withRetry, Et as maskDeep, F as extractDeploymentEventError, Fa as globMatches, Fi as resolveDockerContextDirectory, Fn as malformedExportSourceWarning, Fo as markNonRetryable, Fr as dynamicReferenceTokens, Ft as carriesDynamicReference, G as toCfnInteger, Ga as renderAssemblyPathEscape, Gi as partitionSensitiveEnv, Gn as malformedResourceEntriesWarning, Gr as recordMaskOnlyValuesIn, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as absoluteAssemblyPathEscape, Hi as getDockerCmd, Hn as malformedOutputsRefusalMessage, Hr as maskSecretsInText, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as processStackMessages, Ii as describeDockerCapturedOutput, In as malformedLocalOutputsWarning, Io as markRedactedCause, Ir as errorCauseChain, It as carriesFetchableDynamicReference, J as bold, Ja as resolveBucketRegion, Ji as runDockerStreaming, Jn as malformedStateRefusalMessage, Jr as scrubResourceRecord, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resolveAssemblyPath, Ki as redactDockerArgvValues, Kn as malformedResourcePropertiesWarning, Kr as recoverMaskedOutput, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as defineOwnKey, Li as describeDockerExecFailure, Ln as malformedOrphanRecordsRefusalMessage, Lo as retryClassificationText, Lr as identityKeyFor, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as credentialFingerprint, Mi as validateContainerRepoName, Mn as isReadableOrphanRecord, Mo as isRetryableTransientError, Mr as TEMPLATE_SOURCED_RULES, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as AssemblyReader, Ni as buildDenyExternalAccessPolicy, Nn as isReadableResourceEntry, No as isThrottlingError, Nr as carriesSecretMask, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as derivePartitionAndUrlSuffix, Oi as isCrossRegionRedirect, On as displayLogicalId, Oo as quotedOrDescribed, Or as TemplateParser, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as failedStageNote, Pi as buildDockerImage, Pn as malformedExportNamesWarning, Po as isTransientServerError, Pr as createSecretMasker, Pt as IntrinsicFunctionResolver, Q as red, Qa as runWithStackAwsClients, Qi as AssetManifestLoader, Qn as refuseMalformedOrphanRecords, Qr as UNREPRODUCIBLE_LOCK_CLAUSE, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as hasOwnKey, Ri as describeDockerFailure, Rn as malformedOrphanRecordsWarning, Ro as describeAwsFailure, Rr as isSingleDynamicReferenceToken, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as producerCoordinateKey, Si as rewriteTemplateAssetReferences, Sn as INTRINSIC_KEYS, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as expectedOwnerParam, Ti as assertAssetBucketRegion, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as commandHole, Tr as describeTypeWithThrottleRetry, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as describeFileReadFailure, Ui as isDockerClientEnvKey, Un as malformedOutputsWarning, Ur as pathCrossesDottedKey, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as ownValue, Vi as formatDockerLoginError, Vn as malformedOrphansWarning, Vr as maskSecretsInError, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as displayAssemblyPath, Wi as isMalformedEnvKey, Wn as malformedRenderedContainersWarning, Wr as recordMaskOnlyValue, Wt as refStateLookupFromResource, X as gray, Xa as getAwsClients, Xi as escapeRegExp, Xn as refuseDivergentRecordRegionForDestroy, Xr as S3StateBackend, Xt as coerceCfnBoolean, Y as cyan, Ya as AwsClients, Yi as warnFinchArgvExposure, Yn as previewableOrphanRecords, Yr as LockManager, Yt as assertRegionMatch, Z as green, Za as resetAwsClients, Zi as stripControlChars, Zn as refuseMalformedNestedChildOutputs, Zr as rebuildClientForBucketRegion, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as findLargeInlineResources, _i as stringifyValue, _n as AWS_CREDENTIAL_ENV_KEYS, _o as StackHasActiveImportsError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveAutoAssetStorage, ai as describeRegionValueKind, an as requireConfigString, ao as DeployCancelledError, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as injectiveKey, bi as createAssetRedirectResolver, bn as envCredentialsAreAssumedRole, bo as SynthesisError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveStateBucketWithDefault, ci as hasReasonlessBaselineRefusal, cn as classifyReplaySecretRegion, co as LocalInvokeBuildError$1, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as stateBucketExistenceConfirmed, di as importableOutputs, dn as s3BucketArn, do as MalformedProducerRecordRefusalError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as Synthesizer, ei as buildLockContentionMessage, en as configStringRefusal, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as warnDeprecatedNoPrefixCliFlag, fi as isReadableBag, fn as s3BucketDomainName, fo as NestedStackChildDirectDestroyError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as MIGRATE_TMP_PREFIX, gi as AssetPublisher, gn as applyRoleArnIfSet, go as ResourceUpdateNotSupportedError, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as CFN_TEMPLATE_URL_LIMIT, hi as shouldRetainResource, hn as s3BucketWebsiteUrl, ho as ResourceTimeoutError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveApp, ii as DEFAULT_STATE_PREFIX, in as requireConfigObject, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as clientDefaultsFor, ji as validateAssetBucketName, jn as hasReadableResources, jo as isMarkedNonRetryable, jr as STATE_SOURCED_READBACK_RULES, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as ambientClientDefaults, ki as parseBootstrapMarker, kn as hasReadableOrphans, ko as shellQuote, kr as STATE_SOURCED_BASELINE_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as resolveStateBucketWithDefaultAndSource, li as hasUnverifiableParameterRefusal, ln as producerRegionsFromState, lo as LocalStartServiceError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as CFN_TEMPLATE_BODY_LIMIT, mi as orphansCarriedFrom, mn as s3BucketRegionalDomainName, mo as ProvisioningError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as getDefaultStateBucketName, ni as formatLockExpiry, nn as replayWarn, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveCaptureObservedState, oi as exportNamesCarriedFrom, on as definedAttributes, oo as DynamicReferenceRegionAmbiguousError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as ssmResolvedValueType, pi as orphansAfterRollback, pn as s3BucketDualStackDomainName, po as PartialFailureError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qi as runDockerForeground, qn as malformedResourcesWarning, qr as redactSecretsForState, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as getLegacyStateBucketName, ri as CUSTOM_RESOURCE_RESPONSE_PREFIX, rn as requireConfigArray, ro as CrossAccountSecretRefusalError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveSkipPrefix, si as hasReadableExportSet, sn as stringifyIfAssigned, so as IntrinsicResolutionRefusalError, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as synthesisStatusMessage, ti as forceQuitRecoveryClause, tn as readConfigString, to as CdkdError, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as resolveUseCdkBootstrapAssets, ui as importableOutputKeys, un as withSharedDrainBudget, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as uploadCfnTemplate, vi as WorkGraph, vn as applyCallerIdentityCredentials, vo as StackTerminationProtectionError, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as decodeListingKey, wi as BOOTSTRAP_MARKER_PREFIX, wn as STATE_RESOURCES_MALFORMED, wo as withErrorHandling, wr as templateResourceTypes, wt as packCompositeId, x as bindingSkippedOutputs, xa as injectiveKeyPrefix, xi as loadPublishableAssetManifest, xn as DiffCalculator, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, yi as buildAssetRedirectMap, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as hasPlainPrototype, zi as dockerSpawnEnvWithSensitive, zn as malformedOrphanRowsKeptWarning, zo as safeStringify, zr as isUncertifiedBaselineMaskPosition, zt as getAccountInfo } from "./deploy-engine-CidtgaFr.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion, u as formatAuthority } from "./aws-client-defaults-qSDe1fA_.js";
-import { t as getCdkdVersion } from "./version-CuKFdkKV.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CWCv370K.js";
+import { t as getCdkdVersion } from "./version-CyFoAN6V.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DaYT8UPi.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9810,6 +9810,34 @@ var S3BucketProvider = class S3BucketProvider {
 		return Array.isArray(list) && list.length === 0;
 	}
 	/**
+	* The refusal a TEMPLATE-path `update()` raises for a malformed
+	* `VersioningConfiguration.Status` or `LoggingConfiguration` member, or
+	* `undefined` (issue [#3728](https://github.com/go-to-k/cdkd/issues/3728)).
+	*
+	* It asks exactly what the two warn-and-skip arms in
+	* {@link applySubConfigDiffs} ask, with the same predicate, key, fallback and
+	* path, and only where those arms would ACT:
+	*
+	* - versioning: the block CHANGED (nullish on both sides, the arm's own
+	*   `versioningChanged`), and `configStringRefusal` refuses `Status`;
+	* - logging: the block CHANGED, and `DestinationBucketName` or
+	*   `LogFilePrefix` refuses, in the applier's order. An ABSENT block (the
+	*   legitimate removal, `diffSubConfig`'s clear arm) needs no gate of its
+	*   own: `configStringRefusal` answers `undefined` for a nullish container.
+	*
+	* An unchanged malformed value is not a pending operation, so it is not
+	* refused either — the same gate the arms' own warnings take.
+	*/
+	static versioningOrLoggingRefusal(properties, previousProperties) {
+		const changed = (key) => JSON.stringify(previousProperties[key] ?? null) !== JSON.stringify(properties[key] ?? null);
+		if (changed("VersioningConfiguration")) {
+			const refusal = configStringRefusal(properties["VersioningConfiguration"], "Status", "Suspended", "AWS::S3::Bucket VersioningConfiguration");
+			if (refusal !== void 0) return refusal;
+		}
+		const logging = properties["LoggingConfiguration"];
+		if (changed("LoggingConfiguration")) return configStringRefusal(logging, "DestinationBucketName", "", "AWS::S3::Bucket LoggingConfiguration") ?? configStringRefusal(logging, "LogFilePrefix", "", "AWS::S3::Bucket LoggingConfiguration");
+	}
+	/**
 	* Turn a set of per-property overrides into the `effectiveProperties` bag the
 	* deploy engine records in place of the desired one (issues #1612 / #1670).
 	*
@@ -10696,6 +10724,10 @@ var S3BucketProvider = class S3BucketProvider {
 				wasReplaced: true
 			};
 		}
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) {
+			const refusal = S3BucketProvider.versioningOrLoggingRefusal(properties, previousProperties);
+			if (refusal !== void 0) throw new ProvisioningError(`${refusal}. Nothing was applied to bucket ${displaySafe(physicalId)}; fix the template value`, resourceType, logicalId, physicalId);
+		}
 		await this.assertStateBucketRegion("update", logicalId, resourceType, physicalId, await this.getRegion());
 		try {
 			const effectiveOverrides = await this.applyConfiguration(physicalId, properties, {
@@ -18687,6 +18719,53 @@ function liveCeilingAlreadyMatches(live, requested) {
 	return compared > 0;
 }
 /**
+* Is this per-index capacity AWS's on-demand `{0, 0}` placeholder — BOTH
+* members resolving to 0 through {@link toFiniteNumber}, so a string-spelled
+* `{'0', '0'}` counts and a half-zero `{0, 7}` does not?
+*
+* The ONE predicate behind both answers to that value on the UPDATE path: the
+* template-path pre-flight refusal ({@link zeroCapacityIndexRefusal}) and the
+* warn-skip the two non-template callers still take
+* (`DynamoDBTableProvider.skipZeroCapacityIndexUpdate`). Sharing it is what
+* keeps the refusal from being narrower or wider than the skip it replaces on
+* the template path.
+*/
+function isZeroCapacityPlaceholder(requested) {
+	if (requested === void 0 || requested === null || typeof requested !== "object") return false;
+	return toFiniteNumber(requested.ReadCapacityUnits) === 0 && toFiniteNumber(requested.WriteCapacityUnits) === 0;
+}
+/**
+* The template-path pre-flight refusal for a per-index `ProvisionedThroughput`
+* of `{0, 0}` (issue [#3728](https://github.com/go-to-k/cdkd/issues/3728)), or
+* `undefined` when no index would reach `applyGsiUpdates`' capacity arms
+* carrying one.
+*
+* SCOPE, matched to what those arms act on rather than to every entry that
+* holds the value. An index is named only when its capacity is a PENDING
+* operation: it is absent from the recorded previous side (a new index, or the
+* adopted-index arm), or its `ProvisionedThroughput` differs from the recorded
+* one (the same-name arm's own change test, `JSON.stringify` against
+* `JSON.stringify`). A steady-state template that has always carried the
+* placeholder emits no capacity op, so refusing it would fail a deploy that
+* sends nothing — the same gate the `StreamSpecification` refusal takes.
+*
+* Wider than the skip in ONE direction, deliberately: a brand-new index, whose
+* `Create` action never consulted the skip and sent `{0, 0}` for AWS to reject
+* AFTER the tag diff and any billing flip had landed. Refusing it here trades
+* that half-applied failure for one that applied nothing.
+*/
+function zeroCapacityIndexRefusal(properties, previousProperties, logicalId, maskSecrets) {
+	const asEntries = (value) => (Array.isArray(value) ? value : []).filter((entry) => entry !== null && typeof entry === "object" && !Array.isArray(entry));
+	const previousByName = /* @__PURE__ */ new Map();
+	for (const entry of asEntries(previousProperties["GlobalSecondaryIndexes"])) if (entry["IndexName"]) previousByName.set(entry["IndexName"], entry);
+	const offending = asEntries(properties["GlobalSecondaryIndexes"]).filter((entry) => Boolean(entry["IndexName"])).filter((entry) => isZeroCapacityPlaceholder(entry["ProvisionedThroughput"])).filter((entry) => {
+		const previous = previousByName.get(entry["IndexName"]);
+		return previous === void 0 || JSON.stringify(previous["ProvisionedThroughput"]) !== JSON.stringify(entry["ProvisionedThroughput"]);
+	}).map((entry) => typeof entry["IndexName"] === "string" ? maskSecrets(entry["IndexName"]) : "<unnamed>");
+	if (offending.length === 0) return void 0;
+	return `AWS::DynamoDB::Table ${logicalId}: GlobalSecondaryIndexes ${offending.join(", ")} declare ProvisionedThroughput {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1). Declare a capacity of at least 1, or remove the per-index ProvisionedThroughput on a PAY_PER_REQUEST table. Nothing was applied to the table`;
+}
+/**
 * The sentinel DynamoDB accepts to CLEAR an on-demand request-unit maximum
 * (issue [#3373](https://github.com/go-to-k/cdkd/issues/3373)).
 *
@@ -19590,6 +19669,10 @@ var DynamoDBTableProvider = class {
 				const [streamRefusal] = streamMemberRefusals(properties["StreamSpecification"]);
 				if (streamRefusal !== void 0) throw new ProvisioningError(`${streamRefusal}. Nothing was applied to DynamoDB table ${logicalId}; fix the template value`, resourceType, logicalId, physicalId);
 			}
+			if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) {
+				const zeroCapacityRefusal = zeroCapacityIndexRefusal(properties, previousProperties, logicalId, maskSecrets);
+				if (zeroCapacityRefusal !== void 0) throw new ProvisioningError(zeroCapacityRefusal, resourceType, logicalId, physicalId);
+			}
 			const table = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: physicalId }))).Table;
 			let latestStreamArn = table?.LatestStreamArn;
 			if (table?.TableArn) await this.applyTagDiff(table.TableArn, previousProperties["Tags"], properties["Tags"]);
@@ -21143,43 +21226,35 @@ var DynamoDBTableProvider = class {
 	* capacity — including a half-declared or malformed one — still goes out and
 	* is answered by AWS, the fail-OPEN direction this file uses everywhere.
 	*
-	* CALLER-BLIND, decided rather than overlooked (PR review). A TEMPLATE-borne
-	* `{0, 0}` warn-skips here while `create()` fails loudly on the same value,
-	* which reads like the "loud failure for a quiet lie" trade the adopted-index
-	* arm below forbids. It was decided for three reasons; the first no longer
-	* holds as written (see its own bullet), the other two still do:
-	*
-	*  - When this was decided, no discriminator separated the callers that
-	*    matter. `ResourceProvider.update` takes an optional `UpdateContext`, and
-	*    `desiredFromAwsReadback` on it is set ONLY by `cdkd drift --revert`
-	*    (`src/cli/commands/drift.ts`). The rollback executor's revert arms DO
-	*    pass a context (a `maskSecrets` capability, issue #1932) but never set
-	*    that flag: their desired bag is `previousState.properties`, a TEMPLATE
-	*    recorded earlier. At the time they were therefore indistinguishable
-	*    from an ordinary template deploy — and THAT is the pair this decision
-	*    turns on. (An earlier revision said the revert arms "pass NO context",
-	*    which stopped being true with #1932 — issue #1999.) Since issue #3141
-	*    they ALSO set `UpdateContext.replayingState`, so the caller is now
-	*    knowable: the per-index `OnDemandThroughput` refusal in `update()` gates
-	*    on exactly that pair of flags (the go-to-k/cdkd#3401 review). This arm
-	*    was not re-decided when that became possible; splitting it the same way
-	*    would turn a template-path warn-skip into a refusal, a behaviour change
-	*    that needs its own review rather than a comment edit (issue #3728).
-	*  - The repo's general rule for the UPDATE path is WARN-never-throw (issues
-	*    #1545 / #1552): the desired bag here can BE a historical cdkd state
-	*    record, and a refusal would make the table un-updatable and
-	*    un-rollbackable with no template-side remedy.
-	*  - The lie is bounded and self-surfacing. AWS never accepted `{0, 0}` at
-	*    create either, so no live table can be holding it; and where the value
-	*    would actually matter — a PROVISIONED table, whose indexes hold a real
-	*    capacity — recording `{0, 0}` diverges from the readback and `cdkd drift`
-	*    REPORTS it. On a PAY_PER_REQUEST table the recorded `{0, 0}` matches what
-	*    `DescribeTable` reports for every index anyway, so there is no divergence
-	*    to hide.
+	* NOT caller-blind any more (issue #3728). A TEMPLATE-borne `{0, 0}` never
+	* reaches this skip: `update()` REFUSES it at pre-flight, before any call —
+	* see {@link zeroCapacityIndexRefusal} — exactly as `create()` fails loudly
+	* on the same value. What still arrives here is the two NON-template desired
+	* bags, and for them the warn-skip stands:
+	*
+	*  - `cdkd drift --revert` (`UpdateContext.desiredFromAwsReadback`), the
+	*    caller this skip was written for: its desired bag is a pre-#1767
+	*    `observedProperties` blob, which the user cannot edit from the template.
+	*  - The rollback executor's two revert arms (`UpdateContext.replayingState`,
+	*    since issue #3141): their desired bag is `previousState.properties`, a
+	*    cdkd STATE record, so a refusal would make the table un-rollbackable with
+	*    no template-side remedy (issues #1545 / #1552).
+	*
+	* The lie the skip tells on those paths is bounded and self-surfacing. AWS
+	* never accepted `{0, 0}` at create either, so no live table can be holding
+	* it; and where the value would actually matter — a PROVISIONED table, whose
+	* indexes hold a real capacity — recording `{0, 0}` diverges from the readback
+	* and `cdkd drift` REPORTS it. On a PAY_PER_REQUEST table the recorded
+	* `{0, 0}` matches what `DescribeTable` reports for every index anyway, so
+	* there is no divergence to hide.
+	*
+	* Until issue #3728 this skip was caller-blind: when it was written no
+	* discriminator separated a template deploy from the rollback revert arms
+	* (they set neither flag), and the template path warn-skipped too. That
+	* reason expired with #3141, and the template path now takes the refusal.
 	*/
 	skipZeroCapacityIndexUpdate(indexName, physicalId, requested, maskSecrets) {
-		if (requested === void 0) return false;
-		if (toFiniteNumber(requested.ReadCapacityUnits) !== 0 || toFiniteNumber(requested.WriteCapacityUnits) !== 0) return false;
+		if (!isZeroCapacityPlaceholder(requested)) return false;
 		const warn = (message) => this.logger.warn(maskSecrets(message));
 		warn(`${this.indexScopeAt(indexName, physicalId, maskSecrets)}: the requested ProvisionedThroughput is {ReadCapacityUnits: 0, WriteCapacityUnits: 0}, which is AWS's on-demand placeholder rather than a capacity DynamoDB accepts (the minimum is 1), so no per-index throughput update was sent. This usually means the value came from a pre-#1767 cdkd state record — a \`cdkd drift --revert\` of such a record, or a rollback replaying it. Re-run \`cdkd deploy\` (or \`cdkd drift --accept\`) to refresh the record.`);
 		return true;
@@ -28896,6 +28971,14 @@ function narrowRouteDestinations(properties) {
 		narrowed
 	};
 }
+/**
+* The multi-destination refusal sentence, shared by `createRoute`'s guard and
+* `updateRoute`'s template-path pre-flight (issue #3728) so the two cannot
+* word the same fault differently.
+*/
+function routeMultipleDestinationsMessage(logicalId, declared) {
+	return `Route ${logicalId} declares more than one destination (${declared.join(", ")}). CloudFormation and EC2 accept exactly one of DestinationCidrBlock/DestinationIpv6CidrBlock/DestinationPrefixListId; remove the extra keys from the template.`;
+}
 /** The `AuthorizeSecurityGroupIngress` default protocol: "all protocols". */
 const SG_INGRESS_IP_PROTOCOL_DEFAULT = "-1";
 /** The refusal path both the create guard and the canonicalizer report under. */
@@ -29280,7 +29363,7 @@ var EC2Provider = class {
 			case "AWS::EC2::VPCGatewayAttachment": return this.updateVpcGatewayAttachment(logicalId, physicalId);
 			case "AWS::EC2::NatGateway": return this.updateNatGateway(logicalId, physicalId);
 			case "AWS::EC2::RouteTable": return this.updateRouteTable(logicalId, physicalId);
-			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
+			case "AWS::EC2::Route": return this.updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			case "AWS::EC2::SubnetRouteTableAssociation": return this.updateSubnetRouteTableAssociation(logicalId, physicalId);
 			case "AWS::EC2::SecurityGroup": return this.updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::EC2::SecurityGroupIngress": return this.updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties, context?.maskSecrets);
@@ -30009,7 +30092,7 @@ var EC2Provider = class {
 		const { declared: declaredDestinations, narrowed: narrowedProperties } = narrowRouteDestinations(properties);
 		let effectiveProperties;
 		if (declaredDestinations.length > 1) {
-			const message = `Route ${logicalId} declares more than one destination (${declaredDestinations.join(", ")}). CloudFormation and EC2 accept exactly one of DestinationCidrBlock/DestinationIpv6CidrBlock/DestinationPrefixListId; remove the extra keys from the template.`;
+			const message = routeMultipleDestinationsMessage(logicalId, declaredDestinations);
 			if (onMultipleDestinations) {
 				const usedKey = declaredDestinations[0];
 				effectiveProperties = narrowedProperties;
@@ -30053,12 +30136,17 @@ var EC2Provider = class {
 			throw new ProvisioningError(`Failed to create Route ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
+	async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Route ${logicalId}: ${physicalId}`);
+		const maskSecrets = context?.maskSecrets;
 		if (JSON.stringify(properties) === JSON.stringify(previousProperties)) return {
 			physicalId,
 			wasReplaced: false
 		};
+		if (context?.replayingState !== true && context?.desiredFromAwsReadback !== true) {
+			const { declared } = narrowRouteDestinations(properties);
+			if (declared.length > 1) throw new ProvisioningError(`${routeMultipleDestinationsMessage(logicalId, declared)} The route was not changed.`, resourceType, logicalId, physicalId);
+		}
 		try {
 			await this.deleteRoute(logicalId, physicalId, resourceType);
 			const createResult = await this.createRoute(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets);
@@ -33262,7 +33350,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 				path: `/canarySettings/stageVariableOverrides/${key}`,
 				value
 			});
-			for (const key of Object.keys(prevOverrides)) if (!(key in overrides)) patchOperations.push({
+			for (const key of Object.keys(prevOverrides)) if (!Object.hasOwn(overrides, key)) patchOperations.push({
 				op: "remove",
 				path: `/canarySettings/stageVariableOverrides/${key}`
 			});
@@ -33274,7 +33362,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			path: `/variables/${key}`,
 			value
 		});
-		for (const key of Object.keys(prevVariables)) if (!(key in variables)) patchOperations.push({
+		for (const key of Object.keys(prevVariables)) if (!Object.hasOwn(variables, key)) patchOperations.push({
 			op: "remove",
 			path: `/variables/${key}`
 		});
@@ -44984,7 +45072,7 @@ var Route53Provider = class {
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.updateHostedZone(logicalId, physicalId, resourceType, properties, previousProperties);
-			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, context);
+			case "AWS::Route53::RecordSet": return this.updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
 	}
@@ -45331,12 +45419,17 @@ var Route53Provider = class {
 			throw new ProvisioningError(`Failed to create record set ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async updateRecordSet(logicalId, physicalId, resourceType, properties, context) {
+	async updateRecordSet(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Route 53 record set ${logicalId}: ${physicalId}`);
 		const hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId);
 		const recordName = properties["Name"];
 		const recordType = properties["Type"];
-		const compositeId = packCompositeId(resourceType, logicalId, [
+		const stateBorneDesired = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		const recordedSegmentValues = {
+			recordName: previousProperties["Name"],
+			recordType: previousProperties["Type"]
+		};
+		const segments = [
 			{
 				name: "hostedZoneId",
 				value: hostedZoneId
@@ -45349,8 +45442,15 @@ var Route53Provider = class {
 				name: "recordType",
 				value: recordType
 			}
-		], {
-			onRefusal: (message) => this.logger.warn(message),
+		];
+		const sameRecordedSegment = (value, recorded) => {
+			if (typeof recorded !== "string" || recorded.includes("{{resolve:")) return true;
+			const normalize = (text) => text.replace(/\.$/, "").toLowerCase();
+			return normalize(String(value)) === normalize(recorded);
+		};
+		const introducesSeparator = !stateBorneDesired && segments.some((segment) => String(segment.value).includes("|") && !sameRecordedSegment(segment.value, recordedSegmentValues[segment.name]));
+		const compositeId = packCompositeId(resourceType, logicalId, segments, {
+			...!introducesSeparator && { onRefusal: (message) => this.logger.warn(message) },
 			maskSecrets: context?.maskSecrets
 		});
 		try {
@@ -47607,19 +47707,25 @@ var CognitoUserPoolProvider = class {
 	* modify or remove an existing attribute — those changes require replacement
 	* and are rejected with ResourceUpdateNotSupportedError.
 	*
-	* The `context` parameter is read for ONE thing today: `maskSecrets` (issue
+	* The `context` parameter is read for two things: `maskSecrets` (issue
 	* #1932 item 3), forwarded to `applyMfaConfig` so the MFA warnings mask a
-	* resolved secret the same way they do on the create path. It deliberately
-	* does NOT consult `desiredFromAwsReadback` -- this provider has no
-	* empty-collection-means-delete shape, so reading that flag would be a
-	* behavior change with no motivating case, and the `MfaConfiguration`
-	* refusal below stays UNCONDITIONALLY downgraded for the reason its own
-	* comment gives (a refusal against a state-borne bag leaves the resource
-	* un-rollbackable). Accepting the context does not change that.
+	* resolved secret the same way they do on the create path; and the ORIGIN
+	* of the desired bag (`replayingState` / `desiredFromAwsReadback`), which
+	* decides whether the `MfaConfiguration` shape guard below refuses (a
+	* template-path update) or warns (a rollback revert or `cdkd drift
+	* --revert`) — issue #3728. It reads `desiredFromAwsReadback` for that
+	* origin question ONLY: this provider has no empty-collection-means-delete
+	* shape, so nothing here treats a readback value as a removal.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		this.logger.debug(`Updating Cognito User Pool ${logicalId}: ${physicalId}`);
-		const mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], { onUnusable: (message) => this.logger.warn(message) });
+		const stateBorneDesired = context?.replayingState === true || context?.desiredFromAwsReadback === true;
+		let mfaConfiguration;
+		try {
+			mfaConfiguration = readDeclaredMfaConfiguration(properties["MfaConfiguration"], stateBorneDesired ? { onUnusable: (message) => this.logger.warn(message) } : {});
+		} catch (error) {
+			throw new ProvisioningError(`${error instanceof Error ? error.message : String(error)}. Nothing was applied to user pool ${physicalId}`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0);
+		}
 		this.warnOnBlankMfaConfiguration(properties["MfaConfiguration"]);
 		const liveFirstAuthFactors = mfaPreflightNeedsLiveSignInPolicy(properties, mfaConfiguration) ? await this.readLiveAllowedFirstAuthFactors(physicalId) : void 0;
 		this.assertMfaCombinationApplicable(logicalId, resourceType, physicalId, properties, mfaConfiguration, liveFirstAuthFactors);
@@ -51473,6 +51579,163 @@ function resolveTableIdentity(input) {
 	};
 }
 /**
+* Describe an unresolved name by SHAPE only. Its leaves can be resolved
+* secrets, and the engine's masker matches a secret's full plaintext, which a
+* JSON rendering (escaping) or a cut (a fragment) would defeat.
+*/
+function describeUnresolvedName(value) {
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "object" && value !== null) {
+		const keys = Object.keys(value).slice(0, 5);
+		return keys.length === 0 ? "an empty object" : `an object with keys [${keys.join(", ")}]`;
+	}
+	if (typeof value === "number") return "a number that is not a safe integer";
+	return `a ${typeof value}`;
+}
+/**
+* Refuse an UPDATE whose nested `Name` renames the recorded Glue entity
+* (issue #3724).
+*
+* CDK emits the NESTED name (`TableInput.Name`, `DatabaseInput.Name`,
+* `ConnectionInput.Name`), and none of the registry schemas marks it
+* createOnly (Table marks its top-level `Name`, Database its `DatabaseName`,
+* Connection only `CatalogId`), so a rename diffs as an in-place UPDATE. For
+* a table that update is a wrong-target write: `UpdateTable` addresses the
+* table BY `TableInput.Name`, so it would rewrite whichever table holds the new
+* name — possibly one cdkd does not manage — while the state record kept the
+* old id. `UpdateDatabase` / `UpdateConnection` address the recorded name, but
+* whatever AWS does with a different name inside the definition, cdkd keeps
+* recording the old one. No arm is licensed to downgrade this on a replay: the
+* alternative is a write to a resource the record does not name.
+*
+* `ResourceUpdateNotSupportedError` is what the deploy engine's `--replace`
+* fallback reacts to, so the remedy it names is a real path. An ABSENT name
+* passes: the builders then send the recorded one. Any other non-string value
+* still reaches the wire uncoerced, so a safe integer is compared by its string
+* form (the one spelling JS and Glue cannot disagree on) and anything else is
+* refused with an untyped error, since a `--replace` CREATE would carry the
+* same value — cdkd cannot tell which entity it addresses.
+* `foldCase` is set for tables and databases, whose names Glue folds to
+* lowercase: a case-only difference addresses the same entity, and a
+* `drift --revert` bag read back from AWS carries the folded spelling. Only
+* ASCII is folded, so a guess wrong about Glue's folding over-refuses rather
+* than letting a different entity through.
+*/
+function refuseNestedRename(args) {
+	const { desiredName: raw, recordedName } = args;
+	if (raw == null) return;
+	if (!(typeof raw === "string" || typeof raw === "number" && Number.isSafeInteger(raw))) throw markNonRetryable(new ProvisioningError(`${args.field} is not a resolved name (${describeUnresolvedName(raw)}), so cdkd cannot tell which Glue ${args.noun} the update of ${args.logicalId} would address and will not send it. Declare ${args.field} as a string ('${recordedName}' keeps the recorded ${args.noun})`, args.resourceType, args.logicalId));
+	const desiredName = String(raw);
+	const fold = (name) => args.foldCase ? name.replace(/[A-Z]/g, (c) => c.toLowerCase()) : name;
+	if (fold(desiredName) === fold(recordedName)) return;
+	const remedyFlags = args.stateful ? "--replace --force-stateful-recreation" : "--replace";
+	throw new ResourceUpdateNotSupportedError(args.resourceType, args.logicalId, `${args.field} changed from '${recordedName}' to '${desiredName}', and cdkd cannot rename a Glue ${args.noun} in place — ${args.consequence(desiredName)}. To rename it, re-deploy with ${remedyFlags}, which DELETEs the ${args.noun} '${recordedName}' and then CREATEs '${desiredName}' (under UpdateReplacePolicy: Retain the old one is kept instead); the CREATE fails if a ${args.noun} named '${desiredName}' already exists, after the DELETE. If the template did not change this name, the state record was left by an earlier deploy that wrote to '${desiredName}' (issue #3724): check that ${args.noun} before re-deploying. Otherwise keep the name '${recordedName}'`);
+}
+/**
+* The recorded `CatalogId` a `readCurrentState` snapshot carries back, so a
+* `drift --revert` built from that snapshot addresses the catalog the entity
+* was READ from (issue #3756). `GetDatabase` / `GetTable` / `GetConnection` do
+* not echo it, and a snapshot without it made the revert's update target this
+* account's DEFAULT catalog. Echoed only when usable: the raw value keeps drift
+* comparing like with like, and an unusable one (the account-id pseudo
+* parameter, another intrinsic) stays absent, which is what the reads
+* addressed for it.
+*/
+function withRecordedCatalogId(snapshot, properties) {
+	const raw = properties?.["CatalogId"];
+	return catalogIdForApi(raw) === void 0 ? snapshot : {
+		...snapshot,
+		CatalogId: raw
+	};
+}
+/**
+* The `CatalogId` an UPDATE sends. A finite number (a YAML-numeric account id,
+* which {@link withRecordedCatalogId} can now carry into a `drift --revert`
+* bag) is stringified the way the readers and deletes do; anything else keeps
+* the pre-existing cast, so an unresolved intrinsic still reaches AWS and is
+* rejected there rather than silently defaulting to this account's catalog.
+*/
+function updateCatalogId(value) {
+	return typeof value === "number" && Number.isFinite(value) ? String(value) : value;
+}
+/**
+* Classify a `CatalogId`. Absent and the account-id pseudo parameter both mean
+* the caller's own catalog ({@link isAccountIdPseudoParameter}); a usable
+* literal is itself; anything else (another intrinsic, a malformed value)
+* cannot be placed.
+*/
+function classifyCatalog(value) {
+	if (value == null || isAccountIdPseudoParameter(value)) return { kind: "default" };
+	const id = catalogIdForApi(value);
+	return id === void 0 ? { kind: "unusable" } : {
+		kind: "literal",
+		id
+	};
+}
+/**
+* Refuse an UPDATE whose `CatalogId` moves the entity to another Data Catalog
+* (issue #3756).
+*
+* Every Glue update sends the DESIRED `CatalogId` while the state record names
+* only the entity, so a changed catalog addresses the same-named entity in
+* ANOTHER catalog — rewriting it while the recorded one is left alone.
+* `AWS::Glue::Database` reaches this on every such edit (its registry schema
+* marks only `DatabaseName` createOnly); Table and Connection mark `CatalogId`
+* createOnly and reach it only when the createOnly lookup degrades.
+*
+* Equivalence is decided, not string-compared: absent and a literal equal to
+* the caller's own account are the SAME catalog, so the mixed case asks STS
+* (`callerAccountId`), which a CDK stack's `catalogId: Stack.of(this).account`
+* hits whenever the recorded side holds the pseudo parameter an import left.
+* An unusable DESIRED side is left to the wire as before, and an unusable
+* RECORDED side (an imported raw intrinsic) cannot be placed, so it warns and
+* proceeds: refusing would wedge every later deploy on a record the user
+* cannot edit.
+*/
+async function refuseCatalogMove(args) {
+	const recorded = classifyCatalog(args.recorded);
+	const desired = classifyCatalog(args.desired);
+	if (desired.kind === "unusable") return;
+	if (recorded.kind === "unusable") {
+		args.warn(`Glue ${args.noun} ${args.logicalId}: the recorded CatalogId is not a usable value (likely an unresolved intrinsic an import recorded), so cdkd cannot confirm the update addresses the Data Catalog the ${args.noun} was deployed to; it proceeds against ${desired.kind === "literal" ? `Data Catalog ${desired.id}` : "this account's default Data Catalog"}.`);
+		return;
+	}
+	if (recorded.kind === "default" && desired.kind === "default") return;
+	if (recorded.kind === "literal" && desired.kind === "literal") {
+		if (recorded.id === desired.id) return;
+	} else {
+		const literal = recorded.kind === "literal" ? recorded.id : desired.id;
+		let callerAccount;
+		try {
+			callerAccount = await args.callerAccountId();
+		} catch (error) {
+			throw new ProvisioningError(`Could not resolve the caller's account id (sts:GetCallerIdentity) to tell whether CatalogId ${literal} is this account's default Data Catalog, so cdkd did not update Glue ${args.noun} ${args.logicalId}: ${error instanceof Error ? error.message : String(error)}`, args.resourceType, args.logicalId, void 0, error instanceof Error ? error : void 0);
+		}
+		if (literal === callerAccount) return;
+	}
+	const describe = (side) => side.kind === "literal" ? `Data Catalog ${side.id}` : "this account's default Data Catalog";
+	const remedyFlags = args.stateful ? "--replace --force-stateful-recreation" : "--replace";
+	throw new ResourceUpdateNotSupportedError(args.resourceType, args.logicalId, `CatalogId moves the ${args.noun} '${args.entityName}' from ${describe(recorded)} to ${describe(desired)}, and an in-place update would address the same-named ${args.noun} in the NEW catalog while the state record kept the old one. To move it, re-deploy with ${remedyFlags}, which DELETEs the ${args.noun} from ${describe(recorded)} and then CREATEs it in ${describe(desired)} (under UpdateReplacePolicy: Retain the old one is kept instead); or keep the recorded CatalogId`);
+}
+/**
+* A memoized "which account am I" for {@link refuseCatalogMove}'s mixed case,
+* built per provider instance so the STS call happens at most once and only
+* when a catalog comparison needs it. A failure is not cached.
+*/
+function makeCallerAccountResolver(region) {
+	let stsClient;
+	let cached;
+	return async () => {
+		if (cached) return cached;
+		stsClient ??= new STSClient({
+			...ambientClientDefaults(),
+			...region ? { region } : {}
+		});
+		cached = await resolveAccountId(stsClient);
+		return cached;
+	};
+}
+/**
 * SDK Provider for AWS Glue resources
 *
 * Supports:
@@ -51485,6 +51748,7 @@ function resolveTableIdentity(input) {
 var GlueProvider = class {
 	client;
 	providerRegion = ambientRegion();
+	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
 		"DatabaseInput",
@@ -51551,7 +51815,29 @@ var GlueProvider = class {
 		this.logger.debug(`Updating Glue Database ${logicalId}: ${physicalId}`);
 		const databaseInput = properties["DatabaseInput"];
 		if (!databaseInput) throw new ProvisioningError(`DatabaseInput is required for Glue Database update ${logicalId}`, resourceType, logicalId, physicalId);
-		const catalogId = properties["CatalogId"];
+		refuseNestedRename({
+			resourceType,
+			logicalId,
+			field: "DatabaseInput.Name",
+			noun: "database",
+			recordedName: physicalId,
+			desiredName: databaseInput["Name"],
+			foldCase: true,
+			consequence: () => `UpdateDatabase would address '${physicalId}' with a different name inside its definition, and the state record would keep '${physicalId}' whatever AWS did with it`,
+			stateful: true
+		});
+		await refuseCatalogMove({
+			resourceType,
+			logicalId,
+			noun: "database",
+			entityName: physicalId,
+			recorded: previousProperties?.["CatalogId"],
+			desired: properties["CatalogId"],
+			stateful: true,
+			callerAccountId: this.callerAccountId,
+			warn: (message) => this.logger.warn(message)
+		});
+		const catalogId = updateCatalogId(properties["CatalogId"]);
 		const liveParameters = await this.readLiveDatabaseParameters(logicalId, resourceType, physicalId, catalogId);
 		const previousDatabaseInput = asRecord(previousProperties?.["DatabaseInput"]);
 		try {
@@ -51644,7 +51930,29 @@ var GlueProvider = class {
 		const { databaseName, tableName } = decoded;
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
-		const catalogId = properties["CatalogId"];
+		refuseNestedRename({
+			resourceType,
+			logicalId,
+			field: "TableInput.Name",
+			noun: "table",
+			recordedName: tableName,
+			desiredName: tableInput["Name"],
+			foldCase: true,
+			consequence: (desired) => `UpdateTable addresses the table by TableInput.Name, so it would write to the table named '${desired}' in database '${databaseName}' (possibly one cdkd does not manage) while the state record kept '${tableName}'`,
+			stateful: true
+		});
+		await refuseCatalogMove({
+			resourceType,
+			logicalId,
+			noun: "table",
+			entityName: `${databaseName}.${tableName}`,
+			recorded: previousProperties?.["CatalogId"],
+			desired: properties["CatalogId"],
+			stateful: true,
+			callerAccountId: this.callerAccountId,
+			warn: (message) => this.logger.warn(message)
+		});
+		const catalogId = updateCatalogId(properties["CatalogId"]);
 		const updateIcebergKey = findIcebergTableInputKey(properties);
 		if (updateIcebergKey !== void 0) this.logger.warn(icebergTableInputRefusalMessage(logicalId, updateIcebergKey, "update"));
 		const live = await this.readLiveTableState(logicalId, resourceType, physicalId, databaseName, tableName, catalogId);
@@ -52155,11 +52463,10 @@ var GlueProvider = class {
 	*    `ViewExpandedText`, `TargetTable`). The table physicalId is
 	*    `databaseName|tableName`; we recover both from the split.
 	*
-	* `CatalogId` is intentionally not surfaced — `GetDatabase` /
-	* `GetTable` do not echo it back, and cdkd state's `CatalogId` is
-	* usually the AWS account id (defaulted by the API). Comparator only
-	* descends into keys present in state, so an absent surface key cannot
-	* fire false drift here.
+	* `CatalogId` is not READ — `GetDatabase` / `GetTable` do not echo it —
+	* but the recorded usable value is carried back
+	* ({@link withRecordedCatalogId}), so a `drift --revert` built from this
+	* snapshot addresses the catalog it was read from.
 	*
 	* Returns `undefined` when the resource is gone (`EntityNotFoundException`).
 	* Other Glue resource types (`Job`, `Crawler`, `Connection`, `Trigger`,
@@ -52170,8 +52477,14 @@ var GlueProvider = class {
 	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
 		const catalogId = catalogIdForApi(properties?.["CatalogId"]);
 		switch (resourceType) {
-			case "AWS::Glue::Database": return this.readDatabase(physicalId, catalogId);
-			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId, properties);
+			case "AWS::Glue::Database": {
+				const snapshot = await this.readDatabase(physicalId, catalogId);
+				return snapshot && withRecordedCatalogId(snapshot, properties);
+			}
+			case "AWS::Glue::Table": {
+				const snapshot = await this.readTable(physicalId, catalogId, properties);
+				return snapshot && withRecordedCatalogId(snapshot, properties);
+			}
 			default: return;
 		}
 	}
@@ -53605,6 +53918,7 @@ function toCfnCrawlerTargets(targets) {
 var GlueConnectionProvider = class {
 	client;
 	providerRegion = ambientRegion();
+	callerAccountId = makeCallerAccountResolver(this.providerRegion);
 	logger = getLogger().child("GlueConnectionProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Connection", /* @__PURE__ */ new Set(["ConnectionInput", "CatalogId"])]]);
 	getClient() {
@@ -53635,14 +53949,36 @@ var GlueConnectionProvider = class {
 			throw new ProvisioningError(`Failed to create Glue Connection ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
-	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Connection ${logicalId}: ${physicalId}`);
 		const connectionInput = properties["ConnectionInput"];
 		if (!connectionInput) throw new ProvisioningError(`ConnectionInput is required for Glue Connection update ${logicalId}`, resourceType, logicalId, physicalId);
-		const catalogId = properties["CatalogId"];
+		refuseNestedRename({
+			resourceType,
+			logicalId,
+			field: "ConnectionInput.Name",
+			noun: "connection",
+			recordedName: physicalId,
+			desiredName: connectionInput["Name"],
+			foldCase: false,
+			consequence: () => `UpdateConnection would address '${physicalId}' with a different name inside its definition, and the state record would keep '${physicalId}' whatever AWS did with it`,
+			stateful: false
+		});
+		await refuseCatalogMove({
+			resourceType,
+			logicalId,
+			noun: "connection",
+			entityName: physicalId,
+			recorded: previousProperties?.["CatalogId"],
+			desired: properties["CatalogId"],
+			stateful: false,
+			callerAccountId: this.callerAccountId,
+			warn: (message) => this.logger.warn(message)
+		});
+		const catalogId = updateCatalogId(properties["CatalogId"]);
 		try {
 			await this.getClient().send(new UpdateConnectionCommand({
-				...catalogId && { CatalogId: catalogId },
+				...catalogId !== void 0 && { CatalogId: catalogId },
 				Name: physicalId,
 				ConnectionInput: buildConnectionInput(connectionInput, physicalId)
 			}));
@@ -53691,7 +54027,7 @@ var GlueConnectionProvider = class {
 			throw err;
 		}
 		if (!conn) return void 0;
-		return { ConnectionInput: {
+		return withRecordedCatalogId({ ConnectionInput: {
 			Name: conn.Name ?? physicalId,
 			ConnectionType: conn.ConnectionType ?? "",
 			Description: conn.Description ?? "",
@@ -53701,7 +54037,7 @@ var GlueConnectionProvider = class {
 			AthenaProperties: conn.AthenaProperties ?? {},
 			PythonProperties: conn.PythonProperties ?? {},
 			PhysicalConnectionRequirements: conn.PhysicalConnectionRequirements ? pickDefined(conn.PhysicalConnectionRequirements) : {}
-		} };
+		} }, properties);
 	}
 	async import(input) {
 		const explicitName = input.knownPhysicalId ?? input.properties["ConnectionInput"]?.["Name"];
@@ -64868,14 +65204,24 @@ async function runDestroyForStack(stackName, state, ctx) {
 	* as the other. The ` / ` join that first replaced it was its own defect:
 	* pasted, it handed the second command to the first as arguments.
 	*/
-	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${pasteableCommand(command, [{
+	const hintCommand = (command, t) => pasteableCommand(command, [{
 		value: t,
-		hole: "stack"
+		hole: "stack",
+		opts: { plainIdent: true }
 	}, {
 		flag: "--stack-region",
 		value: regionForState,
-		hole: "region"
-	}]).command}`))].join("");
+		hole: "region",
+		opts: { plainIdent: true }
+	}]);
+	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${hintCommand(command, t).command}`))].join("");
+	/**
+	* The ONE sentence explaining `hintFor`'s holes, for the prose BEFORE its
+	* lines (go-to-k/cdkd#3759). `hintFor` prints one command per target, so a
+	* per-hole `withheldTargetClause` would repeat once per line; this states the
+	* rule once, and only when the gate actually withheld a value on some line.
+	*/
+	const hintHolesClause = (targets) => targets.every((t) => hintCommand("cdkd state show", t).withheld.length === 0) ? "" : " A target that is not a plain identifier is printed as a quoted '<stack>' or '<region>' placeholder; list the records as stored with 'cdkd state list --long'.";
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
 		return {
@@ -65163,26 +65509,29 @@ async function runDestroyForStack(stackName, state, ctx) {
 		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
 		const guardSuffix = result.guardIndeterminateCount > 0 ? `, ${yellow(result.guardIndeterminateCount)} unverified` : "";
 		if (result.guardIndeterminateCount > 0) {
-			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : `The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run.\nRead them with: ${pasteableCommand("cdkd events", [{
+			const eventsCommand = pasteableCommand("cdkd events", [{
 				value: stackName,
-				hole: "stack"
-			}]).command}`;
-			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
+				hole: "stack",
+				opts: { plainIdent: true }
+			}]);
+			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : "The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run." + withheldTargetClause(eventsCommand, "stack", "cdkd events", "This stack's name") + `\nRead them with: ${eventsCommand.command}`;
+			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].map((t) => plainOrDescribed(t, "logical id")).join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
 		}
-		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${guardSuffix}, ${result.errorCount} errors)`);
-		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
+		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${guardSuffix}, ${result.errorCount} errors)`);
+		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
 		else if (result.errorCount === 0) {
 			const targets = [...skippedStateTargets];
 			const showHint = hintFor("cdkd state show", targets, "Inspect it with");
 			const orphanHint = hintFor("cdkd state orphan", targets, "Drop the record with");
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop the records.` + showHint + orphanHint);
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop the records.` + hintHolesClause(targets) + showHint + orphanHint);
 		} else {
-			const orphanHint = hintFor("cdkd state orphan", failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName], "Drop the record with");
+			const failedTargets = failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName];
+			const orphanHint = hintFor("cdkd state orphan", failedTargets, "Drop the record with");
 			const skippedTargets = [...skippedStateTargets];
 			const skippedClause = skippedTargets.length > 0 ? ` Separately, ${result.skippedCount} resource(s) were SKIPPED — cdkd could not address them, so no delete was issued and they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop their records.` : "";
 			const skippedCommands = hintFor("cdkd state show", skippedTargets, "Inspect it with") + hintFor("cdkd state orphan", skippedTargets, "Drop the record with");
 			const dedupedCommands = (lines) => [...new Set(lines.split("\n").filter((l) => l !== ""))].map((l) => `\n${l}`).join("");
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.` + skippedClause + dedupedCommands(orphanHint + skippedCommands));
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${plainOrDescribed(stackName, "stack name")} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.` + skippedClause + hintHolesClause([...failedTargets, ...skippedTargets]) + dedupedCommands(orphanHint + skippedCommands));
 		}
 	} finally {
 		try {
@@ -65297,16 +65646,18 @@ function getCurrentNestedStackContext() {
 * prevent. `tests/unit/provisioning/nested-stack-provider.test.ts` pins that
 * property against the union of both phrase sets.
 *
-* @param childStackName the child's `<parent>~<childLogicalId>` state key
+* @param childStackName the child's `<parent>~<childLogicalId>` state key as
+*   the PROSE may print it — the caller passes it through `plainOrDescribed`,
+*   since this leaf cannot import it (go-to-k/cdkd#3759)
 * @param errorCount     resources in the child that failed to delete
 * @param alsoSkippedCount resources the child SKIPPED (no AWS call issued)
 * @param alsoInterrupted  whether the child's destroy was also interrupted
 */
-function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand) {
+function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand, holeNote = "") {
 	const extra = [];
 	if (alsoSkippedCount > 0) extra.push(`${alsoSkippedCount} resource(s) were also skipped`);
 	if (alsoInterrupted) extra.push("the child destroy was also interrupted");
-	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + `. The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable.\nInspect it with: ${inspectCommand}`;
+	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + ". The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable." + holeNote + `\nInspect it with: ${inspectCommand}`;
 }
 
 //#endregion
@@ -65483,10 +65834,12 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
 		if (childResult.errorCount > 0) {
-			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted, pasteableCommand("cdkd state show", [{
+			const inspect = pasteableCommand("cdkd state show", [{
 				value: childStackName,
-				hole: "stack"
-			}]).command));
+				hole: "stack",
+				opts: { plainIdent: true }
+			}]);
+			const failure = new Error(nestedStackChildFailureMessage(plainOrDescribed(childStackName, "stack name"), childResult.errorCount, childResult.skippedCount, childResult.interrupted, inspect.command, withheldTargetClause(inspect, "stack", "cdkd state show", "The child stack's name")));
 			throw childResult.interrupted ? markNonRetryable(failure) : failure;
 		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
@@ -68983,17 +69336,38 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * and the user should re-synth, exactly as `NestedStackProvider` would
 * fail at deploy time.
 */
+/**
+* The template's `Resources` entries whose logical id the state already
+* records — the only rows that can diff as an UPDATE. Own keys only, and
+* tolerant of a malformed section, since it feeds a prefetch that must never
+* throw.
+*/
+function recordedTemplateResources(template, state) {
+	const recorded = nullPrototypeRecord();
+	const resources = template.Resources;
+	const stateResources = state.resources;
+	if (resources === null || typeof resources !== "object" || stateResources === null || typeof stateResources !== "object") return recorded;
+	for (const [logicalId, resource] of Object.entries(resources)) if (Object.prototype.hasOwnProperty.call(stateResources, logicalId)) recorded[logicalId] = resource;
+	return recorded;
+}
 async function buildDiffTree(args) {
 	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths, isNestedChild } = args;
 	const { state, unreadable, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend);
+	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
-		...parameters && { parameters },
-		...canonicalizeProperties && { canonicalizeProperties },
-		...cfnFallback !== void 0 && { cfnFallback },
-		...previewOrphanAdoption && { previewOrphanAdoption },
-		inheritSecretBearingTemplate: false
-	});
+	let stackDiff;
+	try {
+		stackDiff = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+			...parameters && { parameters },
+			...canonicalizeProperties && { canonicalizeProperties },
+			...cfnFallback !== void 0 && { cfnFallback },
+			...previewOrphanAdoption && { previewOrphanAdoption },
+			inheritSecretBearingTemplate: false
+		});
+	} finally {
+		createOnlyPrefetch.cancel();
+	}
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals } = stackDiff;
 	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
 		...state,
 		resources: {
@@ -77522,14 +77896,16 @@ async function destroyCommand(stackArgs, options) {
 				else stackTargetRegion = onlyRegion;
 			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
 			else {
-				const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.\nRemove one record with: ${pasteableCommand("cdkd state orphan", [{
+				const regions = refs.map((r) => r.region === void 0 ? "(legacy)" : plainOrDescribed(r.region, "region")).join(", ");
+				const orphanOne = pasteableCommand("cdkd state orphan", [{
 					value: stackName,
-					hole: "stack"
+					hole: "stack",
+					opts: { plainIdent: true }
 				}, {
 					flag: "--stack-region",
 					hole: "region"
-				}]).command}`);
+				}]);
+				throw new Error(`Stack ${quotedOrDescribed(stackName, "stack name")} has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.` + withheldTargetClause(orphanOne, "stack", "cdkd state orphan", "This stack's name") + `\nRemove one record with: ${orphanOne.command}`);
 			}
 			const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
 			if (!stateResult) {
@@ -79152,7 +79528,7 @@ async function resolveIdentifierValue(entry, ctx, deps) {
 		return entry.resolve(ctx);
 	} catch (stateOnlyError) {
 		if (entry.backfill && deps) return await entry.backfill(ctx, deps);
-		if (carriesSecretMask(ctx.attributes[entry.field])) throw new Error(maskedIdentifierAttributeReason(entry.field, ctx.logicalId));
+		if (carriesSecretMask(ctx.attributes[entry.field])) throw new RepairableRefusal(maskedIdentifierAttributeReason(entry.field, ctx.logicalId), importRepairCommand(ctx.logicalId));
 		throw stateOnlyError;
 	}
 }
@@ -79167,25 +79543,19 @@ async function resolveIdentifierValue(entry, ctx, deps) {
 * today and would never stop being blocked by a re-import.
 */
 function maskedIdentifierAttributeReason(field, logicalId) {
-	return `cdkd state holds only the redaction mask ('***') at attributes.${field} for ${isPasteableIdent(logicalId) ? logicalId : `this resource (its logical id is not a plain identifier; read it with 'cdkd state show')`}, and that attribute is the value cdkd export reads as this resource type's CloudFormation import identifier (${field}); nothing masked may reach the exported template, since CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. The mask is what 'cdkd import' writes for a Cloud Control model key it could not certify as read-only — every key when cloudformation:DescribeType was unavailable. Re-deploying does NOT clear it. Repair the record with the command below, after granting cloudformation:DescribeType, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.\nRepair with: ${importRepairCommand(logicalId)}`;
+	return `cdkd state holds only the redaction mask ('***') at attributes.${field} for ${isPasteableIdent(logicalId) ? logicalId : `this resource (its logical id is not a plain identifier; read it with 'cdkd state show')`}, and that attribute is the value cdkd export reads as this resource type's CloudFormation import identifier (${field}); nothing masked may reach the exported template, since CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. The mask is what 'cdkd import' writes for a Cloud Control model key it could not certify as read-only — every key when cloudformation:DescribeType was unavailable. Re-deploying does NOT clear it. Repair the record with the command below, after granting cloudformation:DescribeType, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.`;
 }
 /**
-* The `cdkd import` line `maskedIdentifierAttributeReason` tells the operator
-* to run.
+* The `cdkd import` command a redaction-mask refusal carries in
+* {@link BlockedResource.repair}, which `groupBlockedReasons` prints on the
+* row's one `Repair with:` line.
 *
-* It is a named helper for ONE caller on purpose. A SECOND site prints the same
-* remedy — `buildImportPlan`'s resolved-identifier refusal — written
-* independently, and it still carries go-to-k/cdkd#3363's shape: a prose
-* `'...'` span holding a `cdkd` verb AND an interpolation, its opening quote in
-* one concatenated literal and its interpolation in the next. The source fence
-* found it only once its `+` runs were folded; a grep for the gate's name never
-* would have.
-*
-* That site is NOT routed here, deliberately: `export.ts` is one of the
-* go-to-k/cdkd#3436 own-copy gates the maintainer asked to land in a follow-up
-* PR rather than widen go-to-k/cdkd#3613. The fence carries an EXEMPTION naming
-* it, so this helper gains its second caller in the PR that closes the site —
-* and the exemption goes stale in the same commit.
+* Two refusals carry this remedy, and both build it here so there is one
+* spelling of its gate: `resolveIdentifierValue`'s masked-attribute refusal
+* (a `RepairableRefusal` beside `maskedIdentifierAttributeReason`'s prose) and
+* `buildImportPlan`'s resolved-identifier refusal (go-to-k/cdkd#3736). The
+* second used to spell it independently inside a prose `'...'` span with the
+* logical id interpolated (go-to-k/cdkd#3363's shape).
 *
 * The POSITIONAL is a hole on purpose, and the load-bearing half is what it is
 * NOT: an earlier cut passed the LOGICAL ID there, producing a command that
@@ -79193,11 +79563,10 @@ function maskedIdentifierAttributeReason(field, logicalId) {
 * check can see that — both spellings are equally well-formed to one — and only
 * reading the command can.
 *
-* It is a hole rather than a name because its caller,
-* {@link maskedIdentifierAttributeReason}, has no stack name in scope at all.
-* (`buildImportPlan` does have one, so when that site joins this helper it
-* could fill it — a separate change with its own gating question, and not a
-* reason to grow two spellings here.)
+* It is a hole rather than a name because one caller,
+* `resolveIdentifierValue`, has no stack name in scope at all.
+* (`buildImportPlan` does have one, but filling it is a separate gating
+* question, and a second spelling here is what this helper exists to avoid.)
 */
 function importRepairCommand(logicalId) {
 	const named = isPasteableIdent(logicalId);
@@ -79677,6 +80046,19 @@ async function assertCfnStackAbsent(cfnClient, stackName) {
 	}
 }
 /**
+* A resolver refusal that carries a repair command, so the `buildImportPlan`
+* catch can move it into {@link BlockedResource.repair} instead of the
+* message text.
+*/
+var RepairableRefusal = class extends Error {
+	repair;
+	constructor(message, repair) {
+		super(message);
+		this.name = "RepairableRefusal";
+		this.repair = repair;
+	}
+};
+/**
 * Returns true when a resource type is non-importable BUT can be handled
 * by the phase-2 CREATE path. Today this is exactly `Custom::*` and the
 * untyped CDK form `AWS::CloudFormation::CustomResource` (both are
@@ -80183,7 +80565,8 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: "could not resolve resource identifier: " + (err instanceof Error ? err.message : String(err))
+				reason: "could not resolve resource identifier: " + (err instanceof Error ? err.message : String(err)),
+				...err instanceof RepairableRefusal ? { repair: err.repair } : {}
 			});
 			continue;
 		}
@@ -80192,7 +80575,8 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 			blocked.push({
 				logicalId,
 				resourceType,
-				reason: `the CloudFormation import identifier cdkd resolved for this resource is the redaction mask ('***'), so the exported template would declare the mask as the resource's identity — CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. cdkd state holds only the mask where the identifier should be (a masked attribute, or a masked physical id). Repair the record ('cdkd import <stack> --resource ${logicalId}=<physicalId> --force', granting cloudformation:DescribeType first if the import warned that it could not read the schema), or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.`
+				reason: "the CloudFormation import identifier cdkd resolved for this resource is the redaction mask ('***'), so the exported template would declare the mask as the resource's identity — CloudFormation would either refuse it at IMPORT or write it onto the live resource at the next update. cdkd state holds only the mask where the identifier should be (a masked attribute, or a masked physical id). Repair the record with the command below, granting cloudformation:DescribeType first if the import warned that it could not read the schema, or export the stack without this resource and adopt it into CloudFormation by hand. See https://github.com/go-to-k/cdkd/issues/2932.",
+				repair: importRepairCommand(logicalId)
 			});
 			continue;
 		}
@@ -80241,10 +80625,29 @@ function groupBlockedReasons(blocked) {
 			resourceType: b.resourceType,
 			reasons: []
 		};
-		entry.reasons.push(b.reason);
+		const text = displaySafe(b.reason);
+		entry.reasons.push(b.repair === void 0 ? text : `${text}\nRepair with: ${b.repair}`);
 		byResource.set(b.logicalId, entry);
 	}
-	return [...byResource].map(([logicalId, { resourceType, reasons }]) => reasons.length === 1 ? `  - ${logicalId} (${resourceType}): ${reasons[0]}` : `  - ${logicalId} (${resourceType}):\n${reasons.map((r) => `      - ${r}`).join("\n")}`);
+	return [...byResource].map(([logicalId, { resourceType, reasons }]) => {
+		const header = `${blockedRowId(logicalId)} (${blockedRowType(resourceType)})`;
+		return reasons.length === 1 ? `  - ${header}: ${reasons[0]}` : `  - ${header}:\n${reasons.map((r) => `      - ${r}`).join("\n")}`;
+	});
+}
+/**
+* A blocked row's identifiers come from the synthesized template's keys and
+* print beside reasons that end in a labelled `Repair with:` line, so the row
+* names them only in a shape that cannot forge that line — by a newline, or by
+* interior padding that wraps on screen (go-to-k/cdkd#3736). A CloudFormation
+* logical id is always a plain identifier, and a type always matches
+* `BLOCKED_ROW_TYPE`, so a real template loses nothing.
+*/
+function blockedRowId(logicalId) {
+	return isPasteableIdent(logicalId) ? logicalId : "a resource whose logical id is not a plain identifier";
+}
+const BLOCKED_ROW_TYPE = /^[A-Za-z0-9]+(?:::[A-Za-z0-9_@-]+)+$/;
+function blockedRowType(resourceType) {
+	return BLOCKED_ROW_TYPE.test(resourceType) ? resourceType : "an unrecognized type";
 }
 /**
 * Build the `ResourceIdentifier` map CloudFormation IMPORT expects in
@@ -99291,4 +99694,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-WCBWtvb0.js.map
+//# sourceMappingURL=program-DP27UiVh.js.map