@go-to-k/cdkd 0.291.7 → 0.291.9

package/dist/{deploy-engine-Gl-b_bNn.js → deploy-engine-TkL9nyq8.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-oHfbqdBD.js";
+import { t as getCdkdVersion } from "./version-RzKz4JAW.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1230,6 +1230,182 @@ function isUpdateUnsupportedError(error, logicalId) {
 	return false;
 }
 
+//#endregion
+//#region src/utils/pasteable-command.ts
+/**
+* The way cdkd builds a `cdkd ...` command it tells an operator to PASTE.
+*
+* Thirteen message modules route through it today. The CATEGORIES it does not
+* cover yet are at the end of this header — categories, not a census: the
+* population is what go-to-k/cdkd#3436's greps return against the tree of the
+* day, and a list here would be read as complete and go stale.
+*
+* go-to-k/cdkd#3363 measured the class this module closes, and
+* [#3436](https://github.com/go-to-k/cdkd/issues/3436) records it repo-wide.
+* Three shapes, each of which a per-site discipline kept re-introducing:
+*
+* 1. **A command inside prose quotes.** `drop it whole with '<command>'` puts
+*    the command in a `'...'` span, so an interpolated value carrying `'`
+*    CLOSES that wrapper when the span is pasted WITH its quotes and the rest
+*    runs as shell: `'cdkd state orphan S --state-bucket 'b; printf X; #''`
+*    printed `X`. Quoting the value does not help — the wrapper is what
+*    inverts. So a command is printed UNWRAPPED on its own labelled line, and
+*    this module returns the text for exactly that.
+*
+*    **UNWRAPPED always; LAST only when the message prints ONE command.** A
+*    message offering a READ and a DESTRUCTIVE template prints one command per
+*    LINE, and there the read ends a line while the TEMPLATE is last — the
+*    rule `.claude/rules/state-malformed-containers.md` states for
+*    go-to-k/cdkd#3516, and a shape this module already serves twice:
+*    `deploy-engine.ts`'s `Inspect it with:` / `Drop the record with:` pair,
+*    and `destroy-runner.ts`'s through `hintFor`. In both, the read command is
+*    correctly NOT last. Collapsing such a pair onto one line is the defect
+*    that rule names: the read must end a line, and the template must be last
+*    with no substituted value after it.
+* 2. **A bare `<placeholder>`.** `<name>` is two redirections, not a word:
+*    `<name` reads stdin from a file and `>` truncates whatever word follows.
+*    {@link commandHole} quotes it, so it pastes as one literal argument.
+* 3. **A value whose quote context the PROSE already flipped.** An English
+*    apostrophe earlier in the sentence (`this stack's name`) opens a shell
+*    quote that closes at the value's own opening quote, leaving the value
+*    bare. This module cannot reach that one — a value in prose is not a
+*    command — which is why the rule it belongs to is "a shell-quoted value
+*    goes on a labelled trailing line, never inside a sentence", and why
+*    deleting apostrophes is NOT the remedy (the next sentence re-opens it).
+*
+* What this module owns is the ARGUMENT side of shape 1 and shape 2: every
+* user-controlled value is sanitized, gated on rendering EXACTLY, and either
+* shell-quoted or replaced by a quoted hole. A value sanitizing would ALTER is
+* never printed in its altered spelling — that addresses a DIFFERENT record
+* than the message means — and never silently dropped, which would resolve the
+* ambient default instead.
+*
+* {@link shellQuote} and {@link commandHole} live here rather than in
+* `../state/lock-contention-message.js`, which still re-exports them for its
+* own callers: `src/utils/**` imports nothing from `src/state/**`, so the
+* shared helper could not reach them the other way round.
+*
+* ## The CATEGORIES not covered yet, as of go-to-k/cdkd#3436's first half
+*
+* Re-derive the members with that issue's greps rather than trusting a list:
+* these are kinds of site, and each kind has more members than the examples.
+*
+* - **Its own copy of the gate.** `buildForceUnlockCommand`
+*   (`state/lock-contention-message.ts`), the `cdkd orphan` properties refusal
+*   (`state/malformed-resources-bag.ts`), `orphanCommandFor` (`cli/commands/
+*   export.ts`), and others in `deployment/deploy-engine.ts`,
+*   `deployment/rollback-executor.ts` and `cli/commands/gc.ts`. They behave the
+*   same way; they are not this function, so a rule change reaches them only by
+*   hand.
+* - **A command in prose quotes with a RAW value**, outside the modules
+*   migrated here — `provisioning/providers/**` (S3 Tables, Route 53, DynamoDB),
+*   `cli/config-loader.ts` and `cli/commands/orphan.ts` are where the greps land
+*   today.
+* - **The `cdkd drift` sites of
+*   [#3307](https://github.com/go-to-k/cdkd/issues/3307)**, which take their own
+*   gate in that PR. Note a `cdkd drift` command also appears OUTSIDE that file.
+* - **A spelled-out template or usage synopsis printing a BARE `<hole>`**, and
+*   the source fence that would find them.
+*/
+/**
+* Quote a value for a pasteable shell command.
+*
+* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
+* prints `aws <service> ...` recovery commands naming a resource's physical id,
+* which is the same hazard one directory over. A second spelling of this
+* predicate is how the two would come to disagree about which values need
+* quoting -- the reason `display-safe.ts`'s header gives for not widening a
+* rule by hand. It is a pure function of its argument and imports nothing.
+*/
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* A placeholder for a value a pasteable command could not name, QUOTED.
+*
+* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
+* reads stdin from a file named `profile` and `>` sends stdout to whatever
+* word follows. While the hole was the command's LAST word that was only a
+* syntax error; with flags appended after it (`--profile <profile>
+* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
+* redirect target and `b` as the profile — a delete against the ambient
+* bucket, with nothing printed (measured by the maintainer, M4 of the
+* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
+* nothing else — no redirection, no swallowed flag. It is not refused: an
+* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
+* `<prefix>`).
+*/
+function commandHole(name) {
+	return `'<${name}>'`;
+}
+/**
+* WHY a value must become a hole, or `undefined` when it may be NAMED.
+*
+* FIRST MATCH WINS, in the order written: `empty`, `altered`, `too-long`,
+* `option-shaped`, `pattern-shaped` (m21 of the go-to-k/cdkd#3499 review). A
+* value can satisfy several — `-\u001b[x` is both option-shaped and altered —
+* and the caller renders ONE sentence, so the order decides which. It runs
+* cheapest-and-most-fundamental first: a value that does not survive rendering
+* cannot be reasoned about as a command argument at all, so saying "this would
+* be read as an option" about a spelling that is not what is stored would be
+* the more misleading of the two true sentences. The order is also the order
+* the two functions this replaced already applied, which is what keeps the
+* refactor behaviour-preserving.
+*/
+function withholdReason(value, opts) {
+	if (value === "") return "empty";
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (safe !== value) return "altered";
+	if (truncateCodePoints(safe, 1152).truncated) return "too-long";
+	if (value.startsWith("-")) return "option-shaped";
+	if (opts?.patternMatched === true && (value.includes("*") || value.includes("/"))) return "pattern-shaped";
+}
+/**
+* Build a pasteable `cdkd` command: every user-controlled value shell-quoted
+* behind an exactness gate, every placeholder quoted, nothing wrapped.
+*
+* `extraFlags` is where a caller appends the flags that pin the command to its
+* own account and key space — in practice `recoveryCommandFlags(recovery)`,
+* whose `exact` the caller folds into its own decision. They are appended
+* verbatim, LAST, because they are built by the same rules one layer up.
+*/
+function pasteableCommand(verb, args = [], extraFlags = []) {
+	let exact = true;
+	const withheld = [];
+	const parts = [verb];
+	for (const arg of args) {
+		if ("literal" in arg) {
+			parts.push(arg.literal);
+			continue;
+		}
+		if (!("value" in arg)) {
+			if ("flag" in arg) parts.push(arg.flag);
+			parts.push(commandHole(arg.hole));
+			exact = false;
+			continue;
+		}
+		const reason = withholdReason(arg.value, arg.opts);
+		let rendered;
+		if (reason === void 0) rendered = shellQuote(arg.value);
+		else {
+			rendered = commandHole(arg.hole);
+			exact = false;
+			withheld.push({
+				hole: arg.hole,
+				reason
+			});
+		}
+		if ("flag" in arg) parts.push(arg.flag);
+		parts.push(rendered);
+	}
+	parts.push(...extraFlags);
+	return {
+		command: parts.join(" "),
+		exact,
+		withheld
+	};
+}
+
 //#endregion
 //#region src/utils/error-handler.ts
 /**
@@ -1736,14 +1912,18 @@ var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError exte
 * redeploy, then retry the destroy. A future `--remove-protection`
 * flag (separate scope) will provide an explicit one-shot bypass.
 *
-* Note: `cdkd state destroy` (state-only, no synth) does NOT honor
+* Note: `cdkd state destroy` (the synth-free destroy) does NOT honor
 * `terminationProtection` — the flag is a CDK property not persisted
 * in cdkd's state.json. Use `cdkd destroy` when synth is available.
 */
 var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
 	stackName;
 	constructor(stackName, cause) {
-		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry 'cdkd destroy ${stackName}'.`, "STACK_TERMINATION_PROTECTION", cause);
+		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry the destroy.\nRetry with: ${pasteableCommand("cdkd destroy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`, "STACK_TERMINATION_PROTECTION", cause);
 		this.stackName = stackName;
 		this.name = "StackTerminationProtectionError";
 		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
@@ -1773,8 +1953,11 @@ var StackTerminationProtectionError = class StackTerminationProtectionError exte
 *  1. `cdkd destroy <parent>` — the normal cascading-destroy path; the
 *     parent's reverse-DAG walks into the child via
 *     `NestedStackProvider.delete` and removes both layers atomically.
-*  2. `cdkd state destroy <child>` — state-only destroy with no parent
-*     coupling check. The state-driven entry point intentionally
+*  2. `cdkd state destroy <child>` — the SYNTH-FREE destroy, with no parent
+*     coupling check. It deletes the child's AWS resources and then its
+*     record; "state-only" named the wrong thing, and this message's own text
+*     was corrected away from that reading (go-to-k/cdkd#3499 review nits).
+*     `cdkd state orphan` is the record-only command. The state-driven entry point intentionally
 *     bypasses this guard for the same reason `cdkd state destroy`
 *     bypasses `terminationProtection`: it's the "I know what I'm
 *     doing" path for cleaning up state when synth is unavailable or
@@ -1786,7 +1969,16 @@ var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyErro
 	parentLogicalId;
 	constructor(stackName, parentStack, parentLogicalId, cause) {
 		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${parentLogicalId})` : "";
-		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either run 'cdkd destroy ${parentStack}' to cascade-delete this child along with its parent, or run 'cdkd state destroy ${stackName}' if you intentionally want to leave the parent's reference dangling (the state-only escape hatch).`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
+		const cascadeCommand = pasteableCommand("cdkd destroy", [{
+			value: parentStack,
+			hole: "parent",
+			opts: { patternMatched: true }
+		}]).command;
+		const childDestroyCommand = pasteableCommand("cdkd state destroy", [{
+			value: stackName,
+			hole: "stack"
+		}]).command;
+		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either cascade-delete this child along with its parent, or destroy the child on its own — which deletes its AWS resources and its record, and leaves the parent's reference dangling (the synth-free escape hatch).\nCascade-delete with: ${cascadeCommand}\nDestroy the child alone with: ${childDestroyCommand}`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
 		this.stackName = stackName;
 		this.parentStack = parentStack;
 		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
@@ -3165,6 +3357,86 @@ function assemblyPathEscape(base, bound, candidate) {
 	return resolved;
 }
 /**
+* A letter or digit that neither draws as a blank nor reads as a quote.
+* `\p{L}` alone admits both, so two classes are carved out: the
+* default-ignorables, which hold letters that draw as a blank (the Hangul
+* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
+* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
+* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
+* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
+* an ordinary character of a Japanese directory name.
+*/
+const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
+/**
+* A combining mark, which counts only DIRECTLY after a visible letter (or a
+* mark that itself counted): on a space or on punctuation it draws on its own,
+* and U+030B / U+030E there look like a quote.
+*/
+const COMBINING_MARK = /^\p{M}$/u;
+/**
+* The ASCII a bare path may carry besides letters and digits. Everything else —
+* any whitespace, any quote, any other symbol — takes the boundary, which
+* costs a legitimate path nothing but a pair of quotes.
+*/
+const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
+/**
+* Classify each code point: `bare` (allowed in a bare path), `shown` (shown as
+* itself inside the boundary), or `escaped`. An ALLOWLIST, because a denylist
+* has to enumerate every character that draws as a blank or reads as a quote,
+* and JS `\s` alone already misses U+2800 and U+3164.
+*
+* Each test is ONE character and this walks the value — never `^(...)+$` over
+* the whole of it: alternatives that overlap (ASCII letters are in both
+* classes) under a quantifier backtrack exponentially on a long path that
+* fails near its end, which hangs the process uncatchably.
+*/
+function classify(chars) {
+	let afterLetter = false;
+	return chars.map((ch) => {
+		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
+		afterLetter = VISIBLE_LETTER.test(ch);
+		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
+		return ch >= " " && ch <= "~" ? "shown" : "escaped";
+	});
+}
+/**
+* Render a filesystem path that an assembly chose, or that embeds a value it
+* chose, into cdkd's own prose (go-to-k/cdkd#3509). The caller writes NO
+* quotes around the result.
+*
+* `displaySafe` alone is not enough inside quotes of cdkd's: it is a denylist
+* of control characters and passes `'`, so a value carrying one closed cdkd's
+* quote and wrote a clause of its own into the refusal. This keeps a plain path
+* bare and puts any other one inside a JSON string literal. Inside it, `"` and
+* `\` are escaped as JSON escapes them, and so is every character that is
+* neither printable ASCII nor a visible letter — a curly or fullwidth quote
+* that could pass for the boundary's own closing `"`, and a blank that could
+* pass for a space. The result stays valid JSON: `JSON.parse` returns the
+* sanitized value.
+*
+* Deliberately NOT `displayIdent`, which go-to-k/cdkd#3506 used for a Stage
+* path: that one is ASCII-only and capped at 255 code points, and a legitimate
+* path is neither — a non-ASCII directory name would render as spaces, naming
+* a path that does not exist. Here nothing is truncated and a non-ASCII letter
+* is shown as itself. A legitimate path with a space or any symbol outside
+* `/ \ . _ ~ + @ : = -` (`/Users/me/My Project/cdk.out`,
+* `C:\Program Files (x86)\app`) renders quoted, and a non-letter non-ASCII
+* character in it (an emoji, `©`) is shown as its `\u` escape.
+*/
+function displayAssemblyPath(value) {
+	const clean = displaySafe(value);
+	const chars = Array.from(clean);
+	const kinds = classify(chars);
+	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
+	let body = "";
+	chars.forEach((ch, i) => {
+		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
+		else if (kinds[i] !== "escaped") body += ch;
+		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
+	});
+	return `"${body}"`;
+}
+/**
 * The shared tail of every containment refusal: what the value resolved to,
 * what it escaped, and why that means the assembly is not CDK-generated. Each
 * call site supplies its own subject ("Stack 'X' has templateFile='...' which
@@ -3173,23 +3445,25 @@ function assemblyPathEscape(base, bound, candidate) {
 * other than loading the file — `renderNestedTemplateTreeDefect` says "deploy"
 * or "diff", matching its own sibling refusals.
 *
-* Every interpolation goes through `displaySafe` for the reason
-* `AssemblyReader`'s own refusals give (go-to-k/cdkd#3277): this text exists
-* FOR a hand-modified assembly, so the candidate, the resolved path and even
-* `dir` (below a Stage it derives from the manifest's `directoryName`) are all
-* attacker-chosen, and `formatError` sanitizes only an error's `cause`, never
-* its own `message`.
+* Every path goes through {@link displayAssemblyPath}, with no quotes of this
+* function's own, for the reason `AssemblyReader`'s own refusals give
+* (go-to-k/cdkd#3277): this text exists FOR a hand-modified assembly, so the
+* candidate, the resolved path and even `dir` (below a Stage it derives from
+* the manifest's `directoryName`) are all attacker-chosen, and `formatError`
+* sanitizes only an error's `cause`, never its own `message`.
 */
 function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverride) {
 	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
 	const base = path.resolve(dir);
 	const realBase = resolveThroughLinks(base) ?? base;
+	const shownPath = displayAssemblyPath(escape.path);
+	const shownBase = displayAssemblyPath(base);
 	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to '${displaySafe(escape.path)}', a symbolic link to the directory '${displaySafe(base)}' itself rather than to a file inside it. ${provenance}`;
-		return `resolves to '${displaySafe(escape.path)}', which leads through a symbolic link to '${displaySafe(escape.realPath)}', outside '${displaySafe(base)}'. ${provenance}`;
+		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a file inside it. ${provenance}`;
+		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayAssemblyPath(escape.realPath)}, outside ${shownBase}. ${provenance}`;
 	}
-	if (escape.path === base) return `names the directory '${displaySafe(base)}' itself rather than a file inside it. ${provenance}`;
-	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
+	if (escape.path === base) return `names the directory ${shownBase} itself rather than a file inside it. ${provenance}`;
+	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
 }
 
 //#endregion
@@ -7817,12 +8091,25 @@ function formatDockerLoginError(stderr, endpoint) {
 	return trimmed;
 }
 /**
-* Env vars the docker CLI itself reads to decide how / where to run. A resolved
-* ECS secret (or SecureString) whose NAME collides with one of these must NOT
-* override it in the docker client's own process environment: a secret named
-* `DOCKER_HOST` would redirect the client to a different daemon, and `PATH`
-* would break locating the docker binary. See issue
-* https://github.com/go-to-k/cdkd/issues/2183.
+* Env vars the container CLI itself reads to decide how / where to run — the
+* binary {@link getDockerCmd} resolves, i.e. `docker` or whatever `CDK_DOCKER`
+* names (podman / nerdctl / finch). A resolved ECS secret (or SecureString)
+* whose NAME collides with one of these must NOT override it in the client's
+* own process environment: a secret named `DOCKER_HOST` (or podman's
+* `CONTAINER_HOST`) would redirect the client to a different daemon, and `PATH`
+* would break locating the binary. See issues
+* https://github.com/go-to-k/cdkd/issues/2183 and
+* https://github.com/go-to-k/cdkd/issues/2188.
+*
+* RULE for additions: anything a supported container CLIENT (or a credential /
+* connection helper it execs) reads to decide WHAT CODE IT LOADS, WHAT IT
+* TRUSTS, or WHERE / HOW IT CONNECTS. The docker CLI's documented set is kept
+* whole, behaviour toggles included; beyond it, a var that only tunes
+* behaviour (a storage driver, a snapshotter, a temp dir, an experimental
+* toggle) is OUT, because dropping a colliding secret costs the user that
+* secret. The operator's OWN value is never touched — the spawn
+* env starts from `process.env` — so adding a key costs only a secret of that
+* name.
 */
 const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"PATH",
@@ -7864,6 +8151,40 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
 	"AWS_ROLE_ARN",
 	"AWS_EC2_METADATA_SERVICE_ENDPOINT",
+	"AWS_ECR_CACHE_DIR",
+	"CONTAINER_HOST",
+	"CONTAINER_CONNECTION",
+	"CONTAINER_SSHKEY",
+	"PODMAN_CONNECTIONS_CONF",
+	"CONTAINER_PROXY",
+	"CONTAINERS_SSH_CONF",
+	"CONTAINERS_CONF",
+	"CONTAINERS_CONF_OVERRIDE",
+	"CONTAINERS_REGISTRIES_CONF",
+	"CONTAINERS_REGISTRIES_CONF_OVERRIDE",
+	"REGISTRIES_CONFIG_PATH",
+	"CONTAINERS_STORAGE_CONF",
+	"CONTAINERS_STORAGE_CONF_OVERRIDE",
+	"CONTAINERS_POLICY_JSON",
+	"STORAGE_OPTS",
+	"CONTAINERS_HELPER_BINARY_DIR",
+	"REGISTRY_AUTH_FILE",
+	"DBUS_SESSION_BUS_ADDRESS",
+	"NOTIFY_SOCKET",
+	"XDG_CONFIG_HOME",
+	"XDG_RUNTIME_DIR",
+	"APPDATA",
+	"PROGRAMDATA",
+	"PROGRAMFILES",
+	"LOCALAPPDATA",
+	"SSH",
+	"CONTAINERD_ADDRESS",
+	"CONTAINERD_NAMESPACE",
+	"NERDCTL_TOML",
+	"CNI_PATH",
+	"NETCONFPATH",
+	"ROOTLESSKIT_STATE_DIR",
+	"NERDCTL_LOG_FILE",
 	"SSL_CERT_FILE",
 	"SSL_CERT_DIR",
 	"GODEBUG",
@@ -9667,7 +9988,14 @@ function isCrossRegionRedirect(error) {
 */
 async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, accountId, cause) {
 	const want = canonicalizeRegion(expectedRegion);
-	const remedy = `Either bootstrap ${want} with an asset-bucket name unique to it ('cdkd bootstrap --region ${want} --asset-bucket <name>'), or run this against the bucket's own region.`;
+	const remedy = `Either bootstrap ${want} with an asset-bucket name unique to it, or run this against the bucket's own region.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+		flag: "--region",
+		value: want,
+		hole: "region"
+	}, {
+		flag: "--asset-bucket",
+		hole: "name"
+	}]).command}`;
 	let actual;
 	const fromHeader = readBucketRegionHeader(cause);
 	if (fromHeader) actual = canonicalizeRegion(fromHeader);
@@ -9831,7 +10159,11 @@ function parseBootstrapMarker(body, markerKey) {
 * (bucket-squatting defense, design §5).
 */
 async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
-	const rebootstrapHint = `Run 'cdkd bootstrap --region ${region}' to recreate it. cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.`;
+	const rebootstrapHint = `cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.\nRecreate it with: ${pasteableCommand("cdkd bootstrap", [{
+		flag: "--region",
+		value: region,
+		hole: "region"
+	}]).command}`;
 	const clientOpts = {
 		region,
 		...opts.profile && { profile: opts.profile }
@@ -9915,7 +10247,11 @@ async function ensureAssetStorage(options) {
 		const conflicts = [];
 		if (options.assetBucketName && options.assetBucketName !== existingMarker.assetBucket) conflicts.push(`asset bucket '${existingMarker.assetBucket}' (requested '${options.assetBucketName}')`);
 		if (options.containerRepoName && options.containerRepoName !== existingMarker.containerRepo) conflicts.push(`container repo '${existingMarker.containerRepo}' (requested '${options.containerRepoName}')`);
-		if (conflicts.length > 0) throw new CdkdError(`Region '${region}' is already bootstrapped with ${conflicts.join(" and ")}. Changing asset storage names would strand the existing storage and every published asset in it — run 'cdkd bootstrap --destroy --region ${region}' to tear the region's asset storage down first, then re-run bootstrap with the new names.`, "ASSET_STORAGE_NAME_CONFLICT");
+		if (conflicts.length > 0) throw new CdkdError(`Region '${region}' is already bootstrapped with ${conflicts.join(" and ")}. Changing asset storage names would strand the existing storage and every published asset in it — tear the region's asset storage down first, then re-run bootstrap with the new names.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+			flag: "--region",
+			value: region,
+			hole: "region"
+		}]).command}`, "ASSET_STORAGE_NAME_CONFLICT");
 	}
 	const assetBucket = options.assetBucketName ?? existingMarker?.assetBucket ?? getCdkdAssetBucketName(accountId, region);
 	const containerRepo = options.containerRepoName ?? existingMarker?.containerRepo ?? getCdkdContainerRepoName(accountId, region);
@@ -10105,7 +10441,11 @@ var AssetModeResolver = class {
 			}
 			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
 				this.legacyNoticeShownRegions.add(region);
-				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap --region ${region}' to create cdkd-owned asset storage that 'cdk gc' never touches.`);
+				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Create cdkd-owned asset storage that 'cdk gc' never touches:\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+					flag: "--region",
+					value: region,
+					hole: "region"
+				}]).command}`);
 			}
 			return { mode: "legacy" };
 		}
@@ -10165,7 +10505,11 @@ var AssetModeResolver = class {
 			};
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — run 'cdkd bootstrap --region ${region}' (with S3/ECR create permissions) to opt the region in.`);
+			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — opt the region in with S3/ECR create permissions.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+				flag: "--region",
+				value: region,
+				hole: "region"
+			}]).command}`);
 			return null;
 		} finally {
 			s3Client?.destroy();
@@ -11406,19 +11750,6 @@ function formatDuration(ms) {
 	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
 }
 /**
-* Quote a value for a pasteable shell command.
-*
-* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
-* prints `aws <service> ...` recovery commands naming a resource's physical id,
-* which is the same hazard one directory over. A second spelling of this
-* predicate is how the two would come to disagree about which values need
-* quoting -- the reason `display-safe.ts`'s header gives for not widening a
-* rule by hand. It is a pure function of its argument and imports nothing.
-*/
-function shellQuote(value) {
-	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-/**
 * The `cdkd force-unlock ...` line, carrying every flag that decides which
 * lock object it resolves to.
 */
@@ -11432,24 +11763,6 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	return [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`, ...recoveryFlags.flags].join(" ");
 }
 /**
-* A placeholder for a value a pasteable command could not name, QUOTED.
-*
-* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
-* reads stdin from a file named `profile` and `>` sends stdout to whatever
-* word follows. While the hole was the command's LAST word that was only a
-* syntax error; with flags appended after it (`--profile <profile>
-* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
-* redirect target and `b` as the profile — a delete against the ambient
-* bucket, with nothing printed (measured by the maintainer, M4 of the
-* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
-* nothing else — no redirection, no swallowed flag. It is not refused: an
-* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
-* `<prefix>`).
-*/
-function commandHole(name) {
-	return `'<${name}>'`;
-}
-/**
 * The flags that pin a pasteable state command to the caller's account and
 * bucket: `--profile`, the resolved `--state-bucket`, and a NON-default
 * `--state-prefix` (see {@link LockRecoveryContext} for why each is emitted
@@ -16779,6 +17092,40 @@ function hasPlainPrototype(value) {
 	return proto === Object.prototype || proto === null;
 }
 /**
+* Is this a `Date` the value scan may return BY IDENTITY (issue
+* [#2427](https://github.com/go-to-k/cdkd/issues/2427))?
+*
+* The scan redacts what PERSISTS, and `JSON.stringify` persists an unmodified
+* `Date` as `Date.prototype.toJSON`'s ISO timestamp (or `null`) — never its own
+* entries. So the only thing to scan is that timestamp — the walk runs it
+* through the string arms and keeps the `Date` only when they leave it alone —
+* and rebuilding it just threw the timestamp away. "Unmodified" is three
+* conjuncts, each closing a shape whose persisted form is NOT that timestamp:
+* the EXACT prototype, a real `[[DateValue]]` (the `getTime` brand check, which
+* a `Proxy` or an `Object.create(Date.prototype)` fails), and NO own keys — an
+* own `toJSON` (enumerable or not) is what `JSON.stringify` would call instead.
+* No SDK readback or `JSON.parse` produces any of those; they are refused
+* because the identity return must mean exactly "persists as a timestamp".
+*
+* Deliberately NOT "any non-plain object". `JSON.stringify` persists an
+* arbitrary class instance's OWN ENUMERABLE fields, which is exactly what the
+* rebuild scans, so returning one by identity would persist a plaintext held in
+* such a field — a disclosure, traded for fidelity. A `Uint8Array` persists as
+* the same `{"0":...}` either way. The EXACT prototype (not `instanceof`) keeps
+* a `Date` subclass on the rebuild: its prototype can override `toJSON`, which
+* the rebuild drops and identity would honour. A cross-realm `Date` fails the
+* test too, which is the old flattening rather than a leak.
+*/
+function isOrdinaryDate(value) {
+	if (Object.getPrototypeOf(value) !== Date.prototype) return false;
+	try {
+		Date.prototype.getTime.call(value);
+	} catch {
+		return false;
+	}
+	return Reflect.ownKeys(value).length === 0;
+}
+/**
 * Structural equality over the JSON shapes this module walks (issue #2012).
 *
 * Own ENUMERABLE keys only, and a key count on both sides, so an inherited
@@ -17379,21 +17726,22 @@ function asIndex(marks, index) {
 *
 * KEEPING A NON-PLAIN LEAF INTACT takes the prototype guard on the object arm,
 * NOT that leaf rule, and an earlier revision of this comment claimed the
-* opposite — measured wrong. The scan's own walk rebuilds objects and turns a
+* opposite — measured wrong. The scan's own walk rebuilt objects and turned a
 * `Date` the provider readback carries (`LastModified`) into `{}`; that
-* flattening predates this module's derived needles on the POPULATED-map path
-* (issue #2427). The object arm runs FIRST here and `isPlainObject` admits a
-* `Date`, so without `hasPlainPrototype` this walk did the flattening ITSELF —
-* newly extending #2427 to the EMPTY-map path, where the unchanged-resource
-* `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
-* the result to the live resource. With the guard a non-plain leaf falls
-* through to `refused`. That is the position passes' own answer, which is the
-* bag by identity: their object arm carried no prototype guard of its own until
-* issue [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain
-* leaf whose source subtree carries a reference WAS already flattened one
-* function earlier and this guard could only keep a `{}` intact. Both halves
-* are guarded now; the remaining copy of the defect is the VALUE scan's own
-* walk, which is issue #2427 and a different pass.
+* flattening predated this module's derived needles on the POPULATED-map path
+* (issue #2427, since fixed in the scan). The object arm runs FIRST here and
+* `isPlainObject` admits a `Date`, so without `hasPlainPrototype` this walk did
+* the flattening ITSELF — newly extending #2427 to the EMPTY-map path, where
+* the unchanged-resource `drainObservedCaptures` baseline lives and where
+* `cdkd drift --revert` pushes the result to the live resource. With the guard
+* a non-plain leaf falls through to `refused`. That is the position passes' own
+* answer, which is the bag by identity: their object arm carried no prototype
+* guard of its own until issue
+* [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain leaf
+* whose source subtree carries a reference WAS already flattened one function
+* earlier and this guard could only keep a `{}` intact. Both halves are guarded
+* now, and the VALUE scan's own walk keeps a `Date` by identity since issue
+* #2427, so `scanned` holds the same instance.
 *
 * The net effect is byte-identical to the FIRST ordering on every input where
 * the un-certification did not fire — which is the whole point: it keeps that
@@ -17947,6 +18295,12 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
+			if (isOrdinaryDate(value)) {
+				const persisted = value.toJSON();
+				if (typeof persisted !== "string") return value;
+				const scanned = walk(persisted);
+				return scanned === persisted ? value : scanned;
+			}
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
 			return out;
@@ -32368,12 +32722,32 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			throw error;
 		}
 	}
-	/** Lazily-constructed per-region CloudFormation client (issue #1697). */
+	/**
+	* Lazily-constructed per-region CloudFormation client (issue #1697).
+	*
+	* Built with the ambient clients' {@link AwsClients.credentialConfig}, the
+	* way {@link serviceDiscoveryClient} is (issue
+	* [#1983](https://github.com/go-to-k/cdkd/issues/1983)). An explicit
+	* `AwsClientConfig.credentials` has no environment path — only a LIBRARY
+	* caller passes one, and it never runs the CLI's `AWS_PROFILE` mirror — so a
+	* client built from `awsClientDefaults()` alone ran the CFn fallback reads
+	* under the default chain's identity instead. The explicit `credentials`
+	* spread AFTER the defaults, so they outrank an assumed `--role-arn` role,
+	* matching {@link AwsClients}' own spread order.
+	*
+	* Not routed through {@link clientsForRegion}: the region here is always
+	* the one the caller named, never the ambient's, and a test double without
+	* `credentialConfig` degrades to the default chain rather than throwing.
+	* Keyed by region alone for the reason {@link regionScopedClients} gives:
+	* the credential half is process-wide.
+	*/
 	getCfnClient(region) {
 		let client = this.cfnClients[region];
 		if (!client) {
+			const credentialConfig = getAwsClients().credentialConfig ?? {};
 			client = new CloudFormationClient({
-				...awsClientDefaults(),
+				...awsClientDefaults({ profile: credentialConfig.profile }),
+				...credentialConfig,
 				region
 			});
 			this.cfnClients[region] = client;
@@ -35587,7 +35961,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-DqAx9B6g.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D9EJApN9.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -45153,6 +45527,53 @@ function updatePartialMessage(reason) {
 //#endregion
 //#region src/deployment/rollback-executor.ts
 /**
+* Rollback executor (issue #1183).
+*
+* The reusable engine that reverts a list of {@link CompletedOperation}s —
+* extracted from `DeployEngine` so BOTH callers drive identical semantics:
+*
+* - `DeployEngine` runs it in-process after a failed deploy (automatic
+*   rollback, unchanged behavior except the two fixes below).
+* - The standalone `cdkd rollback` command runs it against a persisted
+*   rollback journal (issue #1183 §journal), so a `--no-rollback` /
+*   interrupted / partially-failed-auto-rollback deploy can be reverted
+*   later.
+*
+* The executor deliberately depends only on `ProviderRegistry`, the stack
+* region, a logger, and an optional event recorder + per-op state-save
+* hook. It does NOT touch `DagBuilder` / `DiffCalculator` / the synthesizer
+* / `ExportIndexStore`, so the command can construct it without any of the
+* engine's synth-side collaborators (rollback never publishes
+* outputs/exports).
+*
+* Two deliberate behavior fixes vs. the pre-extraction in-process path
+* (both are pre-existing gaps; fixing them once benefits both callers):
+*
+* 1. **DeletionPolicy on CREATE rollback** — rolling a CREATE back IS a
+*    delete as far as the policy is concerned (CloudFormation semantics), so
+*    the CURRENT state record's `DeletionPolicy` decides what happens:
+*    - `Retain` → ORPHANED (removed from state, left in AWS). The policy
+*      says KEEP the resource, so cdkd does.
+*    - `Snapshot` → final snapshot, THEN delete (issue #1358), through the
+*      same mechanism matrix as the deploy engine's
+*      `prepareFinalSnapshotForDelete`: atomic delete parameter for the
+*      SDK-routed `ATOMIC_FINAL_SNAPSHOT_TYPES`, an explicit pre-delete
+*      snapshot for `PRE_DELETE_SNAPSHOT_TYPES`, refusal for every other
+*      Snapshot shape (cc-api routing included) unless
+*      `--skip-final-snapshot` opts into the data loss. This arm ORPHANED
+*      alongside `Retain` until #1358: when this file was written cdkd could
+*      not create a final snapshot at all, so leaving the resource behind
+*      was the only non-destructive option — but it silently handed the user
+*      an untracked, billing resource that state no longer knew about.
+*      `src/provisioning/final-snapshot.ts` (#1352 / #1353) removed the
+*      constraint, so the policy is now honored literally.
+*    - `RetainExceptOnCreate` (which exists precisely to allow cleanup of
+*      failed creates) and absent / `Delete` → DELETE.
+* 2. **Idempotent replay skip rules** — so a partially-failed rollback can
+*    be re-run safely (also harmless for the in-process caller, which
+*    replays each op exactly once).
+*/
+/**
 * Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762): turn a
 * `{ outcome: 'skipped' }` delete into a thrown error at every rollback delete
 * arm.
@@ -46479,7 +46900,14 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					createLayer: createProvisionedBy
 				}) && !deletedNewFirst && createResult.physicalId === current.physicalId;
 				if (adoptedLiveNewResource) {
-					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so run 'cdkd drift ${stackName}' to inspect and 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.`);
+					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so inspect the drift and run 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.\nInspect it with: ${pasteableCommand("cdkd drift", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: ctx.region,
+						hole: "region"
+					}]).command}`);
 					result.warnings++;
 				}
 				const { observedProperties: _staleObserved, ...prevRecord } = prev;
@@ -48207,27 +48635,6 @@ var DeployEngine = class DeployEngine {
 		const foreignReads = reads.filter((read) => !isLocal(read));
 		const hasRefStateRead = reads.some((read) => read.kind === "ref-state-key" && isLocal(read));
 		/**
-		* A logical id rendered inside the single-quoted command below.
-		*
-		* cdkd validates no logical-id charset, so the id can contain a `'` — and
-		* the line it lands in is meant to be COPY-PASTED into a shell, where an
-		* unescaped one closes the quoting early and the rest of the command
-		* reparses as something else. POSIX single-quote escaping (`'` becomes
-		* `'\\''`) is the fix: close, emit an escaped quote, reopen.
-		*
-		* cdkd never EXECUTES this string — it is advice in an error message — so
-		* this is about the pasted command being correct, not about injection into
-		* cdkd itself (issue #2847 round-5 review).
-		*
-		* SINCE go-to-k/cdkd#3435 no id reaching this arm can contain a `'`:
-		* `isPasteableIdent` admits `[A-Za-z0-9][A-Za-z0-9~_.-]*` only, and the
-		* command is not emitted for anything else. Kept anyway rather than
-		* deleted — dropping a guard on the strength of a NEW guard one line up is
-		* how the pair later comes apart, and this one costs a `replaceAll` on a
-		* short string.
-		*/
-		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
-		/**
 		* A logical id rendered as a NAME rather than as a command argument
 		* (go-to-k/cdkd#3435 security round).
 		*
@@ -48242,11 +48649,24 @@ var DeployEngine = class DeployEngine {
 		/** CloudFormation's own logical-id length bound. */
 		const CFN_LOGICAL_ID_MAX_LENGTH = 255;
 		const parts = [];
+		/** Pasteable commands, emitted LAST and one per line (go-to-k/cdkd#3436). */
+		const commandLines = [];
 		if (localTargets.length > 0) {
 			const pasteableHere = (id) => isPasteableIdent(id) && id.length <= CFN_LOGICAL_ID_MAX_LENGTH;
 			const pasteable = localTargets.filter(pasteableHere);
 			const withheld = localTargets.filter((id) => !pasteableHere(id));
-			if (pasteable.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + pasteable.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+			if (pasteable.length > 0) {
+				parts.push(`Re-import the record that HOLDS the mask (command(s) below).`);
+				for (const id of pasteable) commandLines.push(`Re-import with: ${pasteableCommand("cdkd import", [
+					{ hole: "stack" },
+					{
+						flag: "--resource",
+						value: `${id}=<physicalId>`,
+						hole: "resource"
+					},
+					{ literal: "--force" }
+				]).command}`);
+			}
 			if (withheld.length > 0) parts.push(`Re-import the record that HOLDS the mask for ${withheld.map(shown).join(", ")}, but the command is withheld: that is not a plain CloudFormation logical id, so a pasted 'cdkd import <stack> --resource <id>=<physicalId> --force' could be reshaped by the shell or name a different resource. Read the id from 'cdkd state show' and quote it yourself.`);
 		}
 		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.map(shown).join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
@@ -48255,7 +48675,7 @@ var DeployEngine = class DeployEngine {
 			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
 		}
 		if (hasRefStateRead) parts.push("A 'Ref <LogicalId> (state key <Key>)' entry above is CDKD's own read, not one the template can stop making: CloudFormation defines that resource type's Ref value as that state key rather than the physical id, so the record must be repaired (re-import it, or let a deploy create or update the resource) — the \"stop reading it\" remedy does not apply to such an entry.");
-		return parts.join(" ");
+		return [parts.join(" "), ...commandLines].join("\n");
 	}
 	/**
 	* Refuse to provision a resource whose resolution served a REDACTED attribute
@@ -48298,7 +48718,7 @@ var DeployEngine = class DeployEngine {
 	refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const reads = context.redactedAttributeReads;
 		if (reads === void 0 || reads.length === 0) return;
-		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)} If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
+		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)}`, resourceType, logicalId);
 	}
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
@@ -48821,7 +49241,13 @@ var DeployEngine = class DeployEngine {
 				const journal = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
 				if (journal && journal.segments.length > 0) {
 					const failedOnly = journal.segments.every((s) => s.operations.length === 0) && journal.segments.some((s) => (s.failedOperations?.length ?? 0) > 0);
-					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — run 'cdkd rollback ${stackName} --revert-failed' to revert it, or continue deploying to fix forward (a successful deploy clears this note).` : `A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
+					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — revert it, or continue deploying to fix forward (a successful deploy clears this note).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+						value: stackName,
+						hole: "stack"
+					}, { literal: "--revert-failed" }]).command}` : `A previous deploy of '${stackName}' failed or was interrupted. Revert it, or continue deploying to fix forward.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+						value: stackName,
+						hole: "stack"
+					}]).command}`);
 				}
 			} catch {}
 			this.stampReasonlessParameterRefusals(currentState.resources, template);
@@ -49450,7 +49876,10 @@ var DeployEngine = class DeployEngine {
 			return;
 		}
 		await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy);
-		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, run 'cdkd rollback ${stackName} --revert-failed' to revert it.`);
+		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+			value: stackName,
+			hole: "stack"
+		}, { literal: "--revert-failed" }]).command}`);
 	}
 	/** Build the {@link RollbackExecutorContext} from the engine's fields. */
 	rollbackExecutorContext(previousState) {
@@ -50179,7 +50608,21 @@ var DeployEngine = class DeployEngine {
 					const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 					renderer.removeTask(logicalId);
 					this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
-					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first ('cdkd state show ${stackName}' to inspect; for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record with 'cdkd state orphan ${stackName}'.`);
+					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record.\nInspect it with: ${pasteableCommand("cdkd state show", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: this.stackRegion,
+						hole: "region"
+					}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: this.stackRegion,
+						hole: "region"
+					}]).command}`);
 					if (counts) counts.deleteSkipped++;
 					return { deleteSkipped };
 				}
@@ -50837,5 +51280,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, retryClassificationText as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isRetryableTransientError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, markRedactedCause as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, isTransientServerError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isThrottlingError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markNonRetryable as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, describeAwsFailure as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, __exportAll as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isMarkedNonRetryable as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, safeStringify$1 as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-Gl-b_bNn.js.map
+export { yellow as $, markRedactedCause as $a, PARTITION_TABLE as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalStartServiceError as Aa, getLegacyStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StateError as Ba, ssmResolvedValueType as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, ConfigError as Ca, escapeRegExp$1 as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DynamicReferenceRegionAmbiguousError as Da, Synthesizer as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DeployCancelledError as Ea, getDockerImageBySourceHash as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, ProvisioningError as Fa, resolveStateBucketWithDefault as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, withErrorHandling as Ga, uploadCfnTemplate as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, formatError as Ha, CFN_TEMPLATE_URL_LIMIT as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ResourceTimeoutError as Ia, resolveStateBucketWithDefaultAndSource as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, isMarkedNonRetryable as Ja, injectiveKeyPrefix as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, pasteableCommand as Ka, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceUpdateNotSupportedError as La, resolveUseCdkBootstrapAssets as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, MalformedProducerRecordRefusalError as Ma, resolveAutoAssetStorage as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, NestedStackChildDirectDestroyError as Na, resolveCaptureObservedState as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, IntrinsicResolutionRefusalError as Oa, synthesisStatusMessage as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, PartialFailureError as Pa, resolveSkipPrefix as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, markNonRetryable as Qa, expectedOwnerParam as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, StackHasActiveImportsError as Ra, stateBucketExistenceConfirmed as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, CdkdError as Sa, runDockerStreaming as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, DependencyError as Ta, AssetManifestLoader as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, isCdkdError as Ua, MIGRATE_TMP_PREFIX as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, SynthesisError as Va, CFN_TEMPLATE_BODY_LIMIT as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, normalizeAwsError as Wa, findLargeInlineResources as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, isThrottlingError as Xa, producerRecordKey as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, isRetryableTransientError as Ya, producerCoordinateKey as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, isTransientServerError as Za, decodeListingKey as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, getAwsClients as _a, formatDockerLoginError as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, processStackMessages as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, setAwsClients as ba, redactDockerArgvValues as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasPlainPrototype$1 as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, absoluteAssemblyPathEscape as da, resolveDockerContextDirectory as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, canonicalizeRegion as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, retryClassificationText as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, renderAssemblyPathEscape as fa, warnManifestExecutable as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, AwsClients as ga, dockerSpawnEnvWithSensitive as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, resolveBucketRegion as ha, describeDockerFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, globMatches as ia, isCrossRegionRedirect as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LockError as ja, resolveApp as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, LocalInvokeBuildError as ka, getDefaultStateBucketName as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, nullPrototypeRecord as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, clearBucketRegionCache as ma, describeDockerExecFailure as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssemblyReader as na, ensureAssetStorage as ni, producerRegionsFromState as nn, safeStringify$1 as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, defineOwnKey as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, resolveAssemblyPath as pa, describeDockerCapturedOutput as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, shellQuote as qa, injectiveKey as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, failedStageNote as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, __exportAll as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, hasOwnKey as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, derivePartitionAndUrlSuffix as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, describeAwsFailure as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, ownValue as ua, buildDockerImage as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, resetAwsClients as va, getDockerCmd as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, CrossAccountSecretRefusalError as wa, stripControlChars as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, AssetError as xa, runDockerForeground as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, runWithStackAwsClients as ya, partitionSensitiveEnv as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackTerminationProtectionError as za, warnDeprecatedNoPrefixCliFlag as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-TkL9nyq8.js.map