@go-to-k/cdkd 0.291.7 → 0.291.9

package/dist/{program-Cy-pVgf_.js → program-CY92mXcX.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-Gl-b_bNn.js";
+import { $ as yellow, $a as markRedactedCause, $i as PARTITION_TABLE, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalStartServiceError, Ai as getLegacyStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Bi as ssmResolvedValueType, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ci as escapeRegExp, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DynamicReferenceRegionAmbiguousError, Di as Synthesizer, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as DeployCancelledError, Ei as getDockerImageBySourceHash, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as ProvisioningError, Fi as resolveStateBucketWithDefault, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as withErrorHandling, Gi as uploadCfnTemplate, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Hi as CFN_TEMPLATE_URL_LIMIT, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ResourceTimeoutError, Ii as resolveStateBucketWithDefaultAndSource, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ja as isMarkedNonRetryable, Ji as injectiveKeyPrefix, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as pasteableCommand, Ki as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceUpdateNotSupportedError, Li as resolveUseCdkBootstrapAssets, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Ma as MalformedProducerRecordRefusalError, Mi as resolveAutoAssetStorage, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as NestedStackChildDirectDestroyError, Ni as resolveCaptureObservedState, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as IntrinsicResolutionRefusalError, Oi as synthesisStatusMessage, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as PartialFailureError, Pi as resolveSkipPrefix, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as markNonRetryable, Qi as expectedOwnerParam, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as StackHasActiveImportsError, Ri as stateBucketExistenceConfirmed, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Sa as CdkdError, Si as runDockerStreaming, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ti as AssetManifestLoader, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as MIGRATE_TMP_PREFIX, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Va as SynthesisError, Vi as CFN_TEMPLATE_BODY_LIMIT, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wa as normalizeAwsError, Wi as findLargeInlineResources, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as isThrottlingError, Xi as producerRecordKey, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as isRetryableTransientError, Yi as producerCoordinateKey, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as isTransientServerError, Zi as decodeListingKey, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as getAwsClients, _i as formatDockerLoginError, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as processStackMessages, ai as parseBootstrapMarker, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as setAwsClients, bi as redactDockerArgvValues, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasPlainPrototype, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as absoluteAssemblyPathEscape, di as resolveDockerContextDirectory, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as canonicalizeRegion, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as retryClassificationText, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as renderAssemblyPathEscape, fi as warnManifestExecutable, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as AwsClients, gi as dockerSpawnEnvWithSensitive, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, ha as resolveBucketRegion, hi as describeDockerFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as globMatches, ii as isCrossRegionRedirect, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ji as resolveApp, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as LocalInvokeBuildError$1, ki as getDefaultStateBucketName, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as nullPrototypeRecord, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, mi as describeDockerExecFailure, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as AssemblyReader, ni as ensureAssetStorage, nn as producerRegionsFromState, no as safeStringify, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as defineOwnKey, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as resolveAssemblyPath, pi as describeDockerCapturedOutput, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as shellQuote, qi as injectiveKey, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as failedStageNote, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as hasOwnKey, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as derivePartitionAndUrlSuffix, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as describeAwsFailure, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as ownValue, ui as buildDockerImage, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as resetAwsClients, vi as getDockerCmd, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wa as CrossAccountSecretRefusalError, wi as stripControlChars, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xi as runDockerForeground, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as runWithStackAwsClients, yi as partitionSensitiveEnv, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackTerminationProtectionError, zi as warnDeprecatedNoPrefixCliFlag, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-TkL9nyq8.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-oHfbqdBD.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DqAx9B6g.js";
+import { t as getCdkdVersion } from "./version-RzKz4JAW.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-D9EJApN9.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1759,10 +1759,18 @@ async function bootstrapDestroyCommand(options) {
 		if (markerBody === null) {
 			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
 			logger.info(`No bootstrap marker for region '${region}' (${probed}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
-			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive. Re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear it down.`);
+			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+				flag: "--region",
+				value: markerRegionOfKey(siblingKey),
+				hole: "region"
+			}]).command}`);
 			if (!options.includeStateBucket) {
 				if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so it is NOT known whether this region has a marker under another spelling of its name. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}' before re-bootstrapping — re-running 'cdkd bootstrap' while one exists writes a SECOND marker with DEFAULT names, and the next destroy would then tear down that storage while the storage the existing marker names survives.`);
-				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
+				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, recreate the marker and destroy again.\nRecreate it with: ${pasteableCommand("cdkd bootstrap", [{
+					flag: "--region",
+					value: region,
+					hole: "region"
+				}]).command}`);
 				return;
 			}
 		} else marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
@@ -1780,9 +1788,14 @@ async function bootstrapDestroyCommand(options) {
 			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.map((r) => displayIdent(r)).join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
 			if (markerSiblings.sameRegionKeys.length > 0) {
 				const canonicalStillPresent = markerBody !== null && resolvedMarkerKey === markerKey;
-				const listing = markerSiblings.sameRegionKeys.map((k) => canonicalStillPresent ? `  - ${k}` : `  - ${k}  (cdkd bootstrap --destroy --region ${markerRegionOfKey(k)})`).join("\n");
-				const remedy = canonicalStillPresent ? `Run 'cdkd bootstrap --destroy --region ${region}' WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : "Run the command shown against each marker above, then re-run with --include-state-bucket.";
-				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.`, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
+				const listing = markerSiblings.sameRegionKeys.map((k, i) => `  ${i + 1}. ${k}`).join("\n");
+				const teardownCommands = canonicalStillPresent ? "" : markerSiblings.sameRegionKeys.map((k, i) => `\n${i + 1}. Tear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+					flag: "--region",
+					value: markerRegionOfKey(k),
+					hole: "region"
+				}]).command}`).join("");
+				const remedy = canonicalStillPresent ? `Re-run the destroy for this region WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : `Run each command below, then re-run with --include-state-bucket.`;
+				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.` + teardownCommands, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
 			}
 		}
 		const planLines = [];
@@ -1808,7 +1821,11 @@ async function bootstrapDestroyCommand(options) {
 				await stateBackend.purgeNoncurrentVersions([resolvedMarkerKey], { objectDescription: "the bootstrap marker, which names this region's asset bucket and container-asset ECR repository" });
 			}
 			logger.info(`✓ Deleted bootstrap marker (${resolvedMarkerKey})`);
-			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run — re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear that one down too.`);
+			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+				flag: "--region",
+				value: markerRegionOfKey(siblingKey),
+				hole: "region"
+			}]).command}`);
 			if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so a marker under another spelling of this region may still be live. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}'.`);
 			logger.info(`\ncdkd asset storage is now OFF for region ${region}: future deploys in this region fall back to legacy mode (CDK bootstrap destinations) unless the region is bootstrapped again.`);
 		}
@@ -64681,8 +64698,25 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stateTargetFor = (logicalId, resourceType) => resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName;
 	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const failedStateTargets = /* @__PURE__ */ new Set();
-	/** `'cmd A' / 'cmd B'` — the quoted, slash-joined hint both summary arms print. */
-	const hintFor = (command, targets) => targets.map((t) => `'${command} ${t}'`).join(" / ");
+	/**
+	* One labelled line per target — the hint both summary arms print.
+	*
+	* The PROSE quotes are gone, every target goes through the shared gate, and
+	* each command gets its OWN line (go-to-k/cdkd#3436). The old
+	* `'${command} ${t}'` wrapper is the shape whose paste ran an interpolated
+	* value, and this builder was the issue's example of a command the repo-wide
+	* grep cannot see, since neither `'cdkd ` nor the value is on the same line
+	* as the other. The ` / ` join that first replaced it was its own defect:
+	* pasted, it handed the second command to the first as arguments.
+	*/
+	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${pasteableCommand(command, [{
+		value: t,
+		hole: "stack"
+	}, {
+		flag: "--stack-region",
+		value: regionForState,
+		hole: "region"
+	}]).command}`))].join("");
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
 		return {
@@ -64970,21 +65004,26 @@ async function runDestroyForStack(stackName, state, ctx) {
 		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
 		const guardSuffix = result.guardIndeterminateCount > 0 ? `, ${yellow(result.guardIndeterminateCount)} unverified` : "";
 		if (result.guardIndeterminateCount > 0) {
-			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : `Run 'cdkd events ${stackName}' for the RESOURCE_GUARD_INDETERMINATE entries, which name the check and the reason and survive the run.`;
+			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : `The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run.\nRead them with: ${pasteableCommand("cdkd events", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`;
 			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
 		}
 		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${guardSuffix}, ${result.errorCount} errors)`);
 		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
 		else if (result.errorCount === 0) {
 			const targets = [...skippedStateTargets];
-			const showHint = hintFor("cdkd state show", targets);
-			const orphanHint = hintFor("cdkd state orphan", targets);
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json (${showHint}) and re-run, or delete them by hand and drop the records with ${orphanHint}.`);
+			const showHint = hintFor("cdkd state show", targets, "Inspect it with");
+			const orphanHint = hintFor("cdkd state orphan", targets, "Drop the record with");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop the records.` + showHint + orphanHint);
 		} else {
-			const orphanHint = hintFor("cdkd state orphan", failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName]);
+			const orphanHint = hintFor("cdkd state orphan", failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName], "Drop the record with");
 			const skippedTargets = [...skippedStateTargets];
-			const skippedClause = skippedTargets.length > 0 ? ` Separately, ${result.skippedCount} resource(s) were SKIPPED — cdkd could not address them, so no delete was issued and they may still exist in AWS. Fix the physicalId in state.json (${hintFor("cdkd state show", skippedTargets)}) and re-run, or delete them by hand and drop the records with ${hintFor("cdkd state orphan", skippedTargets)}.` : "";
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, ${orphanHint} is the last resort: it removes the state record without deleting AWS resources.` + skippedClause);
+			const skippedClause = skippedTargets.length > 0 ? ` Separately, ${result.skippedCount} resource(s) were SKIPPED — cdkd could not address them, so no delete was issued and they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop their records.` : "";
+			const skippedCommands = hintFor("cdkd state show", skippedTargets, "Inspect it with") + hintFor("cdkd state orphan", skippedTargets, "Drop the record with");
+			const dedupedCommands = (lines) => [...new Set(lines.split("\n").filter((l) => l !== ""))].map((l) => `\n${l}`).join("");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.` + skippedClause + dedupedCommands(orphanHint + skippedCommands));
 		}
 	} finally {
 		try {
@@ -65104,11 +65143,11 @@ function getCurrentNestedStackContext() {
 * @param alsoSkippedCount resources the child SKIPPED (no AWS call issued)
 * @param alsoInterrupted  whether the child's destroy was also interrupted
 */
-function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted) {
+function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand) {
 	const extra = [];
 	if (alsoSkippedCount > 0) extra.push(`${alsoSkippedCount} resource(s) were also skipped`);
 	if (alsoInterrupted) extra.push("the child destroy was also interrupted");
-	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + `. The child's state is PRESERVED and still lists them — inspect it with 'cdkd state show ${childStackName}', resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable.`;
+	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + `. The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable.\nInspect it with: ${inspectCommand}`;
 }
 
 //#endregion
@@ -65285,7 +65324,10 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
 		if (childResult.errorCount > 0) {
-			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted, pasteableCommand("cdkd state show", [{
+				value: childStackName,
+				hole: "stack"
+			}]).command));
 			throw childResult.interrupted ? markNonRetryable(failure) : failure;
 		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
@@ -68325,6 +68367,36 @@ function conditionsDependOnTokenParameters(template, tokenParameterNames) {
 	}
 	return false;
 }
+/**
+* The reason a repaired `properties` map puts on the node's `blocking`
+* (go-to-k/cdkd#3335).
+*
+* `cdkd diff` REPAIRS this container and previews the record; `cdkd deploy`
+* REFUSES it inside `DiffCalculator.calculateDiff`, which both deploy paths
+* reach. So the preview is honest about the rows and wrong about what happens
+* next, and this is the sentence that says so.
+*
+* The ids are NOT re-rendered here: they have already been through
+* `malformedResourcePropertiesWarning`'s sanitizer in the warning printed
+* beside this, and the renderer strips control characters from every blocking
+* reason on the way out. The count is what this line adds — and the line does
+* not send the reader to that warning for the names, because the warning caps
+* at five before `and N more`, and under `--json` this reason ships in the
+* payload, where "above" has no referent.
+*/
+function deployRefusesPropertiesReason(logicalIds) {
+	return `${logicalIds.length} resource record(s) hold a 'properties' map that cannot be read. This preview repaired them to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
+/**
+* The `outputs` twin of {@link deployRefusesPropertiesReason}, a constant
+* because the bag is refused as a whole and there is nothing to count.
+*
+* `refuseMalformedOutputs` in `DeployEngine` is what refuses it. This arm is
+* the one the issue could not drive end to end — a record whose template
+* declares no Outputs produces no delta at all, so before this the node had
+* nothing to report and `--fail` exited 0.
+*/
+const DEPLOY_REFUSES_OUTPUTS_REASON = "The 'outputs' bag cannot be read. This preview repaired it to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
 /** How many unreadable row names the human preview lists before summarizing. */
 const UNREADABLE_PREVIEW_NAMES = 10;
 /** Empty template used to diff a removed nested child's state → all DELETE. */
@@ -68392,6 +68464,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
 		const unreadable = [];
+		const deployRefusals = [];
 		if (repairMalformedResourcesForReadOnly(result.state)) {
 			logger.warn(malformedResourcesWarning(stackName, region));
 			unreadable.push(UNREADABLE_RESOURCES_MAP_ROW);
@@ -68402,8 +68475,14 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 			unreadable.push(...dropped);
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
-		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
-		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
+		if (unreadableProps.length > 0) {
+			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
+			deployRefusals.push(deployRefusesPropertiesReason(unreadableProps));
+		}
+		if (repairMalformedOutputsForReadOnly(result.state)) {
+			logger.warn(malformedOutputsWarning(stackName, region));
+			deployRefusals.push(DEPLOY_REFUSES_OUTPUTS_REASON);
+		}
 		if (repairMalformedOrphansForReadOnly(result.state)) {
 			logger.warn(malformedOrphansWarning(stackName, region));
 			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
@@ -68411,7 +68490,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
 			state: result.state,
-			unreadable
+			unreadable,
+			deployRefusals
 		};
 	}
 	return {
@@ -68423,7 +68503,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 			version: 10,
 			lastModified: Date.now()
 		},
-		unreadable: []
+		unreadable: [],
+		deployRefusals: []
 	};
 }
 /**
@@ -68572,6 +68653,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let adoptedOrphans = [];
 	let adoptedRecords = {};
 	let blocking = [];
+	const deployRefusals = [];
 	let stateForDiff = currentState;
 	const unreadableOrphans = [];
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
@@ -68598,7 +68680,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				}
 			};
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
-			if (tornAdopted.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+			if (tornAdopted.length > 0) {
+				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
+			}
 		}
 	}
 	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties);
@@ -68641,7 +68726,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		adoptedOrphans,
 		adoptedRecords,
 		blocking,
-		unreadableOrphans
+		unreadableOrphans,
+		deployRefusals
 	};
 }
 /**
@@ -68719,10 +68805,10 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths } = args;
-	const { state, unreadable } = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths, isNestedChild } = args;
+	const { state, unreadable, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
 		...parameters && { parameters },
 		...canonicalizeProperties && { canonicalizeProperties },
 		...cfnFallback !== void 0 && { cfnFallback },
@@ -68744,7 +68830,11 @@ async function buildDiffTree(args) {
 		ccApiRoutes: collectCcApiRoutes(template, stateAfterAdoption),
 		outputChanges,
 		adoptedOrphans,
-		blocking,
+		blocking: isNestedChild ? blocking : [
+			...deployRefusals,
+			...adoptedDeployRefusals,
+			...blocking
+		],
 		unreadable: [...unreadable, ...unreadableOrphans],
 		children: []
 	};
@@ -68778,6 +68868,7 @@ async function buildDiffTree(args) {
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			ancestorTemplatePaths: childAncestorTemplatePaths,
+			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
@@ -69214,9 +69305,18 @@ var DiffDetectedError = class DiffDetectedError extends CdkdError {
 	}
 };
 /**
-* Signals that the preview completed and `cdkd deploy` would REFUSE to start
-* (issue go-to-k/cdkd#2943) — today, a rollback-orphan record whose physical
-* id another cdkd stack already manages.
+* Signals that the preview completed and `cdkd deploy` would REFUSE to start.
+* Two conditions reach it, and the message must fit BOTH:
+*
+*  - a rollback-orphan record whose physical id another cdkd stack already
+*    manages (issue go-to-k/cdkd#2943), where the remedy is resolving the
+*    ownership conflict between two stacks;
+*  - a container this preview REPAIRED and the deploy refuses — a resource's
+*    unreadable `properties` map or an unreadable `outputs` bag (issue
+*    go-to-k/cdkd#3335), where there is no second stack at all and the remedy
+*    is repairing the one record.
+*
+* So the message names no remedy at all and closes on the count.
 *
 * Exit **3**, and neither 1 nor 2, for reasons that are about what a caller
 * can conclude:
@@ -69226,18 +69326,19 @@ var DiffDetectedError = class DiffDetectedError extends CdkdError {
 *    code for "there is work to do" and "the work cannot begin".
 *  - **2** is this CLI's partial-failure family, documented as "work
 *    completed, re-running typically resolves it" (`docs/cli-reference.md`).
-*    A refusal is the opposite: re-running changes nothing until a human
-*    resolves the ownership conflict.
+*    A refusal is the opposite: re-running changes nothing until a human acts
+*    — repairing the record, or resolving the ownership conflict, depending on
+*    which condition fired.
 *
 * It is NOT silent: unlike `--fail`, this is not a flag the user opted into,
 * so the reason has to be visible even when the diff report scrolled away.
-* The `Blocking` section already printed the per-record detail; this adds the
-* one line that says the run cannot proceed.
+* The `Blocking` section already printed the per-condition detail; this adds
+* the one line that says the run cannot proceed.
 */
 var DeployRefusalPreviewError = class DeployRefusalPreviewError extends CdkdError {
 	exitCode = 3;
 	constructor(count) {
-		super(`cdkd deploy would refuse to start: ${count} blocking condition(s) reported above. Resolve them, or run \`cdkd state\` to inspect the conflicting stack.`, "DEPLOY_REFUSAL_PREVIEW");
+		super(`cdkd deploy would refuse to start: ${count} blocking condition(s) reported above.`, "DEPLOY_REFUSAL_PREVIEW");
 		this.name = "DeployRefusalPreviewError";
 		Object.setPrototypeOf(this, DeployRefusalPreviewError.prototype);
 	}
@@ -69362,7 +69463,8 @@ async function diffCommand(stacks, options) {
 				canonicalizeProperties,
 				...assetRedirect && { assetRedirect },
 				...options.cfnFallback === false && { cfnFallback: false },
-				previewOrphanAdoption
+				previewOrphanAdoption,
+				isNestedChild: false
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
@@ -70735,9 +70837,15 @@ function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, logg
 	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => `'${s}'`).join(", ")})` : "";
 	const templateClaim = verdict.kind === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes '${loggedExportKey}' by RE-EXPORTING a value that '${chainRoot}' declares from a {{resolve:...}} expression${through}` : `publishes '${loggedExportKey}' by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value '${chainRoot}' declares from a {{resolve:...}} expression${through} (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
 	const scrubOrder = dedupePreservingOrder([...chain].reverse().concat(loggedProducerStack), "last");
+	const remedyCommands = scrubOrder.map((name) => `Scrub with: ${pasteableCommand("cdkd scrub", [{
+		value: name,
+		hole: "stack",
+		opts: { patternMatched: true }
+	}]).command}`);
 	return {
 		templateClaim,
-		remedy: scrubOrder.length > 1 ? `Scrub the producers first, from the head of the chain (${scrubOrder.map((s) => `'cdkd scrub ${s}'`).join(", then ")})` : `Scrub the producer first ('cdkd scrub ${loggedProducerStack}')`
+		remedy: scrubOrder.length > 1 ? `Scrub the producers first, from the head of the chain, in the order below` : `Scrub the producer first`,
+		remedyCommands
 	};
 }
 /**
@@ -70799,8 +70907,12 @@ function dedupePreservingOrder(values, keep) {
 function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path, producerStack, exportKey, verdict, secrets) {
 	const loggedExportKey = maskSecretsInText(exportKey, secrets);
 	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
-	const { templateClaim, remedy } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
-	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run 'cdkd scrub ${stackName}' — the read will then return the expression and this stack is scrubbed normally.`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
+	const { templateClaim, remedy, remedyCommands } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
+	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
+		value: stackName,
+		hole: "stack",
+		opts: { patternMatched: true }
+	}]).command}`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
 }
 /** The `no` verdict, shared so the walk allocates nothing for the common case. */
 const NO_SECRET_EXPRESSION = {
@@ -72421,10 +72533,9 @@ function createScrubCommand() {
 * (phantom drift against an ISO-string baseline, and `--accept` persisted the
 * `{}`). The identity return is what makes the second visible to the
 * comparator; the null-prototype target is what keeps the first an own key.
-* One layer LATER the same flattening survives in `secret-redaction.ts`'s
-* value walk, which `--accept` runs over a resource that RECORDS a secret
-* (issue #2427) -- so the ISO string reaches the baseline only where that
-* walk does not run.
+* One layer LATER `secret-redaction.ts`'s value walk, which `--accept` runs
+* over a resource that RECORDS a secret, keeps a `Date` by identity too (issue
+* #2427), so the ISO string reaches the baseline on both kinds of resource.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -76854,7 +76965,13 @@ async function destroyCommand(stackArgs, options) {
 			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
 			else {
 				const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state orphan ${stackName} --stack-region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`);
+				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.\nRemove one record with: ${pasteableCommand("cdkd state orphan", [{
+					value: stackName,
+					hole: "stack"
+				}, {
+					flag: "--stack-region",
+					hole: "region"
+				}]).command}`);
 			}
 			const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
 			if (!stateResult) {
@@ -78744,7 +78861,10 @@ async function exportCommand(stackArg, options) {
 		const { state, etag, migrationPending } = stateData;
 		const exportJournal = await stateBackend.loadRollbackJournal(resolvedStackName, targetRegion);
 		if (exportJournal && exportJournal.segments.length > 0) {
-			logger.warn(`Stack '${resolvedStackName}' has a rollback journal — a previous deploy failed or was interrupted and has not been reverted. Exporting this half-deployed state to CloudFormation is likely unintended; run 'cdkd rollback ${resolvedStackName}' to revert (or 'cdkd deploy' to fix forward) first.`);
+			logger.warn(`Stack '${resolvedStackName}' has a rollback journal — a previous deploy failed or was interrupted and has not been reverted. Exporting this half-deployed state to CloudFormation is likely unintended; revert it first (or 'cdkd deploy' to fix forward).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				value: resolvedStackName,
+				hole: "stack"
+			}]).command}`);
 			if (!options.yes && !options.dryRun) {
 				if (!await confirmPrompt$3("Export anyway?")) {
 					logger.info("Export cancelled");
@@ -79094,7 +79214,7 @@ function safeDetail(value) {
 */
 function orphanCommandFor(stackName, region) {
 	const shownStack = safeSegment(stackName);
-	if (!(typeof stackName === "string" && shownStack === stackName && typeof region === "string" && safeSegment(region) === region)) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
+	if (!(typeof stackName === "string" && shownStack === stackName && !stackName.startsWith("-") && typeof region === "string" && safeSegment(region) === region && !region.startsWith("-"))) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
 	return `cdkd state orphan ${shellQuote(shownStack)} --stack-region ${shellQuote(safeSegment(region))}`;
 }
 /**
@@ -80975,7 +81095,10 @@ async function runPerStackImportLoop(args) {
 				} catch (err) {
 					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
 					const remainingSummary = perStackPlans.slice(i).map((p) => safeSegment(p.cdkdName)).join(", ");
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run the export — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}\nRe-run with: ${pasteableCommand("cdkd export", [{
+						value: rootStackName,
+						hole: "stack"
+					}]).command}`, { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
 				if (!cfnArn) throw new Error(`runPerStackImportLoop: DescribeStacks returned no StackId for '${plan.cfnName}' immediately after Phase 1A IMPORT — AWS may be in an unexpected state.`);
@@ -81757,7 +81880,11 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
@@ -81964,7 +82091,11 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
@@ -82432,7 +82563,11 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.yes && !options.force) {
 				const targetList = targets.map((t) => formatStackRefSafe(t)).join(", ");
-				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nUse 'cdkd destroy ${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' if you want to delete the actual resources.\n\n`);
+				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nDelete the actual resources instead with the command below.\nDestroy with: ${pasteableCommand("cdkd destroy", [{
+					value: stackName,
+					hole: "stack",
+					opts: { patternMatched: true }
+				}]).command}\n\n`);
 				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(`Cancelled removal of state for stack: ${stackName}`);
 					continue;
@@ -82964,6 +83099,68 @@ function createStateInfoCommand() {
 	return cmd;
 }
 /**
+* The hole the legacy refusal's `cdkd deploy` prints for a name it cannot
+* name, and the key {@link withheldNameClause} reads the reason back by. ONE
+* spelling so the two cannot drift apart (m22 of the go-to-k/cdkd#3499 review).
+*/
+const STACK_HOLE = "stack";
+/**
+* The sentence for a name `pasteableCommand` would not print, rendered from the
+* REASON it gave rather than from a predicate of this site's own — M11 of the
+* go-to-k/cdkd#3499 review. Keying it on a second predicate got both directions
+* wrong at once: `Old;Stack` renders exactly, so a rendering-based clause called
+* a command that names it "not exact", and `--all` also renders exactly, so the
+* same clause said nothing above a hole the operator was then invited to fill
+* with the name printed beside it.
+*
+* THREE of the five reasons are reachable from this call site, and the other
+* two are bounded out by where the name comes from — an S3 key segment:
+*
+* - `altered`, `option-shaped` and `pattern-shaped` are all reachable: a
+*   planted key can spell a name any of those ways in a handful of bytes.
+* - `empty` is not. `listStacks` drops a key whose stack segment is empty
+*   (`s3-state-backend.ts`'s `if (!stackName) continue`), so `target.stackName`
+*   is non-empty by the time the refusal is built.
+* - `too-long` is not either, and the bound is not obvious: the cap is
+*   `STACK_REF_MAX_CODE_POINTS` (1152), while S3 caps the WHOLE key at 1024
+*   bytes, leaving at most 1008 for the name inside `cdkd/<name>/state.json`.
+*   A multi-byte character only lowers the code-point count further, so a name
+*   arriving through `listStacks` can never reach the cap.
+*
+* Both unreachable arms stay, and are covered, because the REASON is the
+* gate's and not this site's: `pasteableCommand` can return either to a caller
+* whose value comes from somewhere else. A missing arm is no longer a silent
+* fall-through — the `switch` below is exhaustive over `WithholdReason`, so
+* dropping one is a compile error (M13). What the cases buy on top of that is
+* the SENTENCE: the type checker knows an arm exists, not that it says the
+* right thing, and substituting one arm's text for another's is exactly the
+* disagreement M11 closed.
+*/
+function withheldNameClause(built) {
+	const reason = built.withheld.find((w) => w.hole === STACK_HOLE)?.reason;
+	if (reason === void 0) return "";
+	let why;
+	switch (reason) {
+		case "altered":
+			why = `does NOT render exactly, so another record may render identically`;
+			break;
+		case "empty":
+			why = `is empty`;
+			break;
+		case "too-long":
+			why = `is too long to print`;
+			break;
+		case "option-shaped":
+			why = "begins with a '-', so it is not safe to print as an argument to 'cdkd deploy' — a name like '--all' is parsed as the FLAG and targets every stack";
+			break;
+		case "pattern-shaped":
+			why = `would be read as a PATTERN by 'cdkd deploy', which can match other stacks`;
+			break;
+		default: throw new Error(`withheldNameClause: unhandled WithholdReason ${String(reason)}`);
+	}
+	return ` This record's name ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
+}
+/**
 * `cdkd state refresh-observed <stack>` command implementation.
 *
 * Walks every resource in the given stack(s) and refreshes its
@@ -83053,9 +83250,13 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			}
 		}
 		for (const target of targets) if (!target.region) {
-			const stack = shellQuote(safeStackName(target.stackName));
-			const example = safeStackName(target.stackName) === target.stackName && !/^-|[*/]/.test(target.stackName) ? ` For example: cdkd deploy ${stack}` : "";
-			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + example);
+			const stack = displayIdent(target.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+			const migrate = pasteableCommand("cdkd deploy", [{
+				value: target.stackName,
+				hole: STACK_HOLE,
+				opts: { patternMatched: true }
+			}]);
+			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + withheldNameClause(migrate) + `\nMigrate with: ${migrate.command}`);
 		}
 		let totalRefreshed = 0;
 		let totalUnsupported = 0;
@@ -83644,7 +83845,10 @@ async function rollbackCommand(stackArg, options) {
 						const fresh = await setup.stateBackend.getState(stackName, region);
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
-						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run 'cdkd rollback ${safeStack(stackName)}' to reconcile state.`);
+						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run the rollback to reconcile state.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+							value: stackName,
+							hole: "stack"
+						}]).command}`);
 					}
 				}
 			};
@@ -83725,8 +83929,14 @@ async function rollbackCommand(stackArg, options) {
 				await setup.stateBackend.deleteState(stackName, region);
 				logger.info(`State for '${safeStack(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
-			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to finish.`);
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to retry.`);
+			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`);
+			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`);
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${safeStack(stackName)}' (${safe(region)}) complete.`);
 		} finally {
@@ -84073,7 +84283,13 @@ function printRunList(stackName, region, runs) {
 		const resultColored = result === "SUCCEEDED" ? green(result) : result === "UNKNOWN" || result === "<unrenderable>" ? gray(result) : red(result);
 		logger.info(`  ${cyan(safeId(run.runId) || "<unrenderable>")}  ${safeId(run.command) || "<unrenderable>"}  ${resultColored}  ${gray(safeId(run.startedAt) || "?")} -> ${gray(safeId(run.finishedAt) || "?")}  ${gray(`cdkd ${safeId(run.cdkdVersion) || "<unrenderable>"}`)}  ${gray(`${safeCount(run.eventCount)} events`)}`);
 	}
-	logger.info(gray(`\nUse 'cdkd events ${safeStack} --run <runId>' to read one run's events.`));
+	logger.info(gray(`\nRead one run's events with: ${pasteableCommand("cdkd events", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--run",
+		hole: "runId"
+	}]).command}`));
 }
 /** Human-readable single-run event stream (in recorded order). */
 /**
@@ -90870,7 +91086,7 @@ async function runDetached(opts) {
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`);
-	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
+	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
 			maxBuffer: 10485760,
@@ -94123,7 +94339,7 @@ async function createNetworkAndSidecar(args) {
 	if (cluster) sidecarEnv["CLUSTER"] = cluster;
 	const { flags: sidecarFlags, sensitiveEnv: sidecarSensitiveEnv, collisions: sidecarCollisions } = partitionSensitiveEnv(sidecarEnv, SENSITIVE_ENV_KEYS);
 	sidecarArgs.push(...sidecarFlags);
-	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable and were NOT passed to the sidecar at all (they would hijack the docker client).`);
+	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) and were NOT passed to the sidecar at all (they would hijack that client).`);
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
@@ -94489,7 +94705,7 @@ async function runEcsTask(task, options, state) {
 		});
 		dockerCmds.set(container.name, built.args);
 		dockerEnvs.set(container.name, built.sensitiveEnv);
-		if (built.collisions.length > 0) logger.warn(`Container '${container.name}': secret(s) ${built.collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the secret if the container needs it.`);
+		if (built.collisions.length > 0) logger.warn(`Container '${container.name}': secret(s) ${built.collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the secret if the container needs it.`);
 	}
 	const startedByName = /* @__PURE__ */ new Map();
 	for (const containerName of startOrder) {
@@ -98272,4 +98488,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Cy-pVgf_.js.map
+//# sourceMappingURL=program-CY92mXcX.js.map