@go-to-k/cdkd 0.291.8 → 0.291.10

package/dist/{deploy-engine-eLdrQQ2R.js → deploy-engine-BomFOZF4.js}

@@ -1,6 +1,6 @@
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS, y as withoutGeneratedFallbackName } from "./logger-GASr9bAF.js";
 import { a as setAssumedRoleCredentials, c as currentStackAwsScope, i as getPreAssumeEnvCredentials, l as runInStackAwsScope, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-D_XcHZoy.js";
+import { t as getCdkdVersion } from "./version-5OUy_OlQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -10,7 +10,7 @@ import { SQSClient } from "@aws-sdk/client-sqs";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
 import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
-import { CreateSnapshotCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
+import { CreateSnapshotCommand, DeleteVolumeCommand, DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeInstancesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSnapshotsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client, ModifyInstanceAttributeCommand } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand, DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStacksCommand, DescribeTypeCommand, GetTemplateCommand, ListExportsCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, GetRestApiCommand } from "@aws-sdk/client-api-gateway";
@@ -35,9 +35,10 @@ import { GetHostedZoneCommand, ListHostedZonesByNameCommand, Route53Client } fro
 import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBalancingV2Client } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
-import { isAbsolute as isAbsolute$1, resolve as resolve$1 } from "path";
+import { isAbsolute as isAbsolute$1, relative, resolve as resolve$1, sep } from "path";
 import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { inspect } from "node:util";
+import { realpathSync as realpathSync$1 } from "fs";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -1230,6 +1231,182 @@ function isUpdateUnsupportedError(error, logicalId) {
 	return false;
 }
 
+//#endregion
+//#region src/utils/pasteable-command.ts
+/**
+* The way cdkd builds a `cdkd ...` command it tells an operator to PASTE.
+*
+* Thirteen message modules route through it today. The CATEGORIES it does not
+* cover yet are at the end of this header — categories, not a census: the
+* population is what go-to-k/cdkd#3436's greps return against the tree of the
+* day, and a list here would be read as complete and go stale.
+*
+* go-to-k/cdkd#3363 measured the class this module closes, and
+* [#3436](https://github.com/go-to-k/cdkd/issues/3436) records it repo-wide.
+* Three shapes, each of which a per-site discipline kept re-introducing:
+*
+* 1. **A command inside prose quotes.** `drop it whole with '<command>'` puts
+*    the command in a `'...'` span, so an interpolated value carrying `'`
+*    CLOSES that wrapper when the span is pasted WITH its quotes and the rest
+*    runs as shell: `'cdkd state orphan S --state-bucket 'b; printf X; #''`
+*    printed `X`. Quoting the value does not help — the wrapper is what
+*    inverts. So a command is printed UNWRAPPED on its own labelled line, and
+*    this module returns the text for exactly that.
+*
+*    **UNWRAPPED always; LAST only when the message prints ONE command.** A
+*    message offering a READ and a DESTRUCTIVE template prints one command per
+*    LINE, and there the read ends a line while the TEMPLATE is last — the
+*    rule `.claude/rules/state-malformed-containers.md` states for
+*    go-to-k/cdkd#3516, and a shape this module already serves twice:
+*    `deploy-engine.ts`'s `Inspect it with:` / `Drop the record with:` pair,
+*    and `destroy-runner.ts`'s through `hintFor`. In both, the read command is
+*    correctly NOT last. Collapsing such a pair onto one line is the defect
+*    that rule names: the read must end a line, and the template must be last
+*    with no substituted value after it.
+* 2. **A bare `<placeholder>`.** `<name>` is two redirections, not a word:
+*    `<name` reads stdin from a file and `>` truncates whatever word follows.
+*    {@link commandHole} quotes it, so it pastes as one literal argument.
+* 3. **A value whose quote context the PROSE already flipped.** An English
+*    apostrophe earlier in the sentence (`this stack's name`) opens a shell
+*    quote that closes at the value's own opening quote, leaving the value
+*    bare. This module cannot reach that one — a value in prose is not a
+*    command — which is why the rule it belongs to is "a shell-quoted value
+*    goes on a labelled trailing line, never inside a sentence", and why
+*    deleting apostrophes is NOT the remedy (the next sentence re-opens it).
+*
+* What this module owns is the ARGUMENT side of shape 1 and shape 2: every
+* user-controlled value is sanitized, gated on rendering EXACTLY, and either
+* shell-quoted or replaced by a quoted hole. A value sanitizing would ALTER is
+* never printed in its altered spelling — that addresses a DIFFERENT record
+* than the message means — and never silently dropped, which would resolve the
+* ambient default instead.
+*
+* {@link shellQuote} and {@link commandHole} live here rather than in
+* `../state/lock-contention-message.js`, which still re-exports them for its
+* own callers: `src/utils/**` imports nothing from `src/state/**`, so the
+* shared helper could not reach them the other way round.
+*
+* ## The CATEGORIES not covered yet, as of go-to-k/cdkd#3436's first half
+*
+* Re-derive the members with that issue's greps rather than trusting a list:
+* these are kinds of site, and each kind has more members than the examples.
+*
+* - **Its own copy of the gate.** `buildForceUnlockCommand`
+*   (`state/lock-contention-message.ts`), the `cdkd orphan` properties refusal
+*   (`state/malformed-resources-bag.ts`), `orphanCommandFor` (`cli/commands/
+*   export.ts`), and others in `deployment/deploy-engine.ts`,
+*   `deployment/rollback-executor.ts` and `cli/commands/gc.ts`. They behave the
+*   same way; they are not this function, so a rule change reaches them only by
+*   hand.
+* - **A command in prose quotes with a RAW value**, outside the modules
+*   migrated here — `provisioning/providers/**` (S3 Tables, Route 53, DynamoDB),
+*   `cli/config-loader.ts` and `cli/commands/orphan.ts` are where the greps land
+*   today.
+* - **The `cdkd drift` sites of
+*   [#3307](https://github.com/go-to-k/cdkd/issues/3307)**, which take their own
+*   gate in that PR. Note a `cdkd drift` command also appears OUTSIDE that file.
+* - **A spelled-out template or usage synopsis printing a BARE `<hole>`**, and
+*   the source fence that would find them.
+*/
+/**
+* Quote a value for a pasteable shell command.
+*
+* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
+* prints `aws <service> ...` recovery commands naming a resource's physical id,
+* which is the same hazard one directory over. A second spelling of this
+* predicate is how the two would come to disagree about which values need
+* quoting -- the reason `display-safe.ts`'s header gives for not widening a
+* rule by hand. It is a pure function of its argument and imports nothing.
+*/
+function shellQuote(value) {
+	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* A placeholder for a value a pasteable command could not name, QUOTED.
+*
+* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
+* reads stdin from a file named `profile` and `>` sends stdout to whatever
+* word follows. While the hole was the command's LAST word that was only a
+* syntax error; with flags appended after it (`--profile <profile>
+* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
+* redirect target and `b` as the profile — a delete against the ambient
+* bucket, with nothing printed (measured by the maintainer, M4 of the
+* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
+* nothing else — no redirection, no swallowed flag. It is not refused: an
+* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
+* `<prefix>`).
+*/
+function commandHole(name) {
+	return `'<${name}>'`;
+}
+/**
+* WHY a value must become a hole, or `undefined` when it may be NAMED.
+*
+* FIRST MATCH WINS, in the order written: `empty`, `altered`, `too-long`,
+* `option-shaped`, `pattern-shaped` (m21 of the go-to-k/cdkd#3499 review). A
+* value can satisfy several — `-\u001b[x` is both option-shaped and altered —
+* and the caller renders ONE sentence, so the order decides which. It runs
+* cheapest-and-most-fundamental first: a value that does not survive rendering
+* cannot be reasoned about as a command argument at all, so saying "this would
+* be read as an option" about a spelling that is not what is stored would be
+* the more misleading of the two true sentences. The order is also the order
+* the two functions this replaced already applied, which is what keeps the
+* refactor behaviour-preserving.
+*/
+function withholdReason(value, opts) {
+	if (value === "") return "empty";
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (safe !== value) return "altered";
+	if (truncateCodePoints(safe, 1152).truncated) return "too-long";
+	if (value.startsWith("-")) return "option-shaped";
+	if (opts?.patternMatched === true && (value.includes("*") || value.includes("/"))) return "pattern-shaped";
+}
+/**
+* Build a pasteable `cdkd` command: every user-controlled value shell-quoted
+* behind an exactness gate, every placeholder quoted, nothing wrapped.
+*
+* `extraFlags` is where a caller appends the flags that pin the command to its
+* own account and key space — in practice `recoveryCommandFlags(recovery)`,
+* whose `exact` the caller folds into its own decision. They are appended
+* verbatim, LAST, because they are built by the same rules one layer up.
+*/
+function pasteableCommand(verb, args = [], extraFlags = []) {
+	let exact = true;
+	const withheld = [];
+	const parts = [verb];
+	for (const arg of args) {
+		if ("literal" in arg) {
+			parts.push(arg.literal);
+			continue;
+		}
+		if (!("value" in arg)) {
+			if ("flag" in arg) parts.push(arg.flag);
+			parts.push(commandHole(arg.hole));
+			exact = false;
+			continue;
+		}
+		const reason = withholdReason(arg.value, arg.opts);
+		let rendered;
+		if (reason === void 0) rendered = shellQuote(arg.value);
+		else {
+			rendered = commandHole(arg.hole);
+			exact = false;
+			withheld.push({
+				hole: arg.hole,
+				reason
+			});
+		}
+		if ("flag" in arg) parts.push(arg.flag);
+		parts.push(rendered);
+	}
+	parts.push(...extraFlags);
+	return {
+		command: parts.join(" "),
+		exact,
+		withheld
+	};
+}
+
 //#endregion
 //#region src/utils/error-handler.ts
 /**
@@ -1736,14 +1913,18 @@ var ResourceUpdateNotSupportedError = class ResourceUpdateNotSupportedError exte
 * redeploy, then retry the destroy. A future `--remove-protection`
 * flag (separate scope) will provide an explicit one-shot bypass.
 *
-* Note: `cdkd state destroy` (state-only, no synth) does NOT honor
+* Note: `cdkd state destroy` (the synth-free destroy) does NOT honor
 * `terminationProtection` — the flag is a CDK property not persisted
 * in cdkd's state.json. Use `cdkd destroy` when synth is available.
 */
 var StackTerminationProtectionError = class StackTerminationProtectionError extends CdkdError {
 	stackName;
 	constructor(stackName, cause) {
-		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry 'cdkd destroy ${stackName}'.`, "STACK_TERMINATION_PROTECTION", cause);
+		super(`Stack '${stackName}' has terminationProtection: true and cannot be destroyed. Set terminationProtection: false in the CDK code, redeploy, then retry the destroy.\nRetry with: ${pasteableCommand("cdkd destroy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`, "STACK_TERMINATION_PROTECTION", cause);
 		this.stackName = stackName;
 		this.name = "StackTerminationProtectionError";
 		Object.setPrototypeOf(this, StackTerminationProtectionError.prototype);
@@ -1773,8 +1954,11 @@ var StackTerminationProtectionError = class StackTerminationProtectionError exte
 *  1. `cdkd destroy <parent>` — the normal cascading-destroy path; the
 *     parent's reverse-DAG walks into the child via
 *     `NestedStackProvider.delete` and removes both layers atomically.
-*  2. `cdkd state destroy <child>` — state-only destroy with no parent
-*     coupling check. The state-driven entry point intentionally
+*  2. `cdkd state destroy <child>` — the SYNTH-FREE destroy, with no parent
+*     coupling check. It deletes the child's AWS resources and then its
+*     record; "state-only" named the wrong thing, and this message's own text
+*     was corrected away from that reading (go-to-k/cdkd#3499 review nits).
+*     `cdkd state orphan` is the record-only command. The state-driven entry point intentionally
 *     bypasses this guard for the same reason `cdkd state destroy`
 *     bypasses `terminationProtection`: it's the "I know what I'm
 *     doing" path for cleaning up state when synth is unavailable or
@@ -1786,7 +1970,16 @@ var NestedStackChildDirectDestroyError = class NestedStackChildDirectDestroyErro
 	parentLogicalId;
 	constructor(stackName, parentStack, parentLogicalId, cause) {
 		const logicalIdSuffix = parentLogicalId ? ` (parent's logical id: ${parentLogicalId})` : "";
-		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either run 'cdkd destroy ${parentStack}' to cascade-delete this child along with its parent, or run 'cdkd state destroy ${stackName}' if you intentionally want to leave the parent's reference dangling (the state-only escape hatch).`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
+		const cascadeCommand = pasteableCommand("cdkd destroy", [{
+			value: parentStack,
+			hole: "parent",
+			opts: { patternMatched: true }
+		}]).command;
+		const childDestroyCommand = pasteableCommand("cdkd state destroy", [{
+			value: stackName,
+			hole: "stack"
+		}]).command;
+		super(`Stack '${stackName}' is a nested child of '${parentStack}'${logicalIdSuffix}; directly destroying a nested stack is not supported. Either cascade-delete this child along with its parent, or destroy the child on its own — which deletes its AWS resources and its record, and leaves the parent's reference dangling (the synth-free escape hatch).\nCascade-delete with: ${cascadeCommand}\nDestroy the child alone with: ${childDestroyCommand}`, "NESTED_STACK_CHILD_DIRECT_DESTROY", cause);
 		this.stackName = stackName;
 		this.parentStack = parentStack;
 		if (parentLogicalId !== void 0) this.parentLogicalId = parentLogicalId;
@@ -3165,6 +3358,86 @@ function assemblyPathEscape(base, bound, candidate) {
 	return resolved;
 }
 /**
+* A letter or digit that neither draws as a blank nor reads as a quote.
+* `\p{L}` alone admits both, so two classes are carved out: the
+* default-ignorables, which hold letters that draw as a blank (the Hangul
+* fillers U+3164 and U+FFA0), and the quote-shaped letters — the Spacing
+* Modifier Letters block (U+02BA reads as `"`, U+02BC as `'`) plus the ones
+* outside it (U+0374, U+0559, U+07F4-U+07F5, U+A78B-U+A78C, and the halfwidth
+* sound marks U+FF9E-U+FF9F). Not all of `\p{Lm}`: U+30FC is in it, and it is
+* an ordinary character of a Japanese directory name.
+*/
+const VISIBLE_LETTER = new RegExp(String.raw`^(?![\p{Default_Ignorable_Code_Point}\u02b0-\u02ff\u0374\u0559\u07f4\u07f5\ua78b\ua78c\uff9e\uff9f])[\p{L}\p{N}]$`, "u");
+/**
+* A combining mark, which counts only DIRECTLY after a visible letter (or a
+* mark that itself counted): on a space or on punctuation it draws on its own,
+* and U+030B / U+030E there look like a quote.
+*/
+const COMBINING_MARK = /^\p{M}$/u;
+/**
+* The ASCII a bare path may carry besides letters and digits. Everything else —
+* any whitespace, any quote, any other symbol — takes the boundary, which
+* costs a legitimate path nothing but a pair of quotes.
+*/
+const BARE_PUNCTUATION = /^[/\\._~+@:=-]$/;
+/**
+* Classify each code point: `bare` (allowed in a bare path), `shown` (shown as
+* itself inside the boundary), or `escaped`. An ALLOWLIST, because a denylist
+* has to enumerate every character that draws as a blank or reads as a quote,
+* and JS `\s` alone already misses U+2800 and U+3164.
+*
+* Each test is ONE character and this walks the value — never `^(...)+$` over
+* the whole of it: alternatives that overlap (ASCII letters are in both
+* classes) under a quantifier backtrack exponentially on a long path that
+* fails near its end, which hangs the process uncatchably.
+*/
+function classify(chars) {
+	let afterLetter = false;
+	return chars.map((ch) => {
+		if (COMBINING_MARK.test(ch)) return afterLetter ? "bare" : "escaped";
+		afterLetter = VISIBLE_LETTER.test(ch);
+		if (afterLetter || BARE_PUNCTUATION.test(ch)) return "bare";
+		return ch >= " " && ch <= "~" ? "shown" : "escaped";
+	});
+}
+/**
+* Render a filesystem path that an assembly chose, or that embeds a value it
+* chose, into cdkd's own prose (go-to-k/cdkd#3509). The caller writes NO
+* quotes around the result.
+*
+* `displaySafe` alone is not enough inside quotes of cdkd's: it is a denylist
+* of control characters and passes `'`, so a value carrying one closed cdkd's
+* quote and wrote a clause of its own into the refusal. This keeps a plain path
+* bare and puts any other one inside a JSON string literal. Inside it, `"` and
+* `\` are escaped as JSON escapes them, and so is every character that is
+* neither printable ASCII nor a visible letter — a curly or fullwidth quote
+* that could pass for the boundary's own closing `"`, and a blank that could
+* pass for a space. The result stays valid JSON: `JSON.parse` returns the
+* sanitized value.
+*
+* Deliberately NOT `displayIdent`, which go-to-k/cdkd#3506 used for a Stage
+* path: that one is ASCII-only and capped at 255 code points, and a legitimate
+* path is neither — a non-ASCII directory name would render as spaces, naming
+* a path that does not exist. Here nothing is truncated and a non-ASCII letter
+* is shown as itself. A legitimate path with a space or any symbol outside
+* `/ \ . _ ~ + @ : = -` (`/Users/me/My Project/cdk.out`,
+* `C:\Program Files (x86)\app`) renders quoted, and a non-letter non-ASCII
+* character in it (an emoji, `©`) is shown as its `\u` escape.
+*/
+function displayAssemblyPath(value) {
+	const clean = displaySafe(value);
+	const chars = Array.from(clean);
+	const kinds = classify(chars);
+	if (clean === value && chars.length > 0 && kinds.every((k) => k === "bare")) return clean;
+	let body = "";
+	chars.forEach((ch, i) => {
+		if (ch === "\"" || ch === "\\") body += `\\${ch}`;
+		else if (kinds[i] !== "escaped") body += ch;
+		else for (let u = 0; u < ch.length; u++) body += `\\u${ch.charCodeAt(u).toString(16).padStart(4, "0")}`;
+	});
+	return `"${body}"`;
+}
+/**
 * The shared tail of every containment refusal: what the value resolved to,
 * what it escaped, and why that means the assembly is not CDK-generated. Each
 * call site supplies its own subject ("Stack 'X' has templateFile='...' which
@@ -3173,23 +3446,25 @@ function assemblyPathEscape(base, bound, candidate) {
 * other than loading the file — `renderNestedTemplateTreeDefect` says "deploy"
 * or "diff", matching its own sibling refusals.
 *
-* Every interpolation goes through `displaySafe` for the reason
-* `AssemblyReader`'s own refusals give (go-to-k/cdkd#3277): this text exists
-* FOR a hand-modified assembly, so the candidate, the resolved path and even
-* `dir` (below a Stage it derives from the manifest's `directoryName`) are all
-* attacker-chosen, and `formatError` sanitizes only an error's `cause`, never
-* its own `message`.
+* Every path goes through {@link displayAssemblyPath}, with no quotes of this
+* function's own, for the reason `AssemblyReader`'s own refusals give
+* (go-to-k/cdkd#3277): this text exists FOR a hand-modified assembly, so the
+* candidate, the resolved path and even `dir` (below a Stage it derives from
+* the manifest's `directoryName`) are all attacker-chosen, and `formatError`
+* sanitizes only an error's `cause`, never its own `message`.
 */
 function renderAssemblyPathEscape(escape, dir, action = "load", provenanceOverride) {
 	const provenance = provenanceOverride ?? `CDK emits assembly paths that stay inside the assembly directory; one that leaves it indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to ${action}.`;
 	const base = path.resolve(dir);
 	const realBase = resolveThroughLinks(base) ?? base;
+	const shownPath = displayAssemblyPath(escape.path);
+	const shownBase = displayAssemblyPath(base);
 	if (escape.escape === "symlink") {
-		if (escape.realPath === realBase) return `resolves to '${displaySafe(escape.path)}', a symbolic link to the directory '${displaySafe(base)}' itself rather than to a file inside it. ${provenance}`;
-		return `resolves to '${displaySafe(escape.path)}', which leads through a symbolic link to '${displaySafe(escape.realPath)}', outside '${displaySafe(base)}'. ${provenance}`;
+		if (escape.realPath === realBase) return `resolves to ${shownPath}, a symbolic link to the directory ${shownBase} itself rather than to a file inside it. ${provenance}`;
+		return `resolves to ${shownPath}, which leads through a symbolic link to ${displayAssemblyPath(escape.realPath)}, outside ${shownBase}. ${provenance}`;
 	}
-	if (escape.path === base) return `names the directory '${displaySafe(base)}' itself rather than a file inside it. ${provenance}`;
-	return `resolves to '${displaySafe(escape.path)}', outside '${displaySafe(base)}'. ${provenance}`;
+	if (escape.path === base) return `names the directory ${shownBase} itself rather than a file inside it. ${provenance}`;
+	return `resolves to ${shownPath}, outside ${shownBase}. ${provenance}`;
 }
 
 //#endregion
@@ -7817,12 +8092,25 @@ function formatDockerLoginError(stderr, endpoint) {
 	return trimmed;
 }
 /**
-* Env vars the docker CLI itself reads to decide how / where to run. A resolved
-* ECS secret (or SecureString) whose NAME collides with one of these must NOT
-* override it in the docker client's own process environment: a secret named
-* `DOCKER_HOST` would redirect the client to a different daemon, and `PATH`
-* would break locating the docker binary. See issue
-* https://github.com/go-to-k/cdkd/issues/2183.
+* Env vars the container CLI itself reads to decide how / where to run — the
+* binary {@link getDockerCmd} resolves, i.e. `docker` or whatever `CDK_DOCKER`
+* names (podman / nerdctl / finch). A resolved ECS secret (or SecureString)
+* whose NAME collides with one of these must NOT override it in the client's
+* own process environment: a secret named `DOCKER_HOST` (or podman's
+* `CONTAINER_HOST`) would redirect the client to a different daemon, and `PATH`
+* would break locating the binary. See issues
+* https://github.com/go-to-k/cdkd/issues/2183 and
+* https://github.com/go-to-k/cdkd/issues/2188.
+*
+* RULE for additions: anything a supported container CLIENT (or a credential /
+* connection helper it execs) reads to decide WHAT CODE IT LOADS, WHAT IT
+* TRUSTS, or WHERE / HOW IT CONNECTS. The docker CLI's documented set is kept
+* whole, behaviour toggles included; beyond it, a var that only tunes
+* behaviour (a storage driver, a snapshotter, a temp dir, an experimental
+* toggle) is OUT, because dropping a colliding secret costs the user that
+* secret. The operator's OWN value is never touched — the spawn
+* env starts from `process.env` — so adding a key costs only a secret of that
+* name.
 */
 const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"PATH",
@@ -7848,6 +8136,39 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"GLIBC_TUNABLES",
 	"GCONV_PATH",
 	"BASH_ENV",
+	"SHELLOPTS",
+	"PS4",
+	"PYTHONPATH",
+	"PYTHONHOME",
+	"PYTHONUSERBASE",
+	"PYTHONPYCACHEPREFIX",
+	"PYTHONPLATLIBDIR",
+	"PYTHONWARNINGS",
+	"BROWSER",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"HTTPLIB2_CA_CERTS",
+	"SSLKEYLOGFILE",
+	"GCE_METADATA_HOST",
+	"GCE_METADATA_ROOT",
+	"GCE_METADATA_IP",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_COMPILE_CACHE",
+	"NODE_EXTRA_CA_CERTS",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"RUBYOPT",
+	"RUBYLIB",
+	"GEM_PATH",
+	"GEM_HOME",
+	"RUBYGEMS_GEMDEPS",
+	"PERL5OPT",
+	"PERL5LIB",
+	"PERLLIB",
+	"PERL5DB",
+	"OPENSSL_CONF",
+	"OPENSSL_MODULES",
+	"OPENSSL_ENGINES",
 	"SSH_AUTH_SOCK",
 	"SSH_ASKPASS",
 	"SSH_ASKPASS_REQUIRE",
@@ -7864,6 +8185,40 @@ const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
 	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
 	"AWS_ROLE_ARN",
 	"AWS_EC2_METADATA_SERVICE_ENDPOINT",
+	"AWS_ECR_CACHE_DIR",
+	"CONTAINER_HOST",
+	"CONTAINER_CONNECTION",
+	"CONTAINER_SSHKEY",
+	"PODMAN_CONNECTIONS_CONF",
+	"CONTAINER_PROXY",
+	"CONTAINERS_SSH_CONF",
+	"CONTAINERS_CONF",
+	"CONTAINERS_CONF_OVERRIDE",
+	"CONTAINERS_REGISTRIES_CONF",
+	"CONTAINERS_REGISTRIES_CONF_OVERRIDE",
+	"REGISTRIES_CONFIG_PATH",
+	"CONTAINERS_STORAGE_CONF",
+	"CONTAINERS_STORAGE_CONF_OVERRIDE",
+	"CONTAINERS_POLICY_JSON",
+	"STORAGE_OPTS",
+	"CONTAINERS_HELPER_BINARY_DIR",
+	"REGISTRY_AUTH_FILE",
+	"DBUS_SESSION_BUS_ADDRESS",
+	"NOTIFY_SOCKET",
+	"XDG_CONFIG_HOME",
+	"XDG_RUNTIME_DIR",
+	"APPDATA",
+	"PROGRAMDATA",
+	"PROGRAMFILES",
+	"LOCALAPPDATA",
+	"SSH",
+	"CONTAINERD_ADDRESS",
+	"CONTAINERD_NAMESPACE",
+	"NERDCTL_TOML",
+	"CNI_PATH",
+	"NETCONFPATH",
+	"ROOTLESSKIT_STATE_DIR",
+	"NERDCTL_LOG_FILE",
 	"SSL_CERT_FILE",
 	"SSL_CERT_DIR",
 	"GODEBUG",
@@ -7882,10 +8237,16 @@ const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k)
 * family aws-sdk-go-v2 (and so `docker-credential-ecr-login`) honours — a
 * secret named `AWS_ENDPOINT_URL_ECR` walks around the exact
 * `AWS_ENDPOINT_URL` entry and redirects a request signed with the operator's
-* real credentials (#2186 round 4). No plausible secret name collides with
-* any of the three. Matched by prefix rather than enumerated (issue #2183
-* review). `SSH_` was a prefix here and was demoted to an EXACT enumeration
-* in {@link DOCKER_CLIENT_ENV_KEYS} (#2186 review round 3): the family is not
+* real credentials (#2186 round 4). `CLOUDSDK_` is gcloud's (#3599): every
+* gcloud property is settable as `CLOUDSDK_<SECTION>_<NAME>`, which covers
+* its token host, API endpoint overrides, proxy, CA bundle and account, and
+* the `docker-credential-gcloud` wrapper execs `$CLOUDSDK_PYTHON
+* $CLOUDSDK_PYTHON_ARGS`. `BASH_FUNC_` is bash's exported-function family.
+* No plausible secret name collides with these, apart from the one listed in
+* {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}. Matched by prefix rather than
+* enumerated (issue #2183 review). `SSH_` was a prefix here and was demoted to
+* an EXACT enumeration in {@link DOCKER_CLIENT_ENV_KEYS} (#2186 review round
+* 3): the family is not
 * uniformly dangerous and is not growing, while the prefix broke realistic,
 * currently-working secrets (`SSH_PRIVATE_KEY`, GitLab CI's canonical
 * deploy-key spelling). Exported so the test fence can assert the EXACT
@@ -7895,19 +8256,37 @@ const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k)
 const DOCKER_CLIENT_ENV_PREFIXES = [
 	"LD_",
 	"DYLD_",
-	"AWS_ENDPOINT_URL_"
+	"AWS_ENDPOINT_URL_",
+	"CLOUDSDK_",
+	"BASH_FUNC_"
 ];
 /**
+* Exact names inside a {@link DOCKER_CLIENT_ENV_PREFIXES} family that are still
+* delivered. An entry must be a realistic secret name AND harmless to the
+* helper that reads it. `CLOUDSDK_AUTH_ACCESS_TOKEN` is gcloud's own variable
+* for a caller-supplied access token (#3599). Given to `docker-credential-gcloud`,
+* it only changes which token gcloud hands docker, with no network call of its
+* own. gcloud's `auth docker-helper` answers only for a registry in its own
+* supported list unless `artifacts/allow_unrecognized_registry` is set, and
+* that property, the token host, the universe domain and every other variable
+* that could redirect or weaken the exchange stay refused by the `CLOUDSDK_`
+* prefix. Stored upper-case and matched case-insensitively. Never exempt an
+* exact {@link DOCKER_CLIENT_ENV_KEYS} member: the exact list wins.
+*/
+const DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS = /* @__PURE__ */ new Set(["CLOUDSDK_AUTH_ACCESS_TOKEN"]);
+/**
 * Is `key` the name of a var the docker client reads? Case-INSENSITIVE, because
 * Windows environment lookups are, so a lowercase `docker_host` must be caught
 * too (issue #2183). Matches the exact denylist OR a prefixed family — the
 * prefix families are fail-closed on the whole prefix, so an unlisted `LD_*` /
-* `DYLD_*` / `AWS_ENDPOINT_URL_*` secret is dropped (with a rename warning)
-* rather than reaching the client.
+* `DYLD_*` / `AWS_ENDPOINT_URL_*` / `CLOUDSDK_*` / `BASH_FUNC_*` secret is
+* dropped (with a rename warning) rather than reaching the client, except for
+* a name in {@link DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS}.
 */
 function isDockerClientEnvKey(key) {
 	const upper = key.toUpperCase();
 	if (DOCKER_CLIENT_ENV_KEYS_UPPER.has(upper)) return true;
+	if (DOCKER_CLIENT_ENV_PREFIX_EXEMPTIONS.has(upper)) return false;
 	return DOCKER_CLIENT_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
 }
 /**
@@ -9115,6 +9494,62 @@ function dockerSubject(assetId) {
 	return assetId === void 0 ? "A Docker asset" : `Docker asset '${displaySafe(assetId)}'`;
 }
 /**
+* Refuse a Docker asset whose build context the bundled `cdk-local` engine
+* would take from outside the assembly (issue
+* [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+*
+* `cdk-local`'s own `buildDockerImage` spells the context (and the
+* `executable` arm's cwd) as `${cdkOutDir}/${source.directory}` with no
+* containment, and cdkd cannot hand it a pre-resolved path without changing
+* the image tag it derives from `source`. So this judges the path the engine
+* WILL open, before the engine runs, through the same
+* {@link resolveDockerContextDirectory} cdkd's own build uses.
+*
+* An ABSOLUTE value is judged by the engine's spelling, not honoured: the
+* concatenation folds it UNDER the manifest directory, so its leading
+* separators are stripped and the remainder takes the relative arm. That
+* keeps a symlink inside the assembly from becoming an escape through an
+* absolute spelling, and keeps the honour-and-warn arm, which describes a
+* build this engine never performs, out of these paths.
+*/
+function assertCdkLocalDockerContextContained(opts) {
+	const { manifestDir, source, assetOutdir, wrapError } = opts;
+	const directory = source.directory;
+	if (!directory) return;
+	const asEngineJoinsIt = isAbsolute$1(directory) ? directory.replace(/^[/\\]+/, "") : directory;
+	resolveDockerContextDirectory({
+		manifestDir,
+		directory: asEngineJoinsIt,
+		wrapError,
+		assetOutdir,
+		sink: source.executable && source.executable.length > 0 ? "run this asset's source.executable with that directory as its working directory" : "send that directory to docker build as the context of an image cdkd then runs locally"
+	});
+	const engineSpelled = `${manifestDir}/${asEngineJoinsIt}`;
+	const physical = tryRealpathNative(engineSpelled);
+	if (physical === void 0) return;
+	const bound = tryRealpathNative(assetOutdir) ?? resolve$1(assetOutdir);
+	const rel = relative(bound, physical);
+	if (rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute$1(rel)) return;
+	throw wrapError(`asset source.directory='${displaySafe(directory)}' which ` + renderAssemblyPathEscape({
+		contained: false,
+		escape: "symlink",
+		path: engineSpelled,
+		realPath: physical
+	}, assetOutdir, "build it"));
+}
+/**
+* `realpath(3)`, or `undefined` when the path does not resolve. `.native` is
+* load-bearing: the JavaScript `realpathSync` folds `..` lexically first,
+* which is the very reading the check above exists to avoid.
+*/
+function tryRealpathNative(p) {
+	try {
+		return realpathSync$1.native(p);
+	} catch {
+		return;
+	}
+}
+/**
 * Build a Docker image from a CDK asset source. Returns the local image
 * tag the caller should use for `docker tag` / `docker push` (publisher)
 * or `docker run` (local-invoke).
@@ -9667,7 +10102,14 @@ function isCrossRegionRedirect(error) {
 */
 async function assertAssetBucketRegion(s3Client, bucketName, expectedRegion, accountId, cause) {
 	const want = canonicalizeRegion(expectedRegion);
-	const remedy = `Either bootstrap ${want} with an asset-bucket name unique to it ('cdkd bootstrap --region ${want} --asset-bucket <name>'), or run this against the bucket's own region.`;
+	const remedy = `Either bootstrap ${want} with an asset-bucket name unique to it, or run this against the bucket's own region.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+		flag: "--region",
+		value: want,
+		hole: "region"
+	}, {
+		flag: "--asset-bucket",
+		hole: "name"
+	}]).command}`;
 	let actual;
 	const fromHeader = readBucketRegionHeader(cause);
 	if (fromHeader) actual = canonicalizeRegion(fromHeader);
@@ -9831,7 +10273,11 @@ function parseBootstrapMarker(body, markerKey) {
 * (bucket-squatting defense, design §5).
 */
 async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
-	const rebootstrapHint = `Run 'cdkd bootstrap --region ${region}' to recreate it. cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.`;
+	const rebootstrapHint = `cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.\nRecreate it with: ${pasteableCommand("cdkd bootstrap", [{
+		flag: "--region",
+		value: region,
+		hole: "region"
+	}]).command}`;
 	const clientOpts = {
 		region,
 		...opts.profile && { profile: opts.profile }
@@ -9915,7 +10361,11 @@ async function ensureAssetStorage(options) {
 		const conflicts = [];
 		if (options.assetBucketName && options.assetBucketName !== existingMarker.assetBucket) conflicts.push(`asset bucket '${existingMarker.assetBucket}' (requested '${options.assetBucketName}')`);
 		if (options.containerRepoName && options.containerRepoName !== existingMarker.containerRepo) conflicts.push(`container repo '${existingMarker.containerRepo}' (requested '${options.containerRepoName}')`);
-		if (conflicts.length > 0) throw new CdkdError(`Region '${region}' is already bootstrapped with ${conflicts.join(" and ")}. Changing asset storage names would strand the existing storage and every published asset in it — run 'cdkd bootstrap --destroy --region ${region}' to tear the region's asset storage down first, then re-run bootstrap with the new names.`, "ASSET_STORAGE_NAME_CONFLICT");
+		if (conflicts.length > 0) throw new CdkdError(`Region '${region}' is already bootstrapped with ${conflicts.join(" and ")}. Changing asset storage names would strand the existing storage and every published asset in it — tear the region's asset storage down first, then re-run bootstrap with the new names.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+			flag: "--region",
+			value: region,
+			hole: "region"
+		}]).command}`, "ASSET_STORAGE_NAME_CONFLICT");
 	}
 	const assetBucket = options.assetBucketName ?? existingMarker?.assetBucket ?? getCdkdAssetBucketName(accountId, region);
 	const containerRepo = options.containerRepoName ?? existingMarker?.containerRepo ?? getCdkdContainerRepoName(accountId, region);
@@ -10105,7 +10555,11 @@ var AssetModeResolver = class {
 			}
 			if (!this.legacyNoticeShownRegions.has(region) && !this.suppressLegacyNotice) {
 				this.legacyNoticeShownRegions.add(region);
-				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap --region ${region}' to create cdkd-owned asset storage that 'cdk gc' never touches.`);
+				this.logger.info(`Assets for region '${region}' are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Create cdkd-owned asset storage that 'cdk gc' never touches:\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+					flag: "--region",
+					value: region,
+					hole: "region"
+				}]).command}`);
 			}
 			return { mode: "legacy" };
 		}
@@ -10165,7 +10619,11 @@ var AssetModeResolver = class {
 			};
 		} catch (error) {
 			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — run 'cdkd bootstrap --region ${region}' (with S3/ECR create permissions) to opt the region in.`);
+			this.logger.warn(`Failed to auto-create cdkd asset storage for region '${region}': ${message} Falling back to the CDK bootstrap destinations for this run — opt the region in with S3/ECR create permissions.\nBootstrap with: ${pasteableCommand("cdkd bootstrap", [{
+				flag: "--region",
+				value: region,
+				hole: "region"
+			}]).command}`);
 			return null;
 		} finally {
 			s3Client?.destroy();
@@ -11406,19 +11864,6 @@ function formatDuration(ms) {
 	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
 }
 /**
-* Quote a value for a pasteable shell command.
-*
-* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
-* prints `aws <service> ...` recovery commands naming a resource's physical id,
-* which is the same hazard one directory over. A second spelling of this
-* predicate is how the two would come to disagree about which values need
-* quoting -- the reason `display-safe.ts`'s header gives for not widening a
-* rule by hand. It is a pure function of its argument and imports nothing.
-*/
-function shellQuote(value) {
-	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
-}
-/**
 * The `cdkd force-unlock ...` line, carrying every flag that decides which
 * lock object it resolves to.
 */
@@ -11432,24 +11877,6 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	return [safeRegion === void 0 ? `cdkd force-unlock ${shellQuote(safeStack)}` : `cdkd force-unlock ${shellQuote(safeStack)} --stack-region ${shellQuote(safeRegion)}`, ...recoveryFlags.flags].join(" ");
 }
 /**
-* A placeholder for a value a pasteable command could not name, QUOTED.
-*
-* A bare `<profile>` is two shell redirections, not a word: pasted, `<profile`
-* reads stdin from a file named `profile` and `>` sends stdout to whatever
-* word follows. While the hole was the command's LAST word that was only a
-* syntax error; with flags appended after it (`--profile <profile>
-* --state-bucket b`) it ran the command with `--state-bucket` swallowed as a
-* redirect target and `b` as the profile — a delete against the ambient
-* bucket, with nothing printed (measured by the maintainer, M4 of the
-* go-to-k/cdkd#3363 review). Quoted, it pastes as one literal argument and
-* nothing else — no redirection, no swallowed flag. It is not refused: an
-* UNFILLED hole runs as that literal value (a stack named `<stack>`, a prefix
-* `<prefix>`).
-*/
-function commandHole(name) {
-	return `'<${name}>'`;
-}
-/**
 * The flags that pin a pasteable state command to the caller's account and
 * bucket: `--profile`, the resolved `--state-bucket`, and a NON-default
 * `--state-prefix` (see {@link LockRecoveryContext} for why each is emitted
@@ -16779,6 +17206,40 @@ function hasPlainPrototype(value) {
 	return proto === Object.prototype || proto === null;
 }
 /**
+* Is this a `Date` the value scan may return BY IDENTITY (issue
+* [#2427](https://github.com/go-to-k/cdkd/issues/2427))?
+*
+* The scan redacts what PERSISTS, and `JSON.stringify` persists an unmodified
+* `Date` as `Date.prototype.toJSON`'s ISO timestamp (or `null`) — never its own
+* entries. So the only thing to scan is that timestamp — the walk runs it
+* through the string arms and keeps the `Date` only when they leave it alone —
+* and rebuilding it just threw the timestamp away. "Unmodified" is three
+* conjuncts, each closing a shape whose persisted form is NOT that timestamp:
+* the EXACT prototype, a real `[[DateValue]]` (the `getTime` brand check, which
+* a `Proxy` or an `Object.create(Date.prototype)` fails), and NO own keys — an
+* own `toJSON` (enumerable or not) is what `JSON.stringify` would call instead.
+* No SDK readback or `JSON.parse` produces any of those; they are refused
+* because the identity return must mean exactly "persists as a timestamp".
+*
+* Deliberately NOT "any non-plain object". `JSON.stringify` persists an
+* arbitrary class instance's OWN ENUMERABLE fields, which is exactly what the
+* rebuild scans, so returning one by identity would persist a plaintext held in
+* such a field — a disclosure, traded for fidelity. A `Uint8Array` persists as
+* the same `{"0":...}` either way. The EXACT prototype (not `instanceof`) keeps
+* a `Date` subclass on the rebuild: its prototype can override `toJSON`, which
+* the rebuild drops and identity would honour. A cross-realm `Date` fails the
+* test too, which is the old flattening rather than a leak.
+*/
+function isOrdinaryDate(value) {
+	if (Object.getPrototypeOf(value) !== Date.prototype) return false;
+	try {
+		Date.prototype.getTime.call(value);
+	} catch {
+		return false;
+	}
+	return Reflect.ownKeys(value).length === 0;
+}
+/**
 * Structural equality over the JSON shapes this module walks (issue #2012).
 *
 * Own ENUMERABLE keys only, and a key count on both sides, so an inherited
@@ -17379,21 +17840,22 @@ function asIndex(marks, index) {
 *
 * KEEPING A NON-PLAIN LEAF INTACT takes the prototype guard on the object arm,
 * NOT that leaf rule, and an earlier revision of this comment claimed the
-* opposite — measured wrong. The scan's own walk rebuilds objects and turns a
+* opposite — measured wrong. The scan's own walk rebuilt objects and turned a
 * `Date` the provider readback carries (`LastModified`) into `{}`; that
-* flattening predates this module's derived needles on the POPULATED-map path
-* (issue #2427). The object arm runs FIRST here and `isPlainObject` admits a
-* `Date`, so without `hasPlainPrototype` this walk did the flattening ITSELF —
-* newly extending #2427 to the EMPTY-map path, where the unchanged-resource
-* `drainObservedCaptures` baseline lives and where `cdkd drift --revert` pushes
-* the result to the live resource. With the guard a non-plain leaf falls
-* through to `refused`. That is the position passes' own answer, which is the
-* bag by identity: their object arm carried no prototype guard of its own until
-* issue [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain
-* leaf whose source subtree carries a reference WAS already flattened one
-* function earlier and this guard could only keep a `{}` intact. Both halves
-* are guarded now; the remaining copy of the defect is the VALUE scan's own
-* walk, which is issue #2427 and a different pass.
+* flattening predated this module's derived needles on the POPULATED-map path
+* (issue #2427, since fixed in the scan). The object arm runs FIRST here and
+* `isPlainObject` admits a `Date`, so without `hasPlainPrototype` this walk did
+* the flattening ITSELF — newly extending #2427 to the EMPTY-map path, where
+* the unchanged-resource `drainObservedCaptures` baseline lives and where
+* `cdkd drift --revert` pushes the result to the live resource. With the guard
+* a non-plain leaf falls through to `refused`. That is the position passes' own
+* answer, which is the bag by identity: their object arm carried no prototype
+* guard of its own until issue
+* [#2869](https://github.com/go-to-k/cdkd/issues/2869), so a non-plain leaf
+* whose source subtree carries a reference WAS already flattened one function
+* earlier and this guard could only keep a `{}` intact. Both halves are guarded
+* now, and the VALUE scan's own walk keeps a `Date` by identity since issue
+* #2427, so `scanned` holds the same instance.
 *
 * The net effect is byte-identical to the FIRST ordering on every input where
 * the un-certification did not fire — which is the whole point: it keeps that
@@ -17947,6 +18409,12 @@ function redactSecretsForState(bag, secrets, source, rules = TEMPLATE_DERIVED_RU
 		}
 		if (Array.isArray(value)) return value.map(walk);
 		if (value !== null && typeof value === "object") {
+			if (isOrdinaryDate(value)) {
+				const persisted = value.toJSON();
+				if (typeof persisted !== "string") return value;
+				const scanned = walk(persisted);
+				return scanned === persisted ? value : scanned;
+			}
 			const out = Object.create(null);
 			for (const [k, v] of Object.entries(value)) out[k] = walk(v);
 			return out;
@@ -33964,6 +34432,221 @@ function isTerminationProtectionPropagationError(message) {
 	return /may not be terminated|disableApiTermination/i.test(message);
 }
 
+//#endregion
+//#region src/provisioning/wait-abandoned.ts
+/**
+* The "cdkd stopped watching an operation that may still be running" marker
+* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
+* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
+*
+* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
+* and `ec2-volume-delete.ts` marks its own abandoned volume-delete wait (issue
+* [#3455](https://github.com/go-to-k/cdkd/issues/3455)) with the same marker,
+* but FIVE call sites have to refuse it, and three of them live in other
+* files. Four are GOVERNED by
+* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
+*
+*  - `cloud-control-provider.ts`'s own `delete()` catch,
+*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
+*  - `deploy-engine.ts`'s template-removal delete arm,
+*  - `destroy-runner.ts`'s per-resource delete loop.
+*
+* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
+* by construction rather than by oversight: its partner classifier is the
+* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
+* needle-driven scan can find it. It has a behavioural case instead, and it
+* needs the guard for a sharper reason than the other four — that regex is
+* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
+*
+* Each decides "the resource is already gone" by SUBSTRING-matching the error
+* message, and each then DROPS the state row. An abandoned wait says the
+* opposite — the delete may still be running — and its message interpolates
+* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
+* so a resource named `PageNotFound` satisfies those needles. Round 1 of
+* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
+* the other three, which is what this module exists to fix: ONE predicate the
+* three foreign sites can import without importing the provider.
+*
+* **A marker rather than an exported class + `instanceof`**, for the reason
+* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
+* through `ProviderRegistry`, so importing the class there would add an edge
+* into an already dense ring, and a marker survives a wrapper that copies a
+* message without preserving a prototype.
+*
+* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
+* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
+* re-issue an idempotent delete, and only CREATE is marked. Reusing that
+* marker would either make the guards miss DELETE — the case that drops a
+* state row — or make a DELETE non-retryable and lose the recovery.
+*
+* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
+* rollback executor -> registry -> provider ring, and a new edge into it from
+* any of them would close a cycle.
+*/
+const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
+/**
+* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
+* wraps errors, so the marked error is routinely one or two hops down.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamp an error as an abandoned wait.
+*
+* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
+* lookup, so marking a class or a shared prototype would silently mark every
+* instance of it. A non-extensible (frozen / sealed) error is returned
+* UNMARKED rather than allowed to throw — callers use this inline, so a
+* `TypeError` raised here would REPLACE the error the caller meant to raise.
+* Both rules are `markNonRetryable`'s, for its reasons.
+*/
+function markWaitAbandoned(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markWaitAbandoned}.
+*
+* Every already-deleted classifier must test this BEFORE its substring match,
+* and must treat a true answer as "not already deleted" — i.e. re-throw. The
+* ordering is the whole point: a message-first guard has already decided by
+* the time it would consult the marker.
+*/
+function isWaitAbandonedError(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (current[WAIT_ABANDONED_MARKER] === true) return true;
+		current = current.cause;
+	}
+	return false;
+}
+
+//#endregion
+//#region src/provisioning/ec2-volume-delete.ts
+/**
+* Delete a Cloud-Control-routed `AWS::EC2::Volume` with EC2 `DeleteVolume`
+* instead of Cloud Control `DeleteResource` (issue
+* [#3455](https://github.com/go-to-k/cdkd/issues/3455)).
+*
+* WHY THE CLOUD CONTROL DELETE IS BYPASSED. The registry delete handler for
+* this type holds `ec2:CreateSnapshot` (it implements CloudFormation's
+* `DeletionPolicy: Snapshot` itself), and it has been observed taking that
+* snapshot on a plain Cloud Control delete, which carries no deletion policy
+* at all: CloudTrail shows a `CreateSnapshot` from `cloudformation.amazonaws.com`
+* in the same second as cdkd's `DeleteResource`, then the handler's
+* `DeleteVolume` while that snapshot was still pending. Both times it
+* happened, the volume then sat in `deleting` for well over the 15-minute
+* wait, the delete failed, and the handler's snapshot was left behind
+* untracked. What makes the handler do it is not known, so the only fix that
+* does not depend on the trigger is not to invoke the handler. The EC2 call is
+* the same one the handler makes; cdkd's own final snapshot (when the policy
+* asks for one) is taken and waited to `completed` before this runs.
+*
+* CONTRACT, matching the Cloud Control delete it replaces:
+*  - Resolves only once the volume is GONE (`InvalidVolume.NotFound`, or state
+*    `deleted`) — returning means "deleted" to every caller.
+*  - `DeleteVolume`'s own errors propagate UNCHANGED, so the caller's
+*    existing already-deleted arm (region-checked) sees `InvalidVolume.NotFound`
+*    exactly as it saw Cloud Control's `NotFound`, and every other failure
+*    takes the caller's ordinary wrap.
+*  - `IncorrectState` from `DeleteVolume` on a volume that is already
+*    `deleting`, `deleted` or gone (a re-run after an interrupted destroy, or
+*    a race with one) is waited on rather than failed. If the describe that
+*    classifies it fails, the ORIGINAL `IncorrectState` is rethrown, carrying
+*    the describe failure as its `cause`.
+*  - A TRANSIENT describe failure during the wait (a throttle, a 5xx, a
+*    socket error — `isTransientFailure`, the Cloud Control poll's own
+*    classifier) is re-polled for up to `transientGraceMs` of unbroken
+*    failures, the same grace the Cloud Control wait gives its status poll.
+*  - Every way the wait can end without seeing the volume gone — the
+*    `maxWaitMs` deadline, the grace running out, a non-transient describe
+*    failure — throws an error marked as an abandoned wait
+*    (`wait-abandoned.ts`). Every already-deleted classifier refuses that
+*    marker structurally, and they must: they match SUBSTRINGS of a message
+*    that interpolates the user's logical id (`PageNotFound` would match). So
+*    the state record is KEPT, and the error stays retryable, like a Cloud
+*    Control DELETE abandonment, because a re-issued `DeleteVolume` is
+*    idempotent.
+*/
+async function deleteEc2VolumeDirect(client, volumeId, logicalId, opts) {
+	const now = opts.now ?? Date.now;
+	try {
+		await client.send(new DeleteVolumeCommand({ VolumeId: volumeId }));
+		opts.logger.debug(`DeleteVolume accepted for ${logicalId} (${volumeId})`);
+	} catch (error) {
+		if (errorName(error) !== "IncorrectState") throw error;
+		let state;
+		try {
+			state = await readVolumeState(client, volumeId);
+		} catch (describeError) {
+			throw withCause(error, describeError);
+		}
+		if (!(state === void 0 || state === "deleted" || state === "deleting")) throw error;
+		opts.logger.debug(`${logicalId} (${volumeId}) is already ${state ?? "gone"}; waiting for it to go`);
+	}
+	const abandoned = (reason, cause) => markWaitAbandoned(new ProvisioningError(`DELETE of ${logicalId} (${volumeId}) was accepted by EC2, but ${reason}. The state record is kept; re-run the command once the volume is gone.`, "AWS::EC2::Volume", logicalId, volumeId, cause instanceof Error ? cause : void 0));
+	const deadline = now() + opts.maxWaitMs;
+	let interval = 2e3;
+	let outageStartedAt;
+	for (;;) {
+		let state;
+		let polled = false;
+		try {
+			state = await readVolumeState(client, volumeId);
+			polled = true;
+			outageStartedAt = void 0;
+		} catch (pollError) {
+			if (!opts.isTransientFailure(pollError)) throw abandoned(`cdkd could not read the volume's state: ${describeAwsFailure(pollError).summary}`, pollError);
+			outageStartedAt ??= now();
+			const outageMs = now() - outageStartedAt;
+			if (outageMs >= opts.transientGraceMs) throw abandoned(`cdkd could not read the volume's state for ${Math.round(outageMs / 1e3)}s: ` + describeAwsFailure(pollError).summary, pollError);
+			opts.logger.debug(`Could not read ${logicalId} (${volumeId}) while waiting for its delete; re-polling: ${describeAwsFailure(pollError).detail}`);
+		}
+		if (polled && (state === void 0 || state === "deleted")) return;
+		if (now() >= deadline) throw abandoned(polled ? `the volume was still '${state}' after ${Math.round(opts.maxWaitMs / 1e3)}s` : `cdkd could not read the volume's state before the ${Math.round(opts.maxWaitMs / 1e3)}s wait ran out`);
+		if (polled) opts.logger.debug(`Waiting for ${logicalId} (${volumeId}) to be deleted (state: ${state})`);
+		await opts.sleep(interval);
+		interval = Math.min(Math.ceil(interval * 1.5), 1e4);
+	}
+}
+/**
+* Rethrow `original` carrying `cause`, without replacing it: the caller's
+* classification (the idempotent arm, the retry classifier) must see the
+* `DeleteVolume` failure, not the describe that tried to explain it. A
+* non-extensible error, or one that already has a cause, is returned as-is.
+*/
+function withCause(original, cause) {
+	if (typeof original === "object" && original !== null && Object.isExtensible(original) && original.cause === void 0) Object.defineProperty(original, "cause", {
+		value: cause,
+		configurable: true,
+		writable: true,
+		enumerable: false
+	});
+	return original;
+}
+/** The volume's state, or `undefined` when EC2 reports it does not exist. */
+async function readVolumeState(client, volumeId) {
+	try {
+		const volume = (await client.send(new DescribeVolumesCommand({ VolumeIds: [volumeId] }))).Volumes?.[0];
+		return volume === void 0 ? void 0 : volume.State ?? "unknown";
+	} catch (error) {
+		if (errorName(error) === "InvalidVolume.NotFound") return void 0;
+		throw error;
+	}
+}
+/** The error's `name`, or `''` — never throws, whatever was rejected. */
+function errorName(error) {
+	if (typeof error !== "object" || error === null) return "";
+	const name = error.name;
+	return typeof name === "string" ? name : "";
+}
+
 //#endregion
 //#region src/deployment/delete-outcome.ts
 /**
@@ -34834,99 +35517,6 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
-//#endregion
-//#region src/provisioning/wait-abandoned.ts
-/**
-* The "cdkd stopped watching an operation that may still be running" marker
-* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
-* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
-*
-* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
-* but FIVE call sites have to refuse it, and three of them live in other
-* files. Four are GOVERNED by
-* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
-*
-*  - `cloud-control-provider.ts`'s own `delete()` catch,
-*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
-*  - `deploy-engine.ts`'s template-removal delete arm,
-*  - `destroy-runner.ts`'s per-resource delete loop.
-*
-* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
-* by construction rather than by oversight: its partner classifier is the
-* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
-* needle-driven scan can find it. It has a behavioural case instead, and it
-* needs the guard for a sharper reason than the other four — that regex is
-* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
-*
-* Each decides "the resource is already gone" by SUBSTRING-matching the error
-* message, and each then DROPS the state row. An abandoned wait says the
-* opposite — the delete may still be running — and its message interpolates
-* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
-* so a resource named `PageNotFound` satisfies those needles. Round 1 of
-* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
-* the other three, which is what this module exists to fix: ONE predicate the
-* three foreign sites can import without importing the provider.
-*
-* **A marker rather than an exported class + `instanceof`**, for the reason
-* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
-* through `ProviderRegistry`, so importing the class there would add an edge
-* into an already dense ring, and a marker survives a wrapper that copies a
-* message without preserving a prototype.
-*
-* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
-* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
-* re-issue an idempotent delete, and only CREATE is marked. Reusing that
-* marker would either make the guards miss DELETE — the case that drops a
-* state row — or make a DELETE non-retryable and lose the recovery.
-*
-* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
-* rollback executor -> registry -> provider ring, and a new edge into it from
-* any of them would close a cycle.
-*/
-const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
-/**
-* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
-* wraps errors, so the marked error is routinely one or two hops down.
-*/
-const MAX_CAUSE_CHAIN_DEPTH = 5;
-/**
-* Stamp an error as an abandoned wait.
-*
-* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
-* lookup, so marking a class or a shared prototype would silently mark every
-* instance of it. A non-extensible (frozen / sealed) error is returned
-* UNMARKED rather than allowed to throw — callers use this inline, so a
-* `TypeError` raised here would REPLACE the error the caller meant to raise.
-* Both rules are `markNonRetryable`'s, for its reasons.
-*/
-function markWaitAbandoned(error) {
-	if (!Object.isExtensible(error)) return error;
-	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
-		value: true,
-		enumerable: false,
-		configurable: true,
-		writable: false
-	});
-	return error;
-}
-/**
-* True when the error, or anything in its bounded `.cause` chain, was marked
-* by {@link markWaitAbandoned}.
-*
-* Every already-deleted classifier must test this BEFORE its substring match,
-* and must treat a true answer as "not already deleted" — i.e. re-throw. The
-* ordering is the whole point: a message-first guard has already decided by
-* the time it would consult the marker.
-*/
-function isWaitAbandonedError(error) {
-	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
-		if (current[WAIT_ABANDONED_MARKER] === true) return true;
-		current = current.cause;
-	}
-	return false;
-}
-
 //#endregion
 //#region src/provisioning/cloud-control-provider.ts
 /**
@@ -35607,7 +36197,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-B3RJYZnx.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-BY-tj21g.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -35617,8 +36207,20 @@ var CloudControlProvider = class {
 			const protectionEntry = ccProtectionProperty(resourceType);
 			if (protectionEntry) await this.disableCcProtection(logicalId, physicalId, resourceType, protectionEntry);
 		}
+		const volumeEc2Client = resourceType === "AWS::EC2::Volume" ? await this.ec2ClientInCcRegion(resourceType, logicalId, physicalId) : void 0;
 		const maxAttempts = isProtectedEc2Instance ? 5 : 1;
 		for (let attempt = 1;; attempt++) try {
+			if (volumeEc2Client !== void 0) {
+				await deleteEc2VolumeDirect(volumeEc2Client, physicalId, logicalId, {
+					logger: this.logger,
+					sleep: (ms) => this.sleep(ms),
+					maxWaitMs: Math.max(this.MAX_WAIT_TIME_MS, slowCcOperationTimeoutMs(resourceType, "DELETE")),
+					transientGraceMs: this.POLL_TRANSIENT_GRACE_MS,
+					isTransientFailure: isTransientPollFailure
+				});
+				this.logger.debug(`Deleted resource ${logicalId}`);
+				return withIndeterminateGuard(void 0, indeterminateGuard);
+			}
 			const deleteResponse = await this.cloudControlClient.send(new DeleteResourceCommand({
 				TypeName: resourceType,
 				Identifier: physicalId
@@ -35646,6 +36248,32 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
+	* The EC2 client for a delete this provider issues through EC2 instead of
+	* Cloud Control (issue #3455), refused unless it targets the SAME region as
+	* the Cloud Control client the region pre-flight vetted.
+	*
+	* `getAwsClients()` is read at call time while `cloudControlClient` was
+	* captured at construction, so the two are not the same object and could
+	* name different regions. The comparison is load-bearing rather than
+	* defensive: a volume id is region-scoped, so a wrong-region `DeleteVolume`
+	* answers `InvalidVolume.NotFound`, which the caller's already-deleted arm
+	* would take as success and drop the record of a live volume.
+	*/
+	async ec2ClientInCcRegion(resourceType, logicalId, physicalId) {
+		const ec2 = getAwsClients().ec2;
+		const resolve = async (client) => {
+			try {
+				return canonicalizeRegion((await client.config.region())?.trim());
+			} catch {
+				return;
+			}
+		};
+		const ccRegion = await resolve(this.cloudControlClient);
+		const ec2Region = await resolve(ec2);
+		if (ccRegion === void 0 || ccRegion === "" || ccRegion !== ec2Region) throw markNonRetryable(new ProvisioningError(`Refusing to delete ${logicalId} (${resourceType}, ${physicalId}): the EC2 client targets region '${ec2Region ?? "unknown"}' but the Cloud Control client targets '${ccRegion ?? "unknown"}', so cdkd cannot show the delete would reach this volume. Re-run with --region set to the stack's region.`, resourceType, logicalId, physicalId));
+		return ec2;
+	}
+	/**
 	* Refuse a Cloud Control call whose target region cannot be shown to be the
 	* one the state record was written in (issue #2301).
 	*
@@ -45173,6 +45801,53 @@ function updatePartialMessage(reason) {
 //#endregion
 //#region src/deployment/rollback-executor.ts
 /**
+* Rollback executor (issue #1183).
+*
+* The reusable engine that reverts a list of {@link CompletedOperation}s —
+* extracted from `DeployEngine` so BOTH callers drive identical semantics:
+*
+* - `DeployEngine` runs it in-process after a failed deploy (automatic
+*   rollback, unchanged behavior except the two fixes below).
+* - The standalone `cdkd rollback` command runs it against a persisted
+*   rollback journal (issue #1183 §journal), so a `--no-rollback` /
+*   interrupted / partially-failed-auto-rollback deploy can be reverted
+*   later.
+*
+* The executor deliberately depends only on `ProviderRegistry`, the stack
+* region, a logger, and an optional event recorder + per-op state-save
+* hook. It does NOT touch `DagBuilder` / `DiffCalculator` / the synthesizer
+* / `ExportIndexStore`, so the command can construct it without any of the
+* engine's synth-side collaborators (rollback never publishes
+* outputs/exports).
+*
+* Two deliberate behavior fixes vs. the pre-extraction in-process path
+* (both are pre-existing gaps; fixing them once benefits both callers):
+*
+* 1. **DeletionPolicy on CREATE rollback** — rolling a CREATE back IS a
+*    delete as far as the policy is concerned (CloudFormation semantics), so
+*    the CURRENT state record's `DeletionPolicy` decides what happens:
+*    - `Retain` → ORPHANED (removed from state, left in AWS). The policy
+*      says KEEP the resource, so cdkd does.
+*    - `Snapshot` → final snapshot, THEN delete (issue #1358), through the
+*      same mechanism matrix as the deploy engine's
+*      `prepareFinalSnapshotForDelete`: atomic delete parameter for the
+*      SDK-routed `ATOMIC_FINAL_SNAPSHOT_TYPES`, an explicit pre-delete
+*      snapshot for `PRE_DELETE_SNAPSHOT_TYPES`, refusal for every other
+*      Snapshot shape (cc-api routing included) unless
+*      `--skip-final-snapshot` opts into the data loss. This arm ORPHANED
+*      alongside `Retain` until #1358: when this file was written cdkd could
+*      not create a final snapshot at all, so leaving the resource behind
+*      was the only non-destructive option — but it silently handed the user
+*      an untracked, billing resource that state no longer knew about.
+*      `src/provisioning/final-snapshot.ts` (#1352 / #1353) removed the
+*      constraint, so the policy is now honored literally.
+*    - `RetainExceptOnCreate` (which exists precisely to allow cleanup of
+*      failed creates) and absent / `Delete` → DELETE.
+* 2. **Idempotent replay skip rules** — so a partially-failed rollback can
+*    be re-run safely (also harmless for the in-process caller, which
+*    replays each op exactly once).
+*/
+/**
 * Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762): turn a
 * `{ outcome: 'skipped' }` delete into a thrown error at every rollback delete
 * arm.
@@ -46499,7 +47174,14 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					createLayer: createProvisionedBy
 				}) && !deletedNewFirst && createResult.physicalId === current.physicalId;
 				if (adoptedLiveNewResource) {
-					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so run 'cdkd drift ${stackName}' to inspect and 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.`);
+					logger.warn(`  ⚠ ${safe(op.logicalId)} (${safe(op.resourceType)}): the re-create returned the LIVE new resource (${displaySafe(current.physicalId)}) instead of re-creating the old one — its Create API is name-idempotent and the new resource still holds the same user-supplied name. Skipping the delete-new step (it would delete that very resource). The old resource's ORIGINAL properties may NOT have been re-applied; state now records the pre-replacement properties, so inspect the drift and run 'cdkd deploy' to reconcile, or rename the resource to make the replacement reversible.\nInspect it with: ${pasteableCommand("cdkd drift", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: ctx.region,
+						hole: "region"
+					}]).command}`);
 					result.warnings++;
 				}
 				const { observedProperties: _staleObserved, ...prevRecord } = prev;
@@ -48227,27 +48909,6 @@ var DeployEngine = class DeployEngine {
 		const foreignReads = reads.filter((read) => !isLocal(read));
 		const hasRefStateRead = reads.some((read) => read.kind === "ref-state-key" && isLocal(read));
 		/**
-		* A logical id rendered inside the single-quoted command below.
-		*
-		* cdkd validates no logical-id charset, so the id can contain a `'` — and
-		* the line it lands in is meant to be COPY-PASTED into a shell, where an
-		* unescaped one closes the quoting early and the rest of the command
-		* reparses as something else. POSIX single-quote escaping (`'` becomes
-		* `'\\''`) is the fix: close, emit an escaped quote, reopen.
-		*
-		* cdkd never EXECUTES this string — it is advice in an error message — so
-		* this is about the pasted command being correct, not about injection into
-		* cdkd itself (issue #2847 round-5 review).
-		*
-		* SINCE go-to-k/cdkd#3435 no id reaching this arm can contain a `'`:
-		* `isPasteableIdent` admits `[A-Za-z0-9][A-Za-z0-9~_.-]*` only, and the
-		* command is not emitted for anything else. Kept anyway rather than
-		* deleted — dropping a guard on the strength of a NEW guard one line up is
-		* how the pair later comes apart, and this one costs a `replaceAll` on a
-		* short string.
-		*/
-		const quoteSafe = (id) => id.replaceAll("'", `'\\''`);
-		/**
 		* A logical id rendered as a NAME rather than as a command argument
 		* (go-to-k/cdkd#3435 security round).
 		*
@@ -48262,11 +48923,24 @@ var DeployEngine = class DeployEngine {
 		/** CloudFormation's own logical-id length bound. */
 		const CFN_LOGICAL_ID_MAX_LENGTH = 255;
 		const parts = [];
+		/** Pasteable commands, emitted LAST and one per line (go-to-k/cdkd#3436). */
+		const commandLines = [];
 		if (localTargets.length > 0) {
 			const pasteableHere = (id) => isPasteableIdent(id) && id.length <= CFN_LOGICAL_ID_MAX_LENGTH;
 			const pasteable = localTargets.filter(pasteableHere);
 			const withheld = localTargets.filter((id) => !pasteableHere(id));
-			if (pasteable.length > 0) parts.push(`Re-import the record that HOLDS the mask: ` + pasteable.map((id) => `'cdkd import <stack> --resource ${quoteSafe(id)}=<physicalId> --force'`).join(", ") + `.`);
+			if (pasteable.length > 0) {
+				parts.push(`Re-import the record that HOLDS the mask (command(s) below).`);
+				for (const id of pasteable) commandLines.push(`Re-import with: ${pasteableCommand("cdkd import", [
+					{ hole: "stack" },
+					{
+						flag: "--resource",
+						value: `${id}=<physicalId>`,
+						hole: "resource"
+					},
+					{ literal: "--force" }
+				]).command}`);
+			}
 			if (withheld.length > 0) parts.push(`Re-import the record that HOLDS the mask for ${withheld.map(shown).join(", ")}, but the command is withheld: that is not a plain CloudFormation logical id, so a pasted 'cdkd import <stack> --resource <id>=<physicalId> --force' could be reshaped by the shell or name a different resource. Read the id from 'cdkd state show' and quote it yourself.`);
 		}
 		if (unclearableTargets.length > 0) parts.push(`Do NOT re-import ${unclearableTargets.map(shown).join(", ")}: a custom resource's import records no attributes, so the masked bag is carried forward unchanged and the refusal repeats. Cause (1) above is the one that applies to it.`);
@@ -48275,7 +48949,7 @@ var DeployEngine = class DeployEngine {
 			parts.push(`${subject} through ANOTHER stack (an Fn::ImportValue, an Fn::GetStackOutput, or a nested stack's Outputs), whose masked record lives in that stack's state — re-importing anything in this stack cannot clear it; act on the producer stack instead.`);
 		}
 		if (hasRefStateRead) parts.push("A 'Ref <LogicalId> (state key <Key>)' entry above is CDKD's own read, not one the template can stop making: CloudFormation defines that resource type's Ref value as that state key rather than the physical id, so the record must be repaired (re-import it, or let a deploy create or update the resource) — the \"stop reading it\" remedy does not apply to such an entry.");
-		return parts.join(" ");
+		return [parts.join(" "), ...commandLines].join("\n");
 	}
 	/**
 	* Refuse to provision a resource whose resolution served a REDACTED attribute
@@ -48318,7 +48992,7 @@ var DeployEngine = class DeployEngine {
 	refuseRedactedAttributeReads(logicalId, resourceType, context) {
 		const reads = context.redactedAttributeReads;
 		if (reads === void 0 || reads.length === 0) return;
-		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)} If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449.`, resourceType, logicalId);
+		throw new ProvisioningError(`Cannot resolve ${reads.map((read) => read.display).join(", ")} for ${logicalId}: cdkd's recorded state holds only the redaction mask there, and the value is not recoverable from state. There are two ways a record comes to hold the mask. (1) A custom resource handler declared its response NoEcho: true — the value is generated by the handler, so cdkd has nothing to re-derive it from and must not write the literal mask to AWS. Remedies: force that custom resource to update (change one of its properties, e.g. a nonce / version property) so its handler runs again and supplies the value in this same run; or stop setting NoEcho on that response. If the value comes from ANOTHER stack, the producer and this stack must deploy in ONE run (cdkd deploy --all) with the producer's custom resource actually running — re-deploying the producer by itself does not help, because it re-masks the value on the way into its own state. (2) The resource was adopted by 'cdkd import' through the Cloud Control fallback, which records only the attributes the type's CloudFormation schema declares read-only and masks the rest. Either the attribute named above is not one of them — CloudFormation would reject an Fn::GetAtt naming it too, so stop reading it — or cdkd could not read that schema and masked the whole model, which the import warned about when it happened. If that warning named a missing cloudformation:DescribeType permission, grant it first. See https://github.com/go-to-k/cdkd/issues/2449. ${DeployEngine.maskedRecordRemedyFor(reads, context.resources)}`, resourceType, logicalId);
 	}
 	redactOperationsForJournal(operations) {
 		return operations.map((op) => {
@@ -48841,7 +49515,13 @@ var DeployEngine = class DeployEngine {
 				const journal = await this.stateBackend.loadRollbackJournal(stackName, this.stackRegion);
 				if (journal && journal.segments.length > 0) {
 					const failedOnly = journal.segments.every((s) => s.operations.length === 0) && journal.segments.some((s) => (s.failedOperations?.length ?? 0) > 0);
-					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — run 'cdkd rollback ${stackName} --revert-failed' to revert it, or continue deploying to fix forward (a successful deploy clears this note).` : `A previous deploy of '${stackName}' failed or was interrupted. Run 'cdkd rollback ${stackName}' to revert it, or continue deploying to fix forward.`);
+					this.logger.info(failedOnly ? `A previous deploy of '${stackName}' failed and was automatically rolled back. The failed resource may be partially applied — revert it, or continue deploying to fix forward (a successful deploy clears this note).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+						value: stackName,
+						hole: "stack"
+					}, { literal: "--revert-failed" }]).command}` : `A previous deploy of '${stackName}' failed or was interrupted. Revert it, or continue deploying to fix forward.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+						value: stackName,
+						hole: "stack"
+					}]).command}`);
 				}
 			} catch {}
 			this.stampReasonlessParameterRefusals(currentState.resources, template);
@@ -49470,7 +50150,10 @@ var DeployEngine = class DeployEngine {
 			return;
 		}
 		await this.writeRollbackJournalSegment(stackName, [], failedOperations, "auto-rollback-clean", initialDeploy);
-		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, run 'cdkd rollback ${stackName} --revert-failed' to revert it.`);
+		this.logger.info(`The automatic rollback restored the pre-deploy state. The failed resource's pre-failure record was kept — if it was left partially applied, revert it.\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+			value: stackName,
+			hole: "stack"
+		}, { literal: "--revert-failed" }]).command}`);
 	}
 	/** Build the {@link RollbackExecutorContext} from the engine's fields. */
 	rollbackExecutorContext(previousState) {
@@ -50199,7 +50882,21 @@ var DeployEngine = class DeployEngine {
 					const skipPrefix = progress ? `[${progress.current}/${progress.total}] ` : "  ";
 					renderer.removeTask(logicalId);
 					this.logger.info(`${skipPrefix}${formatResourceLine("skipped", logicalId, resourceType, `skipped (${deleteSkipped})`)}`);
-					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first ('cdkd state show ${stackName}' to inspect; for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record with 'cdkd state orphan ${stackName}'.`);
+					this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + `. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record.\nInspect it with: ${pasteableCommand("cdkd state show", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: this.stackRegion,
+						hole: "region"
+					}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [{
+						value: stackName,
+						hole: "stack"
+					}, {
+						flag: "--stack-region",
+						value: this.stackRegion,
+						hole: "region"
+					}]).command}`);
 					if (counts) counts.deleteSkipped++;
 					return { deleteSkipped };
 				}
@@ -50857,5 +51554,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { yellow as $, retryClassificationText as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, rewriteTemplateAssetReferences as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, hasUnverifiableParameterRefusal as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, slowCcOperationTimeoutMs as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, deleteSkipReason as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, orphansCarriedFrom as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, importableOutputs as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, DEFAULT_STATE_PREFIX as Ir, isNamelessDynamicReferenceError as It, bold as J, isRetryableTransientError as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, stringifyValue as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, shouldRetainResource as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, exportNamesCarriedFrom as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, shellQuote as Pr, getAccountInfo as Pt, red as Q, markRedactedCause as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, loadPublishableAssetManifest as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReadableExportSet as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, isWaitAbandonedError as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteIndeterminateGuards as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, isReadableBag as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputKeys as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansAfterRollback as Wr, assertRegionMatch as Wt, gray as X, isTransientServerError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, buildAssetRedirectMap as Xr, readConfigString as Xt, cyan as Y, isThrottlingError as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, WorkGraph as Yr, configStringRefusal as Yt, green as Z, markNonRetryable as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, createAssetRedirectResolver as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, isCrossRegionRedirect as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateAssetBucketName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, AssetModeResolver as ei, requireConfigString as en, describeAwsFailure as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, getBootstrapMarkerKey as ii, s3BucketArn as in, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, validateContainerRepoName as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, assertAssetBucketRegion as ni, producerRegionsFromState as nn, __exportAll as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, parseBootstrapMarker as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, isMarkedNonRetryable as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, AssetPublisher as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, ensureAssetStorage as ri, withSharedDrainBudget as rn, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, readBootstrapMarkerBody as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, BOOTSTRAP_MARKER_PREFIX as ti, classifyReplaySecretRegion as tn, safeStringify$1 as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, buildDenyExternalAccessPolicy as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, UNSPECIFIED_SKIP_REASON as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasReasonlessBaselineRefusal as zr, refStateLookupFromResource as zt };
-//# sourceMappingURL=deploy-engine-eLdrQQ2R.js.map
+export { yellow as $, markNonRetryable as $a, expectedOwnerParam as $i, repairMalformedResourcePropertiesForReadOnly as $n, AssetModeResolver as $r, requireConfigObject as $t, createPreDeleteFinalSnapshot as A, LocalInvokeBuildError as Aa, getDefaultStateBucketName as Ai, malformedOutputsRefusalMessage as An, buildForceUnlockCommand as Ar, carriesDynamicReference as At, isStatefulRecreateTargetSync as B, StackTerminationProtectionError as Ba, warnDeprecatedNoPrefixCliFlag as Bi, refuseMalformedOrphansForDestroy as Bn, importableOutputKeys as Br, isSettledInstanceState as Bt, namesAnyDeclaredParameter as C, CdkdError as Ca, runDockerStreaming as Ci, isReadableResourceEntry as Cn, recoverMaskedOutput as Cr, UNSPECIFIED_SKIP_REASON as Ct, PRE_DELETE_SNAPSHOT_TYPES as D, DeployCancelledError as Da, getDockerImageBySourceHash as Di, malformedOrphanRecordsWarning as Dn, S3StateBackend as Dr, disableInstanceApiTermination as Dt, ATOMIC_FINAL_SNAPSHOT_TYPES as E, DependencyError as Ea, AssetManifestLoader as Ei, malformedLocalOutputsWarning as En, LockManager as Er, isWaitAbandonedError as Et, extractDeploymentEventError as F, PartialFailureError as Fa, resolveSkipPrefix as Fi, malformedResourcesWarning as Fn, DEFAULT_STATE_PREFIX as Fr, isImpossibleEmptyStoredAttribute as Ft, toCfnInteger as G, normalizeAwsError as Ga, findLargeInlineResources as Gi, refuseMalformedResourceEntries as Gn, shouldRetainResource as Gr, coerceCfnBoolean as Gt, WARM_THROUGHPUT_MEMBERS as H, SynthesisError as Ha, CFN_TEMPLATE_BODY_LIMIT as Hi, refuseMalformedOutputs as Hn, isReadableBag as Hr, normalizeAwsTagsToCfn as Ht, makeSiblingClaimReader as I, ProvisioningError as Ia, resolveStateBucketWithDefault as Ii, malformedStateRefusalMessage as In, exportNamesCarriedFrom as Ir, isNamelessDynamicReferenceError as It, bold as J, shellQuote as Ja, injectiveKey as Ji, refuseMalformedResourcesForDestroy as Jn, WorkGraph as Jr, configIntegerRefusal as Jt, toFiniteNumber as K, withErrorHandling as Ka, uploadCfnTemplate as Ki, refuseMalformedResourceEntriesForOrphan as Kn, AssetPublisher as Kr, coerceCfnInteger as Kt, planOrphanAdoption as L, ResourceTimeoutError as La, resolveStateBucketWithDefaultAndSource as Li, refuseDivergentRecordRegionForDestroy as Ln, hasReadableExportSet as Lr, isUnboundTemplateParameter as Lt, refusesFinalSnapshot as M, LockError as Ma, resolveApp as Mi, malformedRenderedContainersWarning as Mn, forceQuitRecoveryClause as Mr, cfnRefValueFromPhysicalId as Mt, unsupportedFinalSnapshotError as N, MalformedProducerRecordRefusalError as Na, resolveAutoAssetStorage as Ni, malformedResourceEntriesWarning as Nn, formatLockExpiry as Nr, coerceParameterTypedValue as Nt, buildFinalSnapshotIdentifier as O, DynamicReferenceRegionAmbiguousError as Oa, Synthesizer as Oi, malformedOrphansRefusalMessage as On, rebuildClientForBucketRegion as Or, isTerminationProtectionPropagationError as Ot, makeCanonicalizePropertiesFn as P, NestedStackChildDirectDestroyError as Pa, resolveCaptureObservedState as Pi, malformedResourcePropertiesWarning as Pn, CUSTOM_RESOURCE_RESPONSE_PREFIX as Pr, getAccountInfo as Pt, red as Q, isTransientServerError as Qa, decodeListingKey as Qi, repairMalformedResourceEntriesForReadOnly as Qn, rewriteTemplateAssetReferences as Qr, requireConfigArray as Qt, MULTI_REGION_RECREATE_BLOCKED_TYPES as R, ResourceUpdateNotSupportedError as Ra, resolveUseCdkBootstrapAssets as Ri, refuseMalformedNestedChildOutputs as Rn, hasReasonlessBaselineRefusal as Rr, parameterTypeMayLoseSecretIdentity as Rt, computeParameterTaint as S, AssetError as Sa, runDockerForeground as Si, hasReadableResources as Sn, recordMaskOnlyValue as Sr, slowCcOperationTimeoutMs as St, resourcesNamingDeclaredParameter as T, CrossAccountSecretRefusalError as Ta, stripControlChars as Ti, malformedExportSourceWarning as Tn, scrubResourceRecord as Tr, deleteSkipReason as Tt, coerceWarmThroughput as U, formatError as Ua, CFN_TEMPLATE_URL_LIMIT as Ui, refuseMalformedOutputsForDestroy as Un, orphansAfterRollback as Ur, resolveExplicitPhysicalId as Ut, renderStatefulReason as V, StateError as Va, ssmResolvedValueType as Vi, refuseMalformedOrphansForOrphan as Vn, importableOutputs as Vr, WAFv2WebACLProvider as Vt, isWarmThroughputDecrease as W, isCdkdError as Wa, MIGRATE_TMP_PREFIX as Wi, refuseMalformedResourceAttributesForOrphan as Wn, orphansCarriedFrom as Wr, assertRegionMatch as Wt, gray as X, isRetryableTransientError as Xa, producerCoordinateKey as Xi, repairMalformedOrphansForReadOnly as Xn, createAssetRedirectResolver as Xr, readConfigString as Xt, cyan as Y, isMarkedNonRetryable as Ya, injectiveKeyPrefix as Yi, refuseMalformedState as Yn, buildAssetRedirectMap as Yr, configStringRefusal as Yt, green as Z, isThrottlingError as Za, producerRecordKey as Zi, repairMalformedOutputsForReadOnly as Zn, loadPublishableAssetManifest as Zr, replayWarn as Zt, bagHoldsSecretExpression as _, AwsClients as _a, dockerSpawnEnvWithSensitive as _i, UNREADABLE_ORPHANS_CONTAINER_ROW as _n, identityKeyFor as _r, endCommandInterruptScope as _t, DeploymentEventsStore as a, globMatches as aa, parseBootstrapMarker as ai, s3BucketDomainName as an, describeTypeWithThrottleRetry as ar, secretBearingStateKeyWarning as at, mergeNoChangeOutputs as b, runWithStackAwsClients as ba, partitionSensitiveEnv as bi, hasReadableOrphans as bn, maskSecretsInError as br, startInterruptWatch as bt, replayFailedOperations as c, hasOwnKey as ca, validateContainerRepoName as ci, s3BucketWebsiteUrl as cn, TemplateParser as cr, IAMRoleProvider as ct, updatePartialMessage as d, ownValue as da, buildDockerImage as di, applyCallerIdentityCredentials as dn, STATE_SOURCED_READBACK_RULES as dr, ProviderRegistry as dt, PARTITION_TABLE as ea, BOOTSTRAP_MARKER_PREFIX as ei, requireConfigString as en, markRedactedCause as eo, repairMalformedResourcesForReadOnly as er, collectDeclaredOutputNames as et, updatePartialReason as f, absoluteAssemblyPathEscape as fa, resolveDockerContextDirectory as fi, callerEnvCredentials as fn, TEMPLATE_SOURCED_RULES as fr, wouldReturnToSdkProvider as ft, computeImplicitDeleteEdges as g, resolveBucketRegion as ga, describeDockerFailure as gi, STATE_RESOURCES_MALFORMED as gn, errorCauseChain as gr, beginCommandInterruptScope as gt, IMPLICIT_DELETE_DEPENDENCIES as h, clearBucketRegionCache as ha, describeDockerExecFailure as hi, INTRINSIC_KEYS as hn, dynamicReferenceTokens as hr, maskerOrIdentity as ht, DeploymentEventsReader as i, failedStageNote as ia, isCrossRegionRedirect as ii, s3BucketArn as in, __exportAll as io, findSilentDropProperties as ir, secretBearing as it, isFinalSnapshotError as j, LocalStartServiceError as ja, getLegacyStateBucketName as ji, malformedOutputsWarning as jn, buildLockContentionMessage as jr, carriesFetchableDynamicReference as jt, ccRoutedFinalSnapshotError as k, IntrinsicResolutionRefusalError as ka, synthesisStatusMessage as ki, malformedOrphansWarning as kn, UNREPRODUCIBLE_LOCK_CLAUSE as kr, IntrinsicFunctionResolver as kt, replayRollback as l, hasPlainPrototype$1 as la, buildDenyExternalAccessPolicy as li, applyRoleArnIfSet as ln, STATE_SOURCED_BASELINE_RULES as lr, collectInlinePolicyNamesManagedBySiblings as lt, maskingRetryLogger as m, resolveAssemblyPath as ma, describeDockerCapturedOutput as mi, DiffCalculator as mn, createSecretMasker as mr, maskDeep as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, derivePartitionAndUrlSuffix as na, ensureAssetStorage as ni, producerRegionsFromState as nn, describeAwsFailure as no, safeStackName as nr, exportAliasCollisionScrubWarning as nt, planFailedOps as o, processStackMessages as oa, readBootstrapMarkerBody as oi, s3BucketDualStackDomainName as on, withRetry as or, secretSafeKeyDisplay as ot, withResourceDeadline as p, renderAssemblyPathEscape as pa, warnManifestExecutable as pi, envCredentialsAreAssumedRole as pn, carriesSecretMask as pr, createMaskedRetryLogger as pt, formatResourceLine as q, pasteableCommand as qa, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as qi, refuseMalformedResourcePropertiesForOrphan as qn, stringifyValue as qr, configBooleanRefusal as qt, DeployEngine as r, AssemblyReader as ra, getBootstrapMarkerKey as ri, withSharedDrainBudget as rn, safeStringify$1 as ro, findActionableSilentDrops as rr, isExportAliasCollision as rt, planRollback as s, defineOwnKey as sa, validateAssetBucketName as si, s3BucketRegionalDomainName as sn, DagBuilder as sr, getCurrentResourceSecrets as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, canonicalizeRegion as ta, assertAssetBucketRegion as ti, classifyReplaySecretRegion as tn, retryClassificationText as to, safeRegion as tr, collectPublishedOutputNames as tt, resolveReplacementOldType as u, nullPrototypeRecord as ua, assertCdkLocalDockerContextContained as ui, AWS_CREDENTIAL_ENV_KEYS as un, STATE_SOURCED_CROSS_GENERATION_RULES as ur, clearOnUpdateRemoval as ut, isSecretBearingReferenceString as v, getAwsClients as va, formatDockerLoginError as vi, UNREADABLE_RESOURCES_MAP_ROW as vn, isSingleDynamicReferenceToken as vr, interruptWatchListenerCount as vt, reachableDivergentParameters as w, ConfigError as wa, escapeRegExp$1 as wi, malformedExportNamesWarning as wn, redactSecretsForState as wr, deleteIndeterminateGuards as wt, bindingSkippedOutputs as x, setAwsClients as xa, redactDockerArgvValues as xi, hasReadableOutputs as xn, maskSecretsInText as xr, CloudControlProvider as xt, keptWholeReasonText as y, resetAwsClients as ya, getDockerCmd as yi, displayLogicalId as yn, markSameGenerationBag as yr, isInterruptedWaitError as yt, isStatefulRecreateTargetForReplace as z, StackHasActiveImportsError as za, stateBucketExistenceConfirmed as zi, refuseMalformedOrphans as zn, hasUnverifiableParameterRefusal as zr, refStateLookupFromResource as zt };
+//# sourceMappingURL=deploy-engine-BomFOZF4.js.map