@go-to-k/cdkd 0.291.8 → 0.291.10

package/dist/{program-Fgtmg1PN.js → program-BfCsjuyU.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $a as retryClassificationText, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as rewriteTemplateAssetReferences, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as hasUnverifiableParameterRefusal, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as slowCcOperationTimeoutMs, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as deleteSkipReason, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as orphansCarriedFrom, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as importableOutputs, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as DEFAULT_STATE_PREFIX, It as isNamelessDynamicReferenceError, J as bold, Ja as isRetryableTransientError, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as stringifyValue, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as shouldRetainResource, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as exportNamesCarriedFrom, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as shellQuote, Pt as getAccountInfo, Q as red, Qa as markRedactedCause, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as loadPublishableAssetManifest, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReadableExportSet, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as isWaitAbandonedError, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteIndeterminateGuards, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as isReadableBag, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputKeys, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansAfterRollback, Wt as assertRegionMatch, X as gray, Xa as isTransientServerError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as buildAssetRedirectMap, Xt as readConfigString, Y as cyan, Ya as isThrottlingError, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as WorkGraph, Yt as configStringRefusal, Z as green, Za as markNonRetryable, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as createAssetRedirectResolver, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as isCrossRegionRedirect, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateAssetBucketName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as AssetModeResolver, en as requireConfigString, eo as describeAwsFailure, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as getBootstrapMarkerKey, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as validateContainerRepoName, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as assertAssetBucketRegion, nn as producerRegionsFromState, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as parseBootstrapMarker, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as isMarkedNonRetryable, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as AssetPublisher, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as ensureAssetStorage, rn as withSharedDrainBudget, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as readBootstrapMarkerBody, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as BOOTSTRAP_MARKER_PREFIX, tn as classifyReplaySecretRegion, to as safeStringify, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as buildDenyExternalAccessPolicy, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as UNSPECIFIED_SKIP_REASON, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasReasonlessBaselineRefusal, zt as refStateLookupFromResource } from "./deploy-engine-eLdrQQ2R.js";
+import { $ as yellow, $a as markNonRetryable, $i as expectedOwnerParam, $n as repairMalformedResourcePropertiesForReadOnly, $r as AssetModeResolver, $t as requireConfigObject, A as createPreDeleteFinalSnapshot, Aa as LocalInvokeBuildError$1, Ai as getDefaultStateBucketName, An as malformedOutputsRefusalMessage, Ar as buildForceUnlockCommand, At as carriesDynamicReference, B as isStatefulRecreateTargetSync, Ba as StackTerminationProtectionError, Bi as warnDeprecatedNoPrefixCliFlag, Bn as refuseMalformedOrphansForDestroy, Br as importableOutputKeys, Bt as isSettledInstanceState, C as namesAnyDeclaredParameter, Ca as CdkdError, Ci as runDockerStreaming, Cn as isReadableResourceEntry, Cr as recoverMaskedOutput, Ct as UNSPECIFIED_SKIP_REASON, D as PRE_DELETE_SNAPSHOT_TYPES, Da as DeployCancelledError, Di as getDockerImageBySourceHash, Dn as malformedOrphanRecordsWarning, Dr as S3StateBackend, Dt as disableInstanceApiTermination, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ei as AssetManifestLoader, En as malformedLocalOutputsWarning, Er as LockManager, Et as isWaitAbandonedError, F as extractDeploymentEventError, Fa as PartialFailureError, Fi as resolveSkipPrefix, Fn as malformedResourcesWarning, Fr as DEFAULT_STATE_PREFIX, Ft as isImpossibleEmptyStoredAttribute, G as toCfnInteger, Ga as normalizeAwsError, Gi as findLargeInlineResources, Gn as refuseMalformedResourceEntries, Gr as shouldRetainResource, Gt as coerceCfnBoolean, H as WARM_THROUGHPUT_MEMBERS, Ha as SynthesisError, Hi as CFN_TEMPLATE_BODY_LIMIT, Hn as refuseMalformedOutputs, Hr as isReadableBag, Ht as normalizeAwsTagsToCfn, I as makeSiblingClaimReader, Ia as ProvisioningError, Ii as resolveStateBucketWithDefault, In as malformedStateRefusalMessage, Ir as exportNamesCarriedFrom, It as isNamelessDynamicReferenceError, J as bold, Ja as shellQuote, Ji as injectiveKey, Jn as refuseMalformedResourcesForDestroy, Jr as WorkGraph, Jt as configIntegerRefusal, K as toFiniteNumber, Ka as withErrorHandling, Ki as uploadCfnTemplate, Kn as refuseMalformedResourceEntriesForOrphan, Kr as AssetPublisher, Kt as coerceCfnInteger, L as planOrphanAdoption, La as ResourceTimeoutError, Li as resolveStateBucketWithDefaultAndSource, Ln as refuseDivergentRecordRegionForDestroy, Lr as hasReadableExportSet, Lt as isUnboundTemplateParameter, M as refusesFinalSnapshot, Mi as resolveApp, Mn as malformedRenderedContainersWarning, Mr as forceQuitRecoveryClause, Mt as cfnRefValueFromPhysicalId, N as unsupportedFinalSnapshotError, Na as MalformedProducerRecordRefusalError, Ni as resolveAutoAssetStorage, Nn as malformedResourceEntriesWarning, Nr as formatLockExpiry, Nt as coerceParameterTypedValue, O as buildFinalSnapshotIdentifier, Oa as DynamicReferenceRegionAmbiguousError, Oi as Synthesizer, On as malformedOrphansRefusalMessage, Or as rebuildClientForBucketRegion, Ot as isTerminationProtectionPropagationError, P as makeCanonicalizePropertiesFn, Pa as NestedStackChildDirectDestroyError, Pi as resolveCaptureObservedState, Pn as malformedResourcePropertiesWarning, Pr as CUSTOM_RESOURCE_RESPONSE_PREFIX, Pt as getAccountInfo, Q as red, Qa as isTransientServerError, Qi as decodeListingKey, Qn as repairMalformedResourceEntriesForReadOnly, Qr as rewriteTemplateAssetReferences, Qt as requireConfigArray, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as ResourceUpdateNotSupportedError, Ri as resolveUseCdkBootstrapAssets, Rn as refuseMalformedNestedChildOutputs, Rr as hasReasonlessBaselineRefusal, Rt as parameterTypeMayLoseSecretIdentity, S as computeParameterTaint, Si as runDockerForeground, Sn as hasReadableResources, Sr as recordMaskOnlyValue, St as slowCcOperationTimeoutMs, T as resourcesNamingDeclaredParameter, Ta as CrossAccountSecretRefusalError, Ti as stripControlChars, Tn as malformedExportSourceWarning, Tr as scrubResourceRecord, Tt as deleteSkipReason, U as coerceWarmThroughput$1, Ui as CFN_TEMPLATE_URL_LIMIT, Un as refuseMalformedOutputsForDestroy, Ur as orphansAfterRollback, Ut as resolveExplicitPhysicalId, V as renderStatefulReason, Vi as ssmResolvedValueType, Vn as refuseMalformedOrphansForOrphan, Vr as importableOutputs, Vt as WAFv2WebACLProvider, W as isWarmThroughputDecrease, Wi as MIGRATE_TMP_PREFIX, Wn as refuseMalformedResourceAttributesForOrphan, Wr as orphansCarriedFrom, Wt as assertRegionMatch, X as gray, Xa as isRetryableTransientError, Xi as producerCoordinateKey, Xn as repairMalformedOrphansForReadOnly, Xr as createAssetRedirectResolver, Xt as readConfigString, Y as cyan, Ya as isMarkedNonRetryable, Yi as injectiveKeyPrefix, Yn as refuseMalformedState, Yr as buildAssetRedirectMap, Yt as configStringRefusal, Z as green, Za as isThrottlingError, Zi as producerRecordKey, Zn as repairMalformedOutputsForReadOnly, Zr as loadPublishableAssetManifest, Zt as replayWarn, _ as bagHoldsSecretExpression, _a as AwsClients, _i as dockerSpawnEnvWithSensitive, _n as UNREADABLE_ORPHANS_CONTAINER_ROW, _r as identityKeyFor, _t as endCommandInterruptScope, a as DeploymentEventsStore, aa as globMatches, ai as parseBootstrapMarker, an as s3BucketDomainName, ar as describeTypeWithThrottleRetry, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as runWithStackAwsClients, bi as partitionSensitiveEnv, bn as hasReadableOrphans, br as maskSecretsInError, bt as startInterruptWatch, c as replayFailedOperations, ca as hasOwnKey, ci as validateContainerRepoName, cn as s3BucketWebsiteUrl, cr as TemplateParser, ct as IAMRoleProvider, d as updatePartialMessage, da as ownValue, di as buildDockerImage, dn as applyCallerIdentityCredentials, dr as STATE_SOURCED_READBACK_RULES, dt as ProviderRegistry, ea as PARTITION_TABLE, ei as BOOTSTRAP_MARKER_PREFIX, en as requireConfigString, eo as markRedactedCause, er as repairMalformedResourcesForReadOnly, et as collectDeclaredOutputNames, f as updatePartialReason, fa as absoluteAssemblyPathEscape, fi as resolveDockerContextDirectory, fn as callerEnvCredentials, fr as TEMPLATE_SOURCED_RULES, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as resolveBucketRegion, gi as describeDockerFailure, gn as STATE_RESOURCES_MALFORMED, gr as errorCauseChain, gt as beginCommandInterruptScope, h as IMPLICIT_DELETE_DEPENDENCIES, hi as describeDockerExecFailure, hn as INTRINSIC_KEYS, hr as dynamicReferenceTokens, ht as maskerOrIdentity, i as DeploymentEventsReader, ia as failedStageNote, ii as isCrossRegionRedirect, in as s3BucketArn, ir as findSilentDropProperties, it as secretBearing, j as isFinalSnapshotError, ja as LocalStartServiceError, ji as getLegacyStateBucketName, jn as malformedOutputsWarning, jr as buildLockContentionMessage, jt as carriesFetchableDynamicReference, k as ccRoutedFinalSnapshotError, ka as IntrinsicResolutionRefusalError, ki as synthesisStatusMessage, kn as malformedOrphansWarning, kr as UNREPRODUCIBLE_LOCK_CLAUSE, kt as IntrinsicFunctionResolver, l as replayRollback, la as hasPlainPrototype, li as buildDenyExternalAccessPolicy, ln as applyRoleArnIfSet, lr as STATE_SOURCED_BASELINE_RULES, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as resolveAssemblyPath, mi as describeDockerCapturedOutput, mn as DiffCalculator, mr as createSecretMasker, mt as maskDeep, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as derivePartitionAndUrlSuffix, ni as ensureAssetStorage, nn as producerRegionsFromState, no as describeAwsFailure, nr as safeStackName, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as processStackMessages, oi as readBootstrapMarkerBody, on as s3BucketDualStackDomainName, or as withRetry, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as renderAssemblyPathEscape, pi as warnManifestExecutable, pn as envCredentialsAreAssumedRole, pr as carriesSecretMask, pt as createMaskedRetryLogger, q as formatResourceLine, qa as pasteableCommand, qi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, qn as refuseMalformedResourcePropertiesForOrphan, qr as stringifyValue, qt as configBooleanRefusal, r as DeployEngine, ra as AssemblyReader, ri as getBootstrapMarkerKey, rn as withSharedDrainBudget, ro as safeStringify, rr as findActionableSilentDrops, rt as isExportAliasCollision, s as planRollback, sa as defineOwnKey, si as validateAssetBucketName, sn as s3BucketRegionalDomainName, sr as DagBuilder, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as canonicalizeRegion, ti as assertAssetBucketRegion, tn as classifyReplaySecretRegion, to as retryClassificationText, tr as safeRegion, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as nullPrototypeRecord, ui as assertCdkLocalDockerContextContained, un as AWS_CREDENTIAL_ENV_KEYS, ur as STATE_SOURCED_CROSS_GENERATION_RULES, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as getAwsClients, vi as formatDockerLoginError, vn as UNREADABLE_RESOURCES_MAP_ROW, vr as isSingleDynamicReferenceToken, vt as interruptWatchListenerCount, w as reachableDivergentParameters, wi as escapeRegExp, wn as malformedExportNamesWarning, wr as redactSecretsForState, wt as deleteIndeterminateGuards, x as bindingSkippedOutputs, xa as setAwsClients, xi as redactDockerArgvValues, xn as hasReadableOutputs, xr as maskSecretsInText, xt as CloudControlProvider, y as keptWholeReasonText, ya as resetAwsClients, yi as getDockerCmd, yn as displayLogicalId, yr as markSameGenerationBag, yt as isInterruptedWaitError, z as isStatefulRecreateTargetForReplace, za as StackHasActiveImportsError, zi as stateBucketExistenceConfirmed, zn as refuseMalformedOrphans, zr as hasUnverifiableParameterRefusal, zt as refStateLookupFromResource } from "./deploy-engine-BomFOZF4.js";
 import { C as displayAwsMessage, D as truncateCodePoints, E as isPasteableIdent, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-GASr9bAF.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-D_XcHZoy.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-B3RJYZnx.js";
+import { t as getCdkdVersion } from "./version-5OUy_OlQ.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BY-tj21g.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1759,10 +1759,18 @@ async function bootstrapDestroyCommand(options) {
 		if (markerBody === null) {
 			const probed = rawMarkerKey === markerKey ? markerKey : `${markerKey}, ${rawMarkerKey}`;
 			logger.info(`No bootstrap marker for region '${region}' (${probed}) — asset storage is not opted in for this region (or was already destroyed); nothing to delete.`);
-			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive. Re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear it down.`);
+			if (markerSiblings.sameRegionKeys.length > 0) for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A bootstrap marker for this region DOES exist at '${siblingKey}', under a different spelling of the region name — its asset bucket and ECR repository are still alive.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+				flag: "--region",
+				value: markerRegionOfKey(siblingKey),
+				hole: "region"
+			}]).command}`);
 			if (!options.includeStateBucket) {
 				if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so it is NOT known whether this region has a marker under another spelling of its name. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}' before re-bootstrapping — re-running 'cdkd bootstrap' while one exists writes a SECOND marker with DEFAULT names, and the next destroy would then tear down that storage while the storage the existing marker names survives.`);
-				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, re-run 'cdkd bootstrap --region ${region}' to recreate the marker, then destroy again.`);
+				else if (markerSiblings.sameRegionKeys.length === 0) logger.info(`If the asset bucket / ECR repo still exist without a marker, recreate the marker and destroy again.\nRecreate it with: ${pasteableCommand("cdkd bootstrap", [{
+					flag: "--region",
+					value: region,
+					hole: "region"
+				}]).command}`);
 				return;
 			}
 		} else marker = parseBootstrapMarker(markerBody, resolvedMarkerKey);
@@ -1780,9 +1788,14 @@ async function bootstrapDestroyCommand(options) {
 			if (markerSiblings.otherRegions.length > 0) throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region(s) ${markerSiblings.otherRegions.map((r) => displayIdent(r)).join(", ")} are still opted in to cdkd asset storage (their bootstrap markers live in this bucket). Run 'cdkd bootstrap --destroy --region <r>' for each first.`, "STATE_BUCKET_HOLDS_MARKERS");
 			if (markerSiblings.sameRegionKeys.length > 0) {
 				const canonicalStillPresent = markerBody !== null && resolvedMarkerKey === markerKey;
-				const listing = markerSiblings.sameRegionKeys.map((k) => canonicalStillPresent ? `  - ${k}` : `  - ${k}  (cdkd bootstrap --destroy --region ${markerRegionOfKey(k)})`).join("\n");
-				const remedy = canonicalStillPresent ? `Run 'cdkd bootstrap --destroy --region ${region}' WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : "Run the command shown against each marker above, then re-run with --include-state-bucket.";
-				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.`, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
+				const listing = markerSiblings.sameRegionKeys.map((k, i) => `  ${i + 1}. ${k}`).join("\n");
+				const teardownCommands = canonicalStillPresent ? "" : markerSiblings.sameRegionKeys.map((k, i) => `\n${i + 1}. Tear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+					flag: "--region",
+					value: markerRegionOfKey(k),
+					hole: "region"
+				}]).command}`).join("");
+				const remedy = canonicalStillPresent ? `Re-run the destroy for this region WITHOUT --include-state-bucket ONCE: it tears down '${resolvedMarkerKey}' and then prints the exact --region spelling for each marker still standing. Follow those, then re-run with --include-state-bucket. (No per-marker spelling is given here because '${resolvedMarkerKey}' still exists and would be resolved first — and simply repeating this same command would not clear the rest, since once it is gone this region's canonical key no longer resolves anything.)` : `Run each command below, then re-run with --include-state-bucket.`;
+				throw new CdkdError(`Refusing to delete state bucket '${bucketName}': region '${region}' has ${markerSiblings.sameRegionKeys.length} further bootstrap marker(s) under a different spelling of its name, which this teardown does not delete:\n${listing}\n${remedy}\nDestroy each one first — deleting the state bucket now would remove those markers while the asset storage they name survives, with no record of its names.` + teardownCommands, "STATE_BUCKET_HOLDS_SIBLING_MARKERS");
 			}
 		}
 		const planLines = [];
@@ -1808,7 +1821,11 @@ async function bootstrapDestroyCommand(options) {
 				await stateBackend.purgeNoncurrentVersions([resolvedMarkerKey], { objectDescription: "the bootstrap marker, which names this region's asset bucket and container-asset ECR repository" });
 			}
 			logger.info(`✓ Deleted bootstrap marker (${resolvedMarkerKey})`);
-			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run — re-run 'cdkd bootstrap --destroy --region ${markerRegionOfKey(siblingKey)}' to tear that one down too.`);
+			for (const siblingKey of markerSiblings.sameRegionKeys) logger.warn(`A further bootstrap marker for this region remains at '${siblingKey}' (this region was bootstrapped under more than one spelling of its name). It names asset storage that was NOT destroyed by this run.\nTear it down with: ${pasteableCommand("cdkd bootstrap", [{ literal: "--destroy" }, {
+				flag: "--region",
+				value: markerRegionOfKey(siblingKey),
+				hole: "region"
+			}]).command}`);
 			if (!markerListingSucceeded) logger.warn(`The bootstrap-marker listing could not be made, so a marker under another spelling of this region may still be live. Check 's3://${bucketName}/${BOOTSTRAP_MARKER_PREFIX}'.`);
 			logger.info(`\ncdkd asset storage is now OFF for region ${region}: future deploys in this region fall back to legacy mode (CDK bootstrap destinations) unless the region is bootstrapped again.`);
 		}
@@ -7346,86 +7363,41 @@ function isPlainObject$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
-* Is this `Destination` block written in the CFn FLATTENED form
-* (`{ BucketArn, Format, ... }`) rather than the SDK NESTED one
-* (`{ S3BucketDestination: { ... } }`)?
-*
-* ONE predicate, called from both `resolveS3BucketDestination` (which picks the
-* bag) and `s3BucketDestinationPath` (which names it). They were written out
-* twice and a reviewer rightly pointed out that two copies of a branch
-* condition must be edited together or a refusal starts naming the wrong key.
-*
-* `Bucket` is probed alongside `BucketArn` because the readers accept it
-* (`s3Dest['BucketArn'] ?? s3Dest['Bucket']`); omitting it made a
-* `{ Bucket }`-only block take the nested branch, find nothing, and drop — the
-* same silent drop one shape over.
-*/
-function isFlattenedDestination(dest) {
-	return Boolean(dest["BucketArn"] || dest["Bucket"] || dest["BucketAccountId"] || dest["Format"]);
-}
-/**
-* The CFn path of the destination bag `resolveS3BucketDestination` will pick —
-* issue #1493 item 3, which is a MESSAGE concern, not a value one.
-*
-* Kept separate from the resolver rather than returned alongside the bag:
-* `gen-nested-key-coverage`'s write-evidence walk follows a plain
-* `const x = this.helper(...)` binding to the members written beneath it, and
-* a DESTRUCTURED `const { bag, path } = ...` is a shape it cannot follow — so
-* pairing the two silently withdrew the write evidence for
-* `Destination.BucketArn` / `.BucketAccountId` and turned an opted-in target
-* red with no behavior change at all. Measured against the pre-change provider
-* via the critic's `--providers-dir=` seam.
-*/
-function s3BucketDestinationPath(dest, destinationPath) {
-	return isPlainObject$2(dest) && isFlattenedDestination(dest) ? destinationPath : `${destinationPath}.S3BucketDestination`;
-}
-/**
-* The FLATTENED CFn `Destination` block cdkd actually SENDS for `declared`
-* (issue #1707) — the shared fold behind BOTH halves of the #1633 pair: the
-* per-item `effectiveProperties` record and
+* The CFn `Destination` block cdkd actually SENDS for `declared` (issue #1707) —
+* the shared fold behind BOTH halves of the #1633 pair: the per-item
+* `effectiveProperties` record and
 * {@link S3BucketProvider.canonicalizeDesiredProperties}.
 *
-* The desired side accepts TWO spellings (`resolveS3BucketDestination` picks
-* either the flattened CFn block or the nested SDK `S3BucketDestination` one)
-* plus a `Bucket` / `BucketArn` alias inside either, while the readback
-* (`inventorySdkToCfn` / `analyticsSdkToCfn`) emits ONLY the flattened form with
-* `BucketArn`. So a record written in any other spelling can never match what
-* `readCurrentState` returns: `cdkd drift` re-reports it forever and `--revert`
-* re-issues the same Put — the never-emitted-KEY class of issue #1686, reached
-* through the SHAPE rather than through a value. The live CFn registry schema
-* agrees the flattened form is the only CFn spelling (`Destination` is
-* `{BucketArn, BucketAccountId, Format, Prefix}` with `additionalProperties:
-* false`), so `S3BucketDestination` and `Bucket` are cdkd-only tolerances.
-*
-* This NORMALIZES rather than retracting the tolerance, per the #1686 rule:
-* refusing the SDK spelling would break templates that deploy today. It also
-* supersedes #1670's write-back-at-the-DECLARED-branch decision, whose whole
-* reason was that writing at a hardcoded branch would leave the malformed value
-* alive at the other key and add a stray one — there is no other key left once
-* the block is normalized wholesale.
+* The readback (`inventorySdkToCfn` / `analyticsSdkToCfn`) emits only
+* `{BucketArn, BucketAccountId, Format, Prefix}`, the members the live CFn
+* registry schema declares (`additionalProperties: false`). The block is rebuilt
+* from exactly those members so a record never carries a key the readback cannot
+* report.
+*
+* The SDK spellings this once also folded (the nested
+* `{ S3BucketDestination: { ... } }` shape and a `Bucket` alias for
+* `BucketArn`) are gone: `BucketArn` and `Format` are schema-required here and
+* `AWS::S3::Bucket` is in `CFN_ENFORCED_TYPES`, so a template using either is
+* refused pre-flight by `nested-required.ts` (issue #3602).
 *
 * `Format` is the one member a caller can override: the applier passes the
 * value it SENT, which differs from the declared one when the warn-and-
-* SUBSTITUTE read replaced it (#1670). Absent on BOTH sides it defaults to the
-* `'CSV'` the appliers send, so the record carries what AWS will report back
-* rather than one key fewer.
+* SUBSTITUTE read replaced a malformed value (#1670). Absent on BOTH sides it
+* defaults to the `'CSV'` the appliers send, so the record carries what AWS
+* will report back rather than one key fewer.
 *
-* @returns the flattened block, or `declared` BY IDENTITY when it already is
-*   one (so an ordinary template records byte-for-byte what it declared) or is
-*   not a shape this can fold at all (absent / malformed — left for the
-*   resolver's own refusal to report).
+* @returns the rebuilt block, or `declared` BY IDENTITY when it already is one
+*   (so an ordinary template records byte-for-byte what it declared) or is not
+*   a shape this can fold at all (absent / malformed / no `BucketArn` — left for
+*   the resolver's own refusal to report).
 */
 function effectiveS3BucketDestination(declared, sentFormat) {
 	if (!isPlainObject$2(declared)) return declared;
-	const bag = isFlattenedDestination(declared) ? declared : declared["S3BucketDestination"];
-	if (!isPlainObject$2(bag)) return declared;
-	if (!bag["BucketArn"] && !bag["Bucket"]) return declared;
-	const out = {};
-	const bucketArn = bag["BucketArn"] ?? bag["Bucket"];
-	if (bucketArn !== void 0) out["BucketArn"] = bucketArn;
-	if (bag["BucketAccountId"] !== void 0) out["BucketAccountId"] = bag["BucketAccountId"];
-	out["Format"] = sentFormat ?? declaredOrDefault(bag, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT);
-	if (bag["Prefix"] !== void 0) out["Prefix"] = bag["Prefix"];
+	if (!declared["BucketArn"]) return declared;
+	const out = { BucketArn: declared["BucketArn"] };
+	if (declared["BucketAccountId"] !== void 0) out["BucketAccountId"] = declared["BucketAccountId"];
+	out["Format"] = sentFormat ?? declaredOrDefault(declared, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT);
+	if (declared["Prefix"] !== void 0) out["Prefix"] = declared["Prefix"];
 	return sameScalarRecord(out, declared) ? declared : out;
 }
 /**
@@ -7433,14 +7405,6 @@ function effectiveS3BucketDestination(declared, sentFormat) {
 * NEVER `??`, and that distinction is the whole guard against issue #1670's
 * finding 3.
 *
-* The ONE licensed `??` in these folds is the ALIAS read
-* `bag['BucketArn'] ?? bag['Bucket']`, and it is not an exception to this rule —
-* it supplies no DEFAULT. It picks between two spellings of the same declared
-* value, exactly as the applier's own read does, so a nullish `BucketArn`
-* correctly falls through to the alias the wire would have used. When neither is
-* declared the key is simply absent from the fold's output, which is what makes
-* a bucket-less block identity-return rather than gain a phantom key.
-*
 * The default belongs to a key the template OMITTED: there the provider sends
 * it, the readback reports it, and folding both sides is what makes them agree.
 * A key DECLARED with a malformed value is a different case entirely — the
@@ -7662,10 +7626,14 @@ function foldToleratedAliases(bag, aliases) {
 }
 /** The transition date member, held in a CONST so the fold writes it COMPUTED. */
 const TRANSITION_DATE_KEY = "TransitionDate";
-/** The lifecycle `Transitions[]` aliases the applier accepts (issue #1748). */
+/**
+* The lifecycle `Transitions[]` aliases the applier accepts (issue #1748).
+*
+* `NoncurrentVersionTransitions[]` has none: its `TransitionInDays` is a
+* schema-required member, so a template spelling it `NoncurrentDays` is refused
+* pre-flight by `nested-required.ts` and the alias was dropped (issue #3585).
+*/
 const TRANSITION_ALIASES = [["TransitionInDays", "Days"], ["TransitionDate", "Date"]];
-/** The lifecycle `NoncurrentVersionTransitions[]` alias (issue #1748). */
-const NONCURRENT_VERSION_TRANSITION_ALIASES = [["TransitionInDays", "NoncurrentDays"]];
 /** The refusal path for the notification EventBridge boolean (issue #1759). */
 const EVENTBRIDGE_CONFIG_PATH = "AWS::S3::Bucket NotificationConfiguration.EventBridgeConfiguration";
 /**
@@ -7736,27 +7704,25 @@ function dropEmptyNotificationFamilies(config) {
 	}
 	return out ?? config;
 }
-/** The `NotificationConfiguration` ARN aliases, per family (issue #1748). */
-const NOTIFICATION_ARN_ALIASES = [
-	["TopicConfigurations", [["Topic", "TopicArn"]]],
-	["QueueConfigurations", [["Queue", "QueueArn"]]],
-	["LambdaConfigurations", [["Function", "LambdaFunctionArn"]]]
-];
 /**
-* The `Event` / `Events` half of the same item (issue #1748).
+* The `Event` / `Events` spelling on a notification item (issue #1748).
+*
+* `Event` is the member the CFn registry schema declares (`TopicConfiguration`
+* is `{Event, Filter, Topic}` — there is no `Events`) and therefore the one
+* EVERY template carries. The applier accepts both
+* (`t['Event'] !== undefined ? [t['Event']] : t['Events']`), because the
+* readback emits `Events` for a multi-event live configuration and
+* `drift --revert` sends a readback-shaped bag.
 *
-* The ARN alias is not the only never-emitted spelling on a notification item,
-* and this one is the WIDER of the two: `TopicArn` is a cdkd-only tolerance
-* almost no template uses, while `Event` is the member the CFn registry schema
-* declares (`TopicConfiguration` is `{Event, Filter, Topic}` — there is no
-* `Events`) and therefore the one EVERY template carries. The applier accepts
-* both (`t['Event'] !== undefined ? [t['Event']] : t['Events']`).
+* This is not a pure rename — the SDK member is a LIST — so it folds by ARITY:
+* a single-element list is the CFn `Event`, and a longer one has no CFn
+* spelling at all and is left as `Events`, which is what the readback emits for
+* it.
 *
-* Unlike the ARN pair this is not a pure rename — the SDK member is a LIST — so
-* it folds by ARITY: a single-element list is the CFn `Event`, and a longer one
-* has no CFn spelling at all and is left as `Events`, which is what the readback
-* emits for it. That asymmetry is why it is a separate step rather than another
-* {@link foldToleratedAliases} entry.
+* The destination ARN has no alias: `Topic` / `Queue` / `Function` are
+* schema-required members, so the SDK spellings (`TopicArn`, …) are refused
+* pre-flight by `nested-required.ts` and the applier no longer reads them
+* (issue #3585).
 *
 * `readNotification` was emitting `Events` unconditionally, so the record and
 * the readback disagreed on every notification-configured bucket; it now
@@ -7781,20 +7747,12 @@ function foldNotificationEvents(item) {
 * `readNotification` emits (issue #1748) — the never-emitted-KEY class of issue
 * #1686 reached through the SHAPE rather than through a value.
 *
-* `applyNotificationConfiguration` accepts the SDK spelling of each destination
-* ARN alongside the CFn one (`t['Topic'] ?? t['TopicArn']`, and the two
-* siblings), while `readNotification` emits only `Topic` / `Queue` /
-* `Function` — the spellings the live CFn registry schema declares
-* (`TopicConfiguration` is `{Event, Filter, Topic}`, with no `TopicArn`
-* member at all, so the SDK spellings are cdkd-only tolerances). A record
-* written in the tolerated spelling therefore can never match the readback:
-* `cdkd drift` re-reports it forever and `--revert` re-issues the same Put,
-* with NO warning anywhere, because nothing is malformed and nothing is
-* substituted.
-*
-* This NORMALIZES rather than retracting the tolerance, per #1686's third
-* generalization: refusing the SDK spelling would break templates that deploy
-* today, and buys nothing the normalization does not.
+* `applyNotificationConfiguration` accepts a single-element `Events` list
+* alongside the CFn scalar `Event` ({@link foldNotificationEvents}), while
+* `readNotification` emits `Event` for it. A record written in the list
+* spelling therefore can never match the readback: `cdkd drift` re-reports it
+* forever and `--revert` re-issues the same Put, with NO warning anywhere,
+* because nothing is malformed and nothing is substituted.
 *
 * The Put is a FULL REPLACE with no skip arm, so there is no
 * previous-value-retained case to distinguish — whenever it succeeds, this is
@@ -7807,7 +7765,7 @@ function foldNotificationEvents(item) {
 function effectiveNotificationConfiguration(config) {
 	if (!isPlainObject$2(config)) return config;
 	let out = config;
-	for (const [listKey, aliases] of NOTIFICATION_ARN_ALIASES) out = canonicalizeItemList(out, listKey, (item) => foldNotificationEvents(foldToleratedAliases(item, aliases)));
+	for (const listKey of NOTIFICATION_LIST_KEYS) out = canonicalizeItemList(out, listKey, foldNotificationEvents);
 	out = dropEmptyNotificationFamilies(out);
 	return foldEventBridgeConfiguration(out);
 }
@@ -8248,18 +8206,13 @@ function foldLifecycleScope(rule, useFilterForm) {
 * `readLifecycle` emits (issue #1748) — the lifecycle half of the same class.
 *
 * `applyLifecycleConfiguration` accepts the SDK day/date spellings alongside the
-* CFn ones on both transition families (`t['TransitionInDays'] ?? t['Days']`,
-* `t['TransitionDate'] ?? t['Date']`, `nvt['TransitionInDays'] ??
-* nvt['NoncurrentDays']`) while `readLifecycle` emits only `TransitionInDays` /
-* `TransitionDate` — again the only spellings the registry schema declares
-* (`Transition` is `{StorageClass, TransitionDate, TransitionInDays}`,
-* `NoncurrentVersionTransition` is `{StorageClass, TransitionInDays,
-* NewerNoncurrentVersions}`).
-*
-* The issue named the `Date` alias; the mechanical audit it asks for (match the
-* `(a['X'] ?? a['Y'])` ALIAS form, not a plain bracket read) found all THREE in
-* the same two item shapes, so fixing only the reported one would have left its
-* siblings broken — the "diff the WHOLE blob, not the reported key" rule.
+* CFn ones on `Transitions` (`t['TransitionInDays'] ?? t['Days']`,
+* `t['TransitionDate'] ?? t['Date']`) while `readLifecycle` emits only
+* `TransitionInDays` / `TransitionDate` — again the only spellings the registry
+* schema declares (`Transition` is `{StorageClass, TransitionDate,
+* TransitionInDays}`). `NoncurrentVersionTransitions` has no alias to fold: its
+* `TransitionInDays` is schema-required, so the `NoncurrentDays` spelling is
+* refused pre-flight and the applier no longer reads it (issue #3585).
 *
 * Issues #1754 / #1755 finished the block, so the "still differs on those keys"
 * caveat this doc carried is gone: the legacy SINGULAR `Transition` /
@@ -8309,7 +8262,6 @@ function effectiveLifecycleConfiguration(config) {
 function effectiveLifecycleRule(rule, useFilterForm) {
 	let out = foldLegacySingularTransitions(rule);
 	out = canonicalizeItemList(out, "Transitions", (t) => foldTransitionDate(foldToleratedAliases(t, TRANSITION_ALIASES)));
-	out = canonicalizeItemList(out, "NoncurrentVersionTransitions", (nvt) => foldToleratedAliases(nvt, NONCURRENT_VERSION_TRANSITION_ALIASES));
 	out = dropEmptyTransitionLists(out);
 	out = foldLifecycleExpiration(out);
 	out = foldNoncurrentVersionExpiration(out);
@@ -8376,8 +8328,8 @@ function canonicalizeItemList(properties, key, fold) {
 /**
 * Name a malformed value in a refusal message, the way `config-shape.ts`'s
 * private `describe` does for the string-reading guards. Kept local rather than
-* exported from there because `resolveS3BucketDestination` is S3-specific
-* branch selection, not a shared shape guard — the two only share the wording.
+* exported from there because `resolveS3BucketDestination` is an S3-specific
+* refusal, not a shared shape guard — the two only share the wording.
 */
 function describeValue$1(value, maskSecrets = (text) => text) {
 	if (value === null) return "null";
@@ -8915,7 +8867,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 			else if (coerceCfnNumber(legacyNveDays) !== void 0) sdkRule.NoncurrentVersionExpiration = { NoncurrentDays: coerceCfnNumber(legacyNveDays) };
 			const toSdkNvt = (nvt) => ({
-				NoncurrentDays: nvt["TransitionInDays"] ?? nvt["NoncurrentDays"],
+				NoncurrentDays: nvt["TransitionInDays"],
 				StorageClass: nvt["StorageClass"],
 				NewerNoncurrentVersions: nvt["NewerNoncurrentVersions"]
 			});
@@ -9126,21 +9078,21 @@ var S3BucketProvider = class S3BucketProvider {
 			const topics = notifConfig["TopicConfigurations"];
 			if (topics && Array.isArray(topics) && topics.length > 0) cfg.TopicConfigurations = topics.map((t) => ({
 				Id: t["Id"],
-				TopicArn: t["Topic"] ?? t["TopicArn"],
+				TopicArn: t["Topic"],
 				Events: t["Event"] !== void 0 ? [t["Event"]] : t["Events"],
 				Filter: this.cfnNotifFilterToSdk(t["Filter"])
 			}));
 			const queues = notifConfig["QueueConfigurations"];
 			if (queues && Array.isArray(queues) && queues.length > 0) cfg.QueueConfigurations = queues.map((q) => ({
 				Id: q["Id"],
-				QueueArn: q["Queue"] ?? q["QueueArn"],
+				QueueArn: q["Queue"],
 				Events: q["Event"] !== void 0 ? [q["Event"]] : q["Events"],
 				Filter: this.cfnNotifFilterToSdk(q["Filter"])
 			}));
 			const lambdas = notifConfig["LambdaConfigurations"];
 			if (lambdas && Array.isArray(lambdas) && lambdas.length > 0) cfg.LambdaFunctionConfigurations = lambdas.map((l) => ({
 				Id: l["Id"],
-				LambdaFunctionArn: l["Function"] ?? l["LambdaFunctionArn"],
+				LambdaFunctionArn: l["Function"],
 				Events: l["Event"] !== void 0 ? [l["Event"]] : l["Events"],
 				Filter: this.cfnNotifFilterToSdk(l["Filter"])
 			}));
@@ -9225,39 +9177,32 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 	}
 	/**
-	* Pick the `S3BucketDestination` bag out of an analytics / inventory
-	* `Destination` block, refusing a shape that would otherwise be dropped.
-	*
-	* Two shapes are legitimate and both must keep working: the CFn FLATTENED
-	* form (`Destination: { BucketArn, Format, ... }`, what the schema declares)
-	* and the SDK NESTED form (`Destination: { S3BucketDestination: { ... } }`,
-	* accepted because state records and hand-written templates carry it).
-	*
-	* Issue #1493 item 2: the branch was picked by probing member presence
-	* (`dest?.['BucketAccountId'] || dest?.['BucketArn'] || dest?.['Format']`),
-	* so a `Destination` that is a STRING / array / unresolved intrinsic indexed
-	* every probe to `undefined`, fell through to an equally-`undefined`
-	* `S3BucketDestination`, and the caller's `s3Dest ? … : undefined` omitted
-	* the whole block from the Put — a configuration silently deployed without
-	* the destination it declared. Unlike the sibling defaulting class this is a
-	* DROP, not a substituted default, so `readConfigString` does not cover it:
-	* it needs its own decision, and per issue #1513's precedent that decision is
-	* REFUSE on the template-borne create path, WARN on the replay-reachable
-	* update path (`onUnusable`), where the desired bag can be a historical cdkd
-	* state record with no template-side remedy.
-	*
-	* Also returns the CFn path of the bag it picked (issue #1493 item 3): the
-	* callers used to hardcode `…Destination.S3BucketDestination` in the
-	* `containerPath` they pass to `readConfigString`, so a refusal on the
-	* FLATTENED branch — where the bag IS `dest` itself — named a key the user's
-	* template does not contain.
-	*
-	* @returns the picked bag, or `undefined` when the block was ABSENT or was
-	*   refused on a warn-only path. The caller distinguishes the two by testing
-	*   its own `Destination` value — see the `continue` at each call site.
+	* Validate an analytics / inventory `Destination` block, refusing a shape
+	* that would otherwise be dropped.
+	*
+	* The block is the CFn form the schema declares (`Destination: { BucketArn,
+	* Format, ... }`). The SDK NESTED form (`{ S3BucketDestination: { ... } }`)
+	* and a `Bucket` alias for `BucketArn` are no longer read: `BucketArn` and
+	* `Format` are schema-required, so a template using either is refused
+	* pre-flight by `nested-required.ts` (issue #3602). What still reaches this
+	* guard with such a shape (an unresolved intrinsic on the path, or a replayed
+	* pre-#1707 state record) is refused here like any other bucket-less block.
+	*
+	* Issue #1493 item 2: a `Destination` that is a STRING / array / unresolved
+	* intrinsic used to index every probe to `undefined`, and the caller's
+	* `s3Dest ? … : undefined` omitted the whole block from the Put — a
+	* configuration silently deployed without the destination it declared. Unlike
+	* the sibling defaulting class this is a DROP, not a substituted default, so
+	* `readConfigString` does not cover it: per issue #1513's precedent the
+	* decision is REFUSE on the template-borne create path, WARN on the
+	* replay-reachable update path (`onUnusable`), where the desired bag can be a
+	* historical cdkd state record with no template-side remedy.
+	*
+	* @returns the block, or `undefined` when it was ABSENT or was refused on a
+	*   warn-only path. The caller distinguishes the two by testing its own
+	*   `Destination` value — see the `continue` at each call site.
 	*/
 	resolveS3BucketDestination(dest, destinationPath, onUnusable, maskSecrets = (text) => text) {
-		const nestedPath = `${destinationPath}.S3BucketDestination`;
 		const drop = (message) => {
 			if (onUnusable) {
 				onUnusable(`${message}. Leaving this configuration unchanged; the same value is REFUSED on a template-path create`);
@@ -9267,11 +9212,8 @@ var S3BucketProvider = class S3BucketProvider {
 		};
 		if (dest === void 0 || dest === null) return;
 		if (!isPlainObject$2(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
-		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest, maskSecrets)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$2(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag, maskSecrets)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
-		return bag;
+		if (!dest["BucketArn"]) return drop(`${destinationPath} has no destination bucket (BucketArn) (got ${describeValue$1(dest, maskSecrets)}) — the request would be rejected by S3, or silently carry no destination`);
+		return dest;
 	}
 	/**
 	* Apply analytics configurations
@@ -9332,13 +9274,12 @@ var S3BucketProvider = class S3BucketProvider {
 					skipped.push(index);
 					continue;
 				}
-				const destPath = s3BucketDestinationPath(rawDest, analyticsDestPath);
 				analyticsConfig.StorageClassAnalysis = { DataExport: {
 					OutputSchemaVersion: sentOutputSchemaVersion = this.readSubstitutedConfigString(dataExport, "OutputSchemaVersion", ANALYTICS_DEFAULT_OUTPUT_SCHEMA_VERSION, "AWS::S3::Bucket AnalyticsConfigurations[].StorageClassAnalysis.DataExport", { ...onUnusable ? { onUnusable } : {} }),
 					Destination: s3Dest ? { S3BucketDestination: {
-						Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
+						Bucket: s3Dest["BucketArn"],
 						BucketAccountId: s3Dest["BucketAccountId"],
-						Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
+						Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, analyticsDestPath, { ...onUnusable ? { onUnusable } : {} }),
 						Prefix: s3Dest["Prefix"]
 					} } : void 0
 				} };
@@ -9462,7 +9403,6 @@ var S3BucketProvider = class S3BucketProvider {
 				skipped.push(index);
 				continue;
 			}
-			const destPath = s3BucketDestinationPath(rawDest, inventoryDestPath);
 			let sentFormat;
 			const scheduleFrequencyRefusal = onUnusable ? configStringRefusal(config, "ScheduleFrequency", "Weekly", "AWS::S3::Bucket InventoryConfigurations[]") : void 0;
 			if (scheduleFrequencyRefusal !== void 0 && config["Schedule"] == null) {
@@ -9483,9 +9423,9 @@ var S3BucketProvider = class S3BucketProvider {
 				IncludedObjectVersions: readConfigString(config, "IncludedObjectVersions", INVENTORY_DEFAULT_INCLUDED_OBJECT_VERSIONS, "AWS::S3::Bucket InventoryConfigurations[]"),
 				Schedule: { Frequency: frequency },
 				Destination: { S3BucketDestination: s3Dest ? {
-					Bucket: s3Dest["BucketArn"] ?? s3Dest["Bucket"],
+					Bucket: s3Dest["BucketArn"],
 					AccountId: s3Dest["BucketAccountId"],
-					Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, destPath, { ...onUnusable ? { onUnusable } : {} }),
+					Format: sentFormat = this.readSubstitutedConfigString(s3Dest, "Format", INVENTORY_DESTINATION_DEFAULT_FORMAT, inventoryDestPath, { ...onUnusable ? { onUnusable } : {} }),
 					Prefix: s3Dest["Prefix"]
 				} : void 0 },
 				OptionalFields: config["OptionalFields"],
@@ -64681,8 +64621,25 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const stateTargetFor = (logicalId, resourceType) => resourceType === NESTED_STACK_TYPE ? `${stackName}~${logicalId}` : stackName;
 	const skippedStateTargets = /* @__PURE__ */ new Set();
 	const failedStateTargets = /* @__PURE__ */ new Set();
-	/** `'cmd A' / 'cmd B'` — the quoted, slash-joined hint both summary arms print. */
-	const hintFor = (command, targets) => targets.map((t) => `'${command} ${t}'`).join(" / ");
+	/**
+	* One labelled line per target — the hint both summary arms print.
+	*
+	* The PROSE quotes are gone, every target goes through the shared gate, and
+	* each command gets its OWN line (go-to-k/cdkd#3436). The old
+	* `'${command} ${t}'` wrapper is the shape whose paste ran an interpolated
+	* value, and this builder was the issue's example of a command the repo-wide
+	* grep cannot see, since neither `'cdkd ` nor the value is on the same line
+	* as the other. The ` / ` join that first replaced it was its own defect:
+	* pasted, it handed the second command to the first as arguments.
+	*/
+	const hintFor = (command, targets, label) => [...new Set(targets.map((t) => `\n${label}: ${pasteableCommand(command, [{
+		value: t,
+		hole: "stack"
+	}, {
+		flag: "--stack-region",
+		value: regionForState,
+		hole: "region"
+	}]).command}`))].join("");
 	const buildDestroySnapshot = () => {
 		const { imports: _imports, outputReads: _outputReads, ...rest } = state;
 		return {
@@ -64970,21 +64927,26 @@ async function runDestroyForStack(stackName, state, ctx) {
 		const skippedSuffix = result.skippedCount > 0 ? `, ${yellow(result.skippedCount)} skipped` : "";
 		const guardSuffix = result.guardIndeterminateCount > 0 ? `, ${yellow(result.guardIndeterminateCount)} unverified` : "";
 		if (result.guardIndeterminateCount > 0) {
-			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : `Run 'cdkd events ${stackName}' for the RESOURCE_GUARD_INDETERMINATE entries, which name the check and the reason and survive the run.`;
+			const durablePointer = ctx.eventRecorder === void 0 ? "This summary is the only record: this run wrote no deployment events, either because it is a 'cdkd state destroy' (go-to-k/cdkd#2423) or because it is a nested-stack child, neither of which threads an event recorder." : `The RESOURCE_GUARD_INDETERMINATE entries name the check and the reason and survive the run.\nRead them with: ${pasteableCommand("cdkd events", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`;
 			logger.warn(`\n${yellow("⚠")} ${result.guardIndeterminateCount} pre-flight safety check(s) could NOT be completed during this destroy and cdkd proceeded anyway: ${[...guardIndeterminateTargets].join(", ")}. A check can be suppressed by DENYING the permission it needs, so treat this as unconfirmed rather than benign. ${durablePointer}`);
 		}
 		if (!preserveState) logger.info(`\n${green("✓")} ${bold(`Stack ${stackName} destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${guardSuffix}, ${result.errorCount} errors)`);
 		else if (result.interrupted && result.errorCount === 0) logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} destroy interrupted`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to finish.`);
 		else if (result.errorCount === 0) {
 			const targets = [...skippedStateTargets];
-			const showHint = hintFor("cdkd state show", targets);
-			const orphanHint = hintFor("cdkd state orphan", targets);
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json (${showHint}) and re-run, or delete them by hand and drop the records with ${orphanHint}.`);
+			const showHint = hintFor("cdkd state show", targets, "Inspect it with");
+			const orphanHint = hintFor("cdkd state orphan", targets, "Drop the record with");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${result.errorCount} errors). cdkd could not address the skipped resource(s), so they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop the records.` + showHint + orphanHint);
 		} else {
-			const orphanHint = hintFor("cdkd state orphan", failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName]);
+			const orphanHint = hintFor("cdkd state orphan", failedStateTargets.size > 0 ? [...failedStateTargets] : [stackName], "Drop the record with");
 			const skippedTargets = [...skippedStateTargets];
-			const skippedClause = skippedTargets.length > 0 ? ` Separately, ${result.skippedCount} resource(s) were SKIPPED — cdkd could not address them, so no delete was issued and they may still exist in AWS. Fix the physicalId in state.json (${hintFor("cdkd state show", skippedTargets)}) and re-run, or delete them by hand and drop the records with ${hintFor("cdkd state orphan", skippedTargets)}.` : "";
-			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, ${orphanHint} is the last resort: it removes the state record without deleting AWS resources.` + skippedClause);
+			const skippedClause = skippedTargets.length > 0 ? ` Separately, ${result.skippedCount} resource(s) were SKIPPED — cdkd could not address them, so no delete was issued and they may still exist in AWS. Fix the physicalId in state.json and re-run, or delete them by hand and drop their records.` : "";
+			const skippedCommands = hintFor("cdkd state show", skippedTargets, "Inspect it with") + hintFor("cdkd state orphan", skippedTargets, "Drop the record with");
+			const dedupedCommands = (lines) => [...new Set(lines.split("\n").filter((l) => l !== ""))].map((l) => `\n${l}`).join("");
+			logger.warn(`\n${yellow("⚠")} ${bold(`Stack ${stackName} partially destroyed`)} (${green(result.deletedCount)} deleted${retainedSuffix}${skippedSuffix}${guardSuffix}, ${red(result.errorCount)} errors). State preserved — re-run 'cdkd destroy' / 'cdkd state destroy' to clean up. If the same resource keeps failing, dropping the state record is the last resort: it removes the record without deleting AWS resources.` + skippedClause + dedupedCommands(orphanHint + skippedCommands));
 		}
 	} finally {
 		try {
@@ -65104,11 +65066,11 @@ function getCurrentNestedStackContext() {
 * @param alsoSkippedCount resources the child SKIPPED (no AWS call issued)
 * @param alsoInterrupted  whether the child's destroy was also interrupted
 */
-function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted) {
+function nestedStackChildFailureMessage(childStackName, errorCount, alsoSkippedCount, alsoInterrupted, inspectCommand) {
 	const extra = [];
 	if (alsoSkippedCount > 0) extra.push(`${alsoSkippedCount} resource(s) were also skipped`);
 	if (alsoInterrupted) extra.push("the child destroy was also interrupted");
-	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + `. The child's state is PRESERVED and still lists them — inspect it with 'cdkd state show ${childStackName}', resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable.`;
+	return `Nested stack ${childStackName} failed to destroy: ${errorCount} resource(s) failed to delete` + (extra.length > 0 ? ` (${extra.join("; ")})` : "") + `. The child's state is PRESERVED and still lists them — inspect it, resolve the failure, and re-run the destroy. The parent's record of this nested stack is kept so the child stays reachable.\nInspect it with: ${inspectCommand}`;
 }
 
 //#endregion
@@ -65285,7 +65247,10 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.resourceTimeoutByType && { resourceTimeoutByType: ctx.destroyOptions.resourceTimeoutByType }
 		}));
 		if (childResult.errorCount > 0) {
-			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted));
+			const failure = new Error(nestedStackChildFailureMessage(childStackName, childResult.errorCount, childResult.skippedCount, childResult.interrupted, pasteableCommand("cdkd state show", [{
+				value: childStackName,
+				hole: "stack"
+			}]).command));
 			throw childResult.interrupted ? markNonRetryable(failure) : failure;
 		}
 		if (childResult.skippedCount > 0 || childResult.interrupted) {
@@ -68325,6 +68290,36 @@ function conditionsDependOnTokenParameters(template, tokenParameterNames) {
 	}
 	return false;
 }
+/**
+* The reason a repaired `properties` map puts on the node's `blocking`
+* (go-to-k/cdkd#3335).
+*
+* `cdkd diff` REPAIRS this container and previews the record; `cdkd deploy`
+* REFUSES it inside `DiffCalculator.calculateDiff`, which both deploy paths
+* reach. So the preview is honest about the rows and wrong about what happens
+* next, and this is the sentence that says so.
+*
+* The ids are NOT re-rendered here: they have already been through
+* `malformedResourcePropertiesWarning`'s sanitizer in the warning printed
+* beside this, and the renderer strips control characters from every blocking
+* reason on the way out. The count is what this line adds — and the line does
+* not send the reader to that warning for the names, because the warning caps
+* at five before `and N more`, and under `--json` this reason ships in the
+* payload, where "above" has no referent.
+*/
+function deployRefusesPropertiesReason(logicalIds) {
+	return `${logicalIds.length} resource record(s) hold a 'properties' map that cannot be read. This preview repaired them to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.`;
+}
+/**
+* The `outputs` twin of {@link deployRefusesPropertiesReason}, a constant
+* because the bag is refused as a whole and there is nothing to count.
+*
+* `refuseMalformedOutputs` in `DeployEngine` is what refuses it. This arm is
+* the one the issue could not drive end to end — a record whose template
+* declares no Outputs produces no delta at all, so before this the node had
+* nothing to report and `--fail` exited 0.
+*/
+const DEPLOY_REFUSES_OUTPUTS_REASON = "The 'outputs' bag cannot be read. This preview repaired it to empty; 'cdkd deploy' refuses the record instead, so the deploy this previews will not start.";
 /** How many unreadable row names the human preview lists before summarizing. */
 const UNREADABLE_PREVIEW_NAMES = 10;
 /** Empty template used to diff a removed nested child's state → all DELETE. */
@@ -68392,6 +68387,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
 		const unreadable = [];
+		const deployRefusals = [];
 		if (repairMalformedResourcesForReadOnly(result.state)) {
 			logger.warn(malformedResourcesWarning(stackName, region));
 			unreadable.push(UNREADABLE_RESOURCES_MAP_ROW);
@@ -68402,8 +68398,14 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 			unreadable.push(...dropped);
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
-		if (unreadableProps.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
-		if (repairMalformedOutputsForReadOnly(result.state)) logger.warn(malformedOutputsWarning(stackName, region));
+		if (unreadableProps.length > 0) {
+			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
+			deployRefusals.push(deployRefusesPropertiesReason(unreadableProps));
+		}
+		if (repairMalformedOutputsForReadOnly(result.state)) {
+			logger.warn(malformedOutputsWarning(stackName, region));
+			deployRefusals.push(DEPLOY_REFUSES_OUTPUTS_REASON);
+		}
 		if (repairMalformedOrphansForReadOnly(result.state)) {
 			logger.warn(malformedOrphansWarning(stackName, region));
 			unreadable.push(UNREADABLE_ORPHANS_CONTAINER_ROW);
@@ -68411,7 +68413,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
 		return {
 			state: result.state,
-			unreadable
+			unreadable,
+			deployRefusals
 		};
 	}
 	return {
@@ -68423,7 +68426,8 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 			version: 10,
 			lastModified: Date.now()
 		},
-		unreadable: []
+		unreadable: [],
+		deployRefusals: []
 	};
 }
 /**
@@ -68572,6 +68576,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	let adoptedOrphans = [];
 	let adoptedRecords = {};
 	let blocking = [];
+	const deployRefusals = [];
 	let stateForDiff = currentState;
 	const unreadableOrphans = [];
 	if (currentState.orphans?.length && options.previewOrphanAdoption) {
@@ -68598,7 +68603,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 				}
 			};
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
-			if (tornAdopted.length > 0) logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+			if (tornAdopted.length > 0) {
+				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
+			}
 		}
 	}
 	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties);
@@ -68641,7 +68649,8 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		adoptedOrphans,
 		adoptedRecords,
 		blocking,
-		unreadableOrphans
+		unreadableOrphans,
+		deployRefusals
 	};
 }
 /**
@@ -68719,10 +68728,10 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths } = args;
-	const { state, unreadable } = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, ancestorTemplatePaths, isNestedChild } = args;
+	const { state, unreadable, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
-	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking, unreadableOrphans, deployRefusals: adoptedDeployRefusals } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
 		...parameters && { parameters },
 		...canonicalizeProperties && { canonicalizeProperties },
 		...cfnFallback !== void 0 && { cfnFallback },
@@ -68744,7 +68753,11 @@ async function buildDiffTree(args) {
 		ccApiRoutes: collectCcApiRoutes(template, stateAfterAdoption),
 		outputChanges,
 		adoptedOrphans,
-		blocking,
+		blocking: isNestedChild ? blocking : [
+			...deployRefusals,
+			...adoptedDeployRefusals,
+			...blocking
+		],
 		unreadable: [...unreadable, ...unreadableOrphans],
 		children: []
 	};
@@ -68778,6 +68791,7 @@ async function buildDiffTree(args) {
 			...cfnFallback !== void 0 && { cfnFallback },
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			ancestorTemplatePaths: childAncestorTemplatePaths,
+			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
@@ -69214,9 +69228,18 @@ var DiffDetectedError = class DiffDetectedError extends CdkdError {
 	}
 };
 /**
-* Signals that the preview completed and `cdkd deploy` would REFUSE to start
-* (issue go-to-k/cdkd#2943) — today, a rollback-orphan record whose physical
-* id another cdkd stack already manages.
+* Signals that the preview completed and `cdkd deploy` would REFUSE to start.
+* Two conditions reach it, and the message must fit BOTH:
+*
+*  - a rollback-orphan record whose physical id another cdkd stack already
+*    manages (issue go-to-k/cdkd#2943), where the remedy is resolving the
+*    ownership conflict between two stacks;
+*  - a container this preview REPAIRED and the deploy refuses — a resource's
+*    unreadable `properties` map or an unreadable `outputs` bag (issue
+*    go-to-k/cdkd#3335), where there is no second stack at all and the remedy
+*    is repairing the one record.
+*
+* So the message names no remedy at all and closes on the count.
 *
 * Exit **3**, and neither 1 nor 2, for reasons that are about what a caller
 * can conclude:
@@ -69226,18 +69249,19 @@ var DiffDetectedError = class DiffDetectedError extends CdkdError {
 *    code for "there is work to do" and "the work cannot begin".
 *  - **2** is this CLI's partial-failure family, documented as "work
 *    completed, re-running typically resolves it" (`docs/cli-reference.md`).
-*    A refusal is the opposite: re-running changes nothing until a human
-*    resolves the ownership conflict.
+*    A refusal is the opposite: re-running changes nothing until a human acts
+*    — repairing the record, or resolving the ownership conflict, depending on
+*    which condition fired.
 *
 * It is NOT silent: unlike `--fail`, this is not a flag the user opted into,
 * so the reason has to be visible even when the diff report scrolled away.
-* The `Blocking` section already printed the per-record detail; this adds the
-* one line that says the run cannot proceed.
+* The `Blocking` section already printed the per-condition detail; this adds
+* the one line that says the run cannot proceed.
 */
 var DeployRefusalPreviewError = class DeployRefusalPreviewError extends CdkdError {
 	exitCode = 3;
 	constructor(count) {
-		super(`cdkd deploy would refuse to start: ${count} blocking condition(s) reported above. Resolve them, or run \`cdkd state\` to inspect the conflicting stack.`, "DEPLOY_REFUSAL_PREVIEW");
+		super(`cdkd deploy would refuse to start: ${count} blocking condition(s) reported above.`, "DEPLOY_REFUSAL_PREVIEW");
 		this.name = "DeployRefusalPreviewError";
 		Object.setPrototypeOf(this, DeployRefusalPreviewError.prototype);
 	}
@@ -69362,7 +69386,8 @@ async function diffCommand(stacks, options) {
 				canonicalizeProperties,
 				...assetRedirect && { assetRedirect },
 				...options.cfnFallback === false && { cfnFallback: false },
-				previewOrphanAdoption
+				previewOrphanAdoption,
+				isNestedChild: false
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
@@ -70735,9 +70760,15 @@ function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, logg
 	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => `'${s}'`).join(", ")})` : "";
 	const templateClaim = verdict.kind === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes '${loggedExportKey}' by RE-EXPORTING a value that '${chainRoot}' declares from a {{resolve:...}} expression${through}` : `publishes '${loggedExportKey}' by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value '${chainRoot}' declares from a {{resolve:...}} expression${through} (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
 	const scrubOrder = dedupePreservingOrder([...chain].reverse().concat(loggedProducerStack), "last");
+	const remedyCommands = scrubOrder.map((name) => `Scrub with: ${pasteableCommand("cdkd scrub", [{
+		value: name,
+		hole: "stack",
+		opts: { patternMatched: true }
+	}]).command}`);
 	return {
 		templateClaim,
-		remedy: scrubOrder.length > 1 ? `Scrub the producers first, from the head of the chain (${scrubOrder.map((s) => `'cdkd scrub ${s}'`).join(", then ")})` : `Scrub the producer first ('cdkd scrub ${loggedProducerStack}')`
+		remedy: scrubOrder.length > 1 ? `Scrub the producers first, from the head of the chain, in the order below` : `Scrub the producer first`,
+		remedyCommands
 	};
 }
 /**
@@ -70799,8 +70830,12 @@ function dedupePreservingOrder(values, keep) {
 function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path, producerStack, exportKey, verdict, secrets) {
 	const loggedExportKey = maskSecretsInText(exportKey, secrets);
 	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
-	const { templateClaim, remedy } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
-	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run 'cdkd scrub ${stackName}' — the read will then return the expression and this stack is scrubbed normally.`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
+	const { templateClaim, remedy, remedyCommands } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
+	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
+		value: stackName,
+		hole: "stack",
+		opts: { patternMatched: true }
+	}]).command}`, "SCRUB_CROSS_STACK_PRODUCER_PLAINTEXT");
 }
 /** The `no` verdict, shared so the walk allocates nothing for the common case. */
 const NO_SECRET_EXPRESSION = {
@@ -72421,10 +72456,9 @@ function createScrubCommand() {
 * (phantom drift against an ISO-string baseline, and `--accept` persisted the
 * `{}`). The identity return is what makes the second visible to the
 * comparator; the null-prototype target is what keeps the first an own key.
-* One layer LATER the same flattening survives in `secret-redaction.ts`'s
-* value walk, which `--accept` runs over a resource that RECORDS a secret
-* (issue #2427) -- so the ISO string reaches the baseline only where that
-* walk does not run.
+* One layer LATER `secret-redaction.ts`'s value walk, which `--accept` runs
+* over a resource that RECORDS a secret, keeps a `Date` by identity too (issue
+* #2427), so the ISO string reaches the baseline on both kinds of resource.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -76854,7 +76888,13 @@ async function destroyCommand(stackArgs, options) {
 			} else if (synthRegion && refs.some((r) => r.region === synthRegion)) stackTargetRegion = synthRegion;
 			else {
 				const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
-				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Use 'cdkd state orphan ${stackName} --stack-region <region>' to remove cdkd's record for one region, or run destroy from a CDK app whose env.region matches one of them.`);
+				throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Remove cdkd's record for ONE region with the command below (fill in the region), or run destroy from a CDK app whose env.region matches one of them.\nRemove one record with: ${pasteableCommand("cdkd state orphan", [{
+					value: stackName,
+					hole: "stack"
+				}, {
+					flag: "--stack-region",
+					hole: "region"
+				}]).command}`);
 			}
 			const stateResult = await stateBackend.getState(stackName, stackTargetRegion);
 			if (!stateResult) {
@@ -78744,7 +78784,10 @@ async function exportCommand(stackArg, options) {
 		const { state, etag, migrationPending } = stateData;
 		const exportJournal = await stateBackend.loadRollbackJournal(resolvedStackName, targetRegion);
 		if (exportJournal && exportJournal.segments.length > 0) {
-			logger.warn(`Stack '${resolvedStackName}' has a rollback journal — a previous deploy failed or was interrupted and has not been reverted. Exporting this half-deployed state to CloudFormation is likely unintended; run 'cdkd rollback ${resolvedStackName}' to revert (or 'cdkd deploy' to fix forward) first.`);
+			logger.warn(`Stack '${resolvedStackName}' has a rollback journal — a previous deploy failed or was interrupted and has not been reverted. Exporting this half-deployed state to CloudFormation is likely unintended; revert it first (or 'cdkd deploy' to fix forward).\nRevert it with: ${pasteableCommand("cdkd rollback", [{
+				value: resolvedStackName,
+				hole: "stack"
+			}]).command}`);
 			if (!options.yes && !options.dryRun) {
 				if (!await confirmPrompt$3("Export anyway?")) {
 					logger.info("Export cancelled");
@@ -79094,7 +79137,7 @@ function safeDetail(value) {
 */
 function orphanCommandFor(stackName, region) {
 	const shownStack = safeSegment(stackName);
-	if (!(typeof stackName === "string" && shownStack === stackName && typeof region === "string" && safeSegment(region) === region)) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
+	if (!(typeof stackName === "string" && shownStack === stackName && !stackName.startsWith("-") && typeof region === "string" && safeSegment(region) === region && !region.startsWith("-"))) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
 	return `cdkd state orphan ${shellQuote(shownStack)} --stack-region ${shellQuote(safeSegment(region))}`;
 }
 /**
@@ -80975,7 +81018,10 @@ async function runPerStackImportLoop(args) {
 				} catch (err) {
 					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
 					const remainingSummary = perStackPlans.slice(i).map((p) => safeSegment(p.cdkdName)).join(", ");
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run the export — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}\nRe-run with: ${pasteableCommand("cdkd export", [{
+						value: rootStackName,
+						hole: "stack"
+					}]).command}`, { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
 				if (!cfnArn) throw new Error(`runPerStackImportLoop: DescribeStacks returned no StackId for '${plan.cfnName}' immediately after Phase 1A IMPORT — AWS may be in an unexpected state.`);
@@ -81757,7 +81803,11 @@ async function stateResourcesCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
@@ -81964,7 +82014,11 @@ async function stateShowCommand(stackName, options) {
 	const setup = await setupStateBackend(options);
 	try {
 		const ref = resolveSingleRegion(stackName, await setup.stateBackend.listStacks(), options.stackRegion);
-		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
+		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. A cdkd write migrates it to the region-scoped layout; re-run this command after it.\nMigrate with: ${pasteableCommand("cdkd deploy", [{
+			value: stackName,
+			hole: "stack",
+			opts: { patternMatched: true }
+		}]).command}`);
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
@@ -82432,7 +82486,11 @@ async function stateOrphanCommand(stackArgs, options) {
 			}
 			if (!options.yes && !options.force) {
 				const targetList = targets.map((t) => formatStackRefSafe(t)).join(", ");
-				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nUse 'cdkd destroy ${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' if you want to delete the actual resources.\n\n`);
+				process.stdout.write(`\nWARNING: This removes cdkd's state record for [${targetList}] only. AWS resources will NOT be deleted.\nDelete the actual resources instead with the command below.\nDestroy with: ${pasteableCommand("cdkd destroy", [{
+					value: stackName,
+					hole: "stack",
+					opts: { patternMatched: true }
+				}]).command}\n\n`);
 				if (!await confirmStateOrphanRemoval(`Remove state for ${targetList} from s3://${setup.bucket}/${setup.prefix}/?`)) {
 					logger.info(`Cancelled removal of state for stack: ${stackName}`);
 					continue;
@@ -82964,6 +83022,68 @@ function createStateInfoCommand() {
 	return cmd;
 }
 /**
+* The hole the legacy refusal's `cdkd deploy` prints for a name it cannot
+* name, and the key {@link withheldNameClause} reads the reason back by. ONE
+* spelling so the two cannot drift apart (m22 of the go-to-k/cdkd#3499 review).
+*/
+const STACK_HOLE = "stack";
+/**
+* The sentence for a name `pasteableCommand` would not print, rendered from the
+* REASON it gave rather than from a predicate of this site's own — M11 of the
+* go-to-k/cdkd#3499 review. Keying it on a second predicate got both directions
+* wrong at once: `Old;Stack` renders exactly, so a rendering-based clause called
+* a command that names it "not exact", and `--all` also renders exactly, so the
+* same clause said nothing above a hole the operator was then invited to fill
+* with the name printed beside it.
+*
+* THREE of the five reasons are reachable from this call site, and the other
+* two are bounded out by where the name comes from — an S3 key segment:
+*
+* - `altered`, `option-shaped` and `pattern-shaped` are all reachable: a
+*   planted key can spell a name any of those ways in a handful of bytes.
+* - `empty` is not. `listStacks` drops a key whose stack segment is empty
+*   (`s3-state-backend.ts`'s `if (!stackName) continue`), so `target.stackName`
+*   is non-empty by the time the refusal is built.
+* - `too-long` is not either, and the bound is not obvious: the cap is
+*   `STACK_REF_MAX_CODE_POINTS` (1152), while S3 caps the WHOLE key at 1024
+*   bytes, leaving at most 1008 for the name inside `cdkd/<name>/state.json`.
+*   A multi-byte character only lowers the code-point count further, so a name
+*   arriving through `listStacks` can never reach the cap.
+*
+* Both unreachable arms stay, and are covered, because the REASON is the
+* gate's and not this site's: `pasteableCommand` can return either to a caller
+* whose value comes from somewhere else. A missing arm is no longer a silent
+* fall-through — the `switch` below is exhaustive over `WithholdReason`, so
+* dropping one is a compile error (M13). What the cases buy on top of that is
+* the SENTENCE: the type checker knows an arm exists, not that it says the
+* right thing, and substituting one arm's text for another's is exactly the
+* disagreement M11 closed.
+*/
+function withheldNameClause(built) {
+	const reason = built.withheld.find((w) => w.hole === STACK_HOLE)?.reason;
+	if (reason === void 0) return "";
+	let why;
+	switch (reason) {
+		case "altered":
+			why = `does NOT render exactly, so another record may render identically`;
+			break;
+		case "empty":
+			why = `is empty`;
+			break;
+		case "too-long":
+			why = `is too long to print`;
+			break;
+		case "option-shaped":
+			why = "begins with a '-', so it is not safe to print as an argument to 'cdkd deploy' — a name like '--all' is parsed as the FLAG and targets every stack";
+			break;
+		case "pattern-shaped":
+			why = `would be read as a PATTERN by 'cdkd deploy', which can match other stacks`;
+			break;
+		default: throw new Error(`withheldNameClause: unhandled WithholdReason ${String(reason)}`);
+	}
+	return ` This record's name ${why} — so it is not named in the command below; list the records as stored with 'cdkd state list --long' and act on the one whose key matches.`;
+}
+/**
 * `cdkd state refresh-observed <stack>` command implementation.
 *
 * Walks every resource in the given stack(s) and refreshes its
@@ -83053,9 +83173,13 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			}
 		}
 		for (const target of targets) if (!target.region) {
-			const stack = shellQuote(safeStackName(target.stackName));
-			const example = safeStackName(target.stackName) === target.stackName && !/^-|[*/]/.test(target.stackName) ? ` For example: cdkd deploy ${stack}` : "";
-			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + example);
+			const stack = displayIdent(target.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+			const migrate = pasteableCommand("cdkd deploy", [{
+				value: target.stackName,
+				hole: STACK_HOLE,
+				opts: { patternMatched: true }
+			}]);
+			throw new Error(`Stack ${stack} has only a legacy state record without a region. Migrate it to the region-scoped layout with any cdkd write, then re-run refresh-observed.` + withheldNameClause(migrate) + `\nMigrate with: ${migrate.command}`);
 		}
 		let totalRefreshed = 0;
 		let totalUnsupported = 0;
@@ -83644,7 +83768,10 @@ async function rollbackCommand(stackArg, options) {
 						const fresh = await setup.stateBackend.getState(stackName, region);
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
-						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run 'cdkd rollback ${safeStack(stackName)}' to reconcile state.`);
+						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run the rollback to reconcile state.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+							value: stackName,
+							hole: "stack"
+						}]).command}`);
 					}
 				}
 			};
@@ -83725,8 +83852,14 @@ async function rollbackCommand(stackArg, options) {
 				await setup.stateBackend.deleteState(stackName, region);
 				logger.info(`State for '${safeStack(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
-			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to finish.`);
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to retry.`);
+			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run the rollback to finish.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`);
+			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run the rollback to retry.\nRe-run with: ${pasteableCommand("cdkd rollback", [{
+				value: stackName,
+				hole: "stack"
+			}]).command}`);
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
 			logger.info(`\nRollback of '${safeStack(stackName)}' (${safe(region)}) complete.`);
 		} finally {
@@ -84073,7 +84206,13 @@ function printRunList(stackName, region, runs) {
 		const resultColored = result === "SUCCEEDED" ? green(result) : result === "UNKNOWN" || result === "<unrenderable>" ? gray(result) : red(result);
 		logger.info(`  ${cyan(safeId(run.runId) || "<unrenderable>")}  ${safeId(run.command) || "<unrenderable>"}  ${resultColored}  ${gray(safeId(run.startedAt) || "?")} -> ${gray(safeId(run.finishedAt) || "?")}  ${gray(`cdkd ${safeId(run.cdkdVersion) || "<unrenderable>"}`)}  ${gray(`${safeCount(run.eventCount)} events`)}`);
 	}
-	logger.info(gray(`\nUse 'cdkd events ${safeStack} --run <runId>' to read one run's events.`));
+	logger.info(gray(`\nRead one run's events with: ${pasteableCommand("cdkd events", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--run",
+		hole: "runId"
+	}]).command}`));
 }
 /** Human-readable single-run event stream (in recorded order). */
 /**
@@ -89366,7 +89505,9 @@ function resolveAssetCodeDirectory(opts) {
 * `process.cwd()` survives only for a `StackInfo` carrying NEITHER field, where
 * base and bound coincide again.
 *
-* Exported for `local-start-api.ts`'s copy of the caller, and for unit testing.
+* Exported for `local-start-api.ts`'s copy of the caller, for the Docker
+* context check the ECS emulator commands run over cdk-local's `StackInfo`
+* (which is why it takes only the two fields it reads), and for unit testing.
 */
 function assetPathDirs(stack) {
 	const manifestDir = stack.assetManifestPath ? dirname(stack.assetManifestPath) : stack.assetOutdir ?? process.cwd();
@@ -90870,7 +91011,7 @@ async function runDetached(opts) {
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
 	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`);
-	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
+	if (collisions.length > 0) logger.warn(`Env var(s) ${collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the env var if the container needs it.`);
 	try {
 		const { stdout } = await execFileAsync$3(getDockerCmd(), args, {
 			maxBuffer: 10485760,
@@ -91002,13 +91143,25 @@ const SENSITIVE_ENV_KEYS = /* @__PURE__ */ new Set([
 * wrapper translates cdk-local's thrown error back to cdkd's class at the shim
 * boundary, so a local-invoke build failure still surfaces with cdkd's exit code
 * / branding. `architectureToPlatform` is a pure helper (re-exported directly).
+*
+* It is also where the build context is CONTAINED: cdk-local joins
+* `source.directory` onto `cdkOutDir` with no check, so the shim refuses an
+* escaping value before delegating, against a REQUIRED `assetOutdir` bound
+* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
 * See cdk-local's `src/local/docker-image-builder.ts`.
 */
-async function buildContainerImage$1(...args) {
-	const executable = args[0]?.source?.executable;
+async function buildContainerImage$1(asset, cdkOutDir, options) {
+	const executable = asset?.source?.executable;
 	if (executable && executable.length > 0) warnManifestExecutable(executable);
+	const { assetOutdir, ...implOptions } = options;
+	assertCdkLocalDockerContextContained({
+		manifestDir: cdkOutDir,
+		source: asset.source,
+		assetOutdir,
+		wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build the container image: ${message}`)
+	});
 	try {
-		return await buildContainerImage(...args);
+		return await buildContainerImage(asset, cdkOutDir, implOptions);
 	} catch (e) {
 		if (e instanceof LocalInvokeBuildError) throw new LocalInvokeBuildError$1(e.message);
 		throw e;
@@ -93240,7 +93393,10 @@ async function buildContainerSpec(args) {
 async function resolveContainerImageForStartApi(lambda, skipPull) {
 	const logger = getLogger();
 	const localBuild = await resolveLocalBuildPlan$1(lambda);
-	if (localBuild) return { imageRef: await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, { architecture: lambda.architecture }) };
+	if (localBuild) return { imageRef: await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, {
+		assetOutdir: localBuild.assetOutdir,
+		architecture: lambda.architecture
+	}) };
 	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI cdkd can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
 	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (uses your own credentials — this command has no --ecr-role-arn, so a cross-account image needs cross-account ECR permissions)...`);
 	return { imageRef: await pullEcrImage(lambda.imageUri, { skipPull }) };
@@ -93254,16 +93410,16 @@ async function resolveContainerImageForStartApi(lambda, skipPull) {
 * the two commands evolve their asset-lookup heuristics independently.
 */
 async function resolveLocalBuildPlan$1(lambda) {
-	const manifestPath = lambda.stack.assetManifestPath;
-	if (!manifestPath) return void 0;
-	const cdkOutDir = path.dirname(manifestPath);
+	if (!lambda.stack.assetManifestPath) return void 0;
+	const { manifestDir: cdkOutDir, assetOutdir } = assetPathDirs(lambda.stack);
 	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir
 	};
 }
 /**
@@ -94123,7 +94279,7 @@ async function createNetworkAndSidecar(args) {
 	if (cluster) sidecarEnv["CLUSTER"] = cluster;
 	const { flags: sidecarFlags, sensitiveEnv: sidecarSensitiveEnv, collisions: sidecarCollisions } = partitionSensitiveEnv(sidecarEnv, SENSITIVE_ENV_KEYS);
 	sidecarArgs.push(...sidecarFlags);
-	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable and were NOT passed to the sidecar at all (they would hijack the docker client).`);
+	if (sidecarCollisions.length > 0) logger.warn(`Sidecar env var(s) ${sidecarCollisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) and were NOT passed to the sidecar at all (they would hijack that client).`);
 	sidecarArgs.push(METADATA_ENDPOINT_IMAGE);
 	logger.info(`Starting ECS local-container-endpoints sidecar at ${sidecarIp}...`);
 	try {
@@ -94489,7 +94645,7 @@ async function runEcsTask(task, options, state) {
 		});
 		dockerCmds.set(container.name, built.args);
 		dockerEnvs.set(container.name, built.sensitiveEnv);
-		if (built.collisions.length > 0) logger.warn(`Container '${container.name}': secret(s) ${built.collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a docker-client environment variable or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack the docker client; a malformed name cannot form a valid environment variable). Rename the secret if the container needs it.`);
+		if (built.collisions.length > 0) logger.warn(`Container '${container.name}': secret(s) ${built.collisions.map((k) => JSON.stringify(k)).join(", ")} share a name with a variable the container client reads (docker, or the CDK_DOCKER binary) or have a malformed name (empty, or containing '=' / NUL), and were NOT passed to the container at all (a colliding name would hijack that client; a malformed name cannot form a valid environment variable). Rename the secret if the container needs it.`);
 	}
 	const startedByName = /* @__PURE__ */ new Map();
 	for (const containerName of startOrder) {
@@ -95388,6 +95544,130 @@ function createLocalRunTaskCommand() {
 	return cmd;
 }
 
+//#endregion
+//#region src/cli/commands/emulator-docker-context.ts
+/**
+* Decorate an `EmulatorStrategy` so every Docker image asset the bundled
+* engine could build for this run is containment-checked BEFORE it builds one
+* (issue [#3503](https://github.com/go-to-k/cdkd/issues/3503)).
+*
+* `cdkd local start-service` / `start-alb` hand the whole run to cdk-local's
+* `runEcsServiceEmulator`, which reads each stack's asset manifest itself and
+* joins `source.directory` onto the manifest directory raw — for an ECS
+* container image and for an ALB Lambda target's container image alike. No
+* argument reaches that join, so cdkd judges the manifests here instead.
+*
+* `resolveBoots` is the seam because the engine calls it after every synth —
+* at boot, and again on every `--watch` reload — and before any image is
+* built on either path. A refusal at boot fails the command; on a reload the
+* engine logs it and keeps the previous replicas serving, which is the
+* fail-closed outcome.
+*
+* Every stack with a manifest is checked, not only the booted targets' stacks:
+* which stack a target resolves to is decided inside the engine, and the ALB
+* front door builds Lambda images from stacks no ECS boot names. An escaping
+* `source.directory` is never something a real `cdk synth` writes, so
+* refusing one anywhere in the assembly costs a legitimate run nothing, and
+* `cdkd deploy` refuses the same assembly.
+*/
+function containEmulatorDockerContexts(strategy) {
+	return {
+		...strategy,
+		resolveBoots: (stacks, chosenTargets) => {
+			assertEmulatorDockerContextsContained(stacks);
+			return strategy.resolveBoots(stacks, chosenTargets);
+		}
+	};
+}
+/**
+* The check itself, over the manifests the engine will read. Exported for
+* unit testing.
+*
+* It reads the SAME file the engine does — `<manifest dir>/<stackName>.assets.json`,
+* not `assetManifestPath` verbatim — and refuses a `stackName` that would
+* carry that filename out of the manifest directory, as cdkd's own
+* `AssetManifestLoader.loadManifest` does.
+*
+* A manifest that is absent, unreadable or not JSON is skipped: the engine
+* reads it again and reports that failure itself, before building anything.
+*/
+function assertEmulatorDockerContextsContained(stacks) {
+	for (const stack of stacks) {
+		if (!stack.assetManifestPath) continue;
+		const dirs = assetPathDirs(stack);
+		const { manifestDir } = dirs;
+		const assetOutdir = stack.assetOutdir === void 0 || stack.assetOutdir === "" ? dirs.assetOutdir : engineAssemblyRoot(stack.assetOutdir);
+		const manifestFile = resolveAssemblyPath(manifestDir, `${stack.stackName}.assets.json`);
+		if (!manifestFile.contained) throw new LocalInvokeBuildError$1(`Refusing to build container images: the asset manifest for stack '${displaySafe(stack.stackName)}' ${renderAssemblyPathEscape(manifestFile, manifestDir)}`);
+		const dockerImages = readDockerImages(manifestFile.path);
+		for (const [assetId, asset] of Object.entries(dockerImages)) {
+			const source = asset?.source;
+			if (source === null || typeof source !== "object") continue;
+			const { directory } = source;
+			if (typeof directory !== "string") continue;
+			assertCdkLocalDockerContextContained({
+				manifestDir,
+				source,
+				assetOutdir,
+				wrapError: (message) => new LocalInvokeBuildError$1(`Refusing to build container image asset '${displaySafe(assetId)}' of stack '${displaySafe(stack.stackName)}': ${message}`)
+			});
+		}
+	}
+}
+/**
+* The containment bound the ENGINE itself uses for a stack it synthesized: its
+* `assetOutdir`, climbed to the parent assembly when `--app` names a
+* `cdk.Stage` sub-assembly. cdk-local enumerates no Stage stacks from an app
+* root, so `--app cdk.out/assembly-<Stage>` is the only way these commands run
+* a Stage, and its assets are staged one level up as `../asset.<hash>`.
+*
+* A copy of cdk-local's `assemblyRootOf` (not exported by the package): climb
+* only while the directory is named `assembly-*` AND its parent's
+* `manifest.json` declares it as a `cdk:cloud-assembly` artifact, and WARN
+* whenever a climb happens, since the predicate is read from the tree being
+* judged. Replace with the upstream export once one exists (go-to-k/cdkd#3597).
+*/
+function engineAssemblyRoot(outdir) {
+	let dir = resolve(outdir);
+	let climbed = false;
+	for (;;) {
+		if (!basename(dir).startsWith("assembly-")) break;
+		const parent = dirname(dir);
+		if (parent === dir || !parentDeclaresNestedAssembly(parent, basename(dir))) break;
+		dir = parent;
+		climbed = true;
+	}
+	if (!climbed) return outdir;
+	if (!warnedDerivedRoots.has(dir)) {
+		warnedDerivedRoots.add(dir);
+		getLogger().warn(`'${displaySafe(outdir)}' is a cdk.Stage sub-assembly, so cdkd is treating its parent '${displaySafe(dir)}' as the assembly root when it checks Docker build contexts — that is where cdk synth stages a Stage's assets. Everything under that parent is now inside the containment bound, including siblings of the directory you named.`);
+	}
+	return dir;
+}
+const warnedDerivedRoots = /* @__PURE__ */ new Set();
+function parentDeclaresNestedAssembly(parent, child) {
+	try {
+		const artifacts = JSON.parse(readFileSync(join(parent, "manifest.json"), "utf-8")).artifacts;
+		if (artifacts === null || typeof artifacts !== "object") return false;
+		return Object.values(artifacts).some((a) => {
+			const art = a;
+			return art?.type === "cdk:cloud-assembly" && art.properties?.directoryName === child;
+		});
+	} catch {
+		return false;
+	}
+}
+function readDockerImages(manifestPath) {
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(manifestPath, "utf-8"));
+	} catch {
+		return {};
+	}
+	const dockerImages = parsed?.dockerImages;
+	return dockerImages !== null && typeof dockerImages === "object" ? dockerImages : {};
+}
+
 //#endregion
 //#region src/cli/commands/local-start-service.ts
 /**
@@ -95415,6 +95695,17 @@ function serviceStrategy() {
 	};
 }
 /**
+* The `EmulatorStrategy` `cdkd local start-service` runs with:
+* {@link serviceStrategy}, decorated by `containEmulatorDockerContexts` so the
+* engine's own Docker builds are containment-checked (issue
+* [#3503](https://github.com/go-to-k/cdkd/issues/3503)). A NAMED seam for the
+* same reason `buildAlbEmulatorStrategy` is one: inline in the action, the
+* decorator was deletable at its only call site.
+*/
+function buildServiceEmulatorStrategy() {
+	return containEmulatorDockerContexts(serviceStrategy());
+}
+/**
 * `cdkl start-service <Stack/Service>...` — run one or more `AWS::ECS::Service`
 * resources locally as a long-running emulator. Spins up DesiredCount task
 * replicas per service (clamped by --max-tasks) using the same per-task
@@ -95427,7 +95718,7 @@ function serviceStrategy() {
 */
 function createLocalStartServiceCommand() {
 	const cmd = new Command("start-service").description("Run one or more AWS::ECS::Service resources locally as a long-running emulator. Spins up DesiredCount task replicas per service (clamped by --max-tasks) using the same per-task docker network + metadata sidecar pattern as `cdkd local run-task`, then keeps each replica running and restarts it on exit per --restart-policy. ^C tears every replica + sidecar + network down. Each <target> accepts a CDK display path (MyStack/MyService) or stack-qualified logical ID (MyStack:MyServiceXYZ); single-stack apps may omit the stack prefix. When two or more <target>s are supplied, every service is booted into a shared Cloud Map / Service Connect registry so peer services discover each other via docker --add-host overlay (Issue #460). Omit <targets> in an interactive terminal to multi-select the ECS services from a list.").argument("[targets...]", "One or more CDK display paths or stack-qualified logical IDs of the AWS::ECS::Service resources to run (omit to multi-select interactively in a TTY)").addOption(new Option("--from-state", "Read cdkd's S3 state for the target stack and substitute Ref / Fn::GetAtt / Fn::Sub / Fn::ImportValue / Fn::GetStackOutput intrinsics in container images, environment variables, secrets, role ARNs, and volumes. Mutually exclusive with --from-cfn-stack.").default(false)).addOption(new Option("--state-bucket <bucket>", "S3 bucket for --from-state. Falls back to CDKD_STATE_BUCKET env or cdk.json context.cdkd.stateBucket.")).addOption(new Option("--state-prefix <prefix>", "S3 key prefix for --from-state state files.").default("cdkd")).action(withErrorHandling(async (targets, options) => {
-		await runEcsServiceEmulator(targets, options, serviceStrategy(), cdkdExtraStateProviders);
+		await runEcsServiceEmulator(targets, options, buildServiceEmulatorStrategy(), cdkdExtraStateProviders);
 	}));
 	addStartServiceSpecificOptions(cmd);
 	return adoptDeprecatedRegionFlag(addCommonEcsServiceOptions(cmd));
@@ -96323,6 +96614,7 @@ async function resolveAgentCoreImage(resolved, options, assemblyDir, loaded) {
 		if (manifest) {
 			const entry = getDockerImageBySourceHash(manifest, containerUri);
 			if (entry) return buildContainerImage$1(entry.asset, cdkOutDir, {
+				assetOutdir: assemblyDir,
 				architecture,
 				noBuild: options.build === false
 			});
@@ -97115,7 +97407,8 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 }
 /**
 * The `EmulatorStrategy` `cdkd local start-alb` runs with: cdk-local's ALB
-* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv}.
+* strategy, decorated by {@link warnUnresolvedLambdaTargetEnv} and then by
+* `containEmulatorDockerContexts` (issue go-to-k/cdkd#3503).
 *
 * Extracted from the command's action for ONE reason, and it is the finding
 * that produced it: with the composition written inline in the `.action(...)`
@@ -97135,7 +97428,7 @@ function warnUnresolvedLambdaTargetEnv(strategy, options) {
 * can satisfy reads as coverage while providing none.
 */
 function buildAlbEmulatorStrategy(options) {
-	return warnUnresolvedLambdaTargetEnv(albStrategy(options), options);
+	return containEmulatorDockerContexts(warnUnresolvedLambdaTargetEnv(albStrategy(options), options));
 }
 /**
 * `cdkl start-alb <Stack/Alb>` — Issue #86 v1. Names an
@@ -97693,6 +97986,7 @@ async function resolveContainerImagePlan(lambda, options) {
 	const localBuild = await resolveLocalBuildPlan(lambda);
 	let imageRef;
 	if (localBuild) imageRef = await buildContainerImage$1(localBuild.asset, localBuild.cdkOutDir, {
+		assetOutdir: localBuild.assetOutdir,
 		architecture: lambda.architecture,
 		noBuild: options.build === false
 	});
@@ -97724,16 +98018,16 @@ async function resolveContainerImagePlan(lambda, options) {
 * apply either) — the caller falls back to the ECR-pull path.
 */
 async function resolveLocalBuildPlan(lambda) {
-	const manifestPath = lambda.stack.assetManifestPath;
-	if (!manifestPath) return void 0;
-	const cdkOutDir = dirname(manifestPath);
+	if (!lambda.stack.assetManifestPath) return void 0;
+	const { manifestDir: cdkOutDir, assetOutdir } = assetPathDirs(lambda.stack);
 	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
 	return {
 		asset: entry.asset,
-		cdkOutDir
+		cdkOutDir,
+		assetOutdir
 	};
 }
 /**
@@ -98272,4 +98566,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Fgtmg1PN.js.map
+//# sourceMappingURL=program-BfCsjuyU.js.map