@go-to-k/cdkd 0.296.12 → 0.296.14

package/dist/{program-epAinsMQ.js → program-CKV6Kn8Q.js}

@@ -1,9 +1,9 @@
 import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients, t as AwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, L as stringifyJsonPayload, M as displayStackName, N as isPasteableIdent, O as cutMarker, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, d as PATTERN_B_NAME_PROPERTIES, f as PATTERN_B_RESOURCE_TYPES, g as generateResourceName, h as explicitNamePropertyFor, i as reserveStdoutForPayload, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, m as derivesPatternBName, n as getLogger, o as runStackBuffered, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_OPTIONS, w as SAFE_MSG_ALTERED_CHAR, x as withSkipPrefix } from "./logger-DAaB7GFO.js";
-import { $ as endCommandInterruptScope, $n as retryClassificationText, An as pasteableCommand, At as UNREPRODUCIBLE_LOCK_CLAUSE, Bt as injectiveKey, C as assertRegionMatch, Cn as TIMEOUT_FLAG_RESOURCE_TYPE, Dn as commandHole, Fn as shellQuote, Ft as formatLockOperation, Gt as withPasteableAwsProfile, H as runDeleteAttempt, Ht as producerCoordinateKey, In as withheldTargetClause, It as formatLockOwner, J as isAwsCliLiteral, Jt as clientDefaultsFor, Kt as ambientClientDefaults, Ln as setPasteableRunFlags, Mn as plainOrDescribed, Mt as buildLockContentionMessage, Nn as quotedOrDescribed, Nt as forceQuitRecoveryClause, Pn as shellBoundedDisplay, Pt as formatLockExpiry, Q as beginCommandInterruptScope, Qn as isTransientServerError, Qt as CdkdError, Rn as setPasteableVerbFlags, Rt as CUSTOM_RESOURCE_RESPONSE_PREFIX, S as RESOURCE_NOT_FOUND, Sn as withErrorHandling, Tn as SHELL_ACTIVE_WHY, Ut as producerRecordKey, Wt as setPasteableAwsProfile, Xt as AccountIdUnavailableError, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Zn as isRetryableTransientError, an as LocalInvokeBuildError$1, ar as isThrottlingError, dn as PartialFailureError, dt as resourceTypeShown, en as CrossAccountSecretRefusalError, er as describeAwsFailure, et as interruptWatchListenerCount, fn as ProvisioningError, gn as StackTerminationProtectionError, hn as StackHasActiveImportsError, in as IntrinsicResolutionRefusalError, ir as isMarkedNonRetryable, j as remedyLogicalId, jt as buildForceUnlockCommand, kn as isInertUnquoted, ln as MalformedProducerRecordRefusalError, lt as logicalIdShown, mn as ResourceUpdateNotSupportedError, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as DeployCancelledError, nr as safeStringify, on as LocalStartServiceError, or as markNonRetryable, pn as ResourceTimeoutError, qt as ambientCredentialConfig, rn as DynamicReferenceRegionAmbiguousError, s as readRecordedPrincipals, t as IAM_PRINCIPAL_NAME, tt as isInterruptedWaitError, un as NestedStackChildDirectDestroyError, vn as SynthesisError, w as VALUE_NOT_SHOWN, xn as normalizeAwsError, zt as DEFAULT_STATE_PREFIX } from "./iam-policy-targets-elNafvpb.js";
+import { A as UNRENDERABLE, B as stringifyJsonPayload, D as SAFE_MSG_ALTERED_CHAR, F as displayStackName, I as isPasteableIdent, M as displayAwsMessage, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, T as withStackName, V as truncateCodePoints, _ as derivesPatternBName, a as getLogger, f as getLiveRenderer, h as PATTERN_B_RESOURCE_TYPES, j as cutMarker, k as STACK_REF_MAX_CODE_POINTS, l as runStackBuffered, m as PATTERN_B_NAME_PROPERTIES, o as isStdoutReservedForPayload, p as PATTERN_B_NAME_OPTIONS, r as safeStringify, s as reserveStdoutForPayload, t as describeAwsFailure, v as explicitNamePropertyFor, w as withSkipPrefix, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
+import { $t as AccountIdUnavailableError, An as commandHole, Bn as setPasteableRunFlags, D as VALUE_NOT_SHOWN, E as assertRegionMatch, En as TIMEOUT_FLAG_RESOURCE_TYPE, Fn as plainOrDescribed, Ft as buildLockContentionMessage, G as runDeleteAttempt, Gt as producerCoordinateKey, Ht as DEFAULT_STATE_PREFIX, In as quotedOrDescribed, It as forceQuitRecoveryClause, Jt as withPasteableAwsProfile, Kt as producerRecordKey, Ln as shellBoundedDisplay, Lt as formatLockExpiry, Mn as isInertUnquoted, Nn as pasteableCommand, Nt as UNREPRODUCIBLE_LOCK_CLAUSE, On as SHELL_ACTIVE_WHY, P as remedyLogicalId, Pt as buildForceUnlockCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, Rt as formatLockOperation, T as RESOURCE_NOT_FOUND, Tn as withErrorHandling, Ut as injectiveKey, Vn as setPasteableVerbFlags, Vt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xt as ambientCredentialConfig, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _n as ResourceUpdateNotSupportedError, an as DeployCancelledError, ar as isThrottlingError, cn as LocalInvokeBuildError$1, er as isRetryableTransientError, fn as MalformedProducerRecordRefusalError, ft as logicalIdShown, gn as ResourceTimeoutError, hn as ProvisioningError, ir as isMarkedNonRetryable, it as isInterruptedWaitError, ln as LocalStartServiceError, mn as PartialFailureError, mt as resourceTypeShown, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nr as retryClassificationText, nt as endCommandInterruptScope, on as DynamicReferenceRegionAmbiguousError, or as markNonRetryable, pn as NestedStackChildDirectDestroyError, qt as setPasteableAwsProfile, rn as CrossAccountSecretRefusalError, rt as interruptWatchListenerCount, s as readRecordedPrincipals, sn as IntrinsicResolutionRefusalError, t as IAM_PRINCIPAL_NAME, tn as CdkdError, tr as isTransientServerError, tt as beginCommandInterruptScope, vn as StackHasActiveImportsError, wn as normalizeAwsError, xn as SynthesisError, yn as StackTerminationProtectionError, zn as withheldTargetClause, zt as formatLockOwner } from "./iam-policy-targets-BoZuWtxK.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as recordDisplacedSkips, $a as noEchoLeavesOf, $i as refuseMalformedResourcesForDeploy, $n as withPrintingSecrets, $o as importableOutputs, $s as resolveStateBucketWithDefault, $t as secretNamePrintingBag, A as gray, Ac as resolveBucketRegion, Ai as malformedScrubResourceEntriesRefusalMessage, An as findDestructiveChanges, Ao as recordMaskOnlyValue, Ar as envCredentialsAreAssumedRole, As as formatDockerLoginError, At as removeProtectionTypeList, B as isHandledOrphan, Ba as prefetchCreateOnlyPropertyPaths, Bi as refuseMalformedOutputs, Bo as isSingleDynamicReferenceToken, Br as getAccountInfo, Bs as escapeRegExp, Bt as findNestedStackTypeChanges, C as recordedProtectionNote, Ca as isStatefulRecreateTargetSync, Cc as ownValue, Ci as malformedOrphansWarning, Cn as collectPublishedOutputNames, Co as pathCrossesDottedKey, Cr as assertSendableRoleArn, Cs as buildDockerImage, D as createReadOnlyAttributeHealerFactory, Dc as renderAssemblyPathEscape, Di as malformedResourceEntriesWarning, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Do as identityKeyFor, Dr as AWS_CREDENTIAL_ENV_KEYS, Ds as describeDockerFailure, E as formatResourceLine, Ec as displayAssemblyPath, Ei as malformedRenderedContainersWarning, En as DEFAULT_RESOURCE_TIMEOUT_MS, Er as sendableAssumeRoleCommand, Es as describeDockerExecFailure, F as namesAnyDeclaredParameter, Fi as refuseMalformedOrphanRecords, Fo as STATE_SOURCED_BASELINE_RULES, Fs as redactDockerArgvValues, Ft as isReplacementOrphan, G as makeSiblingClaimReader, Gi as refuseMalformedResourceEntriesForDestroy, Go as splitImportedOps, Gr as keepsSecretReferenceToken, Gs as synthesisStatusMessage, H as loadJournaledOrphans, Ha as describeTypeWithThrottleRetry, Hi as refuseMalformedResourceAttributesForOrphan, Ho as isLockInfoExpired, Hr as carriesDynamicReference, Hs as AssetManifestLoader, Ht as inheritProducerRegions, I as reachableDivergentParameters, Ii as refuseMalformedOrphanRecordsForDestroy, In as withCreateTokenLedger, Io as STATE_SOURCED_CROSS_GENERATION_RULES, Is as redactedDockerCause, It as planFailedOps, J as displacedOpClause, Ja as TemplateParser, Ji as refuseMalformedResourceEntriesForOrphan, Jn as ProviderRegistry, Jo as exportNamesCarriedFrom, Jr as isStalePlaceholderArnAttribute, Js as loadCdkJson, Jt as updatePartialReason, K as planOrphanAdoption, Ki as refuseMalformedResourceEntriesForImport, Ko as acceptedCreateOnlyDropsOf, Kr as AWS_NO_VALUE, Ks as getDefaultStateBucketName, L as resourcesNamingDeclaredParameter, Li as refuseMalformedOrphans, Lo as STATE_SOURCED_READBACK_RULES, Lr as coerceParameterTypedValue, Ls as runDockerForeground, Lt as planRollback, M as red, Mi as previewableOrphanRecords, Mn as RollbackInlinePolicyWriters, Mo as recordNoEchoAttributeValues, Ms as isDockerClientEnvKey, Mt as recordAfterRollbackUpdate, N as yellow, Ni as refuseDivergentRecordRegionForDestroy, No as recordProvenPublicExpression, Ns as isMalformedEnvKey, Nt as demoteSupersededOrphans, O as bold, Oc as resolveAssemblyPath, Oi as malformedResourcePropertiesWarning, On as maskingRetryLogger, Oo as carriesSecretMask, Or as applyCallerIdentityCredentials, Os as dockerSpawnEnvWithSensitive, P as computeParameterTaint, Pn as ledgerForStack, Po as wholeStringLeavesOf, Ps as partitionSensitiveEnv, Pt as isJournaledOrphan, Q as nestedChildStackName$1, Qa as maskedLeafCoordinatesOf, Qi as refuseMalformedResourcePropertiesForOrphan, Qo as importableOutputKeys, Qr as parameterInputsFor, Qs as resolveSkipPrefix, Qt as orphanRecordsPrintingBag, R as deleteJournaledOrphans, Ri as refuseMalformedOrphansForDestroy, Ro as TEMPLATE_SOURCED_RULES, Rr as isUnboundTemplateParameter, Rs as runDockerStreaming, Rt as replacementNeverSwapped, S as recordedProtectionEvidence, Sa as isStatefulRecreateTargetForReplace, Sc as nullPrototypeRecord, Si as malformedOrphansRefusalMessage, Sn as collectDeclaredOutputNames, So as isUncertifiedBaselineMaskPosition, Sr as assertFlagRoleArn, Ss as buildDenyExternalAccessPolicy, Tc as describeFileReadFailure, Ti as malformedOutputsWarning, Tn as bindingSkippedOutputs, To as recordNestedStackParameterExpressions, Tr as isIamRoleArn, Ts as describeDockerCapturedOutput, U as makeForeignHolderScan, Ua as withRetry, Ui as refuseMalformedResourceEntries, Uo as S3StateBackend, Ur as carriesFetchableDynamicReference, Us as getDockerImageBySourceHash, V as journaledOrphanLines, Va as templateResourceTypes, Vi as refuseMalformedOutputsForDestroy, Vo as LockManager, Vr as isImpossibleEmptyStoredAttribute, Vs as stripControlChars, W as sameJournaledOrphans, Wi as refuseMalformedResourceEntriesForDeploy, Wo as rebuildClientForBucketRegion, Wr as isNamelessDynamicReferenceError, Ws as Synthesizer, X as dropSettledNestedJournals, Xa as maskReadbackAtCoordinates, Xi as refuseMalformedResourcePropertiesForDrift, Xn as wouldReturnToSdkProvider, Xo as hasReasonlessBaselineRefusal, Xs as resolveAutoAssetStorage, Xt as journaledOrphanPrintingBag, Y as displacedPhysicalIdShown, Ya as isMarkedCoordinate, Yi as refuseMalformedResourcePropertiesForDestroy, Yn as ccBrokenReason, Yo as hasReadableExportSet, Yr as refStateLookupFromResource, Ys as resolveApp, Yt as completedReplayEntries, Za as maskWholeValue, Zi as refuseMalformedResourcePropertiesForExport, Zn as isCustomResourceType$1, Zo as hasUnverifiableParameterRefusal, Zr as withSharedDrainBudget, Zs as resolveCaptureObservedState, Zt as maskEventTextWithBoundBags, _ as makeCanonicalizePropertiesFn, _a as NO_CC_HANDLERS_REASON, _c as StageLoadError, _i as malformedLocalResourceEntriesWarning, _n as secretBearingStateKeyWarning, _o as markSameGenerationBag, _r as IntrinsicFunctionResolver, _s as isCrossRegionRedirect, a as findNestedTemplateTreeDefect, aa as repairMalformedOutputsForReadOnly, ac as CFN_TEMPLATE_BODY_LIMIT, ai as accountArgs, an as createPreDeleteFinalSnapshot, ao as createUnionSecretMasker, ar as deleteSkipReason, as as isSensitiveAttributeName, at as replayFailedOperations, b as noEchoParameterNamesOf, ba as shownType, bc as hasOwnKey, bi as malformedOrphanRecordsWarning, bn as isWholeDynamicReferenceValue, bo as DYNAMIC_REFERENCE_TOKEN_SCAN, br as regionLessSecretName, bs as validateAssetBucketName, c as renderNestedTemplateTreeDefect, ca as repairMalformedResourcesForReadOnly, cc as findLargeInlineResources, ci as hasReadableOrphans, cn as refusesFinalSnapshot, co as logOnlyValueCount, cs as buildAssetRedirectMap, ct as destroyStackRecordsView, d as conditionInputsFrom, da as unreadableResourceEntries, dc as decodeListingKey, di as isReadableOrphanRecord, dn as DeploymentEventsStore, do as recordLogOnlyValue, ds as rewriteTemplateAssetReferences, dt as PROTECTION_PROPERTY_BY_TYPE, ea as refuseMalformedResourcesForDestroy, ec as resolveStateBucketWithDefaultAndSource, ei as JSON_LISTING_HOLE_VALUE, en as stateSecretNameNeedles, eo as noEchoOutputsComparison, er as CloudControlProvider, es as isReadableBag, f as parentSuppliedValues, fa as withheldAccountClause, fc as expectedOwnerParam, fi as isReadableResourceEntry, fn as extractDeploymentEventError, fo as shareLogOnlyValues, fs as AssetModeResolver, ft as isProtectionValueActive, g as mergeNoChangeOutputs, gc as AssemblyReader, gi as malformedLocalOutputsWarning, gn as secretBearing, go as maskSecretsInText, gr as INTRINSIC_KEYS, gs as getBootstrapMarkerKey, h as keptWholeReasonText, ha as unwrittenCreateOnlyReplacement, hc as derivePartitionAndUrlSuffix, hi as malformedExportSourceWarning, hn as exportAliasCollisionScrubWarning, ho as maskSecretsInError, hr as DiffCalculator, hs as ensureAssetStorage, i as childTemplateLoader, ia as repairMalformedOrphansForReadOnly, ic as ssmResolvedValueType, ii as UNREADABLE_RESOURCES_MAP_ROW, in as ccRoutedFinalSnapshotError, io as carryLogOnlyValues, ir as deleteIndeterminateGuards, is as AssetPublisher, it as withNestedStackContext, j as green, ji as malformedStateRefusalMessage, jn as formatDestructiveChange, jo as recordMaskOnlyValuesIn, js as getDockerCmd, jt as orphanDeleteNeedsIdentity, k as cyan, ki as malformedResourcesWarning, kn as constructPathOf, ko as provenPublicValue, kr as callerEnvCredentials, ks as finchSecretArgvRefusal, l as templateIdentity, la as unpreviewableOrphanRecords, lc as uploadCfnTemplate, li as hasReadableOutputs, ln as unsupportedFinalSnapshotError, lo as printingCorpusOf, ls as createAssetRedirectResolver, m as isSecretBearingReferenceString, mc as canonicalizeRegion, mi as malformedExportNamesWarning, mn as displayTextOrWithheld, mo as errorCauseChain, ms as assertAssetBucketRegion, mt as readProtection, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedState, nc as stateBucketExistenceConfirmed, ni as STATE_RESOURCES_MALFORMED, nn as PRE_DELETE_SNAPSHOT_TYPES, no as readsNoEchoSource, ns as orphansCarriedFrom, nt as withNestedRevertRun, o as isAbsoluteAssetPath, oa as repairMalformedResourceEntriesForReadOnly, oc as CFN_TEMPLATE_URL_LIMIT, oi as deployRefusesOrphanRowsReason, on as effectiveDeletionPolicy, oo as hasMaskableValues, os as stringifyValue, ot as replayRollback, p as readRecordedConditionVerdicts, pa as findActionableSilentDrops, pc as PARTITION_TABLE, pi as malformedDriftResourcePropertiesWarning, pn as WITHHELD_NAME_DISPLAY, po as createSecretMasker, ps as BOOTSTRAP_MARKER_PREFIX, pt as perType, q as NESTED_PENDING_PARENT_REASON, qa as DagBuilder, qi as refuseMalformedResourceEntriesForImportSave, qn as CC_BROKEN_REASON, qo as describeRegionValueKind, qr as cfnRefValueFromPhysicalId, qs as getLegacyStateBucketName, qt as updatePartialMessage, r as computeImplicitDeleteEdges, ra as repairMalformedOrphanRecordsForReadOnly, rc as warnDeprecatedNoPrefixCliFlag, ri as UNREADABLE_ORPHANS_CONTAINER_ROW, rn as buildFinalSnapshotIdentifier, ro as liveMatchesUnresolvedTokenFrame, rr as UNSPECIFIED_SKIP_REASON, rs as shouldRetainResource, s as listNestedTemplateRows, sa as repairMalformedResourcePropertiesForReadOnly, sc as MIGRATE_TMP_PREFIX, si as displayLogicalId, sn as isFinalSnapshotError, so as literalSplitDelimitersOf, sr as isWaitAbandonedError, ss as WorkGraph, t as DeployEngine, ta as refuseMalformedResourcesForExport, tc as resolveUseCdkBootstrapAssets, ti as STATE_REGION_DIVERGED, tn as ATOMIC_FINAL_SNAPSHOT_TYPES, tr as slowCcOperationTimeoutMs, ts as orphansAfterRollback, tt as revertedNestedRowIds, u as conditionFingerprint, ua as unreadableOrphanRecords, uc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, ui as hasReadableResources, un as DeploymentEventsReader, uo as recordLogOnlyParameterValue, us as loadPublishableAssetManifest, ut as withStackRecords, v as noEchoAttributeNamesOf, va as hasNoCloudControlHandlers, vc as processStackMessages, vi as malformedLocalResourcesWarning, vn as secretSafeKeyDisplay, vo as redactSecretsForState, vr as classifyReplaySecretRegion, vs as parseBootstrapMarker, wa as renderStatefulReason, wc as absoluteAssemblyPathEscape, wi as malformedOutputsRefusalMessage, wn as isExportAliasCollision, wo as inheritNestedStackParameterAssociations, wr as explicitRoleArnOrThrow, ws as resolveDockerContextDirectory, x as withResourceDeadline, xa as MULTI_REGION_RECREATE_BLOCKED_TYPES, xc as hasPlainPrototype, xi as malformedOrphanRowsKeptWarning, xn as noEchoParameterValueSeed, xo as dynamicReferenceTokens, xr as applyRoleArnIfSet, xs as validateContainerRepoName, y as noEchoComparisonForTemplate, ya as findReplacedReadersOfRecreateTargets, yc as defineOwnKey, yi as malformedOrphanRecordsRefusalMessage, yn as exportNameSecretExposure, yo as scrubResourceRecord, yr as producerRegionsFromState, ys as readBootstrapMarkerBody, z as dropFailedHint, zi as refuseMalformedOrphansForOrphan, zo as WHOLE_DYNAMIC_REFERENCE_PATTERN, zr as parameterTypeMayLoseSecretIdentity, zs as warnFinchArgvExposure, zt as resolveReplacementOldType } from "./deploy-engine-CrYi7ta5.js";
-import { t as getCdkdVersion } from "./version-B8WzrPJT.js";
+import { $ as dropFailedHint, $a as maskedLeafCoordinatesOf, $i as refuseMalformedResourcePropertiesForOrphan, $o as importableOutputKeys, $r as parameterInputsFor, $s as resolveSkipPrefix, $t as secretNamePrintingBag, A as gray, Ai as malformedResourcesWarning, An as findDestructiveChanges, Ao as provenPublicValue, Ar as callerEnvCredentials, As as finchSecretArgvRefusal, At as removeProtectionTypeList, B as NESTED_PENDING_PARENT_REASON, Bi as refuseMalformedOrphansForOrphan, Bo as WHOLE_DYNAMIC_REFERENCE_PATTERN, Br as parameterTypeMayLoseSecretIdentity, Bs as warnFinchArgvExposure, Bt as findNestedStackTypeChanges, C as recordedProtectionNote, Ca as isStatefulRecreateTargetForReplace, Cc as nullPrototypeRecord, Ci as malformedOrphansRefusalMessage, Cn as collectPublishedOutputNames, Co as isUncertifiedBaselineMaskPosition, Cr as assertFlagRoleArn, Cs as buildDenyExternalAccessPolicy, D as createReadOnlyAttributeHealerFactory, Dc as displayAssemblyPath, Di as malformedRenderedContainersWarning, Dn as DEFAULT_RESOURCE_WARN_AFTER_MS, Dr as sendableAssumeRoleCommand, Ds as describeDockerExecFailure, E as formatResourceLine, Ec as describeFileReadFailure, Ei as malformedOutputsWarning, En as DEFAULT_RESOURCE_TIMEOUT_MS, Eo as recordNestedStackParameterExpressions, Er as isIamRoleArn, Es as describeDockerCapturedOutput, F as namesAnyDeclaredParameter, Fo as wholeStringLeavesOf, Fs as partitionSensitiveEnv, Ft as isReplacementOrphan, G as nestedChildStackName$1, Gi as refuseMalformedResourceEntriesForDeploy, Go as rebuildClientForBucketRegion, Gr as isNamelessDynamicReferenceError, Gs as Synthesizer, H as displacedPhysicalIdShown, Ha as templateResourceTypes, Hi as refuseMalformedOutputsForDestroy, Ho as LockManager, Hr as isImpossibleEmptyStoredAttribute, Hs as stripControlChars, Ht as inheritProducerRegions, I as reachableDivergentParameters, Ii as refuseMalformedOrphanRecords, In as withCreateTokenLedger, Io as STATE_SOURCED_BASELINE_RULES, Is as redactDockerArgvValues, It as planFailedOps, J as revertedNestedRowIds, Ja as DagBuilder, Ji as refuseMalformedResourceEntriesForImportSave, Jn as ProviderRegistry, Jo as describeRegionValueKind, Jr as cfnRefValueFromPhysicalId, Js as getLegacyStateBucketName, Jt as updatePartialReason, K as recordDisplacedSkips, Ki as refuseMalformedResourceEntriesForDestroy, Ko as splitImportedOps, Kr as keepsSecretReferenceToken, Ks as synthesisStatusMessage, L as resourcesNamingDeclaredParameter, Li as refuseMalformedOrphanRecordsForDestroy, Lo as STATE_SOURCED_CROSS_GENERATION_RULES, Ls as redactedDockerCause, Lt as planRollback, M as red, Mi as malformedStateRefusalMessage, Mn as RollbackInlinePolicyWriters, Mo as recordMaskOnlyValuesIn, Ms as getDockerCmd, Mt as recordAfterRollbackUpdate, N as yellow, Ni as previewableOrphanRecords, No as recordNoEchoAttributeValues, Ns as isDockerClientEnvKey, Nt as demoteSupersededOrphans, O as bold, Oc as renderAssemblyPathEscape, Oi as malformedResourceEntriesWarning, On as maskingRetryLogger, Oo as identityKeyFor, Or as AWS_CREDENTIAL_ENV_KEYS, Os as describeDockerFailure, P as computeParameterTaint, Pi as refuseDivergentRecordRegionForDestroy, Pn as ledgerForStack, Po as recordProvenPublicExpression, Ps as isMalformedEnvKey, Pt as isJournaledOrphan, Q as deleteJournaledOrphans, Qa as maskWholeValue, Qi as refuseMalformedResourcePropertiesForExport, Qn as isCustomResourceType$1, Qo as hasUnverifiableParameterRefusal, Qr as withSharedDrainBudget, Qs as resolveCaptureObservedState, Qt as orphanRecordsPrintingBag, R as makeSiblingClaimReader, Ri as refuseMalformedOrphans, Ro as STATE_SOURCED_READBACK_RULES, Rr as coerceParameterTypedValue, Rs as runDockerForeground, Rt as replacementNeverSwapped, S as recordedProtectionEvidence, Sa as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sc as hasPlainPrototype, Si as malformedOrphanRowsKeptWarning, Sn as collectDeclaredOutputNames, So as dynamicReferenceTokens, Sr as applyRoleArnIfSet, Ss as validateContainerRepoName, Ta as renderStatefulReason, Tc as absoluteAssemblyPathEscape, Ti as malformedOutputsRefusalMessage, Tn as bindingSkippedOutputs, To as inheritNestedStackParameterAssociations, Tr as explicitRoleArnOrThrow, Ts as resolveDockerContextDirectory, U as dropSettledNestedJournals, Ua as describeTypeWithThrottleRetry, Ui as refuseMalformedResourceAttributesForOrphan, Uo as isLockInfoExpired, Ur as carriesDynamicReference, Us as AssetManifestLoader, V as displacedOpClause, Va as prefetchCreateOnlyPropertyPaths, Vi as refuseMalformedOutputs, Vo as isSingleDynamicReferenceToken, Vr as getAccountInfo, Vs as escapeRegExp, Wa as withRetry, Wi as refuseMalformedResourceEntries, Wo as S3StateBackend, Wr as carriesFetchableDynamicReference, Ws as getDockerImageBySourceHash, Xa as isMarkedCoordinate, Xi as refuseMalformedResourcePropertiesForDestroy, Xn as isCustomResource, Xo as hasReadableExportSet, Xr as refStateLookupFromResource, Xs as resolveApp, Xt as journaledOrphanPrintingBag, Y as withNestedRevertRun, Ya as TemplateParser, Yi as refuseMalformedResourceEntriesForOrphan, Yn as ccBrokenReason, Yo as exportNamesCarriedFrom, Yr as isStalePlaceholderArnAttribute, Ys as loadCdkJson, Yt as completedReplayEntries, Z as withNestedStackContext, Za as maskReadbackAtCoordinates, Zi as refuseMalformedResourcePropertiesForDrift, Zn as wouldReturnToSdkProvider, Zo as hasReasonlessBaselineRefusal, Zs as resolveAutoAssetStorage, Zt as maskEventTextWithBoundBags, _ as makeCanonicalizePropertiesFn, _c as AssemblyReader, _i as malformedLocalOutputsWarning, _n as secretBearingStateKeyWarning, _o as maskSecretsInText, _r as INTRINSIC_KEYS, _s as getBootstrapMarkerKey, a as findNestedTemplateTreeDefect, aa as repairMalformedOrphansForReadOnly, ac as ssmResolvedValueType, ai as UNREADABLE_RESOURCES_MAP_ROW, an as createPreDeleteFinalSnapshot, ao as carryLogOnlyValues, ar as deleteIndeterminateGuards, as as AssetPublisher, at as replayFailedOperations, b as noEchoParameterNamesOf, ba as findReplacedReadersOfRecreateTargets, bc as defineOwnKey, bi as malformedOrphanRecordsRefusalMessage, bn as isWholeDynamicReferenceValue, bo as scrubResourceRecord, br as producerRegionsFromState, bs as readBootstrapMarkerBody, c as renderNestedTemplateTreeDefect, ca as repairMalformedResourcePropertiesForReadOnly, cc as MIGRATE_TMP_PREFIX, ci as displayLogicalId, cn as refusesFinalSnapshot, co as literalSplitDelimitersOf, cr as isWaitAbandonedError, cs as WorkGraph, ct as destroyStackRecordsView, d as conditionInputsFrom, da as unreadableOrphanRecords, dc as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, di as hasReadableResources, dn as DeploymentEventsStore, do as recordLogOnlyParameterValue, ds as loadPublishableAssetManifest, dt as PROTECTION_PROPERTY_BY_TYPE, ea as refuseMalformedResourcesForDeploy, ec as resolveStateBucketWithDefault, en as stateSecretNameNeedles, eo as noEchoLeavesOf, er as withPrintingSecrets, es as importableOutputs, et as isHandledOrphan, f as parentSuppliedValues, fa as unreadableResourceEntries, fc as decodeListingKey, fi as isReadableOrphanRecord, fn as extractDeploymentEventError, fo as recordLogOnlyValue, fs as rewriteTemplateAssetReferences, ft as isProtectionValueActive, g as mergeNoChangeOutputs, ga as unwrittenCreateOnlyReplacement, gc as derivePartitionAndUrlSuffix, gi as malformedExportSourceWarning, gn as secretBearing, go as maskSecretsInError, gr as DiffCalculator, gs as ensureAssetStorage, h as keptWholeReasonText, hc as canonicalizeRegion, hi as malformedExportNamesWarning, hn as exportAliasCollisionScrubWarning, ho as errorCauseChain, hs as assertAssetBucketRegion, i as childTemplateLoader, ia as repairMalformedOrphanRecordsForReadOnly, ic as warnDeprecatedNoPrefixCliFlag, ii as UNREADABLE_ORPHANS_CONTAINER_ROW, in as ccRoutedFinalSnapshotError, io as liveMatchesUnresolvedTokenFrame, ir as UNSPECIFIED_SKIP_REASON, is as shouldRetainResource, it as sameJournaledOrphans, j as green, jc as resolveBucketRegion, ji as malformedScrubResourceEntriesRefusalMessage, jn as formatDestructiveChange, jo as recordMaskOnlyValue, jr as envCredentialsAreAssumedRole, js as formatDockerLoginError, jt as orphanDeleteNeedsIdentity, k as cyan, kc as resolveAssemblyPath, ki as malformedResourcePropertiesWarning, kn as constructPathOf, ko as carriesSecretMask, kr as applyCallerIdentityCredentials, ks as dockerSpawnEnvWithSensitive, l as templateIdentity, la as repairMalformedResourcesForReadOnly, lc as findLargeInlineResources, li as hasReadableOrphans, ln as unsupportedFinalSnapshotError, lo as logOnlyValueCount, ls as buildAssetRedirectMap, m as isSecretBearingReferenceString, ma as findActionableSilentDrops, mc as PARTITION_TABLE, mi as malformedDriftResourcePropertiesWarning, mn as displayTextOrWithheld, mo as createSecretMasker, ms as BOOTSTRAP_MARKER_PREFIX, mt as readProtection, n as IMPLICIT_DELETE_DEPENDENCIES, na as refuseMalformedResourcesForExport, nc as resolveUseCdkBootstrapAssets, ni as STATE_REGION_DIVERGED, nn as PRE_DELETE_SNAPSHOT_TYPES, nr as slowCcOperationTimeoutMs, ns as orphansAfterRollback, nt as loadJournaledOrphans, o as isAbsoluteAssetPath, oa as repairMalformedOutputsForReadOnly, oc as CFN_TEMPLATE_BODY_LIMIT, oi as accountArgs, on as effectiveDeletionPolicy, oo as createUnionSecretMasker, or as deleteSkipReason, os as isSensitiveAttributeName, ot as replayRollback, p as readRecordedConditionVerdicts, pa as withheldAccountClause, pc as expectedOwnerParam, pi as isReadableResourceEntry, pn as WITHHELD_NAME_DISPLAY, po as shareLogOnlyValues, ps as AssetModeResolver, pt as perType, qi as refuseMalformedResourceEntriesForImport, qn as CC_BROKEN_REASON, qo as acceptedCreateOnlyDropsOf, qr as AWS_NO_VALUE, qs as getDefaultStateBucketName, qt as updatePartialMessage, r as computeImplicitDeleteEdges, ra as refuseMalformedState, rc as stateBucketExistenceConfirmed, ri as STATE_RESOURCES_MALFORMED, rn as buildFinalSnapshotIdentifier, ro as readsNoEchoSource, rs as orphansCarriedFrom, rt as makeForeignHolderScan, s as listNestedTemplateRows, sa as repairMalformedResourceEntriesForReadOnly, sc as CFN_TEMPLATE_URL_LIMIT, si as deployRefusesOrphanRowsReason, sn as isFinalSnapshotError, so as hasMaskableValues, ss as stringifyValue, t as DeployEngine, ta as refuseMalformedResourcesForDestroy, tc as resolveStateBucketWithDefaultAndSource, ti as JSON_LISTING_HOLE_VALUE, tn as ATOMIC_FINAL_SNAPSHOT_TYPES, to as noEchoOutputsComparison, tr as CloudControlProvider, ts as isReadableBag, tt as journaledOrphanLines, u as conditionFingerprint, ua as unpreviewableOrphanRecords, uc as uploadCfnTemplate, ui as hasReadableOutputs, un as DeploymentEventsReader, uo as printingCorpusOf, us as createAssetRedirectResolver, ut as withStackRecords, v as noEchoAttributeNamesOf, va as NO_CC_HANDLERS_REASON, vc as StageLoadError, vi as malformedLocalResourceEntriesWarning, vn as secretSafeKeyDisplay, vo as markSameGenerationBag, vr as IntrinsicFunctionResolver, vs as isCrossRegionRedirect, wa as isStatefulRecreateTargetSync, wc as ownValue, wi as malformedOrphansWarning, wn as isExportAliasCollision, wo as pathCrossesDottedKey, wr as assertSendableRoleArn, ws as buildDockerImage, x as withResourceDeadline, xa as shownType, xc as hasOwnKey, xi as malformedOrphanRecordsWarning, xn as noEchoParameterValueSeed, xo as DYNAMIC_REFERENCE_TOKEN_SCAN, xr as regionLessSecretName, xs as validateAssetBucketName, y as noEchoComparisonForTemplate, ya as hasNoCloudControlHandlers, yc as processStackMessages, yi as malformedLocalResourcesWarning, yn as exportNameSecretExposure, yo as redactSecretsForState, yr as classifyReplaySecretRegion, ys as parseBootstrapMarker, z as planOrphanAdoption, zi as refuseMalformedOrphansForDestroy, zo as TEMPLATE_SOURCED_RULES, zr as isUnboundTemplateParameter, zs as runDockerStreaming, zt as resolveReplacementOldType } from "./deploy-engine-Z_zHC0jz.js";
+import { t as getCdkdVersion } from "./version-1NhJbqzi.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -1449,7 +1449,8 @@ function validateRecreateTargets(input) {
 					property
 				});
 			}
-			if (recordedResource.provisionedBy === "cc-api" && ccBrokenReason(templateResource.Type) === void 0) blockedAlreadyCcApi.push(target);
+			const onCcAnyway = input.hasSdkProvider !== void 0 && !nestedStackRow && noCcRoute === void 0 && !isCustomResource(resourceType) && !isCustomResource(templateResource.Type) && !input.hasSdkProvider(resourceType) && !input.hasSdkProvider(templateResource.Type);
+			if ((recordedResource.provisionedBy === "cc-api" || onCcAnyway) && ccBrokenReason(templateResource.Type) === void 0) blockedAlreadyCcApi.push(target);
 		} else {
 			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, input.allowUnsupportedProperties, recordedResource.properties, { unresolvedAs: "changed" });
 			for (const { property } of actionableDrops) ambiguousIntentSdk.push({
@@ -1543,7 +1544,7 @@ function renderRecreateTargetsErrors(validation) {
 	}
 	if (validation.blockedAlreadyCcApi.length > 0) {
 		if (lines.length > 0) lines.push("");
-		lines.push(`--recreate-via-cc-api named ${validation.blockedAlreadyCcApi.length} resource(s) that are ALREADY sticky on Cloud Control API (the migration is a no-op):`);
+		lines.push(`--recreate-via-cc-api named ${validation.blockedAlreadyCcApi.length} resource(s) that are ALREADY sticky on Cloud Control API, or whose type has no SDK provider (the migration is a no-op):`);
 		for (const blocked of validation.blockedAlreadyCcApi) lines.push(`  - ${blocked.logicalId} (${recordedTypeShown(blocked.resourceType)})`);
 		lines.push("  Fix: drop these logical ids from --recreate-via-cc-api. They are already CC-managed; a destroy + recreate cycle would produce the same end state at the cost of unnecessary downtime.");
 	}
@@ -1621,7 +1622,7 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 					promoted.push({ ...target });
 					continue;
 				}
-				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live S3 probe failed for ${target.logicalId} (bucket ${target.physicalId}); leaving stateful guard at the sync result. If the bucket might be non-empty, re-run with --force-stateful-recreation. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
+				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live S3 probe failed for ${target.logicalId} (bucket ${target.physicalId}); leaving stateful guard at the sync result. If the bucket might be non-empty, re-run with --force-stateful-recreation. Underlying error: ${describeAwsFailure(e).detail}`);
 				promoted.push({
 					...target,
 					probeUnresolved: true
@@ -1678,7 +1679,7 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 					});
 					continue;
 				}
-				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live CloudWatch Logs probe failed for ${target.logicalId} (log group ${target.physicalId}); treating the log group as NOT provably empty. An unset or zero RetentionInDays is CloudWatch Logs' "never expire", so an unprovable emptiness must not read as empty. Fixes, cheapest first: grant logs:DescribeLogStreams and re-run, or re-run as-is if this was transient (CloudWatch Logs throttles this API aggressively). Only if the log group really is disposable, re-run with --force-stateful-recreation — that flag has NO per-resource granularity and clears the guard for every target in the run. Underlying error: ${e instanceof Error ? e.message : String(e)}`);
+				logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: live CloudWatch Logs probe failed for ${target.logicalId} (log group ${target.physicalId}); treating the log group as NOT provably empty. An unset or zero RetentionInDays is CloudWatch Logs' "never expire", so an unprovable emptiness must not read as empty. Fixes, cheapest first: grant logs:DescribeLogStreams and re-run, or re-run as-is if this was transient (CloudWatch Logs throttles this API aggressively). Only if the log group really is disposable, re-run with --force-stateful-recreation — that flag has NO per-resource granularity and clears the guard for every target in the run. Underlying error: ${describeAwsFailure(e).detail}`);
 				promoted.push({
 					...target,
 					statefulReason: "has-log-events"
@@ -2209,7 +2210,7 @@ var ExportIndexStore = class {
 					state: (await this.stateBackend.getState(ref.stackName, ref.region ?? this.region))?.state
 				};
 			} catch (err) {
-				this.logger.warn(`Failed to read state for ${ref.stackName} (${ref.region ?? ""}) during index rebuild: ${err instanceof Error ? err.message : String(err)}`);
+				this.logger.warn(`Failed to read state for ${ref.stackName} (${ref.region ?? ""}) during index rebuild: ${describeAwsFailure(err).detail}`);
 				return {
 					ref,
 					state: null
@@ -2322,10 +2323,10 @@ var ExportIndexStore = class {
 				await new Promise((resolve) => setTimeout(resolve, backoff));
 				continue;
 			}
-			this.logger.warn(`Exports index ${label} failed (non-retryable): ${err instanceof Error ? err.message : String(err)}; continuing without index update`);
+			this.logger.warn(`Exports index ${label} failed (non-retryable): ${describeAwsFailure(err).detail}; continuing without index update`);
 			return false;
 		}
-		this.logger.warn(`Exports index ${label} exhausted ${this.opts.maxWriteRetries} retries due to concurrent writers; continuing without index update. Last error: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`);
+		this.logger.warn(`Exports index ${label} exhausted ${this.opts.maxWriteRetries} retries due to concurrent writers; continuing without index update. Last error: ${describeAwsFailure(lastErr).detail}`);
 		return false;
 	}
 	isNoSuchKey(err) {
@@ -2395,7 +2396,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-D76dAHvV.js");
+	providerClasses ??= import("./provider-classes-Dz2gVtOZ.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -3734,7 +3735,7 @@ async function drainTemplateUploads(cleanups, stateBucket, labels) {
 	for (const cleanup of cleanups) try {
 		await cleanup();
 	} catch (cleanupErr) {
-		const msg = cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr);
+		const msg = describeAwsFailure(cleanupErr).detail;
 		logger.warn(`Failed to delete ${labels.what} from '${stateBucket}'${labels.when ? ` ${labels.when}` : ""}. Clean up manually under prefix '${MIGRATE_TMP_PREFIX}/'. Cause: ${msg}`);
 	}
 }
@@ -3830,7 +3831,7 @@ async function retireCloudFormationStack(options) {
 				}));
 				updateRan = true;
 			} catch (err) {
-				const msg = err instanceof Error ? err.message : String(err);
+				const msg = describeAwsFailure(err).detail;
 				if (/No updates are to be performed/i.test(msg)) logger.info(`  CloudFormation reports no updates needed — proceeding to delete.`);
 				else throw err;
 			}
@@ -3920,7 +3921,7 @@ async function injectRetainPoliciesRecursive(rootTemplateBody, rootCfnStackName,
 			cleanups
 		};
 	} catch (err) {
-		throw new RecursiveRetainInjectionError(err instanceof Error ? err.message : String(err), cleanups, err instanceof Error ? err : void 0);
+		throw new RecursiveRetainInjectionError(describeAwsFailure(err).detail, cleanups, err instanceof Error ? err : void 0);
 	}
 }
 var RecursiveRetainInjectionError = class extends Error {
@@ -4020,7 +4021,7 @@ async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
 			logger.debug(`No CloudFormation stack named '${stackName}'.`);
 			return null;
 		}
-		const reason = err instanceof Error ? err.message : String(err);
+		const reason = describeAwsFailure(err).detail;
 		const subject = isPasteableIdent(stackName) ? `CloudFormation stack '${stackName}'` : "a CloudFormation stack whose name is not a plain identifier";
 		logger.warn(`Could not read ${subject} to resolve physical IDs (${reason}).\nFalling back to per-resource lookup; resources whose physical name CloudFormation generated may be reported as not found. Grant cloudformation:DescribeStackResources, or pass --resource ${commandHole("LogicalId")}=${commandHole("physicalId")} for those resources.`);
 		return null;
@@ -5554,7 +5555,7 @@ var ScrubRefusalError = class ScrubRefusalError extends CdkdError {
 	}
 };
 function describeFailure(err) {
-	if (!(err instanceof Error)) return String(err);
+	if (!(err instanceof Error)) return safeStringify(err);
 	return errorCauseChain(err).map((link, i) => i === 0 ? link.message : `\n    Caused by: ${link.message}`).join("");
 }
 function scrubStacksFailedError(failures) {
@@ -5667,7 +5668,7 @@ async function saveScrubbedState(stateBackend, stackName, region, state, loaded)
 			try {
 				survives = await stateBackend.getRawObject(legacyKey) !== null;
 			} catch (err) {
-				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${err instanceof Error ? err.message : String(err)}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
+				throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but whether its legacy key ${legacyKey} still holds the pre-scrub record ` + safeMsg`could not be verified (${describeAwsFailure(err).detail}). ` + "Check that key yourself and, if it exists, delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes. A re-run will not check it again.", "SCRUB_LEGACY_STATE_KEY_UNVERIFIED");
 			}
 			if (survives) throw new ScrubRefusalError(safeMsg`${displayStackName(stackName)} was rewritten to the region-scoped state key, ` + safeMsg`but its legacy key ${legacyKey} could not be deleted and still holds the ` + "pre-scrub record as its CURRENT object. Delete it (aws s3api delete-object --bucket <state-bucket> --key <that key>), then purge its earlier versions as docs/cli-scrub.md describes.", "SCRUB_LEGACY_STATE_KEY_SURVIVES");
 		}
@@ -5811,7 +5812,7 @@ async function repairParentOutputAttributes(parentRow, region, stateBackend, loc
 		};
 	} finally {
 		await lockManager.releaseLock(parentRow.stackName, region).catch((err) => {
-			logger.warn(safeMsg`Failed to release lock for ${displayStackName(parentRow.stackName)}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(safeMsg`Failed to release lock for ${displayStackName(parentRow.stackName)}: ${describeAwsFailure(err).detail}`);
 		});
 	}
 }
@@ -6062,7 +6063,7 @@ async function scrubCommand(stacks, options) {
 		} catch (err) {
 			if (err instanceof ScrubIndexInvariantError) throw err;
 			if (!indexUnreadable.some((u) => u.region === stackRegion)) {
-				const reason = displaySafe(err instanceof Error ? err.message : String(err));
+				const reason = displaySafe(describeAwsFailure(err).detail);
 				indexUnreadable.push({
 					region: stackRegion,
 					reason
@@ -6129,7 +6130,7 @@ async function scrubCommand(stacks, options) {
 		try {
 			entries = await store.readPersistedEntries();
 		} catch (err) {
-			const reason = displaySafe(err instanceof Error ? err.message : String(err));
+			const reason = displaySafe(describeAwsFailure(err).detail);
 			indexUnreadable.push({
 				region: indexRegion,
 				reason
@@ -6354,7 +6355,7 @@ function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignP
 	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} cannot re-resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => displayIdent(r)).join(", ")}), so it may have been resolved in one of those rather than in ${displayIdent(stackRegion)}. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
 }
 function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
 }
 const DYNAMIC_REFERENCE_OPENING = "{{resolve:";
 const SECRET_REFERENCE_OPENINGS = [
@@ -6527,7 +6528,7 @@ function effectiveIntrinsicKey(node) {
 	return RESOLVER_INTRINSIC_PRECEDENCE.find((key) => key in node);
 }
 function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}: ${maskSecretsInText(describeAwsFailure(cause).detail, secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
 }
 function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, loggedVia, maskedNames = /* @__PURE__ */ new Set()) {
 	const chain = dedupePreservingOrder(loggedVia, "first");
@@ -6938,7 +6939,7 @@ function makeCrossStackPrePass(deps) {
 			try {
 				loaded = await backend.getState(producer.stack, producer.region);
 			} catch (err) {
-				logger.debug(`Scrub of ${shownStackName}: could not re-read producer ${shownProducer} (${displayIdent(producer.region)}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.debug(`Scrub of ${shownStackName}: could not re-read producer ${shownProducer} (${displayIdent(producer.region)}) to classify its stored value: ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
@@ -6972,17 +6973,17 @@ function makeCrossStackPrePass(deps) {
 				await resolver.resolve({ [key]: node[key] }, probe);
 			} catch (err) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${shownStackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`Scrub of ${shownStackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 					return;
 				}
 				if (isByDesignRefusal(err)) {
-					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					const detail = `${where}: ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`;
 					findings.unverifiable.push(detail);
 					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
 				}
 				if (isMalformedProducerRefusal(err)) {
-					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
+					const detail = `${where}: ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`;
 					findings.unverifiable.push(detail);
 					findings.damagedProducerRecords.push(detail);
 					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
@@ -7079,7 +7080,7 @@ async function bindDefaultedParametersOneByOne(resolver, template, shownStack, l
 			});
 			if (Object.hasOwn(one, name)) bound[name] = one[name];
 		} catch (err) {
-			logger.debug(safeMsg`Parameter ${name} of ${shownStack} left unbound: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(safeMsg`Parameter ${name} of ${shownStack} left unbound: ${describeAwsFailure(err).detail}`);
 		}
 	}
 	return bound;
@@ -7233,10 +7234,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			parameters = await resolver.resolveParameters(stack.template, nestedInput?.parameters, inheritedSecrets && { inheritedSecrets });
 		} catch (err) {
 			if (opts.nestedChild) {
-				const reason = maskSecretsInText(err instanceof Error ? err.message : String(err), inheritedSecrets ?? outputSecrets);
+				const reason = maskSecretsInText(describeAwsFailure(err).detail, inheritedSecrets ?? outputSecrets);
 				throw new ScrubRefusalError(`Nested stack ${shownStack}: its Parameters could not be resolved against its own template (${reason}), so its secrets cannot be identified. Its record was NOT examined and may still hold plaintext.`, "SCRUB_NESTED_CHILD_UNRESOLVABLE");
 			}
-			logger.debug(`Parameter resolution skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Parameter resolution skipped for ${shownStack}: ${maskSecretsInText(describeAwsFailure(err).detail, outputSecrets)}`);
 			parameters = await bindDefaultedParametersOneByOne(resolver, stack.template, shownStack, logger);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
@@ -7282,7 +7283,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				});
 			}
 		} catch (err) {
-			logger.debug(`Condition evaluation skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Condition evaluation skipped for ${shownStack}: ${maskSecretsInText(describeAwsFailure(err).detail, outputSecrets)}`);
 		}
 		const templateResources = stack.template.Resources ?? {};
 		const templateOutputs = stack.template.Outputs ?? {};
@@ -7342,7 +7343,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							else ungateableAbandonedScans++;
 							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource ${maskedIdent(logicalId, recordedSecretValues)} property ${maskedIdent(propertyName, recordedSecretValues)}` : `resource ${maskedIdent(logicalId, recordedSecretValues)}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of ${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of ${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""} during scrub was partial: ${describeAwsFailure(err).detail}`, recordedSecretValues));
 					}
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -7380,7 +7381,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							else ungateableAbandonedScans++;
 							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName} during scrub was partial: ${describeAwsFailure(err).detail}`, recordedSecretValues));
 					}
 				}
 			}
@@ -7416,7 +7417,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					}
 					if (nameFailed) {
 						outputsSourceUntrusted = true;
-						logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+						logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} could not be resolved during scrub (${maskSecretsInText(describeAwsFailure(nameError).detail, outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 					}
 				}
 				if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
@@ -7462,7 +7463,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						else ungateableAbandonedScans++;
 						logger.warn(maskSecretsInText(abandonedScanWarning(`output ${maskedIdent(name, outputSecrets)}`, leafVerdict), outputSecrets));
 					}
-					logger.debug(`Resolution of output ${maskedIdent(name, outputSecrets)} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+					logger.debug(`Resolution of output ${maskedIdent(name, outputSecrets)} during scrub was partial: ${maskSecretsInText(describeAwsFailure(err).detail, outputSecrets)}`);
 				}
 			}
 		});
@@ -7655,7 +7656,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						readers = findDroppedOutputReaders(stack.stackName, region, dropping, await (opts.readConsumerRecords ?? (() => readConsumerRecords(stateBackend, region)))());
 					} catch (err) {
 						droppedOutputReadersUnverified = true;
-						logger.warn(safeMsg`${shownStack}'s template no longer declares output key(s) ${shownKeys(dropping)}, ` + `but the other stacks' state could not be read to confirm none of them still ` + safeMsg`reads one (${maskSecretsInText(err instanceof Error ? err.message : String(err), corpus)}), ` + "so NONE was dropped and this stack is not reported clean. Fix the read and re-run cdkd scrub.");
+						logger.warn(safeMsg`${shownStack}'s template no longer declares output key(s) ${shownKeys(dropping)}, ` + `but the other stacks' state could not be read to confirm none of them still ` + safeMsg`reads one (${maskSecretsInText(describeAwsFailure(err).detail, corpus)}), ` + "so NONE was dropped and this stack is not reported clean. Fix the read and re-run cdkd scrub.");
 						dropping = /* @__PURE__ */ new Set();
 					}
 					if (readers !== void 0 && readers.length > 0) {
@@ -7734,7 +7735,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		throw maskSecretsInError(err, boundaryNeedles);
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
-			logger.warn(`Failed to release lock for ${shownStack}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to release lock for ${shownStack}: ${describeAwsFailure(err).detail}`);
 		});
 	}
 }
@@ -8609,7 +8610,7 @@ function createIamPrincipalUniqueIdResolver(awsClients) {
 			if (entityArn !== void 0 && entityArn.toLowerCase() === arn.toLowerCase()) uniqueId = entityId;
 			else getLogger().debug(`Principal ${displayIdent(arn, { maxCodePoints: 613 })} resolved to ${entityArn === void 0 ? "no entity" : displayIdent(entityArn, { maxCodePoints: 613 })} — same name in this account or under another IAM path; leaving the policy principal comparison untouched.`);
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
+			const message = describeAwsFailure(error).detail;
 			const name = error instanceof Error ? error.name : "";
 			const status = error?.$metadata?.httpStatusCode;
 			const denied = /^AccessDenied|^NotAuthorized/i.test(name) || status === 403;
@@ -8776,7 +8777,7 @@ async function driftProducerRegionEvidence(state, stackName, region, stateBacken
 	try {
 		parent = await stateBackend.getState(parentName, parentRegion);
 	} catch (error) {
-		noteUnreadableAncestor(parentName, parentRegion, `it could not be read (${error instanceof Error ? error.message : String(error)})`);
+		noteUnreadableAncestor(parentName, parentRegion, `it could not be read (${describeAwsFailure(error).detail})`);
 		return inheritProducerRegions(own, void 0);
 	}
 	if (!parent || parent.divergentBodyRegion !== void 0 || typeof parent.state !== "object" || parent.state === null) {
@@ -9148,7 +9149,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 					secretResolutionFailed = true;
 					comparisonBaseline = baseline;
 					const refused = isDriftSecretRefusal(err);
-					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.warn(`${logicalId} (${resource.resourceType}): ` + (refused ? "refused to resolve a dynamic reference this resource's state records, so its secret-bearing properties are NOT compared — " : "could not resolve the dynamic reference(s) this resource's state records, so its secret-bearing properties are NOT compared — ") + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 					for (const plaintext of secrets.keys()) recordLogOnlyValue(secrets, plaintext);
 					secrets.clear();
 				}
@@ -9196,7 +9197,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 			} catch (err) {
 				if (isNoReadHandlerError(err)) {
-					logger.debug(`${logicalId} (${resource.resourceType}): read threw with a no-READ-handler signature, reported as drift unknown — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`${logicalId} (${resource.resourceType}): read threw with a no-READ-handler signature, reported as drift unknown — ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 					noteReadReturned();
 					outcomes.push({
 						kind: "unsupported",
@@ -9219,7 +9220,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 						breakerTripped = true;
 					}
 				}
-				logger.warn(`${logicalId} (${resource.resourceType}): could not be compared — the read or comparison failed, so NONE of its properties were checked. ` + (trippedReadPaths.size > 0 ? "" : `cdkd goes on with the rest of this stack. `) + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.warn(`${logicalId} (${resource.resourceType}): could not be compared — the read or comparison failed, so NONE of its properties were checked. ` + (trippedReadPaths.size > 0 ? "" : `cdkd goes on with the rest of this stack. `) + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 				if (breakerTripped) logger.warn(safeMsg`${5} reads in a row in this stack failed ` + safeMsg`${DRIFT_READ_PATH_LABELS[readPath]} — expired credentials, a revoked ` + "role, a permission all of them need, or a burst of throttling — so cdkd stops reading this stack's resources that way, and reports each one left as not compared. Fix the cause, or re-run if it was throttling.");
 				if (err instanceof Error && err.stack) logger.debug(`${logicalId} (${resource.resourceType}): comparison failure detail`, maskSecretsInError(err, secrets).stack);
 				continue;
@@ -9405,7 +9406,7 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			logger.info(`✓ State updated for ${report.stackName} (${report.region}): ` + (acceptedResourceCount === 0 ? "0 resource(s) accepted — no drifted change was recorded, and this write carried only the positioned re-redaction." : `accepted drift on ${acceptedResourceCount} resource(s).`));
 		} finally {
 			await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
-				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
+				logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + describeAwsFailure(err).detail);
 			});
 		}
 	}
@@ -9808,7 +9809,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 		stateBucket: stateConfig.bucket,
 		statePrefix: stateConfig.prefix
 	};
-	printRevertPlan(reports, out);
+	printRevertPlan(reports, out, lockRecovery);
 	if (options.dryRun) {
 		logger.info("--dry-run: AWS will NOT be modified. Re-run without --dry-run to apply.");
 		return;
@@ -9887,7 +9888,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						});
 					} catch (err) {
 						totalUnresolvable++;
-						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ` + (isDriftSecretRefusal(err) ? `refused to re-resolve a dynamic reference this resource's state records — ` : `could not re-resolve the dynamic reference(s) this resource's state records — `) + `${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): ` + (isDriftSecretRefusal(err) ? `refused to re-resolve a dynamic reference this resource's state records — ` : `could not re-resolve the dynamic reference(s) this resource's state records — `) + `${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 						return;
 					}
 					const unrevertablePaths = outcome.changes.map((c) => c.path).filter((path) => (path.split(".", 1)[0] ?? "").includes("***"));
@@ -9928,7 +9929,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 						newProperties = maskPreserved.properties;
 					} catch (err) {
 						totalFailed++;
-						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): could not build the revert payload — ${maskSecretsInText(describeAwsFailure(err).detail, secrets)}`);
 						return;
 					}
 					try {
@@ -9949,7 +9950,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 								if (Object.keys(delta).length > 0) narrowedByLogicalId.set(outcome.logicalId, keepBaselineAtUncertifiedPaths(redactSecretsForState(delta, secrets, revertBaseline, stateResource.observedProperties !== void 0 ? STATE_SOURCED_BASELINE_RULES : STATE_SOURCED_READBACK_RULES), [...outcome.uncertifiedPaths, ...outcome.noEchoParameterPaths ?? []], revertBaseline));
 							}
 						} catch (captureErr) {
-							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(captureErr instanceof Error ? captureErr.message : String(captureErr), secrets)}`);
+							logger.warn(`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the provider's reported effective properties could not be read — ${maskSecretsInText(describeAwsFailure(captureErr).detail, secrets)}`);
 						}
 						try {
 							if (updateResult !== void 0) {
@@ -9964,7 +9965,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 								});
 							}
 						} catch (recordErr) {
-							logger.warn(safeMsg`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the attributes the provider returned could not be recorded — ${maskSecretsInText(recordErr instanceof Error ? recordErr.message : String(recordErr), secrets)}`);
+							logger.warn(safeMsg`  ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): reverted, but the attributes the provider returned could not be recorded — ${maskSecretsInText(describeAwsFailure(recordErr).detail, secrets)}`);
 						}
 					} catch (err) {
 						if (err instanceof ResourceUpdateNotSupportedError) {
@@ -9973,7 +9974,7 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 							return;
 						}
 						totalFailed++;
-						const msg = maskSecretsInText(err instanceof Error ? err.message : String(err), secrets);
+						const msg = maskSecretsInText(describeAwsFailure(err).detail, secrets);
 						logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): AWS update failed — ${msg}`);
 					}
 				})), concurrency);
@@ -10039,12 +10040,12 @@ async function runRevert(reports, regionScope, stateBackend, stateConfig, awsCli
 					} catch (err) {
 						const revertAgain = revertCommandLine(report.stackName, report.region);
 						const unrecorded = [...recordedCount > 0 ? ["the value the provider actually applied"] : [], ...reRecordedCount > 0 ? ["the identity the revert returned"] : []].join(" and ");
-						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record ${unrecorded}: ${err instanceof Error ? err.message : String(err)}.` + (reRecordedCount > 0 ? " The state record still holds the physical id and attributes from before the revert, which a later 'Fn::GetAtt' and 'cdkd export' read. Re-running the revert does not repair it, since the revert landed; a later deploy that updates this resource records the identity its update returns." : "") + (recordedCount > 0 ? ` The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`) : ""));
+						logger.warn(`Reverted ${report.stackName} (${report.region}), but could not record ${unrecorded}: ${describeAwsFailure(err).detail}.` + (reRecordedCount > 0 ? " The state record still holds the physical id and attributes from before the revert, which a later 'Fn::GetAtt' and 'cdkd export' read. Re-running the revert does not repair it, since the revert landed; a later deploy that updates this resource records the identity its update returns." : "") + (recordedCount > 0 ? ` The next 'cdkd drift' will report the same difference — ` + (revertAgain === void 0 ? `re-run 'cdkd drift --revert' for this stack once the state write can succeed.` : `re-run the command below once the state write can succeed.\nRevert with: ${revertAgain}`) : ""));
 					}
 				}
 			} finally {
 				await lockManager.releaseLock(report.stackName, report.region).catch((err) => {
-					logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + (err instanceof Error ? err.message : String(err)));
+					logger.warn(`Failed to release lock for ${report.stackName} (${report.region}): ` + describeAwsFailure(err).detail);
 				});
 			}
 		});
@@ -10117,7 +10118,7 @@ function revertCommandLine(stackName, region) {
 		hole: "region"
 	}]).command} --revert`;
 }
-function printRevertPlan(reports, out) {
+function printRevertPlan(reports, out, recovery) {
 	for (const report of reports) {
 		const drifted = report.outcomes.flatMap((o) => matchOutcome(o, {
 			drifted: (d) => [d],
@@ -10156,15 +10157,20 @@ function printRevertPlan(reports, out) {
 					const word = unbaselined.length === 1 ? "value" : "values";
 					out.write(`    ! this resource has no observed-capture baseline, so the revert pushes the raw TEMPLATE and LEAVES ${unbaselined.length} AWS-authored ${word} untouched:\n`);
 					for (const path of unbaselined) out.write(`        ${reportPath(maskSecretsInText(path, o.secrets))}\n`);
-					const refresh = mayNameTarget(report.stackName, report.region) ? pasteableCommand("cdkd state refresh-observed", [{
-						value: report.stackName,
-						hole: "stack"
-					}, {
-						flag: "--stack-region",
-						value: report.region,
-						hole: "region"
-					}]) : void 0;
-					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). " + (refresh === void 0 ? "Re-deploy if you want them reverted too; this record's identity cannot be named safely in a command, so none is offered.\n" : "Populate observedProperties with the command below, or re-deploy, if you want them reverted too.\n"));
+					const refresh = mayNameTarget(report.stackName, report.region) ? pasteableCommand("cdkd state refresh-observed", [
+						{
+							value: report.stackName,
+							hole: "stack"
+						},
+						{
+							flag: "--stack-region",
+							value: report.region,
+							hole: "region"
+						},
+						...accountArgs(recovery)
+					]) : void 0;
+					const refreshAccountNote = refresh === void 0 ? "" : withheldAccountClause(recovery, "the command below prints").trimEnd();
+					out.write("      The template does not declare these, so cdkd cannot tell an AWS-authored value from an out-of-band change and will not reset either (issue #1626). " + (refresh === void 0 ? "Re-deploy if you want them reverted too; this record's identity cannot be named safely in a command, so none is offered.\n" : `Populate observedProperties with the command below, or re-deploy, if you want them reverted too.${refreshAccountNote === "" ? "" : ` ${refreshAccountNote}`}\n`));
 					if (refresh !== void 0) out.write(`      Populate with: ${refresh.command}\n`);
 				}
 			}
@@ -11934,7 +11940,7 @@ var AttributeFetcher = class {
 				value: chosen
 			};
 		} catch (err) {
-			return this.cacheFallback(orphanLogicalId, attribute, err instanceof Error ? err.message : String(err));
+			return this.cacheFallback(orphanLogicalId, attribute, describeAwsFailure(err).detail);
 		}
 	}
 	cacheFallback(orphanLogicalId, attribute, reason) {
@@ -12331,7 +12337,7 @@ async function orphanCommand(pathArgs, options) {
 			logger.info(`Orphaned ${orphanLogicalIds.length} resource(s) from state: ${displayStackName(stackInfo.stackName)} (${displayIdent(targetRegion)}). AWS resources are still in AWS; cdkd will no longer manage them.`);
 		} finally {
 			if (!options.dryRun) await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`);
+				logger.warn(`Failed to release lock: ${displayAwsMessage(describeAwsFailure(err).detail)}`);
 			});
 		}
 	} finally {
@@ -13533,7 +13539,7 @@ async function exportCommand(stackArg, options) {
 		}
 		try {
 			if (nestedStackRows.length > 0) {
-				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state);
+				const nestedStackTree = await buildCdkdStateStackTree(resolvedStackName, targetRegion, stateBackend, state, lockRecovery);
 				reportDriftBaselineGaps(state, logger, {
 					stackName: resolvedStackName,
 					region: migrationPending ? void 0 : targetRegion
@@ -13659,7 +13665,7 @@ async function exportCommand(stackArg, options) {
 					logger.info(`  ${preDeletedLine(entry.physicalId)}`);
 				} catch (err) {
 					const msg = err instanceof Error ? err.message : String(err);
-					const orphan = orphanCommandFor(resolvedStackName, targetRegion);
+					const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${plainOrNotShown(entry.logicalId)} (${plainOrNotShown(entry.resourceType)}, physicalId: ${recordValueOrNotShown(entry.physicalId)}) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying AWS API — iam:Delete{Role,User,Group}Policy for an inline policy).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n` + preDeleteManualCommands(recreateBeforePhase2).map((line) => `       ${line}\n`).join("") + `     (one per entry in the pre-delete list logged above).
   3. Run the phase-2 UPDATE manually with the full synth template:
        ${phase2RetryCommand(cfnStackName)}\n  4. Once phase 2 succeeds, clean up cdkd's stale state record.${orphan.note}\n     Run: ${orphan.command}`);
@@ -13679,7 +13685,7 @@ async function exportCommand(stackArg, options) {
 			} catch (err) {
 				const msg = err instanceof Error ? err.message : String(err);
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
-				const orphan = orphanCommandFor(resolvedStackName, targetRegion);
+				const orphan = orphanCommandFor(resolvedStackName, targetRegion, lockRecovery);
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${displayAwsMessage(msg)}\n\nThe CloudFormation stack ${quotedOrNotShown(cfnStackName)} now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
   2. Re-run the phase 2 UPDATE manually with the full synth template:
        ${phase2RetryCommand(cfnStackName)}\n  3. Once phase 2 succeeds, clean up cdkd's stale state record.${orphan.note}\n     Run: ${orphan.command}`);
@@ -13980,8 +13986,10 @@ function preDeleteListingLines(entry) {
 	if (entry.unconfirmedPrincipals && entry.unconfirmedPrincipals.length > 0) lines.push("  phase 2 cannot be confirmed to re-attach it to " + entry.unconfirmedPrincipals.map((p) => `${p.kind} ${showRecordValue(p.name)}`).join(", ") + ": the template names its principals through a value cdkd cannot resolve");
 	return lines;
 }
-function orphanCommandFor(stackName, region) {
-	const built = pasteableCommand("cdkd state orphan", [{
+function orphanCommandFor(stackName, region, recovery) {
+	const account = accountArgs(recovery);
+	const accountNote = spacedAccountClause(recovery, "the next line's command prints");
+	const identity = [{
 		value: stackName,
 		hole: "stack",
 		opts: { plainIdent: true }
@@ -13990,16 +13998,24 @@ function orphanCommandFor(stackName, region) {
 		value: region,
 		hole: "region",
 		opts: { plainIdent: true }
-	}]);
+	}];
+	const built = pasteableCommand("cdkd state orphan", identity);
 	if (built.exact) return {
-		command: built.command,
-		note: ""
+		command: pasteableCommand("cdkd state orphan", [...identity, ...account]).command,
+		note: accountNote
 	};
 	const reasons = [orphanWithheldPart("stack name", stackName, built, "stack"), orphanWithheldPart("region", region, built, "region")].filter((part) => part !== "");
 	const dashName = typeof stackName === "string" && stackName.startsWith("-");
 	return {
-		command: `cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")}`,
-		note: ` The next line's command names neither value, because its record's ${reasons.join("; and its ")}. List the records with 'cdkd state list --json' and ` + (dashName ? "repair or remove the one whose stackName and region match by hand — this stack name begins with a '-' and could parse as an option in that position, so do not fill a hole with it." : `act on the one whose stackName and region match, replacing each quoted hole, quotes included, with ${JSON_LISTING_HOLE_VALUE}.`)
+		command: pasteableCommand("cdkd state orphan", [
+			{ hole: "stack" },
+			{
+				flag: "--stack-region",
+				hole: "region"
+			},
+			...account
+		]).command,
+		note: ` The next line's command names neither value, because its record's ${reasons.join("; and its ")}. List the records with ` + (account.length > 0 ? `'cdkd state list --json' run with the same account flags as the next line's command, and ` : `'cdkd state list --json' and `) + (dashName ? "repair or remove the one whose stackName and region match by hand — this stack name begins with a '-' and could parse as an option in that position, so do not fill a hole with it." : `act on the one whose stackName and region match, replacing each quoted hole, quotes included, with ${JSON_LISTING_HOLE_VALUE}.`) + accountNote
 	};
 }
 function orphanWithheldPart(what, raw, built, hole) {
@@ -14020,7 +14036,7 @@ function orphanWithholdWhy(reason, positional) {
 		default: throw new Error(`orphanWithholdWhy: unhandled WithholdReason ${String(reason)}`);
 	}
 }
-async function buildCdkdStateStackTree(rootStackName, region, stateBackend, prefetchedRootState) {
+async function buildCdkdStateStackTree(rootStackName, region, stateBackend, prefetchedRootState, recovery) {
 	let rootState;
 	if (prefetchedRootState !== void 0) rootState = prefetchedRootState;
 	else {
@@ -14028,9 +14044,9 @@ async function buildCdkdStateStackTree(rootStackName, region, stateBackend, pref
 		if (!rootResult) throw new Error(`No cdkd state found for stack ${quotedOrNotShown(rootStackName)} (${quotedRegion(region)}). Cannot build nested-stack tree.`);
 		rootState = rootResult.state;
 	}
-	return walkCdkdStateStackTree(rootStackName, region, rootState, stateBackend);
+	return walkCdkdStateStackTree(rootStackName, region, rootState, stateBackend, recovery);
 }
-async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
+async function walkCdkdStateStackTree(stackName, region, state, stateBackend, recovery) {
 	const nestedChildren = /* @__PURE__ */ new Map();
 	if (!hasReadableResources(state)) return {
 		stackName,
@@ -14043,11 +14059,11 @@ async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
 		if (!childResult) {
-			const orphan = orphanCommandFor(stackName, region);
+			const orphan = orphanCommandFor(stackName, region, recovery);
 			throw new Error(`cdkd state is missing nested-child ${quotedOrNotShown(childStackName)} (${quotedRegion(region)}). Parent stack ${quotedOrNotShown(stackName)} lists ${quotedOrNotShown(logicalId)} as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at ${quotedOrNotShown(`cdkd/${childStackName}/${region}/state.json`)}. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or drop the parent's record and re-import.${orphan.note}\nDrop it with: ${orphan.command}`);
 		}
 		if (childResult.divergentBodyRegion !== void 0) throw new Error(`cdkd state region mismatch: nested-child ${quotedOrNotShown(childStackName)} has state.region=${quotedOrNotShown(childResult.divergentBodyRegion)} but its parent ${quotedOrNotShown(stackName)} is being walked against region=${quotedOrNotShown(region)}. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
-		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend));
+		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend, recovery));
 	}
 	return {
 		stackName,
@@ -14135,7 +14151,7 @@ function indexNestedTemplatePaths(template, templateDir) {
 	}
 	return result;
 }
-function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat, tree) {
+function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat, tree, recovery) {
 	if (tree.stackName !== rootStackName) throw new Error(`buildPerStackImportNodes: tree root ${quotedOrNotShown(tree.stackName)} does not match expected root stack name ${quotedOrNotShown(rootStackName)}.`);
 	const out = /* @__PURE__ */ new Map();
 	walk(tree, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat);
@@ -14151,7 +14167,7 @@ function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplat
 		for (const [childLogicalId, childNode] of node.nestedChildren) {
 			const childTemplatePath = nodeNestedTemplatePaths[childLogicalId];
 			if (!childTemplatePath) {
-				const orphan = orphanCommandFor(childNode.stackName, childNode.region);
+				const orphan = orphanCommandFor(childNode.stackName, childNode.region, recovery);
 				throw new Error(`cdkd export: nested-stack child ${quotedOrNotShown(childLogicalId)} under parent ${quotedOrNotShown(node.stackName)} has cdkd state but no Metadata['aws:asset:path'] in the parent template's ${quotedOrNotShown(childLogicalId)} row. The synth output and the cdkd state tree are out of sync — re-deploy the parent stack to refresh, or remove the cdkd state for the orphaned child.${orphan.note}\nRemove it with: ${orphan.command}`);
 			}
 			const { template: childTemplate, format: childFormat } = readNestedChildTemplateFile(childTemplatePath, childLogicalId);
@@ -14758,29 +14774,37 @@ function reportDriftBaselineGaps(state, logger, loaded, template, recovery) {
 			maxCodePoints: 128
 		}
 	}];
+	const account = accountArgs(recovery);
+	const accountNote = (where) => withheldAccountClause(recovery, where);
 	const refresh = pasteableCommand("cdkd state refresh-observed", refArgs);
-	const refreshCommand = region !== void 0 && refresh.exact ? refresh.command : void 0;
+	const refreshCommand = region !== void 0 && refresh.exact ? pasteableCommand("cdkd state refresh-observed", [...refArgs, ...account]).command : void 0;
+	const refreshNote = refreshCommand === void 0 ? "" : accountNote("the command at the end of this line prints");
 	const refreshWithheld = region === void 0 ? "'cdkd state refresh-observed' for this stack once it is migrated: this record has no region, the legacy layout that command refuses, so migrate it first with any cdkd write, such as a deploy." : `'cdkd state refresh-observed' for this stack. The command is not printed: ${refreshWithheldReason(refresh)}`;
 	const readable = entries.filter((entry) => isReadableResourceEntry(entry[1]));
 	const unreadableCount = entries.length - readable.length;
 	if (unreadableCount > 0) {
 		const inspect = pasteableCommand("cdkd state show", refArgs);
+		const inspectCommand = pasteableCommand("cdkd state show", [
+			...refArgs,
+			{ literal: "--json" },
+			...account
+		]).command;
 		const unreadable = entries.filter(([, r]) => !isReadableResourceEntry(r)).map(([logicalId]) => logicalId);
-		logger.warn(`${unreadable.length} of ${entries.length} resource(s) in cdkd state have a record that is not readable as a resource — not an object, or carrying no resource type — so their drift baseline cannot be reported on. The state record is malformed or truncated. ` + (inspect.exact ? "" : `A quoted '<...>' hole in the command after the list below stands for a value cdkd could not ` + (stackName.startsWith("-") ? "print safely. This stack name begins with '-', which the CLI could read as an option however it is quoted, so do not fill the stack hole with it: repair or remove the record by hand. " : `print safely; fill it from 'cdkd state list --json', replacing the hole, quotes included, with ${JSON_LISTING_HOLE_VALUE}. `)) + `Inspect it with the command after the list below.`);
+		logger.warn(`${unreadable.length} of ${entries.length} resource(s) in cdkd state have a record that is not readable as a resource — not an object, or carrying no resource type — so their drift baseline cannot be reported on. The state record is malformed or truncated. ` + (inspect.exact ? "" : `A quoted '<...>' hole in the command after the list below stands for a value cdkd could not ` + (stackName.startsWith("-") ? "print safely. This stack name begins with '-', which the CLI could read as an option however it is quoted, so do not fill the stack hole with it: repair or remove the record by hand. " : `print safely; fill it from 'cdkd state list --json'` + (account.length > 0 ? ` run with the same account flags as the command after the list below` : "") + `, replacing the hole, quotes included, with ${JSON_LISTING_HOLE_VALUE}. `)) + accountNote("the command after the list below prints") + `Inspect it with the command after the list below.`);
 		for (const logicalId of unreadable.slice(0, NAMED_BASELINE_IDS)) logger.warn(`  ${displayLogicalId(logicalId)}`);
 		if (unreadable.length > NAMED_BASELINE_IDS) logger.warn(`  ... and ${unreadable.length - NAMED_BASELINE_IDS} more`);
-		logger.warn(safeMsg`Inspect it with: ${inspect.command} --json`);
+		logger.warn(safeMsg`Inspect it with: ${inspectCommand}`);
 	}
 	const missing = readable.filter(([, r]) => r.observedProperties === void 0);
 	if (missing.length === 0) return;
 	if (state.version !== void 0 && state.version < 3) {
-		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next 'cdk deploy' after migration may surface spurious changes if AWS has drifted from the ` + (unreadableCount > 0 ? `template. Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one — then capture an AWS-current baseline before export.` : `template. Capture an AWS-current baseline before export — any redeploy does ` + (refreshCommand !== void 0 ? `it, or run: ${refreshCommand}` : `it, or run ${refreshWithheld}`)));
+		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next 'cdk deploy' after migration may surface spurious changes if AWS has drifted from the ` + (unreadableCount > 0 ? `template. Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one — then capture an AWS-current baseline before export.` : `template. ${refreshNote}Capture an AWS-current baseline before export — any redeploy does ` + (refreshCommand !== void 0 ? `it, or run: ${refreshCommand}` : `it, or run ${refreshWithheld}`)));
 		return;
 	}
 	const refused = missing.filter(([, r]) => r.observedBaselineRefused === true);
 	const refreshable = missing.filter(([, r]) => r.observedBaselineRefused !== true);
 	if (refreshable.length > 0) {
-		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next 'cdk deploy' after migration may surface unexpected changes. ` + (unreadableCount > 0 ? `Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one. Then capture a baseline and run 'cdkd drift' to verify the stack matches AWS.` : refreshCommand !== void 0 ? `Capture a baseline before export, then run 'cdkd drift' to verify the stack matches AWS, with: ${refreshCommand}` : `Capture a baseline before export with ${refreshWithheld} Then run 'cdkd drift' to verify the stack matches AWS.`));
+		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next 'cdk deploy' after migration may surface unexpected changes. ` + (unreadableCount > 0 ? `Repair the ${unreadableCount} unreadable record(s) named above first — 'cdkd state refresh-observed' refuses a record that holds one. Then capture a baseline and run 'cdkd drift' to verify the stack matches AWS.` : refreshCommand !== void 0 ? `${refreshNote}Capture a baseline before export, then run 'cdkd drift' to verify the stack matches AWS, with: ${refreshCommand}` : `Capture a baseline before export with ${refreshWithheld} Then run 'cdkd drift' to verify the stack matches AWS.`));
 		for (const [logicalId] of refreshable.slice(0, NAMED_BASELINE_IDS)) logger.warn(`  ${displayLogicalId(logicalId)}`);
 		if (refreshable.length > NAMED_BASELINE_IDS) logger.warn(`  ... and ${refreshable.length - NAMED_BASELINE_IDS} more`);
 	}
@@ -15265,7 +15289,7 @@ async function runPerStackImportLoop(args) {
 		if (cdkdName === rootStackName) return cfnStackNameOverrides.root ?? cdkd2cfnStackName(cdkdName);
 		return cfnStackNameOverrides.childMap.get(cdkdName) ?? cdkd2cfnStackName(cdkdName);
 	};
-	const nodesByCdkdName = buildPerStackImportNodes(rootStackName, rootTemplate, rootStackInfoNestedTemplates, rootTemplateFormat, tree);
+	const nodesByCdkdName = buildPerStackImportNodes(rootStackName, rootTemplate, rootStackInfoNestedTemplates, rootTemplateFormat, tree, args.lockRecovery);
 	const leafFirst = flattenCdkdStateTreeLeafFirst(tree);
 	for (const n of leafFirst) if (!nodesByCdkdName.has(n.stackName)) throw new Error(`runPerStackImportLoop: missing per-stack template for ${quotedOrNotShown(n.stackName)} — tree node has cdkd state but no synth template was loaded. This is a cdkd bug.`);
 	for (const n of leafFirst) {
@@ -15402,7 +15426,7 @@ async function runPerStackImportLoop(args) {
 			const completed = perStackPlans.slice(0, i);
 			const notYetImported = perStackPlans.slice(i + 1).map((p) => quotedOrNotShown(p.cdkdName)).join(", ");
 			const orphanLines = (plans) => plans.map((p) => {
-				const orphan = orphanCommandFor(p.cdkdName, p.region);
+				const orphan = orphanCommandFor(p.cdkdName, p.region, args.lockRecovery);
 				const target = isPasteableIdent(p.cfnName) ? `CloudFormation stack ${p.cfnName}` : "a CloudFormation stack whose name is not a plain identifier";
 				return `${orphan.note ? `\n  For the record targeting ${target}:${orphan.note}` : ""}\n  ${orphan.command}`;
 			}).join("");
@@ -15543,12 +15567,19 @@ async function runPerStackImportLoop(args) {
 					region: node.region,
 					reason: err instanceof Error ? err.message : String(err)
 				});
-				const orphan = orphanCommandFor(node.stackName, node.region);
+				const orphan = orphanCommandFor(node.stackName, node.region, args.lockRecovery);
 				logger.warn(`Failed to delete cdkd state for ${quotedOrNotShown(node.stackName)} (${quotedRegion(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up its state record.${orphan.note}\nClean up with: ${orphan.command}`);
 			}
 			if (stateDeletionFailures.length > 0) {
 				const lines = stateDeletionFailures.map((f) => `  - ${quotedOrNotShown(`cdkd/${f.stackName}/${f.region}/state.json`)}: ${safeDetail(f.reason)}`).join("\n");
-				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with the command below, once per record.\nRecover with: cdkd state orphan ${commandHole("stack")} --stack-region ${commandHole("region")}`);
+				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with the command below, once per record.` + spacedAccountClause(args.lockRecovery, "the command below prints") + `\nRecover with: ${pasteableCommand("cdkd state orphan", [
+					{ hole: "stack" },
+					{
+						flag: "--stack-region",
+						hole: "region"
+					},
+					...accountArgs(args.lockRecovery)
+				]).command}`);
 			}
 			if (sessionIntrinsicSkipped.size > 0) {
 				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${quotedOrNotShown(cdkdName)} (${params.map((n) => quotedOrNotShown(n)).join(", ")})`).join("; ");
@@ -15734,6 +15765,10 @@ function replaceAtCoordinate(node, coordinate, replacement) {
 	}
 	return node;
 }
+function spacedAccountClause(recovery, where) {
+	const clause = withheldAccountClause(recovery, where).trimEnd();
+	return clause === "" ? "" : ` ${clause}`;
+}
 
 //#endregion
 //#region src/cli/commands/state.ts
@@ -16099,7 +16134,7 @@ async function stateShowCommand(stackName, options) {
 		const [stateResult, lockInfo] = await Promise.all([setup.stateBackend.getState(stackName, ref.region), setup.lockManager.getLockInfo(stackName, ref.region)]);
 		if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
 		if (options.showNested) {
-			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
+			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state, renderRecovery(options, setup)), setup.lockManager, lockInfo);
 			if (options.json) {
 				warnUnreadableTreeNodes(treeWithLocks, logger, renderRecovery(options, setup));
 				process.stdout.write(`${stringifyJsonPayload(treeToShowJson(treeWithLocks))}\n`);
@@ -16473,7 +16508,7 @@ async function stateOrphanResources(stackName, requested, options) {
 			logger.info(safeMsg`✓ Removed ${logicalIds.length} resource record(s) from state: ${idList} ` + safeMsg`(${describedStackRef(ref)}). AWS resources are still in AWS; cdkd will no longer manage them.`);
 		} finally {
 			await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-				logger.warn(safeMsg`Failed to release lock: ${displayAwsMessage(err instanceof Error ? err.message : String(err))}`);
+				logger.warn(safeMsg`Failed to release lock: ${displayAwsMessage(describeAwsFailure(err).detail)}`);
 			});
 		}
 	} finally {
@@ -17069,7 +17104,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 					refreshed++;
 				} catch (err) {
 					failed++;
-					logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + safeMsg`readCurrentState failed — ${err instanceof Error ? err.message : String(err)}`);
+					logger.warn(safeMsg`  ✗ ${displayStackName(stackName)}/${displayIdent(logicalId)} ` + safeMsg`(${displayIdent(resource.resourceType)}): ` + safeMsg`readCurrentState failed — ${describeAwsFailure(err).detail}`);
 				}
 			});
 			await Promise.all(tasks);
@@ -17090,7 +17125,7 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		};
 	} finally {
 		await lockManager.releaseLock(stackName, region).catch((err) => {
-			logger.warn(safeMsg`Failed to release lock for ${ref}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(safeMsg`Failed to release lock for ${ref}: ${describeAwsFailure(err).detail}`);
 		});
 	}
 }
@@ -17398,7 +17433,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			logger.info("");
 			if (!skipConfirmation) {
-				if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}` + (options.removeProtection === true ? ", TURNING DELETION PROTECTION OFF on resources a failed CREATE left?" : "?"))) {
+				if (!await confirm(`Roll back ${stackRegionShown(stackName, region)}` + (options.removeProtection === true ? ", TURNING DELETION PROTECTION OFF on the resources it deletes from this stack and the nested stacks it reverts?" : "?"))) {
 					logger.info("Rollback cancelled");
 					return;
 				}
@@ -17491,7 +17526,8 @@ async function rollbackCommand(stackArg, options) {
 						destroyOptions: {
 							...options.profile && { profile: options.profile },
 							statePrefix: options.statePrefix,
-							...options.skipFinalSnapshot === true && { skipFinalSnapshot: true }
+							...options.skipFinalSnapshot === true && { skipFinalSnapshot: true },
+							...options.removeProtection === true && { removeProtection: true }
 						}
 					}, () => withNestedRevertRun(segment.runId, (run) => {
 						nestedRun = run;
@@ -17687,7 +17723,7 @@ function applyFailedPlanToPreview(plan, previewState, skipFinalSnapshot) {
 	}
 }
 function createRollbackCommand() {
-	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(new Option("--drop-failed <logicalId>", "Remove ONE journaled failed CREATE (a resource cdkd proved it made, journaled as its only record) from the rollback journal, after checking that resource by hand. Replays nothing and deletes nothing in AWS; every other entry is kept.")).addOption(skipFinalSnapshotOption).addOption(new Option("--remove-protection", `Turn deletion protection off before deleting a resource a failed CREATE left behind (a journaled orphan, or under --revert-failed the failed CREATE itself), when cdkd can prove it is that resource and no other stack holds it. On a failed nested stack it cascades to that child's resources. Covers ${removeProtectionTypeList()}.`).default(false)).addOption(stackRegionOption()).addHelpText("after", [
+	const cmd = new Command("rollback").description("Revert a stack to its pre-deploy state after a failed --no-rollback / interrupted deploy or a partially-failed automatic rollback (state-driven, no synth needed).").argument("[stack]", "Stack name to roll back (defaults to the single journaled stack)").addOption(new Option("--force", "Skip the confirmation prompt").default(false)).addOption(new Option("--orphan <logicalId>", "Skip the given resource during replay (repeatable). Mirrors cdk rollback --orphan.").argParser((value, previous) => [...previous ?? [], value])).addOption(new Option("--revert-failed", "Also attempt to revert the resource whose operation FAILED mid-deploy. Off by default: the remote state of the failed resource is unknown, so force-applying its previous state is opt-in.").default(false)).addOption(new Option("--drop-failed <logicalId>", "Remove ONE journaled failed CREATE (a resource cdkd proved it made, journaled as its only record) from the rollback journal, after checking that resource by hand. Replays nothing and deletes nothing in AWS; every other entry is kept.")).addOption(skipFinalSnapshotOption).addOption(new Option("--remove-protection", `Turn deletion protection off before this stack's rollback deletes a resource the failed deploy left: one its state records from a completed CREATE, or one a failed CREATE left behind (a journaled orphan, or under --revert-failed the failed CREATE itself) when cdkd can prove it is that resource and no other stack holds it. A nested stack it deletes cascades the flag to that child's resources, and a nested stack it reverts carries it into that child's revert. Covers ${removeProtectionTypeList()}.`).default(false)).addOption(stackRegionOption()).addHelpText("after", [
 		"",
 		"Examples:",
 		"  cdkd rollback MyStack",
@@ -17696,7 +17732,7 @@ function createRollbackCommand() {
 		"  cdkd rollback MyStack --orphan MyBucket --orphan MyTable",
 		"  cdkd rollback MyStack --revert-failed   # also revert the failed in-flight resource",
 		"  cdkd rollback MyStack --skip-final-snapshot  # DeletionPolicy Snapshot → delete without the snapshot",
-		"  cdkd rollback MyStack --remove-protection   # clear a protected resource a failed CREATE left",
+		"  cdkd rollback MyStack --remove-protection   # also delete protected resources the failed deploy left",
 		"  cdkd rollback MyStack --stack-region us-west-2",
 		"  cdkd rollback MyStack --drop-failed MyQueuePolicy  # forget one undeletable failed CREATE",
 		"",
@@ -18457,12 +18493,12 @@ async function gcCommand(options) {
 			try {
 				await stateBackend.deleteRawObjects(responseCandidates.map((c) => c.key));
 			} catch (deleteError) {
-				throw new CdkdError(`Failed to delete abandoned custom-resource response placeholder(s) from ${bucketName}: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}`, "GC_DELETE_FAILED");
+				throw new CdkdError(`Failed to delete abandoned custom-resource response placeholder(s) from ${bucketName}: ${describeAwsFailure(deleteError).detail}`, "GC_DELETE_FAILED");
 			} finally {
 				await stateBackend.purgeNoncurrentVersions(responseCandidates.map((c) => c.key), {
 					listPrefix: `${CUSTOM_RESOURCE_RESPONSE_PREFIX}/`,
 					objectDescription: CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION
-				}).catch((purgeError) => logger.warn(`Could not purge noncurrent versions of the collected custom-resource response placeholder(s) in ${bucketName}; their previous versions survive and remain readable via GetObject with a VersionId. Underlying error: ${purgeError instanceof Error ? purgeError.message : String(purgeError)}`));
+				}).catch((purgeError) => logger.warn(`Could not purge noncurrent versions of the collected custom-resource response placeholder(s) in ${bucketName}; their previous versions survive and remain readable via GetObject with a VersionId. Underlying error: ${describeAwsFailure(purgeError).detail}`));
 			}
 			logger.info(`✓ Deleted ${responseCandidates.length} abandoned custom-resource response placeholder(s) (${formatBytes(responseBytes)}) from ${bucketName}`);
 		}
@@ -18720,7 +18756,7 @@ async function forceUnlockCommand(stackArgs, options) {
 					await lockManager.forceReleaseLock(stackName, r);
 					logger.info(`✓ Lock released for stack: ${where}`);
 				} catch (error) {
-					const message = error instanceof Error ? error.message : String(error);
+					const message = describeAwsFailure(error).detail;
 					if (message.includes("No lock found") || message.includes("NoSuchKey")) logger.info(`No lock found for stack: ${where}`);
 					else {
 						const detail = displaySafe(message, { asciiOnly: true }) || "<unrenderable>";
@@ -19079,7 +19115,7 @@ async function importCommand(stackArg, options) {
 			}
 		} finally {
 			await lockManager.releaseLock(stackInfo.stackName, targetRegion).catch((err) => {
-				logger.warn(`Failed to release lock: ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock: ${describeAwsFailure(err).detail}`);
 			});
 		}
 	} finally {
@@ -19104,7 +19140,7 @@ async function recordImportOnRollbackJournal(stateBackend, stackName, region, lo
 	try {
 		marked = await stateBackend.markRollbackJournalImported(stackName, region, marks);
 	} catch (error) {
-		throw new Error(`Could not record this import on the rollback journal of ${stackShown(stackName)}, so state was NOT written: a later cdkd rollback could otherwise delete what was imported. Cause: ${displaySafe(error instanceof Error ? error.message : String(error))}`);
+		throw new Error(`Could not record this import on the rollback journal of ${stackShown(stackName)}, so state was NOT written: a later cdkd rollback could otherwise delete what was imported. Cause: ${displaySafe(describeAwsFailure(error).detail)}`);
 	}
 	if (marked.length > 0) logger.info(safeMsg`  The rollback journal of ${stackShown(stackName)} records ` + safeMsg`${marked.map((id) => logicalIdShown(id)).join(", ")} as imported: ` + "cdkd rollback leaves those resources as they are.");
 }
@@ -19276,7 +19312,8 @@ async function importOne(task) {
 		outcome: "skipped-no-impl",
 		reason: "no provider registered"
 	};
-	const provider = providerRegistry.getProvider(resource.Type);
+	const route = providerRegistry.getProviderFor({ resourceType: resource.Type });
+	const provider = route.provider;
 	if (!provider.import) return {
 		logicalId,
 		resourceType: resource.Type,
@@ -19305,10 +19342,11 @@ async function importOne(task) {
 			resourceType: resource.Type,
 			outcome: "imported",
 			physicalId: result.physicalId,
-			...result.attributes !== void 0 && { attributes: result.attributes }
+			...result.attributes !== void 0 && { attributes: result.attributes },
+			provisionedBy: route.provisionedBy
 		};
 	} catch (error) {
-		const msg = error instanceof Error ? error.message : String(error);
+		const msg = describeAwsFailure(error).detail;
 		logger.error(`Failed to import ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.Type)}): ${msg}`);
 		return {
 			logicalId,
@@ -19448,7 +19486,7 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 			deletionPolicy: tmplResource.DeletionPolicy,
 			updateReplacePolicy: tmplResource.UpdateReplacePolicy,
 			...constructPathField(constructPathOf(template, row.logicalId)),
-			provisionedBy: "sdk",
+			provisionedBy: row.provisionedBy ?? "sdk",
 			...prior && prior.physicalId === row.physicalId && (hasUnverifiableParameterRefusal(prior) || hasReasonlessBaselineRefusal(prior) && (namesParameter ??= resourcesNamingDeclaredParameter(template))(row.logicalId)) && {
 				observedBaselineRefused: true,
 				observedBaselineRefusalReason: "unverifiable-parameter"
@@ -19487,12 +19525,12 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	try {
 		parameters = await resolver.resolveParameters(template);
 	} catch (err) {
-		logger.debug(`Template parameter resolution failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — retrying with the template's 'Default'-carrying parameters only; resources referencing an unbindable parameter will still be skipped per-resource.`);
+		logger.debug(`Template parameter resolution failed during import-time property resolution: ${describeAwsFailure(err).detail} — retrying with the template's 'Default'-carrying parameters only; resources referencing an unbindable parameter will still be skipped per-resource.`);
 		try {
 			parameters = await resolver.resolveParameters(defaultOnlyParameterTemplate(template));
 		} catch (defaultsErr) {
 			parameters = {};
-			logger.debug(`'Default'-only template parameter resolution also failed during import-time property resolution: ${defaultsErr instanceof Error ? defaultsErr.message : String(defaultsErr)} — continuing without parameters; resources referencing them will be skipped per-resource.`);
+			logger.debug(`'Default'-only template parameter resolution also failed during import-time property resolution: ${describeAwsFailure(defaultsErr).detail} — continuing without parameters; resources referencing them will be skipped per-resource.`);
 		}
 	}
 	try {
@@ -19502,7 +19540,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			parameters
 		});
 	} catch (err) {
-		logger.debug(`Template condition evaluation failed during import-time property resolution: ${err instanceof Error ? err.message : String(err)} — continuing without conditions.`);
+		logger.debug(`Template condition evaluation failed during import-time property resolution: ${describeAwsFailure(err).detail} — continuing without conditions.`);
 	}
 	const unboundParameterNames = Object.keys(template.Parameters ?? {}).filter((name) => isUnboundTemplateParameter(name, template, parameters));
 	let divergentParameters;
@@ -19544,7 +19582,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 			});
 			resource.properties = recordedSecretValues.size > 0 ? redactSecretsForState(markSameGenerationBag(resolved), recordedSecretValues, unresolvedProperties) : resolved;
 		} catch (err) {
-			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
+			logger.warn(`Failed to resolve intrinsics in Properties for imported resource ${logicalIdShown(logicalId)} (${resourceTypeShown(resource.resourceType)}): ${maskSecretsInText(describeAwsFailure(err).detail, recordedSecretValues)}.\nState will be written with the raw intrinsic shape, which may cause 'cdkd destroy' to fail on this resource — re-import once every referenced sibling is in state, or remove this resource from state with 'cdkd orphan <StackPath>/<Path/To/Resource>'.` + (unboundParameterNames.length > 0 ? ` This template also declares parameter(s) with no 'Default' that an import cannot bind (${unboundParameterNames.map((name) => plainOrDescribed(name, "parameter name")).join(", ")}), and 'cdkd import' accepts no parameter values — if this property was built from one of those, re-importing a sibling will not change it: give the parameter a 'Default' in the template and re-import, or correct the recorded properties before the next 'cdkd deploy'.` : ""));
 			threw = true;
 		}
 		if (recordedSecretValues.size > 0 && resource.attributes !== void 0) resource.attributes = redactSecretsForState(resource.attributes, recordedSecretValues);
@@ -19828,7 +19866,7 @@ async function importNestedStackChildrenRecursive(args) {
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
-				logger.warn(`Failed to release lock for nested stack '${childStackName}' (${childRegion}): ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock for nested stack '${childStackName}' (${childRegion}): ${describeAwsFailure(err).detail}`);
 			});
 		}
 	}
@@ -27278,4 +27316,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-epAinsMQ.js.map
+//# sourceMappingURL=program-CKV6Kn8Q.js.map