@go-to-k/cdkd 0.296.6 → 0.296.8

package/dist/{program-CAlg2KEF.js → program-CPziYRDp.js}

@@ -2,8 +2,8 @@ import { a as runWithStackAwsClients, i as resetAwsClients, o as setAwsClients,
 import { A as displayIdent, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, L as stringifyJsonPayload, M as displayStackName, N as isPasteableIdent, O as cutMarker, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, d as PATTERN_B_NAME_PROPERTIES, f as PATTERN_B_RESOURCE_TYPES, g as generateResourceName, h as explicitNamePropertyFor, i as reserveStdoutForPayload, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, m as derivesPatternBName, n as getLogger, o as runStackBuffered, r as isStdoutReservedForPayload, u as PATTERN_B_NAME_OPTIONS, w as SAFE_MSG_ALTERED_CHAR, x as withSkipPrefix } from "./logger-DAaB7GFO.js";
 import { An as setPasteableVerbFlags, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bt as clientDefaultsFor, Ct as buildForceUnlockCommand, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, F as runDeleteAttempt, Ft as producerRecordKey, G as beginCommandInterruptScope, Gn as retryClassificationText, Ht as AccountIdUnavailableError, It as setPasteableAwsProfile, J as isInterruptedWaitError, Jn as safeStringify, Jt as DeployCancelledError, K as endCommandInterruptScope, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, Mt as injectiveKey, On as withheldTargetClause, Ot as formatLockOwner, Pt as producerCoordinateKey, Qn as markNonRetryable, Qt as LocalStartServiceError, Rt as ambientClientDefaults, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, Tn as quotedOrDescribed, Tt as forceQuitRecoveryClause, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Yt as DynamicReferenceRegionAmbiguousError, Zn as isThrottlingError, Zt as LocalInvokeBuildError$1, _ as VALUE_NOT_SHOWN, _n as SHELL_ACTIVE_WHY, an as ResourceTimeoutError, cn as StackTerminationProtectionError, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, hn as TIMEOUT_FLAG_RESOURCE_TYPE, in as ProvisioningError, it as resourceTypeShown, jt as DEFAULT_STATE_PREFIX, kn as setPasteableRunFlags, mn as withErrorHandling, n as RESOLVED_PREVIOUS_PRINCIPAL_KEYS, nn as NestedStackChildDirectDestroyError, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, pn as normalizeAwsError, q as interruptWatchListenerCount, rn as PartialFailureError, s as readRecordedPrincipals, sn as StackHasActiveImportsError, t as IAM_PRINCIPAL_NAME, tn as MalformedProducerRecordRefusalError, un as SynthesisError, w as remedyLogicalId, wn as plainOrDescribed, wt as buildLockContentionMessage, xn as isInertUnquoted, yn as commandHole, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
 import { n as awsClientDefaults, r as getAssumedRoleCredentials, u as formatAuthority } from "./aws-client-defaults-D0q0z4dG.js";
-import { $ as resourcesNamingDeclaredParameter, $a as createSecretMasker, $i as repairMalformedResourceEntriesForReadOnly, $n as deleteSkipReason, $o as ensureAssetStorage, $r as deployRefusesOrphanRowsReason, $s as derivePartitionAndUrlSuffix, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphans, Ao as acceptedCreateOnlyDropsOf, As as getDefaultStateBucketName, At as planRollback, Ba as TemplateParser, Bi as refuseMalformedResourceEntriesForImportSave, Bn as CC_BROKEN_REASON, Bo as orphansCarriedFrom, Br as AWS_NO_VALUE, Bs as stateBucketExistenceConfirmed, Bt as updatePartialMessage, C as perType, Ci as malformedScrubResourceEntriesRefusalMessage, Cn as findDestructiveChanges, Co as WHOLE_DYNAMIC_REFERENCE_PATTERN, Cr as callerEnvCredentials, Cs as warnFinchArgvExposure, Dn as ledgerForStack, Do as S3StateBackend, Ds as getDockerImageBySourceHash, Dt as isJournaledOrphan, Ei as refuseDivergentRecordRegionForDestroy, Eo as isLockInfoExpired, Es as AssetManifestLoader, Et as demoteSupersededOrphans, Fa as withRetry, Fi as refuseMalformedResourceAttributesForOrphan, Fo as hasUnverifiableParameterRefusal, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveCaptureObservedState, Ft as inheritProducerRegions, G as cyan, Ga as createUnionSecretMasker, Gi as refuseMalformedResourcePropertiesForOrphan, Go as WorkGraph, Gr as withSharedDrainBudget, Gs as MIGRATE_TMP_PREFIX, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as inheritNestedStackParameterAssociations, Hi as refuseMalformedResourcePropertiesForDestroy, Hn as ccBrokenReason, Ho as AssetPublisher, Hr as isStalePlaceholderArnAttribute, Hs as ssmResolvedValueType, Ht as completedReplayEntries, Ii as refuseMalformedResourceEntries, Io as importableOutputKeys, Ir as carriesDynamicReference, Is as resolveSkipPrefix, J as red, Ja as logOnlyValueCount, Ji as refuseMalformedResourcesForExport, Jn as slowCcOperationTimeoutMs, Jo as loadPublishableAssetManifest, Jr as JSON_LISTING_HOLE_VALUE, Js as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as hasMaskableValues, Ki as refuseMalformedResourcesForDeploy, Kn as withPrintingSecrets, Ko as buildAssetRedirectMap, Kr as parameterInputsFor, Ks as findLargeInlineResources, Kt as secretNamePrintingBag, Li as refuseMalformedResourceEntriesForDeploy, Lo as importableOutputs, Lr as carriesFetchableDynamicReference, Ls as resolveStateBucketWithDefault, Ma as prefetchCreateOnlyPropertyPaths, Mi as refuseMalformedOrphansForOrphan, Mo as exportNamesCarriedFrom, Mr as isUnboundTemplateParameter, Ms as loadCdkJson, Mt as resolveReplacementOldType, Na as templateResourceTypes, Ni as refuseMalformedOutputs, No as hasReadableExportSet, Nr as parameterTypeMayLoseSecretIdentity, Ns as resolveApp, Nt as findNestedStackTypeChanges, Oi as refuseMalformedOrphanRecords, Oo as rebuildClientForBucketRegion, Os as Synthesizer, Ot as isReplacementOrphan, Pa as describeTypeWithThrottleRetry, Pi as refuseMalformedOutputsForDestroy, Po as hasReasonlessBaselineRefusal, Pr as getAccountInfo, Ps as resolveAutoAssetStorage, Q as reachableDivergentParameters, Qa as shareLogOnlyValues, Qi as repairMalformedOutputsForReadOnly, Qn as deleteIndeterminateGuards, Qo as assertAssetBucketRegion, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as canonicalizeRegion, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDestroy, Ro as isReadableBag, Rr as isNamelessDynamicReferenceError, Rs as resolveStateBucketWithDefaultAndSource, S as isProtectionValueActive, Si as malformedResourcesWarning, Sn as constructPathOf, So as TEMPLATE_SOURCED_RULES, Sr as applyCallerIdentityCredentials, Ss as runDockerStreaming, St as destroyStackRecordsView, Ti as previewableOrphanRecords, Tn as RollbackInlinePolicyWriters, To as LockManager, Ts as stripControlChars, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as recordNestedStackParameterExpressions, Ui as refuseMalformedResourcePropertiesForDrift, Un as wouldReturnToSdkProvider, Uo as isSensitiveAttributeName, Ur as refStateLookupFromResource, Us as CFN_TEMPLATE_BODY_LIMIT, Ut as journaledOrphanPrintingBag, Va as liveMatchesUnresolvedTokenFrame, Vi as refuseMalformedResourceEntriesForOrphan, Vn as ProviderRegistry, Vo as shouldRetainResource, Vr as cfnRefValueFromPhysicalId, Vs as warnDeprecatedNoPrefixCliFlag, Vt as updatePartialReason, W as bold, Wa as carryLogOnlyValues, Wi as refuseMalformedResourcePropertiesForExport, Wn as isCustomResourceType$1, Wo as stringifyValue, Ws as CFN_TEMPLATE_URL_LIMIT, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as recordLogOnlyParameterValue, Xi as repairMalformedOrphanRecordsForReadOnly, Xo as AssetModeResolver, Xr as STATE_RESOURCES_MALFORMED, Xs as expectedOwnerParam, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as printingCorpusOf, Yi as refuseMalformedState, Yn as ccProtectionRegistryTypes, Yo as rewriteTemplateAssetReferences, Yr as STATE_REGION_DIVERGED, Ys as decodeListingKey, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as recordLogOnlyValue, Zi as repairMalformedOrphansForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as BOOTSTRAP_MARKER_PREFIX, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as PARTITION_TABLE, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _i as malformedOutputsRefusalMessage, _n as isExportAliasCollision, _o as recordProvenPublicExpression, _r as assertSendableRoleArn, _s as isMalformedEnvKey, a as findNestedTemplateTreeDefect, aa as findActionableSilentDrops, ac as hasPlainPrototype, ai as isReadableResourceEntry, an as extractDeploymentEventError, ao as scrubResourceRecord, as as validateContainerRepoName, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedResourceEntriesWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as STATE_SOURCED_CROSS_GENERATION_RULES, br as sendableAssumeRoleCommand, bs as redactedDockerCause, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as absoluteAssemblyPathEscape, ci as malformedExportSourceWarning, cn as exportAliasCollisionScrubWarning, co as dynamicReferenceTokens, cs as resolveDockerContextDirectory, ct as displacedOpClause, d as conditionInputsFrom, da as findReplacedReadersOfRecreateTargets, dc as renderAssemblyPathEscape, di as malformedLocalResourcesWarning, dn as secretSafeKeyDisplay, do as identityKeyFor, dr as IntrinsicFunctionResolver, ds as describeDockerFailure, ea as repairMalformedResourcePropertiesForReadOnly, ec as AssemblyReader, ei as displayLogicalId, en as isFinalSnapshotError, eo as errorCauseChain, es as getBootstrapMarkerKey, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as shownType, fc as resolveAssemblyPath, fi as malformedOrphanRecordsRefusalMessage, fn as exportNameSecretExposure, fo as carriesSecretMask, fr as classifyReplaySecretRegion, fs as dockerSpawnEnvWithSensitive, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as renderStatefulReason, gi as malformedOrphansWarning, gn as collectPublishedOutputNames, go as recordNoEchoAttributeValues, gr as assertFlagRoleArn, gs as isDockerClientEnvKey, gt as withNestedRevertRun, h as keptWholeReasonText, ha as isStatefulRecreateTargetSync, hi as malformedOrphansRefusalMessage, hn as collectDeclaredOutputNames, ho as recordMaskOnlyValuesIn, hr as applyRoleArnIfSet, hs as getDockerCmd, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableResourceEntries, ic as hasOwnKey, ii as isReadableOrphanRecord, in as DeploymentEventsStore, io as redactSecretsForState, is as validateAssetBucketName, it as sameJournaledOrphans, ji as refuseMalformedOrphansForDestroy, jo as describeRegionValueKind, jr as coerceParameterTypedValue, js as getLegacyStateBucketName, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecordsForDestroy, kn as withCreateTokenLedger, ko as splitImportedOps, ks as synthesisStatusMessage, kt as planFailedOps, l as templateIdentity, la as NO_CC_HANDLERS_REASON, lc as describeFileReadFailure, li as malformedLocalOutputsWarning, ln as secretBearing, lo as isUncertifiedBaselineMaskPosition, lr as DiffCalculator, ls as describeDockerCapturedOutput, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as isStatefulRecreateTargetForReplace, mc as resolveBucketRegion, mi as malformedOrphanRowsKeptWarning, mn as noEchoParameterValueSeed, mo as recordMaskOnlyValue, mr as regionLessSecretName, ms as formatDockerLoginError, n as IMPLICIT_DELETE_DEPENDENCIES, na as unpreviewableOrphanRecords, nc as processStackMessages, ni as hasReadableOutputs, nn as unsupportedFinalSnapshotError, no as maskSecretsInText, ns as parseBootstrapMarker, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oc as nullPrototypeRecord, oi as malformedDriftResourcePropertiesWarning, on as WITHHELD_NAME_DISPLAY, os as buildDenyExternalAccessPolicy, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, pi as malformedOrphanRecordsWarning, pn as isWholeDynamicReferenceValue, po as provenPublicValue, pr as producerRegionsFromState, ps as finchSecretArgvRefusal, pt as recordDisplacedSkips, q as green, qa as literalSplitDelimitersOf, qi as refuseMalformedResourcesForDestroy, qn as CloudControlProvider, qo as createAssetRedirectResolver, qs as uploadCfnTemplate, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unreadableOrphanRecords, rc as defineOwnKey, ri as hasReadableResources, rn as DeploymentEventsReader, ro as markSameGenerationBag, rs as readBootstrapMarkerBody, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as unwrittenCreateOnlyReplacement, sc as ownValue, si as malformedExportNamesWarning, sn as displayTextOrWithheld, so as DYNAMIC_REFERENCE_TOKEN_SCAN, ss as buildDockerImage, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcesForReadOnly, tc as StageLoadError, ti as hasReadableOrphans, tn as refusesFinalSnapshot, to as maskSecretsInError, tr as isWaitAbandonedError, ts as isCrossRegionRedirect, tt as isHandledOrphan, u as conditionFingerprint, ua as hasNoCloudControlHandlers, uc as displayAssemblyPath, ui as malformedLocalResourceEntriesWarning, un as secretBearingStateKeyWarning, uo as pathCrossesDottedKey, ur as INTRINSIC_KEYS, us as describeDockerExecFailure, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as malformedOutputsWarning, vn as bindingSkippedOutputs, vo as wholeStringLeavesOf, vr as explicitRoleArnOrThrow, vs as partitionSensitiveEnv, vt as withNestedStackContext, w as readProtection, wi as malformedStateRefusalMessage, wn as formatDestructiveChange, wo as isSingleDynamicReferenceToken, wr as envCredentialsAreAssumedRole, ws as escapeRegExp, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourcePropertiesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_READBACK_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as runDockerForeground, y as recordedProtectionEvidence, yi as malformedRenderedContainersWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as STATE_SOURCED_BASELINE_RULES, yr as isIamRoleArn, ys as redactDockerArgvValues, yt as replayFailedOperations, za as DagBuilder, zi as refuseMalformedResourceEntriesForImport, zo as orphansAfterRollback, zr as keepsSecretReferenceToken, zs as resolveUseCdkBootstrapAssets } from "./deploy-engine-BPcBCyUE.js";
-import { t as getCdkdVersion } from "./version-BgqcIKdb.js";
+import { $ as resourcesNamingDeclaredParameter, $a as maskSecretsInError, $i as repairMalformedResourceEntriesForReadOnly, $n as deleteSkipReason, $o as ensureAssetStorage, $r as deployRefusesOrphanRowsReason, $s as derivePartitionAndUrlSuffix, $t as effectiveDeletionPolicy, Ai as refuseMalformedOrphans, Ao as acceptedCreateOnlyDropsOf, As as getDefaultStateBucketName, At as planRollback, Ba as TemplateParser, Bi as refuseMalformedResourceEntriesForImportSave, Bn as CC_BROKEN_REASON, Bo as orphansCarriedFrom, Br as AWS_NO_VALUE, Bs as stateBucketExistenceConfirmed, Bt as updatePartialMessage, C as perType, Ci as malformedScrubResourceEntriesRefusalMessage, Cn as findDestructiveChanges, Co as WHOLE_DYNAMIC_REFERENCE_PATTERN, Cr as callerEnvCredentials, Cs as warnFinchArgvExposure, Dn as ledgerForStack, Do as S3StateBackend, Ds as getDockerImageBySourceHash, Dt as isJournaledOrphan, Ei as refuseDivergentRecordRegionForDestroy, Eo as isLockInfoExpired, Es as AssetManifestLoader, Et as demoteSupersededOrphans, Fa as withRetry, Fi as refuseMalformedResourceAttributesForOrphan, Fo as hasUnverifiableParameterRefusal, Fr as isImpossibleEmptyStoredAttribute, Fs as resolveCaptureObservedState, Ft as inheritProducerRegions, G as cyan, Ga as literalSplitDelimitersOf, Gi as refuseMalformedResourcePropertiesForOrphan, Go as WorkGraph, Gr as withSharedDrainBudget, Gs as MIGRATE_TMP_PREFIX, Gt as orphanRecordsPrintingBag, H as formatResourceLine, Ha as carryLogOnlyValues, Hi as refuseMalformedResourcePropertiesForDestroy, Hn as ccBrokenReason, Ho as AssetPublisher, Hr as isStalePlaceholderArnAttribute, Hs as ssmResolvedValueType, Ht as completedReplayEntries, Ii as refuseMalformedResourceEntries, Io as importableOutputKeys, Ir as carriesDynamicReference, Is as resolveSkipPrefix, J as red, Ja as recordLogOnlyParameterValue, Ji as refuseMalformedResourcesForExport, Jn as slowCcOperationTimeoutMs, Jo as loadPublishableAssetManifest, Jr as JSON_LISTING_HOLE_VALUE, Js as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Jt as ATOMIC_FINAL_SNAPSHOT_TYPES, K as gray, Ka as logOnlyValueCount, Ki as refuseMalformedResourcesForDeploy, Kn as withPrintingSecrets, Ko as buildAssetRedirectMap, Kr as parameterInputsFor, Ks as findLargeInlineResources, Kt as secretNamePrintingBag, Li as refuseMalformedResourceEntriesForDeploy, Lo as importableOutputs, Lr as carriesFetchableDynamicReference, Ls as resolveStateBucketWithDefault, Ma as prefetchCreateOnlyPropertyPaths, Mi as refuseMalformedOrphansForOrphan, Mo as exportNamesCarriedFrom, Mr as isUnboundTemplateParameter, Ms as loadCdkJson, Mt as resolveReplacementOldType, Na as templateResourceTypes, Ni as refuseMalformedOutputs, No as hasReadableExportSet, Nr as parameterTypeMayLoseSecretIdentity, Ns as resolveApp, Nt as findNestedStackTypeChanges, Oi as refuseMalformedOrphanRecords, Oo as rebuildClientForBucketRegion, Os as Synthesizer, Ot as isReplacementOrphan, Pa as describeTypeWithThrottleRetry, Pi as refuseMalformedOutputsForDestroy, Po as hasReasonlessBaselineRefusal, Pr as getAccountInfo, Ps as resolveAutoAssetStorage, Q as reachableDivergentParameters, Qa as errorCauseChain, Qi as repairMalformedOutputsForReadOnly, Qn as deleteIndeterminateGuards, Qo as assertAssetBucketRegion, Qr as UNREADABLE_RESOURCES_MAP_ROW, Qs as canonicalizeRegion, Qt as createPreDeleteFinalSnapshot, Ri as refuseMalformedResourceEntriesForDestroy, Ro as isReadableBag, Rr as isNamelessDynamicReferenceError, Rs as resolveStateBucketWithDefaultAndSource, S as isProtectionValueActive, Si as malformedResourcesWarning, Sn as constructPathOf, So as TEMPLATE_SOURCED_RULES, Sr as applyCallerIdentityCredentials, Ss as runDockerStreaming, St as destroyStackRecordsView, Ti as previewableOrphanRecords, Tn as RollbackInlinePolicyWriters, To as LockManager, Ts as stripControlChars, Tt as recordAfterRollbackUpdate, U as createReadOnlyAttributeHealerFactory, Ua as createUnionSecretMasker, Ui as refuseMalformedResourcePropertiesForDrift, Un as wouldReturnToSdkProvider, Uo as isSensitiveAttributeName, Ur as refStateLookupFromResource, Us as CFN_TEMPLATE_BODY_LIMIT, Ut as journaledOrphanPrintingBag, Va as liveMatchesUnresolvedTokenFrame, Vi as refuseMalformedResourceEntriesForOrphan, Vn as ProviderRegistry, Vo as shouldRetainResource, Vr as cfnRefValueFromPhysicalId, Vs as warnDeprecatedNoPrefixCliFlag, Vt as updatePartialReason, W as bold, Wa as hasMaskableValues, Wi as refuseMalformedResourcePropertiesForExport, Wn as isCustomResourceType$1, Wo as stringifyValue, Ws as CFN_TEMPLATE_URL_LIMIT, Wt as maskEventTextWithBoundBags, X as computeParameterTaint, Xa as shareLogOnlyValues, Xi as repairMalformedOrphanRecordsForReadOnly, Xo as AssetModeResolver, Xr as STATE_RESOURCES_MALFORMED, Xs as expectedOwnerParam, Xt as buildFinalSnapshotIdentifier, Y as yellow, Ya as recordLogOnlyValue, Yi as refuseMalformedState, Yn as ccProtectionRegistryTypes, Yo as rewriteTemplateAssetReferences, Yr as STATE_REGION_DIVERGED, Ys as decodeListingKey, Yt as PRE_DELETE_SNAPSHOT_TYPES, Z as namesAnyDeclaredParameter, Za as createSecretMasker, Zi as repairMalformedOrphansForReadOnly, Zn as UNSPECIFIED_SKIP_REASON, Zo as BOOTSTRAP_MARKER_PREFIX, Zr as UNREADABLE_ORPHANS_CONTAINER_ROW, Zs as PARTITION_TABLE, Zt as ccRoutedFinalSnapshotError, _ as makeCanonicalizePropertiesFn, _i as malformedOutputsRefusalMessage, _n as isExportAliasCollision, _o as recordProvenPublicExpression, _r as assertSendableRoleArn, _s as isMalformedEnvKey, a as findNestedTemplateTreeDefect, aa as findActionableSilentDrops, ac as hasPlainPrototype, ai as isReadableResourceEntry, an as extractDeploymentEventError, ao as dynamicReferenceTokens, as as validateContainerRepoName, at as makeSiblingClaimReader, b as recordedProtectionNote, bi as malformedResourceEntriesWarning, bn as DEFAULT_RESOURCE_WARN_AFTER_MS, bo as STATE_SOURCED_CROSS_GENERATION_RULES, br as sendableAssumeRoleCommand, bs as redactedDockerCause, bt as replayRollback, c as renderNestedTemplateTreeDefect, cc as absoluteAssemblyPathEscape, ci as malformedExportSourceWarning, cn as exportAliasCollisionScrubWarning, co as inheritNestedStackParameterAssociations, cs as resolveDockerContextDirectory, ct as displacedOpClause, d as conditionInputsFrom, da as findReplacedReadersOfRecreateTargets, dc as renderAssemblyPathEscape, di as malformedLocalResourcesWarning, dn as secretSafeKeyDisplay, do as identityKeyFor, dr as IntrinsicFunctionResolver, ds as describeDockerFailure, ea as repairMalformedResourcePropertiesForReadOnly, ec as AssemblyReader, ei as displayLogicalId, en as isFinalSnapshotError, eo as maskSecretsInText, es as getBootstrapMarkerKey, et as deleteJournaledOrphans, f as parentSuppliedValues, fa as shownType, fc as resolveAssemblyPath, fi as malformedOrphanRecordsRefusalMessage, fn as exportNameSecretExposure, fo as carriesSecretMask, fr as classifyReplaySecretRegion, fs as dockerSpawnEnvWithSensitive, ft as nestedChildStackName$1, g as mergeNoChangeOutputs, ga as renderStatefulReason, gi as malformedOrphansWarning, gn as collectPublishedOutputNames, go as recordNoEchoAttributeValues, gr as assertFlagRoleArn, gs as isDockerClientEnvKey, gt as withNestedRevertRun, h as keptWholeReasonText, ha as isStatefulRecreateTargetSync, hi as malformedOrphansRefusalMessage, hn as collectDeclaredOutputNames, ho as recordMaskOnlyValuesIn, hr as applyRoleArnIfSet, hs as getDockerCmd, ht as revertedNestedRowIds, i as childTemplateLoader, ia as unreadableResourceEntries, ic as hasOwnKey, ii as isReadableOrphanRecord, in as DeploymentEventsStore, io as DYNAMIC_REFERENCE_TOKEN_SCAN, is as validateAssetBucketName, it as sameJournaledOrphans, ji as refuseMalformedOrphansForDestroy, jo as describeRegionValueKind, jr as coerceParameterTypedValue, js as getLegacyStateBucketName, jt as replacementNeverSwapped, ki as refuseMalformedOrphanRecordsForDestroy, kn as withCreateTokenLedger, ko as splitImportedOps, ks as synthesisStatusMessage, kt as planFailedOps, l as templateIdentity, la as NO_CC_HANDLERS_REASON, lc as describeFileReadFailure, li as malformedLocalOutputsWarning, ln as secretBearing, lo as recordNestedStackParameterExpressions, lr as DiffCalculator, ls as describeDockerCapturedOutput, lt as displacedPhysicalIdShown, m as isSecretBearingReferenceString, ma as isStatefulRecreateTargetForReplace, mc as resolveBucketRegion, mi as malformedOrphanRowsKeptWarning, mn as noEchoParameterValueSeed, mo as recordMaskOnlyValue, mr as regionLessSecretName, ms as formatDockerLoginError, n as IMPLICIT_DELETE_DEPENDENCIES, na as unpreviewableOrphanRecords, nc as processStackMessages, ni as hasReadableOutputs, nn as unsupportedFinalSnapshotError, no as redactSecretsForState, ns as parseBootstrapMarker, nt as journaledOrphanLines, o as isAbsoluteAssetPath, oc as nullPrototypeRecord, oi as malformedDriftResourcePropertiesWarning, on as WITHHELD_NAME_DISPLAY, oo as isUncertifiedBaselineMaskPosition, os as buildDenyExternalAccessPolicy, ot as planOrphanAdoption, p as readRecordedConditionVerdicts, pa as MULTI_REGION_RECREATE_BLOCKED_TYPES, pi as malformedOrphanRecordsWarning, pn as isWholeDynamicReferenceValue, po as provenPublicValue, pr as producerRegionsFromState, ps as finchSecretArgvRefusal, pt as recordDisplacedSkips, q as green, qa as printingCorpusOf, qi as refuseMalformedResourcesForDestroy, qn as CloudControlProvider, qo as createAssetRedirectResolver, qs as uploadCfnTemplate, qt as stateSecretNameNeedles, r as computeImplicitDeleteEdges, ra as unreadableOrphanRecords, rc as defineOwnKey, ri as hasReadableResources, rn as DeploymentEventsReader, ro as scrubResourceRecord, rs as readBootstrapMarkerBody, rt as loadJournaledOrphans, s as listNestedTemplateRows, sa as unwrittenCreateOnlyReplacement, sc as ownValue, si as malformedExportNamesWarning, sn as displayTextOrWithheld, so as pathCrossesDottedKey, ss as buildDockerImage, st as NESTED_PENDING_PARENT_REASON, t as DeployEngine, ta as repairMalformedResourcesForReadOnly, tc as StageLoadError, ti as hasReadableOrphans, tn as refusesFinalSnapshot, to as markSameGenerationBag, tr as isWaitAbandonedError, ts as isCrossRegionRedirect, tt as isHandledOrphan, u as conditionFingerprint, ua as hasNoCloudControlHandlers, uc as displayAssemblyPath, ui as malformedLocalResourceEntriesWarning, un as secretBearingStateKeyWarning, ur as INTRINSIC_KEYS, us as describeDockerExecFailure, ut as dropSettledNestedJournals, v as withResourceDeadline, vi as malformedOutputsWarning, vn as bindingSkippedOutputs, vo as wholeStringLeavesOf, vr as explicitRoleArnOrThrow, vs as partitionSensitiveEnv, vt as withNestedStackContext, w as readProtection, wi as malformedStateRefusalMessage, wn as formatDestructiveChange, wo as isSingleDynamicReferenceToken, wr as envCredentialsAreAssumedRole, ws as escapeRegExp, wt as withStackRecords, x as PROTECTION_PROPERTY_BY_TYPE, xi as malformedResourcePropertiesWarning, xn as maskingRetryLogger, xo as STATE_SOURCED_READBACK_RULES, xr as AWS_CREDENTIAL_ENV_KEYS, xs as runDockerForeground, y as recordedProtectionEvidence, yi as malformedRenderedContainersWarning, yn as DEFAULT_RESOURCE_TIMEOUT_MS, yo as STATE_SOURCED_BASELINE_RULES, yr as isIamRoleArn, ys as redactDockerArgvValues, yt as replayFailedOperations, za as DagBuilder, zi as refuseMalformedResourceEntriesForImport, zo as orphansAfterRollback, zr as keepsSecretReferenceToken, zs as resolveUseCdkBootstrapAssets } from "./deploy-engine-iXgQFHYR.js";
+import { t as getCdkdVersion } from "./version-Br6yDF8t.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { GetRoleCommand, GetUserCommand } from "@aws-sdk/client-iam";
@@ -2051,6 +2051,7 @@ var ExportIndexStore = class {
 	stateBackend;
 	loadState = { kind: "unloaded" };
 	opts;
+	profile;
 	writeChain = Promise.resolve();
 	clientResolved = false;
 	resolveInFlight = null;
@@ -2060,9 +2061,11 @@ var ExportIndexStore = class {
 		this.prefix = prefix;
 		this.region = region;
 		this.stateBackend = stateBackend;
+		const { profile, ...retry } = opts;
+		this.profile = profile;
 		this.opts = {
 			...DEFAULT_OPTIONS,
-			...opts
+			...retry
 		};
 	}
 	indexKey() {
@@ -2245,7 +2248,11 @@ var ExportIndexStore = class {
 			if (state.outputs === void 0) continue;
 			const region = ref.region ?? this.region;
 			if (!hasReadableExportSet(state)) {
-				this.logger.warn(malformedExportSourceWarning(ref.stackName, region));
+				this.logger.warn(malformedExportSourceWarning(ref.stackName, region, {
+					profile: this.profile,
+					stateBucket: this.bucket,
+					statePrefix: this.prefix
+				}));
 				continue;
 			}
 			const stateModified = state.lastModified ?? 0;
@@ -2414,7 +2421,7 @@ function collectCrossStackRefs(node, onRef) {
 //#region src/provisioning/register-providers.ts
 let providerClasses;
 function loadProviderClasses() {
-	providerClasses ??= import("./provider-classes-oRTqcSCp.js");
+	providerClasses ??= import("./provider-classes-CxXTKgEM.js");
 	return providerClasses;
 }
 function registerAllProviders(registry, classes) {
@@ -2709,7 +2716,7 @@ async function deployCommand(stacks, options) {
 		return {
 			stateBucket,
 			preflightStateBackend,
-			exportIndexStore: new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, preflightStateBackend)
+			exportIndexStore: new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, preflightStateBackend, { profile: options.profile })
 		};
 	})();
 	let deployInterrupted = false;
@@ -2740,6 +2747,11 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 		const [result, statePrep] = await Promise.all([synthesizer.synthesize(synthOptions), statePrepPromise]);
 		const { stateBucket, preflightStateBackend, exportIndexStore } = statePrep;
 		synthOptions.stateBucket = stateBucket;
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const { stacks: allStacks } = result;
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
@@ -2925,8 +2937,8 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 				if (options.recreateViaCcApi?.length || options.recreateViaSdkProvider?.length) {
 					const stateForRecreateCheck = await stackStateBackend.getState(stackInfo.stackName, stackRegion);
 					if (stateForRecreateCheck) {
-						refuseMalformedResourcesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion);
-						refuseMalformedResourceEntriesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion);
+						refuseMalformedResourcesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion, refusalRecovery);
+						refuseMalformedResourceEntriesForDeploy(stateForRecreateCheck.state, stackInfo.stackName, stackRegion, refusalRecovery);
 					}
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
@@ -2997,6 +3009,7 @@ Force-quit: stack locks may not be released. If the next run reports a lock, run
 					dryRun: options.dryRun,
 					noRollback: !options.rollback,
 					...options.roleArn && { roleArn: options.roleArn },
+					refusalRecovery,
 					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...migrationGate && { onCurrentStateLoaded: migrationGate },
@@ -4175,38 +4188,38 @@ function indexNestedChildTemplates(template, templatePath) {
 	}
 	return result;
 }
-async function loadStateOrEmpty(stackName, region, stateBackend) {
+async function loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (result) {
 		const unreadable = [];
 		const unreadableContainers = [];
 		const deployRefusals = [];
 		if (repairMalformedResourcesForReadOnly(result.state)) {
-			logger.warn(malformedResourcesWarning(stackName, region));
+			logger.warn(malformedResourcesWarning(stackName, region, refusalRecovery));
 			unreadableContainers.push("resources");
 			deployRefusals.push(DEPLOY_REFUSES_RESOURCES_BAG_REASON);
 		}
 		const dropped = repairMalformedResourceEntriesForReadOnly(result.state);
 		if (dropped.length > 0) {
-			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+			logger.warn(malformedResourceEntriesWarning(stackName, region, dropped, refusalRecovery));
 			for (const id of dropped) unreadable.push(id);
 			deployRefusals.push(deployRefusesResourceEntriesReason(dropped));
 		}
 		const unreadableProps = repairMalformedResourcePropertiesForReadOnly(result.state);
 		if (unreadableProps.length > 0) {
-			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps));
+			logger.warn(malformedResourcePropertiesWarning(stackName, region, unreadableProps, refusalRecovery));
 			deployRefusals.push(deployRefusesPropertiesReason(unreadableProps));
 		}
 		if (repairMalformedOutputsForReadOnly(result.state)) {
-			logger.warn(malformedOutputsWarning(stackName, region));
+			logger.warn(malformedOutputsWarning(stackName, region, refusalRecovery));
 			deployRefusals.push(DEPLOY_REFUSES_OUTPUTS_REASON);
 		}
 		if (repairMalformedOrphansForReadOnly(result.state)) {
-			logger.warn(malformedOrphansWarning(stackName, region));
+			logger.warn(malformedOrphansWarning(stackName, region, refusalRecovery));
 			unreadableContainers.push("orphans");
 			deployRefusals.push(DEPLOY_REFUSES_ORPHANS_CONTAINER_REASON);
 		}
-		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region));
+		if (isReadableBag(result.state.outputs) && !hasReadableExportSet(result.state)) logger.warn(malformedExportNamesWarning(stackName, region, refusalRecovery));
 		return {
 			state: result.state,
 			unreadable,
@@ -4522,7 +4535,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		for (const id of unpreviewableOrphanRecords(currentState)) unreadableOrphans.push(id);
 		const readableOrphans = previewableOrphanRecords(currentState);
 		if (unreadableOrphans.length > 0) {
-			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans.map((id) => id ?? ""), false));
+			logger.warn(malformedOrphanRecordsWarning(stackName, region, unreadableOrphans.map((id) => id ?? ""), false, options.refusalRecovery));
 			deployRefusals.push(deployRefusesDroppedOrphanRowsReason(unreadableOrphans));
 		}
 		let reportedByTheAdoptedPropertiesArm = [];
@@ -4545,14 +4558,14 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			const tornAdopted = repairMalformedResourcePropertiesForReadOnly(stateForDiff);
 			reportedByTheAdoptedPropertiesArm = tornAdopted;
 			if (tornAdopted.length > 0) {
-				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted));
+				logger.warn(malformedResourcePropertiesWarning(stackName, region, tornAdopted, options.refusalRecovery));
 				deployRefusals.push(deployRefusesPropertiesReason(tornAdopted));
 			}
 		}
 		const alreadyReported = new Set(reportedByTheAdoptedPropertiesArm);
 		const previewedRowsTheDeployRefuses = readableOrphans.filter((record) => !isReadableOrphanRecord(record)).map((record) => record.logicalId).filter((logicalId) => !alreadyReported.has(logicalId));
 		if (previewedRowsTheDeployRefuses.length > 0) {
-			logger.warn(malformedOrphanRowsKeptWarning(stackName, region, previewedRowsTheDeployRefuses));
+			logger.warn(malformedOrphanRowsKeptWarning(stackName, region, previewedRowsTheDeployRefuses, options.refusalRecovery));
 			deployRefusals.push(deployRefusesOrphanRowsReason(previewedRowsTheDeployRefuses));
 		}
 	}
@@ -4591,7 +4604,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 			}
 		} };
 	}
-	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs);
+	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties, void 0, void 0, maskForLog, void 0, maskedInputs, options.refusalRecovery);
 	const nestedStackTypeChanges = findNestedStackTypeChanges({
 		changes,
 		stateResources: stateForDiff.resources
@@ -4858,9 +4871,9 @@ function recordedTemplateResources(template, state) {
 	return recorded;
 }
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, parentUnresolvedParameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption, attributeHealerFor, ancestorTemplatePaths, isNestedChild, inheritedSecrets, refusalRecovery } = args;
 	const attributeHealer = attributeHealerFor?.(stackName, region);
-	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend);
+	const { state, unreadable, unreadableContainers, deployRefusals } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const createOnlyPrefetch = prefetchCreateOnlyPropertyPaths(templateResourceTypes(recordedTemplateResources(template, state)));
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
 	let stackDiff;
@@ -4873,6 +4886,7 @@ async function buildDiffTree(args) {
 			...previewOrphanAdoption && { previewOrphanAdoption },
 			...inheritedSecrets && { inheritedSecrets },
 			...attributeHealer && { attributeHealer },
+			...refusalRecovery && { refusalRecovery },
 			inheritSecretBearingTemplate: false,
 			previewMaskedInputs: !isNestedChild,
 			nestedTemplates
@@ -4943,7 +4957,8 @@ async function buildDiffTree(args) {
 			ancestorTemplatePaths: childAncestorTemplatePaths,
 			isNestedChild: true,
 			parentHasSecretReference: secretBearingAbove,
-			inheritedSecrets: printingSecrets
+			inheritedSecrets: printingSecrets,
+			...refusalRecovery && { refusalRecovery }
 		}));
 	}
 	if (!isNestedChild) {
@@ -4953,15 +4968,16 @@ async function buildDiffTree(args) {
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
 		if (templateChildIds.has(logicalId)) continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, secretBearingAbove, printingSecrets, refusalRecovery));
 	}
 	return node;
 }
-async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets) {
-	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend);
+async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery) {
+	const { state, unreadable, unreadableContainers } = await loadStateOrEmpty(stackName, region, stateBackend, refusalRecovery);
 	const { changes, outputChanges } = await computeStackDiff(state, EMPTY_TEMPLATE, region, stackName, stateBackend, diffCalculator, {
 		inheritSecretBearingTemplate: parentHasSecretReference,
-		inheritedSecrets
+		inheritedSecrets,
+		...refusalRecovery && { refusalRecovery }
 	});
 	const node = {
 		stackName,
@@ -4980,7 +4996,7 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 	};
 	for (const [logicalId, resource] of Object.entries(state.resources ?? {})) {
 		if (resource.resourceType !== "AWS::CloudFormation::Stack") continue;
-		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets));
+		node.children.push(await buildDeletedSubtree(`${stackName}~${logicalId}`, region, stateBackend, diffCalculator, parentHasSecretReference, inheritedSecrets, refusalRecovery));
 	}
 	return node;
 }
@@ -5355,6 +5371,11 @@ async function diffCommand(stacks, options) {
 			...options.profile && { profile: options.profile }
 		});
 		const diffCalculator = new DiffCalculator();
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket,
+			statePrefix: options.statePrefix
+		};
 		const diffProviderRegistry = new ProviderRegistry();
 		registerAllProviders(diffProviderRegistry, providerClasses);
 		const canonicalizeProperties = makeCanonicalizePropertiesFn(diffProviderRegistry);
@@ -5446,7 +5467,8 @@ async function diffCommand(stacks, options) {
 				...options.cfnFallback === false && { cfnFallback: false },
 				previewOrphanAdoption,
 				attributeHealerFor,
-				isNestedChild: false
+				isNestedChild: false,
+				refusalRecovery
 			}));
 		}
 		if (options.json) process.stdout.write(`${stringifyJsonPayload(trees.map(diffTreeToJson))}\n`);
@@ -5879,6 +5901,11 @@ async function scrubCommand(stacks, options) {
 		bucket: stateBucket,
 		prefix: options.statePrefix
 	};
+	const refusalRecovery = {
+		profile: options.profile,
+		stateBucket,
+		statePrefix: options.statePrefix
+	};
 	const stateS3 = new AwsClients({
 		region,
 		...options.profile && { profile: options.profile }
@@ -5921,7 +5948,7 @@ async function scrubCommand(stacks, options) {
 	const exportIndexFor = (indexRegion) => {
 		const existing = exportIndexStores.get(indexRegion);
 		if (existing) return existing;
-		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend);
+		const store = new ExportIndexStore(stateS3.s3, stateBucket, options.statePrefix, indexRegion, stateBackend, { profile: options.profile });
 		exportIndexStores.set(indexRegion, store);
 		return store;
 	};
@@ -5960,7 +5987,8 @@ async function scrubCommand(stacks, options) {
 				logger,
 				appStacks: allStacks,
 				...nestedChild && { nestedChild },
-				readConsumerRecords: loadConsumerRecords
+				readConsumerRecords: loadConsumerRecords,
+				refusalRecovery
 			});
 		} catch (err) {
 			failures.push({ stackName });
@@ -7145,43 +7173,43 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		if (opts.dryRun) {
 			if (repairMalformedResourcesForReadOnly(state)) {
 				malformedResources = true;
-				logger.warn(malformedResourcesWarning(stack.stackName, region));
+				logger.warn(malformedResourcesWarning(stack.stackName, region, opts.refusalRecovery));
 			}
-		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableResources(state)) throw new ScrubRefusalError(malformedStateRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		let malformedResourceRows;
 		if (opts.dryRun) {
 			const droppedRows = repairMalformedResourceEntriesForReadOnly(state);
 			if (droppedRows.length > 0) {
 				malformedResourceRows = true;
-				logger.warn(malformedResourceEntriesWarning(stack.stackName, region, droppedRows));
+				logger.warn(malformedResourceEntriesWarning(stack.stackName, region, droppedRows, opts.refusalRecovery));
 			}
 		} else {
 			const unreadableRows = unreadableResourceEntries(state);
-			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedScrubResourceEntriesRefusalMessage(stack.stackName, region, unreadableRows), STATE_RESOURCES_MALFORMED);
+			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedScrubResourceEntriesRefusalMessage(stack.stackName, region, unreadableRows, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		}
 		let malformedOutputs;
 		if (opts.dryRun) {
 			if (repairMalformedOutputsForReadOnly(state)) {
 				malformedOutputs = true;
-				logger.warn(malformedOutputsWarning(stack.stackName, region));
+				logger.warn(malformedOutputsWarning(stack.stackName, region, opts.refusalRecovery));
 			}
-		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableOutputs(state)) throw new ScrubRefusalError(malformedOutputsRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		let malformedOrphans;
 		let malformedOrphanRows;
 		if (opts.dryRun) {
 			if (repairMalformedOrphansForReadOnly(state)) {
 				malformedOrphans = true;
-				logger.warn(malformedOrphansWarning(stack.stackName, region));
+				logger.warn(malformedOrphansWarning(stack.stackName, region, opts.refusalRecovery));
 			}
 			const droppedRows = repairMalformedOrphanRecordsForReadOnly(state);
 			if (droppedRows.length > 0) {
 				malformedOrphanRows = true;
-				logger.warn(malformedOrphanRecordsWarning(stack.stackName, region, droppedRows, true));
+				logger.warn(malformedOrphanRecordsWarning(stack.stackName, region, droppedRows, true, opts.refusalRecovery));
 			}
-		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region), STATE_RESOURCES_MALFORMED);
+		} else if (!hasReadableOrphans(state)) throw new ScrubRefusalError(malformedOrphansRefusalMessage(stack.stackName, region, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		else {
 			const unreadableRows = unreadableOrphanRecords(state);
-			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedOrphanRecordsRefusalMessage(stack.stackName, region, unreadableRows), STATE_RESOURCES_MALFORMED);
+			if (unreadableRows.length > 0) throw new ScrubRefusalError(malformedOrphanRecordsRefusalMessage(stack.stackName, region, unreadableRows, opts.refusalRecovery), STATE_RESOURCES_MALFORMED);
 		}
 		const perResourceTemplateProps = /* @__PURE__ */ new Map();
 		const outputsTemplateSource = {};
@@ -8303,9 +8331,15 @@ async function driftCommand(stacks, options) {
 	try {
 		const region = namedCliRegion(options.region) ?? "us-east-1";
 		const bucket = await resolveStateBucketWithDefault(options.stateBucket, region);
+		const prefix = options.statePrefix;
 		const stateConfig = {
 			bucket,
-			prefix: options.statePrefix
+			prefix
+		};
+		const refusalRecovery = {
+			profile: options.profile,
+			stateBucket: bucket,
+			statePrefix: prefix
 		};
 		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
 			region,
@@ -8363,7 +8397,7 @@ async function driftCommand(stacks, options) {
 			}
 			const stackRegion = ref.region;
 			const scope = stackRegionScope(stackRegion);
-			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair", nestedChildRecord));
+			const report = await runWithStackAwsClients(scope.clients, () => runDriftForStack(ref.stackName, stackRegion, stateBackend, scope.registry, scope.ccApiFallback, resolvePrincipalUniqueId, options.accept || options.revert ? "refuse" : "repair", nestedChildRecord, refusalRecovery));
 			reports.push(report);
 		}
 		if (options.json) writeJsonReport(reports);
@@ -8817,7 +8851,7 @@ function redactDriftChanges(changes, secrets, secretPaths, maskPaths) {
 		maskedPaths
 	};
 }
-async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord) {
+async function runDriftForStack(stackName, region, stateBackend, providerRegistry, ccApiFallback, resolvePrincipalUniqueId, malformedRecordMode, nestedChildRecord, refusalRecovery) {
 	const result = await stateBackend.getState(stackName, region);
 	if (!result) throw new Error(`No state found for stack '${stackName}' (${region}). Run 'cdkd state list' to see available stacks.`);
 	return await withStackName(stackName, async () => {
@@ -8826,12 +8860,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 		const logger = getLogger();
 		let unreadablePropertyBags = /* @__PURE__ */ new Set();
 		if (malformedRecordMode === "refuse") {
-			refuseMalformedState(state, stackName, region);
-			refuseMalformedResourceEntries(state, stackName, region);
-			refuseMalformedResourcePropertiesForDrift(state, stackName, region);
+			refuseMalformedState(state, stackName, region, refusalRecovery);
+			refuseMalformedResourceEntries(state, stackName, region, refusalRecovery);
+			refuseMalformedResourcePropertiesForDrift(state, stackName, region, refusalRecovery);
 		} else {
 			if (repairMalformedResourcesForReadOnly(state)) {
-				logger.warn(malformedResourcesWarning(stackName, region));
+				logger.warn(malformedResourcesWarning(stackName, region, refusalRecovery));
 				outcomes.push({
 					kind: "notCompared",
 					logicalId: UNREADABLE_RESOURCES_MAP_ROW,
@@ -8841,7 +8875,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			}
 			const dropped = repairMalformedResourceEntriesForReadOnly(state);
 			if (dropped.length > 0) {
-				logger.warn(malformedResourceEntriesWarning(stackName, region, dropped));
+				logger.warn(malformedResourceEntriesWarning(stackName, region, dropped, refusalRecovery));
 				for (const logicalId of dropped) outcomes.push({
 					kind: "notCompared",
 					logicalId,
@@ -8851,7 +8885,7 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 			}
 			const repaired = repairMalformedResourcePropertiesForReadOnly(state);
 			if (repaired.length > 0) {
-				logger.warn(malformedDriftResourcePropertiesWarning(stackName, region, repaired));
+				logger.warn(malformedDriftResourcePropertiesWarning(stackName, region, repaired, refusalRecovery));
 				unreadablePropertyBags = new Set(repaired);
 			}
 		}
@@ -11078,7 +11112,7 @@ async function destroyCommand(stackArgs, options) {
 		});
 		await stateBackend.verifyBucketExists();
 		const lockManager = new LockManager(awsClients.s3, stateConfig);
-		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend);
+		const exportIndexStore = new ExportIndexStore(awsClients.s3, stateBucket, options.statePrefix, region, stateBackend, { profile: options.profile });
 		const providerRegistry = new ProviderRegistry();
 		registerAllProviders(providerRegistry, providerClasses);
 		providerRegistry.setCustomResourceResponseBucket(stateBucket);
@@ -13226,7 +13260,7 @@ async function exportCommand(stackArg, options) {
 				reportDriftBaselineGaps(state, logger, {
 					stackName: resolvedStackName,
 					region: migrationPending ? void 0 : targetRegion
-				}, options.template ? void 0 : template);
+				}, options.template ? void 0 : template, lockRecovery);
 				if (allSynthStacks.length > 0) {
 					const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 					if (crossRefs.length > 0) {
@@ -13318,7 +13352,7 @@ async function exportCommand(stackArg, options) {
 			reportDriftBaselineGaps(state, logger, {
 				stackName: resolvedStackName,
 				region: migrationPending ? void 0 : targetRegion
-			}, options.template ? void 0 : template);
+			}, options.template ? void 0 : template, lockRecovery);
 			if (allSynthStacks.length > 0) {
 				const crossRefs = scanCrossStackReferences(allSynthStacks, resolvedStackName);
 				if (crossRefs.length > 0) {
@@ -14398,12 +14432,12 @@ function refreshWithheldReason(built) {
 		default: throw new Error(`refreshWithheldReason: unhandled WithholdReason ${String(reason)}`);
 	}
 }
-function reportDriftBaselineGaps(state, logger, loaded, template) {
+function reportDriftBaselineGaps(state, logger, loaded, template, recovery) {
 	const stackName = loaded?.stackName ?? state.stackName;
 	const rawRegion = loaded ? loaded.region : state.region;
 	const region = typeof rawRegion === "string" && rawRegion !== "" ? rawRegion : void 0;
 	if (!hasReadableResources(state)) {
-		logger.warn(malformedResourcesWarning(stackName, region));
+		logger.warn(malformedResourcesWarning(stackName, region, recovery));
 		return;
 	}
 	const entries = Object.entries(state.resources);
@@ -15507,10 +15541,17 @@ async function setupStateBackend(options) {
 		region,
 		bucket,
 		prefix,
-		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend),
+		exportIndexStore: new ExportIndexStore(awsClients.s3, bucket, prefix, region, stateBackend, { profile: options.profile }),
 		dispose: () => awsClients.destroy()
 	};
 }
+function renderRecovery(options, setup) {
+	return {
+		profile: options.profile,
+		stateBucket: setup.bucket,
+		statePrefix: setup.prefix
+	};
+}
 function sortRefs(refs) {
 	return refs.slice().sort((a, b) => {
 		if (a.stackName < b.stackName) return -1;
@@ -15638,8 +15679,8 @@ async function stateResourcesCommand(stackName, options) {
 		if (!ref.region) throw legacyRecordRefusal(stackName);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack ${formatStackRefSafe(ref)} in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
-		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
-		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger);
+		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region, renderRecovery(options, setup)));
+		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger, renderRecovery(options, setup));
 		const resources = stateResult.state.resources;
 		const details = Object.entries(resources).map(([logicalId, entry]) => {
 			const resource = entry ?? {};
@@ -15738,11 +15779,11 @@ async function stateShowCommand(stackName, options) {
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
-				warnUnreadableTreeNodes(treeWithLocks, logger);
+				warnUnreadableTreeNodes(treeWithLocks, logger, renderRecovery(options, setup));
 				process.stdout.write(`${stringifyJsonPayload(treeToShowJson(treeWithLocks))}\n`);
 				return;
 			}
-			repairTreeForTextRender(treeWithLocks, logger);
+			repairTreeForTextRender(treeWithLocks, logger, renderRecovery(options, setup));
 			const lines = renderTreeWithChildren(treeWithLocks);
 			process.stdout.write(`${lines.join("\n")}\n`);
 			return;
@@ -15754,7 +15795,7 @@ async function stateShowCommand(stackName, options) {
 			})}\n`);
 			return;
 		}
-		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger);
+		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger, renderRecovery(options, setup));
 		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
 	} finally {
 		setup.dispose();
@@ -15789,7 +15830,7 @@ const RENDERED_CONTAINER_ORDER = [
 ];
 const SHOW_RENDERED_CONTAINERS = new Set(RENDERED_CONTAINER_ORDER);
 const RESOURCES_RENDERED_CONTAINERS = /* @__PURE__ */ new Set(["attributes"]);
-function repairRenderedContainers(state, walked, stackName, region, logger) {
+function repairRenderedContainers(state, walked, stackName, region, logger, recovery) {
 	const repaired = /* @__PURE__ */ new Set();
 	const emptyIfUnwalkable = (owner, name) => {
 		if (!walked.has(name)) return;
@@ -15809,19 +15850,19 @@ function repairRenderedContainers(state, walked, stackName, region, logger) {
 		emptyIfUnwalkable(fields, "properties");
 	}
 	if (repaired.size === 0) return;
-	logger.warn(malformedRenderedContainersWarning(stackName, region, RENDERED_CONTAINER_ORDER.filter((name) => repaired.has(name))));
+	logger.warn(malformedRenderedContainersWarning(stackName, region, RENDERED_CONTAINER_ORDER.filter((name) => repaired.has(name)), recovery));
 }
-function repairRecordForTextRender(state, stackName, region, logger) {
-	if (repairMalformedResourcesForReadOnly(state)) logger.warn(malformedResourcesWarning(stackName, region));
-	repairRenderedContainers(state, SHOW_RENDERED_CONTAINERS, stackName, region, logger);
+function repairRecordForTextRender(state, stackName, region, logger, recovery) {
+	if (repairMalformedResourcesForReadOnly(state)) logger.warn(malformedResourcesWarning(stackName, region, recovery));
+	repairRenderedContainers(state, SHOW_RENDERED_CONTAINERS, stackName, region, logger, recovery);
 }
-function repairTreeForTextRender(node, logger) {
-	repairRecordForTextRender(node.state, node.stackName, node.region, logger);
-	for (const child of node.children) repairTreeForTextRender(child, logger);
+function repairTreeForTextRender(node, logger, recovery) {
+	repairRecordForTextRender(node.state, node.stackName, node.region, logger, recovery);
+	for (const child of node.children) repairTreeForTextRender(child, logger, recovery);
 }
-function warnUnreadableTreeNodes(node, logger) {
-	if (!hasReadableResources(node.state)) logger.warn(malformedResourcesWarning(node.stackName, node.region));
-	for (const child of node.children) warnUnreadableTreeNodes(child, logger);
+function warnUnreadableTreeNodes(node, logger, recovery) {
+	if (!hasReadableResources(node.state)) logger.warn(malformedResourcesWarning(node.stackName, node.region, recovery));
+	for (const child of node.children) warnUnreadableTreeNodes(child, logger, recovery);
 }
 function renderStateBlock(state, lockInfo, withLegend) {
 	const lines = [];
@@ -19500,7 +19541,8 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 		logger.debug(`${prefix}: loaded state for ${stackName} (${targetRegion})`);
 		return {
 			state: stateData.state,
-			region: targetRegion
+			region: targetRegion,
+			stateBucket
 		};
 	} finally {
 		resetAwsClients();
@@ -19582,7 +19624,12 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 		logger.warn(`${prefix}: cross-stack resolver could not access state bucket '${stateBucket}': ${err instanceof Error ? err.message : String(err)}. Fn::ImportValue / Fn::GetStackOutput env entries will warn-and-drop.`);
 		return;
 	}
-	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend);
+	const exportIndex = new ExportIndexStore(awsClients.s3, stateBucket, opts.statePrefix, consumerRegion, stateBackend, { profile: opts.profile });
+	const refusalRecovery = {
+		profile: opts.profile,
+		stateBucket,
+		statePrefix: opts.statePrefix
+	};
 	return {
 		resolver: {
 			async resolveImport(exportName) {
@@ -19630,7 +19677,7 @@ async function buildCrossStackResolver(consumerRegion, opts) {
 						const recordKey = producerRecordKey(producerStack, recordRegion);
 						if (!warnedMalformedProducers.has(recordKey)) {
 							warnedMalformedProducers.add(recordKey);
-							logger.warn(`${prefix}: ${malformedLocalOutputsWarning(producerStack, recordRegion)}`);
+							logger.warn(`${prefix}: ${malformedLocalOutputsWarning(producerStack, recordRegion, refusalRecovery)}`);
 						}
 						return;
 					}
@@ -19692,10 +19739,15 @@ var S3LocalStateProvider = class {
 		};
 		const loaded = await loadStateForStack(stackName, synthRegion, loadOpts);
 		if (!loaded) return void 0;
-		if (repairMalformedOutputsForReadOnly(loaded.state)) getLogger().warn(malformedLocalOutputsWarning(stackName, loaded.region));
-		if (repairMalformedResourcesForReadOnly(loaded.state)) getLogger().warn(malformedLocalResourcesWarning(stackName, loaded.region));
+		const refusalRecovery = {
+			profile: this.opts.profile,
+			stateBucket: loaded.stateBucket,
+			statePrefix: this.opts.statePrefix
+		};
+		if (repairMalformedOutputsForReadOnly(loaded.state)) getLogger().warn(malformedLocalOutputsWarning(stackName, loaded.region, refusalRecovery));
+		if (repairMalformedResourcesForReadOnly(loaded.state)) getLogger().warn(malformedLocalResourcesWarning(stackName, loaded.region, refusalRecovery));
 		const droppedRows = repairMalformedResourceEntriesForReadOnly(loaded.state);
-		if (droppedRows.length > 0) getLogger().warn(malformedLocalResourceEntriesWarning(stackName, loaded.region, droppedRows));
+		if (droppedRows.length > 0) getLogger().warn(malformedLocalResourceEntriesWarning(stackName, loaded.region, droppedRows, refusalRecovery));
 		const outputs = {};
 		for (const [k, v] of Object.entries(loaded.state.outputs ?? {})) if (typeof v === "string") outputs[k] = v;
 		else if (typeof v === "number" || typeof v === "boolean") outputs[k] = String(v);
@@ -26832,4 +26884,4 @@ function collectVerbFlags(program) {
 
 //#endregion
 export { canonicalizeIpProtocolValue as a, buildProgram, resolveSecretDerivedPrincipals as i, runDestroyForStack as n, resolvedResourceTimeoutMs as o, isResolvableSecretPrincipalList as r, canonicalizeIpv4Cidr as t };
-//# sourceMappingURL=program-CAlg2KEF.js.map
+//# sourceMappingURL=program-CPziYRDp.js.map