@go-to-k/cdkd 0.296.7 → 0.296.9

package/dist/{deploy-engine-wyaJUA8V.js → deploy-engine-B-oaHd2t.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-CnmtbrxD.js";
 import { A as displayIdent, C as withoutGeneratedFallbackName, D as UNRENDERABLE, E as STACK_REF_MAX_CODE_POINTS, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, R as truncateCodePoints, S as withStackName, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, b as looksLikeCdkdGeneratedName, c as installLogLineMaskerSource, g as generateResourceName, h as explicitNamePropertyFor, j as displaySafe, k as displayAwsMessage, l as getLiveRenderer, n as getLogger, p as applyDefaultNameForFallback, r as isStdoutReservedForPayload, s as currentLogLineMasker, v as getCurrentSkipPrefix, x as withSkipPrefix, y as getCurrentStackName } from "./logger-DAaB7GFO.js";
-import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-td1X_kKN.js";
+import { $n as markRedactedCause, $t as LockError, A as isTerminalDeleteFailure, At as CUSTOM_RESOURCE_RESPONSE_PREFIX, Bn as isAmbiguousCcHandlerErrorCode, Bt as clientDefaultsFor, C as refusalTypeShown, Cn as physicalIdShownBesideCommand, Ct as buildForceUnlockCommand, D as ProtectionFlipRegistry, Dn as shellQuote, Dt as formatLockOperation, En as shellBoundedDisplay, Et as formatLockExpiry, Fn as isRecreateRetryableError, Ft as producerRecordKey, Gn as retryClassificationText, H as pasteableAwsCommand, Hn as isIamPropagationError, Ht as AccountIdUnavailableError, In as isReplayedNameCollisionFrom, J as isInterruptedWaitError, Jn as safeStringify$1, Kn as describeAwsFailure, Kt as CrossAccountSecretRefusalError, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mn as hasReplayMayCollide, Mt as injectiveKey, N as protectionFlipKey, Nn as isNameCollisionErrorFrom, O as compensateProtectionFlip, On as withheldTargetClause, Ot as formatLockOwner, Pn as isNameCooldownError, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, R as DELETION_PROTECTION_DOC_POINTER, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, St as UNREPRODUCIBLE_LOCK_CLAUSE, T as resolveExplicitPhysicalId, Tn as quotedOrDescribed, U as protectedReplacementAdvice, Un as isRetryableTransientError, Ut as AssetError, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Xn as isMarkedNonRetryable, Xt as IntrinsicResolutionRefusalError, Y as startInterruptWatch, Yt as DynamicReferenceRegionAmbiguousError, Z as monotonicNowMs, Zn as isThrottlingError, _n as SHELL_ACTIVE_WHY, _t as hasCreatedBeforeFailure, an as ResourceTimeoutError, at as segmentAfterAnchor, b as isQuotableImportValue, bt as markAuxiliaryFailure, ct as createMaskedRetryLogger, d as prepareRemovalForUpdate, dt as maskerOrIdentity, en as MacroExpansionError, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, f as removalWarning, ft as withDerivedNameMasks, g as assertRegionMatch, gn as SHELL_ACTIVE, gt as createdBeforeFailure, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, in as ProvisioningError, it as resourceTypeShown, jn as isUpdateUnsupportedError, jt as DEFAULT_STATE_PREFIX, k as deleteWithProtectionCompensation, kt as sanitizeRecoveryValue, l as withUnchangedSecretPrincipalLists, ln as StateError, lt as isSecretDerivedValue, m as withoutInjectedRemovals, mt as carryCreatedBeforeFailure, nt as logicalIdShown, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, pn as normalizeAwsError, pt as RETRY_AUXILIARY_OWNER, qt as DependencyError, st as createMaskedLogSinks, tn as MalformedProducerRecordRefusalError, un as SynthesisError, ut as maskDeep, vn as UNSHOWABLE_VALUE, vt as isAuxiliaryFailure, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, yn as commandHole, yt as isAuxiliaryMarkOf, zn as formatRetryClassificationSignals, zt as ambientCredentialConfig } from "./iam-policy-targets-BREzwsG6.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-D0q0z4dG.js";
-import { t as getCdkdVersion } from "./version-LalLOhpQ.js";
+import { t as getCdkdVersion } from "./version-Dqnp1Xj8.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -12445,7 +12445,7 @@ const PROPERTY_COVERAGE_BY_TYPE = /* @__PURE__ */ new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map(),
 		createOnlyDrops: /* @__PURE__ */ new Set(),
-		readOnly: /* @__PURE__ */ new Set(["Id"]),
+		readOnly: /* @__PURE__ */ new Set(["AnomalyDetectorId"]),
 		ccRouteUnavailable: true
 	}],
 	["AWS::CodeBuild::Project", {
@@ -15237,22 +15237,27 @@ function accountArgs(recovery) {
 		flag: "--state-prefix",
 		value: prefix,
 		hole: "prefix",
-		opts: { plainIdent: true }
+		opts: prefixGate(prefix)
 	});
 	return args;
 }
+function prefixGate(prefix) {
+	return prefix.split("/").every((seg) => isPasteableIdent(seg)) ? {} : { plainIdent: true };
+}
 const ACCOUNT_FLAG_BY_HOLE = {
 	profile: "--profile",
 	bucket: "--state-bucket",
 	prefix: "--state-prefix"
 };
-function withheldAccountClause(withheld, where) {
-	const parts = withheld.filter((w) => ACCOUNT_FLAG_BY_HOLE[w.hole] !== void 0).map((w) => `the '${ACCOUNT_FLAG_BY_HOLE[w.hole]}' value this run was given ${accountReason(w.reason)}`);
+function withheldAccountClause(recovery, where) {
+	const slashPrefix = recovery?.statePrefix?.includes("/") === true;
+	const parts = withheldAccountValues(recovery).filter((w) => ACCOUNT_FLAG_BY_HOLE[w.hole] !== void 0).map((w) => `the '${ACCOUNT_FLAG_BY_HOLE[w.hole]}' value this run was given ${w.hole === "prefix" && w.reason === "not-plain" && slashPrefix ? PREFIX_NOT_PLAIN_WHY : accountReason(w.reason)}`);
 	if (parts.length === 0) return "";
 	const sentence = parts.join(", and ");
 	const holes = parts.length === 1 ? "a quoted hole in its place" : "quoted holes in their place";
 	return `${sentence.charAt(0).toUpperCase()}${sentence.slice(1)}, so ${where} ${holes}: replace each such hole whole, quotes included, with the shell-quoted value you passed this run. `;
 }
+const PREFIX_NOT_PLAIN_WHY = "has a '/'-separated part that is not a plain identifier (a letter or digit, then letters, digits, '~', '_', '.' or '-'), the only shape printed in a command beside a labelled line";
 function accountReason(reason) {
 	switch (reason) {
 		case "altered": return "does not render exactly";
@@ -15283,7 +15288,7 @@ function confirmKeyListing(recovery) {
 	return accountArgs(recovery).length === 0 ? `'cdkd state list --long'` : `'cdkd state list --long' run with the same account flags as the command lines below`;
 }
 function destroyAccountClause(recovery) {
-	const clause = withheldAccountClause(withheldAccountValues(recovery), "the command lines below print");
+	const clause = withheldAccountClause(recovery, "the command lines below print");
 	return clause === "" ? "" : ` ${clause.trimEnd()}`;
 }
 function refuseMalformedResourcesForDestroy(state, stackName, region, recovery) {
@@ -15298,8 +15303,7 @@ function divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBody
 	const kind = describeRegionValueKind(divergentBodyRegion);
 	const opening = exact ? `cdkd will not destroy stack ${shellQuote(safeIdentifier(stackName, cap))} (${shellQuote(safeIdentifier(keyRegion, cap))}): the state record read from that region's key carries a 'region' of its own (${kind}) that is not the key's, and ${lists}` : `cdkd will not destroy the state record this command loaded: it carries a 'region' of its own (${kind}) that is not the region of the key it was read from, and ${lists}`;
 	const listing = withheldListingPointer(recovery);
-	const withheldAccounts = withheldAccountValues(recovery);
-	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. " + withheldAccountClause(withheldAccounts, "the command at the end of this message prints") + "To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + dropRecordTemplate(recovery) : "This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records with " + (listing.line === void 0 ? `${WITHHELD_LISTING_POINTER}. Inspect it with: ${inspectCommand(void 0, void 0)}` : `${listing.pointer}.` + destroyAccountClause(recovery) + `\n${listing.line}\nInspect it with: ${inspectCommand(void 0, void 0, recovery)}`);
+	const remedy = exact ? "Re-run with --verbose to see what the record's region field holds, then either destroy against the region the resources are really in, or repair that field to match the key it is stored under and re-run. " + withheldAccountClause(recovery, "the command at the end of this message prints") + "To drop the record and leave the live resources standing, spelled out rather than pasteable because that command DELETES a record: " + dropRecordTemplate(recovery) : "This record's stack name or region does NOT render exactly — what any surrounding output shows is a sanitized form, and another record may render identically — so this message names no target and offers no command against one. List the records with " + (listing.line === void 0 ? `${WITHHELD_LISTING_POINTER}. Inspect it with: ${inspectCommand(void 0, void 0)}` : `${listing.pointer}.` + destroyAccountClause(recovery) + `\n${listing.line}\nInspect it with: ${inspectCommand(void 0, void 0, recovery)}`);
 	return `${opening} ${resourceCount === void 0 ? `— so cdkd can neither count what it would delete nor tell which region it is in` : `— so cdkd cannot tell which region those resources are in`}. cdkd stamps the key's region into every record it writes, so this record was not written by cdkd. Destroying against the key's region would issue every delete there; if the record's own region is the honest half, each delete comes back not-found, which this command reads as ALREADY DELETED — it would report success, remove the record, and leave every resource standing in the other region with nothing naming it. ${remedy}`;
 }
 function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, divergentBodyRegion, recovery, provenOrphans = 0) {
@@ -15308,14 +15312,14 @@ function refuseDivergentRecordRegionForDestroy(state, stackName, keyRegion, dive
 	if (resourceCount === 0 && provenOrphans === 0) return;
 	throw markNonRetryable(new CdkdError(divergentRecordRegionRefusalMessage(stackName, keyRegion, divergentBodyRegion, resourceCount, recovery, provenOrphans), STATE_REGION_DIVERGED));
 }
-function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion) {
+function malformedDeployResourcesRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. ${inspectClause(stackName, region)}Inspect it with: ${inspectCommand(stackName, region)}`;
+	return `${malformedStateDiagnosis(stackName, region)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: an unreadable map reads as ZERO recorded resources, so every resource the template declares is planned as a CREATE and the deploy re-provisions a stack that already exists, colliding on each deterministic name and duplicating the rest, then saves a well-formed record over the only evidence anything was wrong. Reading the bag as EMPTY produces that same plan rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the stack with this map read as EMPTY and warns that it did. ${inspectClause(stackName, region, recovery)}Inspect it with: ${inspectCommand(stackName, region, recovery)}`;
 }
-function refuseMalformedResourcesForDeploy(state, stackName, region) {
+function refuseMalformedResourcesForDeploy(state, stackName, region, recovery) {
 	if (hasReadableResources(state)) return;
-	throw markNonRetryable(new CdkdError(malformedDeployResourcesRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedDeployResourcesRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
 const EXPORT_LEGACY_LEAD = "The record was loaded from its legacy key, which carries no region segment — 'cdkd state show' reads such a record only when its body names a region, and a 'cdkd deploy' will not migrate it while it is torn — so inspect the object directly";
 const EXPORT_DELETES_STATE = "'cdkd export' migrates the resources this record lists into CloudFormation and then DELETES the cdkd state, so it refuses rather than continuing, under '--dry-run' too.";
@@ -15328,19 +15332,19 @@ function refuseMalformedResourcesForExport(state, stackName, region, recovery) {
 	if (hasReadableResources(state)) return;
 	throw new CdkdError(malformedExportResourcesRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED);
 }
-function malformedRenderedContainersWarning(rawStackName, rawRegion, containers) {
+function malformedRenderedContainersWarning(rawStackName, rawRegion, containers, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
 	const names = containers.map((name) => `'${safeIdentifier(name, 128)}'`).join(", ");
-	return `${stackClause(stackName, region)} has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
 function absentIfEmpty(value) {
 	return value === "" ? void 0 : value;
 }
-function malformedResourcesWarning(rawStackName, rawRegion) {
+function malformedResourcesWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. ${inspectClause(stackName, region)}Inspect it with: ${inspectCommand(stackName, region)}`;
+	return `${malformedStateDiagnosis(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none. ${inspectClause(stackName, region, recovery)}Inspect it with: ${inspectCommand(stackName, region, recovery)}`;
 }
 function repairMalformedOutputsForReadOnly(state) {
 	if (hasReadableOutputs(state)) return false;
@@ -15348,10 +15352,10 @@ function repairMalformedOutputsForReadOnly(state) {
 	return true;
 }
 const DEPLOY_REFUSES_OUTPUTS_SENTENCE = "'cdkd deploy' REFUSES this record when it loads it, over this same unreadable 'outputs' map, rather than rebuilding the map over it — repair the stored value before deploying.";
-function malformedOutputsWarning(rawStackName, rawRegion) {
+function malformedOutputsWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. ${DEPLOY_REFUSES_OUTPUTS_SENTENCE} ${inspectClause(stackName, region)}See the stored value with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. ${DEPLOY_REFUSES_OUTPUTS_SENTENCE} ${inspectClause(stackName, region, recovery)}See the stored value with: ` + inspectCommand(stackName, region, recovery);
 }
 function refuseMalformedState(state, stackName, region, recovery) {
 	if (hasReadableResources(state)) return;
@@ -15362,15 +15366,15 @@ function malformedOutputsRefusalMessage(rawStackName, rawRegion, recovery) {
 	const region = absentIfEmpty(rawRegion);
 	return inspectTail(`${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first.`, stackName, region, recovery);
 }
-function malformedExportSourceWarning(rawStackName, rawRegion) {
+function malformedExportSourceWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
-function malformedExportNamesWarning(rawStackName, rawRegion) {
+function malformedExportNamesWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. ${inspectClause(stackName, region)}See the stored value with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. ${inspectClause(stackName, region, recovery)}See the stored value with: ` + inspectCommand(stackName, region, recovery);
 }
 function refuseMalformedOutputs(state, stackName, region, recovery) {
 	if (hasReadableOutputs(state)) return;
@@ -15385,10 +15389,10 @@ function repairMalformedOrphansForReadOnly(state) {
 	state.orphans = [];
 	return true;
 }
-function malformedOrphansWarning(rawStackName, rawRegion) {
+function malformedOrphansWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. ${inspectClause(stackName, region)}See the stored value with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has no readable 'orphans' list — the record is malformed or truncated. Readers reach it on a bare '?? []' or '?.length', which admits a string, a number, a plain object and null alike: a string is WALKED, one garbage orphan per character, and the others read as no orphans at all. Continuing with it EMPTY: this view previews no adoption and names no orphan, which is NOT the same as the record holding none — resources from an earlier failed deploy may still be live in AWS. ${inspectClause(stackName, region, recovery)}See the stored value with: ` + inspectCommand(stackName, region, recovery);
 }
 function malformedOrphansRefusalMessage(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
@@ -15422,19 +15426,19 @@ function refuseMalformedOutputsForDestroy(state, stackName, region, recovery) {
 	if (hasReadableOutputs(state)) return;
 	throw markNonRetryable(new CdkdError(malformedDestroyOutputsRefusalMessage(stackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
-function malformedNestedChildOutputsRefusalMessage(rawChildStackName, rawRegion) {
+function malformedNestedChildOutputsRefusalMessage(rawChildStackName, rawRegion, recovery) {
 	const childStackName = absentIfEmpty(rawChildStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(childStackName, region, "nested stack child")} has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. ${inspectClause(childStackName, region)}Inspect it with: ` + inspectCommand(childStackName, region);
+	return `${stackClause(childStackName, region, "nested stack child")} has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. ${inspectClause(childStackName, region, recovery)}Inspect it with: ` + inspectCommand(childStackName, region, recovery);
 }
-function refuseMalformedNestedChildOutputs(state, childStackName, region) {
+function refuseMalformedNestedChildOutputs(state, childStackName, region, recovery) {
 	if (hasReadableOutputs(state)) return;
-	throw markNonRetryable(new CdkdError(malformedNestedChildOutputsRefusalMessage(childStackName, region), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedNestedChildOutputsRefusalMessage(childStackName, region, recovery), STATE_RESOURCES_MALFORMED));
 }
-function malformedLocalOutputsWarning(rawStackName, rawRegion) {
+function malformedLocalOutputsWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. ${inspectClause(stackName, region)}See the stored value with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. ${inspectClause(stackName, region, recovery)}See the stored value with: ` + inspectCommand(stackName, region, recovery);
 }
 const NAMED_UNREADABLE_PROPERTY_BAGS = 5;
 function stackClause(stackName, region, kind = "") {
@@ -15485,7 +15489,7 @@ function inspectCommand(stackName, region, recovery) {
 	return inspectGate(stackName, region, recovery).command;
 }
 function inspectClause(stackName, region, recovery) {
-	const accounts = withheldAccountClause(withheldAccountValues(recovery), "the command at the end of this line prints");
+	const accounts = withheldAccountClause(recovery, "the command at the end of this line prints");
 	if (stackName === void 0) return accounts;
 	const { withheld } = inspectGate(stackName, region, recovery);
 	const parts = [inspectWithheldPart("stack name above", withheld, "stack", true), inspectWithheldPart("region above", withheld, "region", false)].filter((part) => part !== "");
@@ -15542,10 +15546,10 @@ function unreadableResourcePropertyBags(state) {
 	if (!hasReadableResources(state)) return [];
 	return Object.entries(state.resources).filter(([, entry]) => isReadableBag(entry) && !isReadableBag(entry.properties)).map(([logicalId]) => logicalId);
 }
-function refuseMalformedResourceProperties(state, stackName, region) {
+function refuseMalformedResourceProperties(state, stackName, region, recovery) {
 	const unreadable = unreadableResourcePropertyBags(state);
 	if (unreadable.length === 0) return;
-	throw markNonRetryable(new CdkdError(malformedResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED));
 }
 function repairMalformedResourcePropertiesForReadOnly(state) {
 	const unreadable = unreadableResourcePropertyBags(state);
@@ -15567,10 +15571,10 @@ function namedPropertyBagsDiagnosis(stackName, region, logicalIds, describeUnsaf
 function namedPropertyBagsClause(stackName, region, logicalIds) {
 	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} Comparing a template against one reports every property the template declares as ADDED (a string bag also invents one change per character), and a create-only property among them is a REPLACEMENT of the live resource.`;
 }
-function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. ${inspectClause(stackName, region)}Inspect the record with: ${inspectCommand(stackName, region)}`;
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a DELETE and re-create of resources the template did not change, and reading the bag as empty produces that same verdict rather than avoiding it. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack with those maps read as EMPTY and warns that it did. ${inspectClause(stackName, region, recovery)}Inspect the record with: ${inspectCommand(stackName, region, recovery)}`;
 }
 function malformedOrphanResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
@@ -15603,7 +15607,7 @@ function withheldIdentityClause(stackName, region) {
 	return ` — the stack name or region above did not render exactly, so take them from the 'Find the exact name' command below — replace each quoted hole, quotes included, with ${JSON_LISTING_HOLE_VALUE} — rather than from this message`;
 }
 function withheldRecoveryClause(recovery) {
-	const clause = withheldAccountClause(withheldAccountValues(recovery), "the command lines below print").trimEnd();
+	const clause = withheldAccountClause(recovery, "the command lines below print").trimEnd();
 	if (clause === "") return "";
 	return ` — ${clause.charAt(0).toLowerCase()}${clause.slice(1, -1)}`;
 }
@@ -15655,26 +15659,26 @@ function refuseMalformedResourcePropertiesForOrphan(state, removedLogicalIds, st
 	if (unreadable.length === 0) return;
 	throw new CdkdError(malformedOrphanResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
-function malformedResourcePropertiesWarning(rawStackName, rawRegion, logicalIds) {
+function malformedResourcePropertiesWarning(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. ${inspectClause(stackName, region)}See the stored values with: ${inspectCommand(stackName, region)}`;
+	return `${namedPropertyBagsClause(stackName, region, logicalIds)} Continuing with those maps EMPTY: what these records are stored as holding is NOT what this preview compares against. Where the template still declares the resource, every property it declares previews as an addition and a create-only one as a replacement; where it no longer declares it, the DELETE row shows an empty previous side instead of the stored one. Do NOT run 'cdkd deploy' against this record — it REFUSES on the same defect rather than acting on this preview. ${inspectClause(stackName, region, recovery)}See the stored values with: ${inspectCommand(stackName, region, recovery)}`;
 }
 const DRIFT_PROPERTIES_ROLE = "To 'cdkd drift' this map is the baseline wherever no 'observedProperties' is recorded — a stored string reads as one drifted key per character, and an EMPTY reading compares nothing and reports the resource clean — and it is where cdkd finds the secret positions it must mask.";
-function malformedDriftResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedDriftResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} 'cdkd drift --accept' and '--revert' WRITE this record back, so they refuse rather than continuing. ${DRIFT_PROPERTIES_ROLE} Continuing would let '--accept' save, and '--revert' push to the live resource, a verdict about properties this record does not hold. Nothing was written and no AWS resource was modified. Repair or remove the record first; plain 'cdkd drift' compares the rest of the stack and reports these resources as not compared. ${inspectClause(stackName, region)}Inspect the record with: ${inspectCommand(stackName, region)}`;
+	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} 'cdkd drift --accept' and '--revert' WRITE this record back, so they refuse rather than continuing. ${DRIFT_PROPERTIES_ROLE} Continuing would let '--accept' save, and '--revert' push to the live resource, a verdict about properties this record does not hold. Nothing was written and no AWS resource was modified. Repair or remove the record first; plain 'cdkd drift' compares the rest of the stack and reports these resources as not compared. ${inspectClause(stackName, region, recovery)}Inspect the record with: ${inspectCommand(stackName, region, recovery)}`;
 }
-function refuseMalformedResourcePropertiesForDrift(state, stackName, region) {
+function refuseMalformedResourcePropertiesForDrift(state, stackName, region, recovery) {
 	const unreadable = unreadableResourcePropertyBags(state);
 	if (unreadable.length === 0) return;
-	throw new CdkdError(malformedDriftResourcePropertiesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED);
+	throw new CdkdError(malformedDriftResourcePropertiesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED);
 }
-function malformedDriftResourcePropertiesWarning(rawStackName, rawRegion, logicalIds) {
+function malformedDriftResourcePropertiesWarning(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} ${DRIFT_PROPERTIES_ROLE} So 'cdkd drift' does NOT compare these resources: each is reported as not compared, and the run does not exit clean. The rest of the stack is compared as usual. 'cdkd drift --accept' / '--revert' and 'cdkd deploy' REFUSE this record. ${inspectClause(stackName, region)}See the stored values with: ${inspectCommand(stackName, region)}`;
+	return `${namedPropertyBagsDiagnosis(stackName, region, logicalIds)} ${DRIFT_PROPERTIES_ROLE} So 'cdkd drift' does NOT compare these resources: each is reported as not compared, and the run does not exit clean. The rest of the stack is compared as usual. 'cdkd drift --accept' / '--revert' and 'cdkd deploy' REFUSE this record. ${inspectClause(stackName, region, recovery)}See the stored values with: ${inspectCommand(stackName, region, recovery)}`;
 }
 function malformedExportResourcePropertiesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
@@ -15704,15 +15708,15 @@ function repairMalformedResourceEntriesForReadOnly(state) {
 	for (const logicalId of unreadable) delete state.resources[logicalId];
 	return unreadable;
 }
-function malformedResourceEntriesWarning(rawStackName, rawRegion, logicalIds) {
+function malformedResourceEntriesWarning(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: this command's output describes the remaining resources only, which is not the same as the stack holding none of these. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: this command's output describes the remaining resources only, which is not the same as the stack holding none of these. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
-function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds, alsoRejectsTornMaps) {
+function malformedOrphanRecordsWarning(rawStackName, rawRegion, logicalIds, alsoRejectsTornMaps, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${namedOrphanRows(logicalIds)} — because they are not objects, have no string 'logicalId' or share it with another row, or their 'state' is not an object, names no resource type${alsoRejectsTornMaps ? ", has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object" : ` or has no non-empty string 'physicalId'`}. Continuing WITHOUT them: ${alsoRejectsTornMaps ? `they are excluded from the secret scan, so nothing this run does can certify them` : "they are not previewed for adoption, and 'cdkd deploy' refuses the record over them rather than dropping them as this command does"}. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' that cannot be read as resources — ${namedOrphanRows(logicalIds)} — because they are not objects, have no string 'logicalId' or share it with another row, or their 'state' is not an object, names no resource type${alsoRejectsTornMaps ? ", has no non-empty string 'physicalId', or holds a 'properties' or 'attributes' map that is not an object" : ` or has no non-empty string 'physicalId'`}. Continuing WITHOUT them: ${alsoRejectsTornMaps ? `they are excluded from the secret scan, so nothing this run does can certify them` : "they are not previewed for adoption, and 'cdkd deploy' refuses the record over them rather than dropping them as this command does"}. These ids were read from 'orphans'; the 'resources' map carries its own warning when it is damaged too. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
 function namedEntriesClause(stackName, region, logicalIds) {
 	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
@@ -15725,15 +15729,15 @@ function malformedResourceEntriesRefusalMessage(rawStackName, rawRegion, logical
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} This command can WRITE state, so it refuses rather than skipping them: saving over the record would report a clean run for entries nothing could read, and would leave the next command to fail on them with no more to go on. Nothing was locked, read from AWS or written FOR THIS STACK. ${inspectClause(stackName, region, recovery)}Inspect it with: ` + inspectCommand(stackName, region, recovery);
 }
-function refuseMalformedResourceEntriesForDeploy(state, stackName, region) {
+function refuseMalformedResourceEntriesForDeploy(state, stackName, region, recovery) {
 	const unreadable = unreadableResourceEntries(state);
 	if (unreadable.length === 0) return;
-	throw markNonRetryable(new CdkdError(malformedDeployResourceEntriesRefusalMessage(stackName, region, unreadable), STATE_RESOURCES_MALFORMED));
+	throw markNonRetryable(new CdkdError(malformedDeployResourceEntriesRefusalMessage(stackName, region, unreadable, recovery), STATE_RESOURCES_MALFORMED));
 }
-function malformedDeployResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedDeployResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a row that is not an object reads as a resource cdkd does not manage, so the template's resource of that id is planned as a CREATE (a second copy of a live resource, or a name collision), and a row with no resource type is planned as a TYPE CHANGE, which replaces the live resource. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack without those rows and warns that it did. ${inspectClause(stackName, region)}Inspect the record with: ` + inspectCommand(stackName, region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd deploy' can WRITE state and AWS resources, so it refuses rather than continuing — under '--dry-run' too, because the plan a dry run would print is the wrong one: a row that is not an object reads as a resource cdkd does not manage, so the template's resource of that id is planned as a CREATE (a second copy of a live resource, or a name collision), and a row with no resource type is planned as a TYPE CHANGE, which replaces the live resource. Nothing was provisioned and no state was written FOR THIS STACK. Repair or remove the record first; 'cdkd diff' previews the rest of the stack without those rows and warns that it did. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
 function refuseMalformedResourceEntriesForDestroy(state, stackName, region, recovery) {
 	const unreadable = unreadableResourceEntries(state);
@@ -15771,20 +15775,20 @@ function malformedImportUnrepairedEntriesRefusalMessage(rawStackName, rawRegion,
 	const region = absentIfEmpty(rawRegion);
 	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd import' was asked to re-import these rows and their import did not succeed (each is reported above), so the record it would save still holds them unreadable; it refuses rather than saving a row it could not replace. Nothing was written FOR THIS STACK, and the resources this run did import stay as they are in AWS. Fix what the import reported, or repair the rows by hand, and re-run. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
-function malformedScrubResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds) {
+function malformedScrubResourceEntriesRefusalMessage(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd scrub' REBUILDS and SAVES the resource map whenever anything in the stack changed, so it refuses rather than continuing: a null row either stops the rewrite on a bare TypeError under the lock (the template still positions it and this stack recorded a secret) or is copied into the rebuilt map as it stands — reported clean when no secret was recorded at all, saved back the moment another record changed; a string or number the template positions is spread into an object and saved as one; and a row with no resource type is rewritten and saved still without one. Nothing was written FOR THIS STACK. Repair or remove the row first; '--dry-run' audits the rest of the record without it and warns that it did. ${inspectClause(stackName, region)}Inspect the record with: ` + inspectCommand(stackName, region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} 'cdkd scrub' REBUILDS and SAVES the resource map whenever anything in the stack changed, so it refuses rather than continuing: a null row either stops the rewrite on a bare TypeError under the lock (the template still positions it and this stack recorded a secret) or is copied into the rebuilt map as it stands — reported clean when no secret was recorded at all, saved back the moment another record changed; a string or number the template positions is spread into an object and saved as one; and a row with no resource type is rewritten and saved still without one. Nothing was written FOR THIS STACK. Repair or remove the row first; '--dry-run' audits the rest of the record without it and warns that it did. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
-function malformedLocalResourcesWarning(rawStackName, rawRegion) {
+function malformedLocalResourcesWarning(rawStackName, rawRegion, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${malformedStateDiagnosis(stackName, region)} Continuing with it EMPTY: every 'Ref' and 'Fn::GetAtt' in this run's environment that names a resource of this record resolves to nothing and is dropped, and a bare '--assume-role' falls back to the developer's credentials — which is not the same as the record holding no resources. Nothing is written; 'cdkd deploy' and 'cdkd destroy' refuse this record instead. ${inspectClause(stackName, region)}See the stored value with: ` + inspectCommand(stackName, region);
+	return `${malformedStateDiagnosis(stackName, region)} Continuing with it EMPTY: every 'Ref' and 'Fn::GetAtt' in this run's environment that names a resource of this record resolves to nothing and is dropped, and a bare '--assume-role' falls back to the developer's credentials — which is not the same as the record holding no resources. Nothing is written; 'cdkd deploy' and 'cdkd destroy' refuse this record instead. ${inspectClause(stackName, region, recovery)}See the stored value with: ` + inspectCommand(stackName, region, recovery);
 }
-function malformedLocalResourceEntriesWarning(rawStackName, rawRegion, logicalIds) {
+function malformedLocalResourceEntriesWarning(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: a 'Ref' or 'Fn::GetAtt' in this run's environment that names one of these ids resolves to nothing and is dropped, and a bare '--assume-role' read through one falls back to the developer's credentials — which is not the same as the record holding no such resource. Nothing is written; 'cdkd deploy' and 'cdkd destroy' refuse this record instead. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${namedEntriesClause(stackName, region, logicalIds)} Continuing WITHOUT them: a 'Ref' or 'Fn::GetAtt' in this run's environment that names one of these ids resolves to nothing and is dropped, and a bare '--assume-role' read through one falls back to the developer's credentials — which is not the same as the record holding no such resource. Nothing is written; 'cdkd deploy' and 'cdkd destroy' refuse this record instead. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
 function refuseMalformedResourceEntriesForOrphan(state, removedLogicalIds, stackName, region, recovery) {
 	const removed = new Set(removedLogicalIds);
@@ -15833,10 +15837,10 @@ function hasAddressablePhysicalId(entry) {
 	const physicalId = entry.physicalId;
 	return typeof physicalId === "string" && physicalId.trim() !== "";
 }
-function unaddressableUpdateRefusalMessage(rawStackName, rawRegion, logicalId, resourceType) {
+function unaddressableUpdateRefusalMessage(rawStackName, rawRegion, logicalId, resourceType, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} holds a record for ${displayIdent(logicalId)} (${displayIdent(resourceType)}) with no non-empty string 'physicalId', so cdkd cannot address that resource in AWS and did not try to update it. 'cdkd deploy' fails on it rather than skipping it, since a skipped update would end the deploy without the template's change. Nothing was sent for this resource. Repair the record's 'physicalId' and re-run. ${inspectClause(stackName, region)}Inspect the record with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} holds a record for ${displayIdent(logicalId)} (${displayIdent(resourceType)}) with no non-empty string 'physicalId', so cdkd cannot address that resource in AWS and did not try to update it. 'cdkd deploy' fails on it rather than skipping it, since a skipped update would end the deploy without the template's change. Nothing was sent for this resource. Repair the record's 'physicalId' and re-run. ${inspectClause(stackName, region, recovery)}Inspect the record with: ` + inspectCommand(stackName, region, recovery);
 }
 function unpreviewableOrphanRecords(state) {
 	if (!Array.isArray(state.orphans)) return [];
@@ -15925,10 +15929,10 @@ function refuseMalformedOrphansForOrphan(state, stackName, region, recovery) {
 function deployRefusesOrphanRowsReason(logicalIds) {
 	return `${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — carry a 'properties' or 'attributes' map that cannot be read. This preview KEEPS them, so any adoption shown for them is one 'cdkd deploy' will not perform: it refuses the record over the same rows, and the deploy this previews will not start.`;
 }
-function malformedOrphanRowsKeptWarning(rawStackName, rawRegion, logicalIds) {
+function malformedOrphanRowsKeptWarning(rawStackName, rawRegion, logicalIds, recovery) {
 	const stackName = absentIfEmpty(rawStackName);
 	const region = absentIfEmpty(rawRegion);
-	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — whose 'properties' or 'attributes' map is not an object. This preview KEEPS them. 'cdkd deploy' of THIS stack does NOT: it refuses the whole record over these rows and will not start until they are repaired. ${inspectClause(stackName, region)}See the stored values with: ` + inspectCommand(stackName, region);
+	return `${stackClause(stackName, region)} holds ${logicalIds.length} rollback-orphan record(s) in 'orphans' — ${namedOrphanRows(logicalIds)} — whose 'properties' or 'attributes' map is not an object. This preview KEEPS them. 'cdkd deploy' of THIS stack does NOT: it refuses the whole record over these rows and will not start until they are repaired. ${inspectClause(stackName, region, recovery)}See the stored values with: ` + inspectCommand(stackName, region, recovery);
 }
 function namedOrphanRows(logicalIds) {
 	const named = logicalIds.slice(0, NAMED_UNREADABLE_ENTRIES).map((id) => displayLogicalId(id)).join(", ");
@@ -20671,10 +20675,10 @@ var DiffCalculator = class DiffCalculator {
 	conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue) {
 		return this.replacementRules.conditionalReplacementVerdict(resourceType, propertyPath, oldValue, newValue);
 	}
-	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs) {
+	async calculateDiff(currentState, desiredTemplate, resolveFn, canonicalizeProperties, allowedUnsupportedProperties, freshParameters, maskForLog, recreateTargets, maskedInputs, refusalRecovery) {
 		const changes = /* @__PURE__ */ new Map();
-		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0);
-		refuseMalformedResourceProperties(currentState, void 0, void 0);
+		refuseMalformedResourceEntriesForDeploy(currentState, void 0, void 0, refusalRecovery);
+		refuseMalformedResourceProperties(currentState, void 0, void 0, refusalRecovery);
 		const currentResources = currentState.resources;
 		const desiredResources = desiredTemplate.Resources;
 		this.logger.debug("Calculating diff...");
@@ -22103,7 +22107,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BU0YONBp.js");
+			const { ASGProvider } = await import("./asg-provider-B0IrI6EW.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -22209,7 +22213,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-Cf5P2so_.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-C3f-vDOh.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-B0YTjZKU.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DGaKBQxm.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -25523,6 +25527,7 @@ const PROPERTY_SHAPES = /* @__PURE__ */ new Map([
 	["AWS::CloudFront::OriginAccessControl", "{\"OriginAccessControlConfig\":\"object\"}"],
 	["AWS::CloudTrail::Trail", "{\"AdvancedEventSelectors\":\"array\",\"AdvancedEventSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[]\":\"object\",\"AdvancedEventSelectors[].FieldSelectors[].EndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].Equals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEndsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotEquals\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].NotStartsWith\":\"array\",\"AdvancedEventSelectors[].FieldSelectors[].StartsWith\":\"array\",\"AggregationConfigurations\":\"array\",\"AggregationConfigurations[]\":\"object\",\"AggregationConfigurations[].Templates\":\"array\",\"EventSelectors\":\"array\",\"EventSelectors[]\":\"object\",\"EventSelectors[].DataResources\":\"array\",\"EventSelectors[].DataResources[]\":\"object\",\"EventSelectors[].DataResources[].Values\":\"array\",\"EventSelectors[].ExcludeManagementEventSources\":\"array\",\"InsightSelectors\":\"array\",\"InsightSelectors[]\":\"object\",\"InsightSelectors[].EventCategories\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
 	["AWS::CloudWatch::Alarm", "{\"AlarmActions\":\"array\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"EvaluationCriteria\":\"object\",\"EvaluationCriteria.PromQLCriteria\":\"object\",\"EvaluationWindow\":\"object\",\"EvaluationWindow.SlidingWindow\":\"object\",\"EvaluationWindow.WallClockWindow\":\"object\",\"InsufficientDataActions\":\"array\",\"Metrics\":\"array\",\"Metrics[]\":\"object\",\"Metrics[].MetricStat\":\"object\",\"Metrics[].MetricStat.Metric\":\"object\",\"Metrics[].MetricStat.Metric.Dimensions\":\"array\",\"Metrics[].MetricStat.Metric.Dimensions[]\":\"object\",\"OKActions\":\"array\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"WarmUpConfiguration\":\"object\"}"],
+	["AWS::CloudWatch::AnomalyDetector", "{\"Configuration\":\"object\",\"Configuration.ExcludedTimeRanges\":\"array\",\"Configuration.ExcludedTimeRanges[]\":\"object\",\"Dimensions\":\"array\",\"Dimensions[]\":\"object\",\"MetricCharacteristics\":\"object\",\"MetricMathAnomalyDetector\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[]\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric\":\"object\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions\":\"array\",\"MetricMathAnomalyDetector.MetricDataQueries[].MetricStat.Metric.Dimensions[]\":\"object\",\"SingleMetricAnomalyDetector\":\"object\",\"SingleMetricAnomalyDetector.Dimensions\":\"array\",\"SingleMetricAnomalyDetector.Dimensions[]\":\"object\"}"],
 	["AWS::CodeCommit::Repository", "{\"Code\":\"object\",\"Code.S3\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\",\"Triggers\":\"array\",\"Triggers[]\":\"object\",\"Triggers[].Branches\":\"array\",\"Triggers[].Events\":\"array\"}"],
 	["AWS::Cognito::UserPool", "{\"AccountRecoverySetting\":\"object\",\"AccountRecoverySetting.RecoveryMechanisms\":\"array\",\"AccountRecoverySetting.RecoveryMechanisms[]\":\"object\",\"AdminCreateUserConfig\":\"object\",\"AdminCreateUserConfig.InviteMessageTemplate\":\"object\",\"AliasAttributes\":\"array\",\"AutoVerifiedAttributes\":\"array\",\"DeviceConfiguration\":\"object\",\"EmailConfiguration\":\"object\",\"EnabledMfas\":\"array\",\"IssuerConfiguration\":\"object\",\"KeyConfiguration\":\"object\",\"LambdaConfig\":\"object\",\"LambdaConfig.CustomEmailSender\":\"object\",\"LambdaConfig.CustomSMSSender\":\"object\",\"LambdaConfig.InboundFederation\":\"object\",\"LambdaConfig.PreTokenGenerationConfig\":\"object\",\"Policies\":\"object\",\"Policies.PasswordPolicy\":\"object\",\"Policies.SignInPolicy\":\"object\",\"Policies.SignInPolicy.AllowedFirstAuthFactors\":\"array\",\"Schema\":\"array\",\"Schema[]\":\"object\",\"Schema[].NumberAttributeConstraints\":\"object\",\"Schema[].StringAttributeConstraints\":\"object\",\"SmsConfiguration\":\"object\",\"SmsConfiguration.EumsSms\":\"object\",\"UserAttributeUpdateSettings\":\"object\",\"UserAttributeUpdateSettings.AttributesRequireVerificationBeforeUpdate\":\"array\",\"UserPoolAddOns\":\"object\",\"UserPoolAddOns.AdvancedSecurityAdditionalFlows\":\"object\",\"UserPoolTags\":\"object\",\"UsernameAttributes\":\"array\",\"UsernameConfiguration\":\"object\",\"VerificationMessageTemplate\":\"object\"}"],
 	["AWS::DLM::LifecyclePolicy", "{\"CrossRegionCopyTargets\":\"array\",\"CrossRegionCopyTargets[]\":\"object\",\"Exclusions\":\"object\",\"Exclusions.ExcludeTags\":\"array\",\"Exclusions.ExcludeTags[]\":\"object\",\"Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails\":\"object\",\"PolicyDetails.Actions\":\"array\",\"PolicyDetails.Actions[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy\":\"array\",\"PolicyDetails.Actions[].CrossRegionCopy[]\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].EncryptionConfiguration\":\"object\",\"PolicyDetails.Actions[].CrossRegionCopy[].RetainRule\":\"object\",\"PolicyDetails.CrossRegionCopyTargets\":\"array\",\"PolicyDetails.CrossRegionCopyTargets[]\":\"object\",\"PolicyDetails.EventSource\":\"object\",\"PolicyDetails.EventSource.Parameters\":\"object\",\"PolicyDetails.EventSource.Parameters.SnapshotOwner\":\"array\",\"PolicyDetails.Exclusions\":\"object\",\"PolicyDetails.Exclusions.ExcludeTags\":\"array\",\"PolicyDetails.Exclusions.ExcludeTags[]\":\"object\",\"PolicyDetails.Exclusions.ExcludeVolumeTypes\":\"array\",\"PolicyDetails.Parameters\":\"object\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags\":\"array\",\"PolicyDetails.Parameters.ExcludeDataVolumeTags[]\":\"object\",\"PolicyDetails.ResourceLocations\":\"array\",\"PolicyDetails.ResourceTypes\":\"array\",\"PolicyDetails.Schedules\":\"array\",\"PolicyDetails.Schedules[]\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule\":\"object\",\"PolicyDetails.Schedules[].ArchiveRule.RetainRule.RetentionArchiveTier\":\"object\",\"PolicyDetails.Schedules[].CreateRule\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Scripts[]\":\"object\",\"PolicyDetails.Schedules[].CreateRule.Scripts[].Stages\":\"array\",\"PolicyDetails.Schedules[].CreateRule.Times\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules\":\"array\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[]\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].CrossRegionCopyRules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].DeprecateRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule\":\"object\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZoneIds\":\"array\",\"PolicyDetails.Schedules[].FastRestoreRule.AvailabilityZones\":\"array\",\"PolicyDetails.Schedules[].RetainRule\":\"object\",\"PolicyDetails.Schedules[].ShareRules\":\"array\",\"PolicyDetails.Schedules[].ShareRules[]\":\"object\",\"PolicyDetails.Schedules[].ShareRules[].TargetAccounts\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd\":\"array\",\"PolicyDetails.Schedules[].TagsToAdd[]\":\"object\",\"PolicyDetails.Schedules[].VariableTags\":\"array\",\"PolicyDetails.Schedules[].VariableTags[]\":\"object\",\"PolicyDetails.TargetTags\":\"array\",\"PolicyDetails.TargetTags[]\":\"object\",\"Tags\":\"array\",\"Tags[]\":\"object\"}"],
@@ -27536,8 +27541,17 @@ function sanitizeSnapshotBase(physicalId) {
 	return base;
 }
 function finalSnapshotNamePrefix(physicalId, resourceType) {
+	return finalSnapshotNameCut(physicalId, resourceType).prefix;
+}
+function finalSnapshotNameCut(physicalId, resourceType) {
 	const maxLength = resourceType === "AWS::ElastiCache::CacheCluster" || resourceType === "AWS::ElastiCache::ReplicationGroup" ? 50 : 255;
-	return `${sanitizeSnapshotBase(physicalId).slice(0, maxLength - 22).replace(/-+$/, "")}-final-`;
+	const sanitized = sanitizeSnapshotBase(physicalId);
+	const base = sanitized.slice(0, maxLength - 22).replace(/-+$/, "");
+	return {
+		prefix: `${base}-final-`,
+		sanitized,
+		kept: base.length
+	};
 }
 function buildFinalSnapshotIdentifier(physicalId, resourceType, now = /* @__PURE__ */ new Date()) {
 	const ts = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "").replace("T", "-").toLowerCase();
@@ -28203,8 +28217,24 @@ function secretNameNeedlesOf(logicalId, record, secrets, options) {
 	if (embeddedBag !== void 0 && physicalId !== void 0) {
 		for (const needle of printingCorpusOf(embeddedBag).keys()) if (needle !== "" && (needle === physicalId || needle.length >= 4 && physicalId.includes(needle))) add(needle);
 	}
+	if (physicalId !== void 0) for (const spelling of finalSnapshotSpellingsOf(physicalId, record?.resourceType, needles)) add(spelling);
 	return needles.size > 0 ? needles : void 0;
 }
+function finalSnapshotSpellingsOf(physicalId, resourceType, needles) {
+	if (typeof resourceType !== "string" || !(ATOMIC_FINAL_SNAPSHOT_TYPES.has(resourceType) || PRE_DELETE_SNAPSHOT_TYPES.has(resourceType))) return [];
+	const { prefix, sanitized, kept } = finalSnapshotNameCut(physicalId, resourceType);
+	const spellings = [];
+	for (const needle of needles) {
+		const folded = needle.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-");
+		if (folded.length < 4) continue;
+		for (let at = sanitized.indexOf(folded); at !== -1; at = sanitized.indexOf(folded, at + 1)) {
+			if (at >= kept) break;
+			if (at + folded.length > kept) spellings.push(prefix);
+			else if (folded !== needle) spellings.push(folded);
+		}
+	}
+	return spellings;
+}
 function secretNamesReadBy(logicalId, record, resources, judge = () => ({
 	secrets: void 0,
 	embedded: void 0
@@ -35127,7 +35157,7 @@ async function provisionUpdate(logicalId, change, stateResources, stackName, tem
 		return;
 	}
 	this.refuseRedactedAttributeReads(logicalId, resourceType, context);
-	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType), STATE_RESOURCES_MALFORMED)));
+	if (!(currentResource.resourceType === "AWS::CloudFormation::Stack" && currentResource.provisionedBy !== "cc-api") && !hasAddressablePhysicalId(currentResource)) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(unaddressableUpdateRefusalMessage(stackName, this.stackRegion, logicalId, oldResourceType, this.options.refusalRecovery), STATE_RESOURCES_MALFORMED)));
 	this.attemptedResolvedProps.set(logicalId, resolvedProps);
 	const noEchoHeldPaths = /* @__PURE__ */ new Set();
 	if (change.propertyChanges?.some((pc) => pc.requiresReplacement) === true) {
@@ -35781,15 +35811,21 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 		renderer.removeTask(logicalId);
 		const skipLine = formatResourceLine("skipped", logicalId, resourceType, `skipped (${reason})`);
 		this.logger.info(safeMsg`${skipPrefix}${skipLine}`);
-		const showCommand = pasteableCommand("cdkd state show", [{
-			value: stackName,
-			hole: "stack",
-			opts: { plainIdent: true }
-		}, {
-			flag: "--stack-region",
-			value: this.stackRegion,
-			hole: "region"
-		}]).command;
+		const recovery = this.options.refusalRecovery;
+		const account = accountArgs(recovery);
+		const showCommand = pasteableCommand("cdkd state show", [
+			{
+				value: stackName,
+				hole: "stack",
+				opts: { plainIdent: true }
+			},
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			...account
+		]).command;
 		const dropCommand = pasteableCommand("cdkd state orphan", [
 			{
 				value: stackName,
@@ -35806,9 +35842,11 @@ async function provisionDelete(logicalId, change, stateResources, stackName, tem
 				value: logicalId,
 				hole: "logicalId",
 				opts: { plainIdent: true }
-			}
+			},
+			...account
 		]).command;
-		this.logger.warn(safeMsg`Resource ${displaySafe(logicalId)} (${displaySafe(resourceType)}) has no non-empty string 'physicalId' in its state record, so cdkd cannot address it in AWS and did not try to delete it while removing it from the template. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record's 'physicalId', or delete the resource by hand and drop the record.
+		const accountClause = withheldAccountClause(recovery, "the command lines below print").trimEnd();
+		this.logger.warn(safeMsg`Resource ${displaySafe(logicalId)} (${displaySafe(resourceType)}) has no non-empty string 'physicalId' in its state record, so cdkd cannot address it in AWS and did not try to delete it while removing it from the template. Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record's 'physicalId', or delete the resource by hand and drop the record.${accountClause === "" ? "" : ` ${accountClause}`}
 Inspect it with: ${showCommand}
 Drop the record with: ${dropCommand}`);
 		if (counts) counts.deleteSkipped++;
@@ -35852,16 +35890,23 @@ Drop the record with: ${dropCommand}`);
 		const nested = resourceType === "AWS::CloudFormation::Stack";
 		const recordStack = nested ? nestedChildStackName(stackName, logicalId) : stackName;
 		const interrupted = nested && deleteSkipped.endsWith(" was interrupted");
+		const recovery = this.options.refusalRecovery;
+		const account = accountArgs(recovery);
+		const accountClause = withheldAccountClause(recovery, "the command lines below print").trimEnd();
 		const stackArg = {
 			value: recordStack,
 			hole: nested ? "child-stack" : "stack",
 			opts: { plainIdent: true }
 		};
-		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + `\nInspect it with: ${pasteableCommand("cdkd state show", [stackArg, {
-			flag: "--stack-region",
-			value: this.stackRegion,
-			hole: "region"
-		}]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
+		this.logger.warn(deleteSkippedMessage(logicalId, currentResource.physicalId, deleteSkipped, "while removing it from the template") + ". Its cdkd state record was KEPT, so the next 'cdkd deploy' re-attempts the delete. Repair the record first (for a nested stack it is the CHILD's own state, whose other resources may already be gone), or delete the resource by hand and drop the record." + (interrupted ? " The commands name the child stack record. Its destroy was interrupted: re-run 'cdkd deploy' to resume it, and drop the child record only if that cannot finish, after deleting by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop)." : nested ? " The commands name the child stack record. Dropping it drops every record the child still has and nothing reaches those resources again, so first delete by hand what the child still holds (the inspect command with --show-nested lists every level; a child with nested stacks of its own has records under '<child>~<logicalId>' too, each needing the same drop). The next 'cdkd deploy' then removes this row." : " Keep '--resource' on the drop: without it the command drops the record of every resource in this still-deployed stack.") + (accountClause === "" ? "" : ` ${accountClause}`) + `\nInspect it with: ${pasteableCommand("cdkd state show", [
+			stackArg,
+			{
+				flag: "--stack-region",
+				value: this.stackRegion,
+				hole: "region"
+			},
+			...account
+		]).command}\nDrop the record with: ${pasteableCommand("cdkd state orphan", [
 			stackArg,
 			{
 				flag: "--stack-region",
@@ -35873,7 +35918,8 @@ Drop the record with: ${dropCommand}`);
 				value: logicalId,
 				hole: "logicalId",
 				opts: { plainIdent: true }
-			}]
+			}],
+			...account
 		]).command}`);
 		if (counts) counts.deleteSkipped++;
 		return { deleteSkipped };
@@ -37324,12 +37370,12 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 		};
 		const currentEtag = currentStateData?.etag;
 		this.healBaseline = currentState.resources ?? {};
-		refuseMalformedOutputs(currentState, stackName, this.stackRegion);
-		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion);
-		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion);
-		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion);
-		refuseMalformedOrphans(currentState, stackName, this.stackRegion);
-		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion);
+		refuseMalformedOutputs(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		refuseMalformedResourcesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		refuseMalformedResourceEntriesForDeploy(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		refuseMalformedResourceProperties(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		refuseMalformedOrphans(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
+		refuseMalformedOrphanRecords(currentState, stackName, this.stackRegion, this.options.refusalRecovery);
 		const migrationPending = currentStateData?.migrationPending ?? false;
 		this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 		if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -37426,7 +37472,7 @@ async function doDeployWithPrefetch(stackName, template, createOnlyPrefetch) {
 			sources: maskedInputSourcesForDiff,
 			rebaselined: /* @__PURE__ */ new Map()
 		};
-		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs);
+		const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry), this.providerRegistry.getAllowedUnsupportedProperties?.(), this.freshNoEchoParameters(parameterValues), this.diffLogMasker(diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues), recreateTargetIdsFor(this.options.recreateTargets, stackName), maskedInputs, this.options.refusalRecovery);
 		createOnlyPrefetch.cancel();
 		for (const [logicalId, fingerprints] of maskedInputs?.rebaselined ?? []) {
 			const record = currentState.resources[logicalId];
@@ -38104,5 +38150,5 @@ DeployEngine.prototype.replacementNameOrigin = replacementNameOrigin;
 DeployEngine.prototype.orphanedNameCollisionAdvice = orphanedNameCollisionAdvice;
 
 //#endregion
-export { resourcesNamingDeclaredParameter as $, maskSecretsInError as $a, repairMalformedResourceEntriesForReadOnly as $i, deleteSkipReason as $n, ensureAssetStorage as $o, deployRefusesOrphanRowsReason as $r, derivePartitionAndUrlSuffix as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, requireConfigObject as Aa, refuseMalformedOrphans as Ai, acquireIdempotencyToken as An, acceptedCreateOnlyDropsOf as Ao, s3BucketWebsiteUrl as Ar, getDefaultStateBucketName as As, planRollback as At, getPriorAttempts as B, TemplateParser as Ba, refuseMalformedResourceEntriesForImportSave as Bi, CC_BROKEN_REASON as Bn, orphansCarriedFrom as Bo, AWS_NO_VALUE as Br, stateBucketExistenceConfirmed as Bs, updatePartialMessage as Bt, perType as C, coerceCfnInteger as Ca, malformedScrubResourceEntriesRefusalMessage as Ci, findDestructiveChanges as Cn, WHOLE_DYNAMIC_REFERENCE_PATTERN as Co, callerEnvCredentials as Cr, warnFinchArgvExposure as Cs, getStackRecords as Ct, beginDeleteWait as D, readConfigString as Da, refuseMalformedNestedChildOutputs as Di, ledgerForStack as Dn, S3StateBackend as Do, s3BucketDomainName as Dr, getDockerImageBySourceHash as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configStringRefusal as Ea, refuseDivergentRecordRegionForDestroy as Ei, earliestDefined as En, isLockInfoExpired as Eo, s3BucketArn as Er, AssetManifestLoader as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, withRetry as Fa, refuseMalformedResourceAttributesForOrphan as Fi, refuseMalformedDesiredTags as Fn, hasUnverifiableParameterRefusal as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveCaptureObservedState as Fs, inheritProducerRegions as Ft, cyan as G, literalSplitDelimitersOf as Ga, refuseMalformedResourcePropertiesForOrphan as Gi, getCurrentResourceSecrets as Gn, WorkGraph as Go, withSharedDrainBudget as Gr, MIGRATE_TMP_PREFIX as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, carryLogOnlyValues as Ha, refuseMalformedResourcePropertiesForDestroy as Hi, ccBrokenReason as Hn, AssetPublisher as Ho, isStalePlaceholderArnAttribute as Hr, ssmResolvedValueType as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, canonicalLambdaFunctionName as Ia, refuseMalformedResourceEntries as Ii, tagMapAsList as In, importableOutputKeys as Io, carriesDynamicReference as Ir, resolveSkipPrefix as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, recordLogOnlyParameterValue as Ja, refuseMalformedResourcesForExport as Ji, slowCcOperationTimeoutMs as Jn, loadPublishableAssetManifest as Jo, JSON_LISTING_HOLE_VALUE as Jr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, logOnlyValueCount as Ka, refuseMalformedResourcesForDeploy as Ki, withPrintingSecrets as Kn, buildAssetRedirectMap as Ko, parameterInputsFor as Kr, findLargeInlineResources as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, lambdaFunctionNameForMask as La, refuseMalformedResourceEntriesForDeploy as Li, tagPlanWarning as Ln, importableOutputs as Lo, carriesFetchableDynamicReference as Lr, resolveStateBucketWithDefault as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, prefetchCreateOnlyPropertyPaths as Ma, refuseMalformedOrphansForOrphan as Mi, DBPROXY_TAG_OPTIONS as Mn, exportNamesCarriedFrom as Mo, isUnboundTemplateParameter as Mr, loadCdkJson as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, templateResourceTypes as Na, refuseMalformedOutputs as Ni, planTagDiff as Nn, hasReadableExportSet as No, parameterTypeMayLoseSecretIdentity as Nr, resolveApp as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, replayWarn as Oa, refuseMalformedOrphanRecords as Oi, reserveStackCreateToken as On, rebuildClientForBucketRegion as Oo, s3BucketDualStackDomainName as Or, Synthesizer as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, describeTypeWithThrottleRetry as Pa, refuseMalformedOutputsForDestroy as Pi, readTagList as Pn, hasReasonlessBaselineRefusal as Po, getAccountInfo as Pr, resolveAutoAssetStorage as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, errorCauseChain as Qa, repairMalformedOutputsForReadOnly as Qi, deleteIndeterminateGuards as Qn, assertAssetBucketRegion as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, canonicalizeRegion as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, sameLambdaFunctionAddress as Ra, refuseMalformedResourceEntriesForDestroy as Ri, definedAttributes as Rn, isReadableBag as Ro, isNamelessDynamicReferenceError as Rr, resolveStateBucketWithDefaultAndSource as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, coerceCfnBoolean as Sa, malformedResourcesWarning as Si, constructPathOf as Sn, TEMPLATE_SOURCED_RULES as So, applyCallerIdentityCredentials as Sr, runDockerStreaming as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, configIntegerRefusal as Ta, previewableOrphanRecords as Ti, RollbackInlinePolicyWriters as Tn, LockManager as To, isSettledInstanceState as Tr, stripControlChars as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, createUnionSecretMasker as Ua, refuseMalformedResourcePropertiesForDrift as Ui, wouldReturnToSdkProvider as Un, isSensitiveAttributeName as Uo, refStateLookupFromResource as Ur, CFN_TEMPLATE_BODY_LIMIT as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, liveMatchesUnresolvedTokenFrame as Va, refuseMalformedResourceEntriesForOrphan as Vi, ProviderRegistry as Vn, shouldRetainResource as Vo, cfnRefValueFromPhysicalId as Vr, warnDeprecatedNoPrefixCliFlag as Vs, updatePartialReason as Vt, bold as W, hasMaskableValues as Wa, refuseMalformedResourcePropertiesForExport as Wi, isCustomResourceType as Wn, stringifyValue as Wo, parseWebACLArn as Wr, CFN_TEMPLATE_URL_LIMIT as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, shareLogOnlyValues as Xa, repairMalformedOrphanRecordsForReadOnly as Xi, unchangedBehindSecretReference as Xn, AssetModeResolver as Xo, STATE_RESOURCES_MALFORMED as Xr, expectedOwnerParam as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, recordLogOnlyValue as Ya, refuseMalformedState as Yi, ccProtectionRegistryTypes as Yn, rewriteTemplateAssetReferences as Yo, STATE_REGION_DIVERGED as Yr, decodeListingKey as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, createSecretMasker as Za, repairMalformedOrphansForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, BOOTSTRAP_MARKER_PREFIX as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, PARTITION_TABLE as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, WARM_THROUGHPUT_MEMBERS as _a, malformedOutputsRefusalMessage as _i, isExportAliasCollision as _n, recordProvenPublicExpression as _o, assertSendableRoleArn as _r, isMalformedEnvKey as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, findActionableSilentDrops as aa, hasPlainPrototype$1 as ac, isReadableResourceEntry as ai, extractDeploymentEventError as an, dynamicReferenceTokens as ao, isTerminationProtectionPropagationError as ar, validateContainerRepoName as as, makeSiblingClaimReader as at, recordedProtectionNote as b, toCfnInteger as ba, malformedResourceEntriesWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, STATE_SOURCED_CROSS_GENERATION_RULES as bo, sendableAssumeRoleCommand as br, redactedDockerCause as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, withoutSilentDropProperties as ca, absoluteAssemblyPathEscape as cc, malformedExportSourceWarning as ci, exportAliasCollisionScrubWarning as cn, inheritNestedStackParameterAssociations as co, reEnableInstanceApiTermination as cr, resolveDockerContextDirectory as cs, displacedOpClause as ct, conditionInputsFrom as d, findReplacedReadersOfRecreateTargets as da, renderAssemblyPathEscape as dc, malformedLocalResourcesWarning as di, secretSafeKeyDisplay as dn, identityKeyFor as do, IntrinsicFunctionResolver as dr, describeDockerFailure as ds, getNestedRevertRun as dt, repairMalformedResourcePropertiesForReadOnly as ea, AssemblyReader as ec, displayLogicalId as ei, isFinalSnapshotError as en, maskSecretsInText as eo, withIndeterminateGuard as er, getBootstrapMarkerKey as es, deleteJournaledOrphans as et, parentSuppliedValues as f, shownType as fa, resolveAssemblyPath as fc, malformedOrphanRecordsRefusalMessage as fi, exportNameSecretExposure as fn, carriesSecretMask as fo, classifyReplaySecretRegion as fr, dockerSpawnEnvWithSensitive as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, renderStatefulReason as ga, malformedOrphansWarning as gi, collectPublishedOutputNames as gn, recordNoEchoAttributeValues as go, assertFlagRoleArn as gr, isDockerClientEnvKey as gs, withNestedRevertRun as gt, keptWholeReasonText as h, isStatefulRecreateTargetSync as ha, malformedOrphansRefusalMessage as hi, collectDeclaredOutputNames as hn, recordMaskOnlyValuesIn as ho, applyRoleArnIfSet as hr, getDockerCmd as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableResourceEntries as ia, hasOwnKey as ic, isReadableOrphanRecord as ii, DeploymentEventsStore as in, DYNAMIC_REFERENCE_TOKEN_SCAN as io, ec2InstanceProtectionSite as ir, validateAssetBucketName as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigString as ja, refuseMalformedOrphansForDestroy as ji, DBPROXY_TAGS_WHAT as jn, describeRegionValueKind as jo, coerceParameterTypedValue as jr, getLegacyStateBucketName as js, replacementNeverSwapped as jt, deleteBudgetKey as k, requireConfigArray as ka, refuseMalformedOrphanRecordsForDestroy as ki, withCreateTokenLedger as kn, splitImportedOps as ko, s3BucketRegionalDomainName as kr, synthesisStatusMessage as ks, planFailedOps as kt, templateIdentity as l, NO_CC_HANDLERS_REASON as la, describeFileReadFailure as lc, malformedLocalOutputsWarning as li, secretBearing as ln, recordNestedStackParameterExpressions as lo, DiffCalculator as lr, describeDockerCapturedOutput as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, isStatefulRecreateTargetForReplace as ma, resolveBucketRegion as mc, malformedOrphanRowsKeptWarning as mi, noEchoParameterValueSeed as mn, recordMaskOnlyValue as mo, regionLessSecretName as mr, formatDockerLoginError as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, unpreviewableOrphanRecords as na, processStackMessages as nc, hasReadableOutputs as ni, unsupportedFinalSnapshotError as nn, redactSecretsForState as no, markWaitAbandoned as nr, parseBootstrapMarker as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, findSilentDropProperties as oa, nullPrototypeRecord as oc, malformedDriftResourcePropertiesWarning as oi, WITHHELD_NAME_DISPLAY as on, isUncertifiedBaselineMaskPosition as oo, observeThenDisableInstanceApiTermination as or, buildDenyExternalAccessPolicy as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, MULTI_REGION_RECREATE_BLOCKED_TYPES as pa, clearBucketRegionCache as pc, malformedOrphanRecordsWarning as pi, isWholeDynamicReferenceValue as pn, provenPublicValue as po, producerRegionsFromState as pr, finchSecretArgvRefusal as ps, recordDisplacedSkips as pt, green as q, printingCorpusOf as qa, refuseMalformedResourcesForDestroy as qi, CloudControlProvider as qn, createAssetRedirectResolver as qo, passedParameterClassesOf as qr, uploadCfnTemplate as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unreadableOrphanRecords as ra, defineOwnKey as rc, hasReadableResources as ri, DeploymentEventsReader as rn, scrubResourceRecord as ro, disableInstanceApiTermination as rr, readBootstrapMarkerBody as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, unwrittenCreateOnlyReplacement as sa, ownValue as sc, malformedExportNamesWarning as si, displayTextOrWithheld as sn, pathCrossesDottedKey as so, reDisableInstanceApiTermination as sr, buildDockerImage as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcesForReadOnly as ta, StageLoadError as tc, hasReadableOrphans as ti, refusesFinalSnapshot as tn, markSameGenerationBag as to, isWaitAbandonedError as tr, isCrossRegionRedirect as ts, isHandledOrphan as tt, conditionFingerprint as u, hasNoCloudControlHandlers as ua, displayAssemblyPath as uc, malformedLocalResourceEntriesWarning as ui, secretBearingStateKeyWarning as un, recoverMaskedOutput as uo, INTRINSIC_KEYS as ur, describeDockerExecFailure as us, dropSettledNestedJournals as ut, withResourceDeadline as v, coerceWarmThroughput as va, malformedOutputsWarning as vi, bindingSkippedOutputs as vn, wholeStringLeavesOf as vo, explicitRoleArnOrThrow as vr, partitionSensitiveEnv as vs, withNestedStackContext as vt, readProtection as w, configBooleanRefusal as wa, malformedStateRefusalMessage as wi, formatDestructiveChange as wn, isSingleDynamicReferenceToken as wo, envCredentialsAreAssumedRole as wr, escapeRegExp$3 as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, toFiniteNumber as xa, malformedResourcePropertiesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_READBACK_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, runDockerForeground as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, isWarmThroughputDecrease as ya, malformedRenderedContainersWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, STATE_SOURCED_BASELINE_RULES as yo, isIamRoleArn as yr, redactDockerArgvValues as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, DagBuilder as za, refuseMalformedResourceEntriesForImport as zi, stringifyIfAssigned as zn, orphansAfterRollback as zo, keepsSecretReferenceToken as zr, resolveUseCdkBootstrapAssets as zs, redactedDeleteAddressSkip as zt };
-//# sourceMappingURL=deploy-engine-wyaJUA8V.js.map
+export { resourcesNamingDeclaredParameter as $, createSecretMasker as $a, repairMalformedOutputsForReadOnly as $i, deleteSkipReason as $n, BOOTSTRAP_MARKER_PREFIX as $o, accountArgs as $r, PARTITION_TABLE as $s, effectiveDeletionPolicy as $t, resolveDynamoDbDeleteBudgetClock as A, replayWarn as Aa, refuseMalformedOrphanRecordsForDestroy as Ai, acquireIdempotencyToken as An, rebuildClientForBucketRegion as Ao, s3BucketWebsiteUrl as Ar, Synthesizer as As, planRollback as At, getPriorAttempts as B, sameLambdaFunctionAddress as Ba, refuseMalformedResourceEntriesForImport as Bi, CC_BROKEN_REASON as Bn, isReadableBag as Bo, AWS_NO_VALUE as Br, resolveStateBucketWithDefaultAndSource as Bs, updatePartialMessage as Bt, perType as C, toFiniteNumber as Ca, malformedResourcesWarning as Ci, findDestructiveChanges as Cn, STATE_SOURCED_READBACK_RULES as Co, callerEnvCredentials as Cr, runDockerForeground as Cs, getStackRecords as Ct, beginDeleteWait as D, configIntegerRefusal as Da, refuseDivergentRecordRegionForDestroy as Di, ledgerForStack as Dn, LockManager as Do, s3BucketDomainName as Dr, stripControlChars as Ds, isJournaledOrphan as Dt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as E, configBooleanRefusal as Ea, previewableOrphanRecords as Ei, earliestDefined as En, isSingleDynamicReferenceToken as Eo, s3BucketArn as Er, escapeRegExp$3 as Es, demoteSupersededOrphans as Et, waitForIndexesSettled as F, templateResourceTypes as Fa, refuseMalformedOutputsForDestroy as Fi, refuseMalformedDesiredTags as Fn, hasReadableExportSet as Fo, isImpossibleEmptyStoredAttribute as Fr, resolveApp as Fs, inheritProducerRegions as Ft, cyan as G, createUnionSecretMasker as Ga, refuseMalformedResourcePropertiesForExport as Gi, getCurrentResourceSecrets as Gn, isSensitiveAttributeName as Go, withSharedDrainBudget as Gr, CFN_TEMPLATE_BODY_LIMIT as Gs, orphanRecordsPrintingBag as Gt, formatResourceLine as H, TemplateParser as Ha, refuseMalformedResourceEntriesForOrphan as Hi, ccBrokenReason as Hn, orphansCarriedFrom as Ho, isStalePlaceholderArnAttribute as Hr, stateBucketExistenceConfirmed as Hs, completedReplayEntries as Ht, ECR_AUTO_DELETE_IMAGES_TAG as I, describeTypeWithThrottleRetry as Ia, refuseMalformedResourceAttributesForOrphan as Ii, tagMapAsList as In, hasReasonlessBaselineRefusal as Io, carriesDynamicReference as Ir, resolveAutoAssetStorage as Is, REDACTED_DELETE_ADDRESS_SKIP_REASON as It, red as J, logOnlyValueCount as Ja, refuseMalformedResourcesForDestroy as Ji, slowCcOperationTimeoutMs as Jn, buildAssetRedirectMap as Jo, JSON_LISTING_HOLE_VALUE as Jr, findLargeInlineResources as Js, ATOMIC_FINAL_SNAPSHOT_TYPES as Jt, gray as K, hasMaskableValues as Ka, refuseMalformedResourcePropertiesForOrphan as Ki, withPrintingSecrets as Kn, stringifyValue as Ko, parameterInputsFor as Kr, CFN_TEMPLATE_URL_LIMIT as Ks, secretNamePrintingBag as Kt, S3_AUTO_DELETE_OBJECTS_TAG as L, withRetry as La, refuseMalformedResourceEntries as Li, tagPlanWarning as Ln, hasUnverifiableParameterRefusal as Lo, carriesFetchableDynamicReference as Lr, resolveCaptureObservedState as Ls, isRedactedRecordedValue as Lt, DELETE_INDEX_WAIT_PROCEED_NOTE as M, requireConfigObject as Ma, refuseMalformedOrphansForDestroy as Mi, DBPROXY_TAG_OPTIONS as Mn, acceptedCreateOnlyDropsOf as Mo, isUnboundTemplateParameter as Mr, getDefaultStateBucketName as Ms, resolveReplacementOldType as Mt, INDEX_SETTLE_POLL_INTERVAL_MS as N, requireConfigString as Na, refuseMalformedOrphansForOrphan as Ni, planTagDiff as Nn, describeRegionValueKind as No, parameterTypeMayLoseSecretIdentity as Nr, getLegacyStateBucketName as Ns, findNestedStackTypeChanges as Nt, compensateRemovedDeletionProtection as O, configStringRefusal as Oa, refuseMalformedNestedChildOutputs as Oi, reserveStackCreateToken as On, isLockInfoExpired as Oo, s3BucketDualStackDomainName as Or, AssetManifestLoader as Os, isReplacementOrphan as Ot, deleteTableWithIndexBusyRetry as P, prefetchCreateOnlyPropertyPaths as Pa, refuseMalformedOutputs as Pi, readTagList as Pn, exportNamesCarriedFrom as Po, getAccountInfo as Pr, loadCdkJson as Ps, getCurrentProducerRegions as Pt, reachableDivergentParameters as Q, shareLogOnlyValues as Qa, repairMalformedOrphansForReadOnly as Qi, deleteIndeterminateGuards as Qn, AssetModeResolver as Qo, UNREADABLE_RESOURCES_MAP_ROW as Qr, expectedOwnerParam as Qs, createPreDeleteFinalSnapshot as Qt, hasCdkAutoDeleteTag as R, canonicalLambdaFunctionName as Ra, refuseMalformedResourceEntriesForDeploy as Ri, definedAttributes as Rn, importableOutputKeys as Ro, isNamelessDynamicReferenceError as Rr, resolveSkipPrefix as Rs, redactedDeleteAddressFields as Rt, isProtectionValueActive as S, toCfnInteger as Sa, malformedResourcePropertiesWarning as Si, constructPathOf as Sn, STATE_SOURCED_CROSS_GENERATION_RULES as So, applyCallerIdentityCredentials as Sr, redactedDockerCause as Ss, destroyStackRecordsView as St, DynamoDBGlobalTableProvider as T, coerceCfnInteger as Ta, malformedStateRefusalMessage as Ti, RollbackInlinePolicyWriters as Tn, WHOLE_DYNAMIC_REFERENCE_PATTERN as To, isSettledInstanceState as Tr, warnFinchArgvExposure as Ts, recordAfterRollbackUpdate as Tt, createReadOnlyAttributeHealerFactory as U, liveMatchesUnresolvedTokenFrame as Ua, refuseMalformedResourcePropertiesForDestroy as Ui, wouldReturnToSdkProvider as Un, shouldRetainResource as Uo, refStateLookupFromResource as Ur, warnDeprecatedNoPrefixCliFlag as Us, journaledOrphanPrintingBag as Ut, markRefusedBeforeApplying as V, DagBuilder as Va, refuseMalformedResourceEntriesForImportSave as Vi, ProviderRegistry as Vn, orphansAfterRollback as Vo, cfnRefValueFromPhysicalId as Vr, resolveUseCdkBootstrapAssets as Vs, updatePartialReason as Vt, bold as W, carryLogOnlyValues as Wa, refuseMalformedResourcePropertiesForDrift as Wi, isCustomResourceType as Wn, AssetPublisher as Wo, parseWebACLArn as Wr, ssmResolvedValueType as Ws, maskEventTextWithBoundBags as Wt, computeParameterTaint as X, recordLogOnlyParameterValue as Xa, refuseMalformedState as Xi, unchangedBehindSecretReference as Xn, loadPublishableAssetManifest as Xo, STATE_RESOURCES_MALFORMED as Xr, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Xs, buildFinalSnapshotIdentifier as Xt, yellow as Y, printingCorpusOf as Ya, refuseMalformedResourcesForExport as Yi, ccProtectionRegistryTypes as Yn, createAssetRedirectResolver as Yo, STATE_REGION_DIVERGED as Yr, uploadCfnTemplate as Ys, PRE_DELETE_SNAPSHOT_TYPES as Yt, namesAnyDeclaredParameter as Z, recordLogOnlyValue as Za, repairMalformedOrphanRecordsForReadOnly as Zi, UNSPECIFIED_SKIP_REASON as Zn, rewriteTemplateAssetReferences as Zo, UNREADABLE_ORPHANS_CONTAINER_ROW as Zr, decodeListingKey as Zs, ccRoutedFinalSnapshotError as Zt, makeCanonicalizePropertiesFn as _, isStatefulRecreateTargetSync as _a, malformedOrphansWarning as _i, isExportAliasCollision as _n, recordMaskOnlyValuesIn as _o, assertSendableRoleArn as _r, getDockerCmd as _s, getCurrentNestedStackContext as _t, findNestedTemplateTreeDefect as a, unreadableResourceEntries as aa, defineOwnKey as ac, isReadableOrphanRecord as ai, extractDeploymentEventError as an, scrubResourceRecord as ao, isTerminationProtectionPropagationError as ar, readBootstrapMarkerBody as as, makeSiblingClaimReader as at, recordedProtectionNote as b, coerceWarmThroughput as ba, malformedRenderedContainersWarning as bi, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, wholeStringLeavesOf as bo, sendableAssumeRoleCommand as br, partitionSensitiveEnv as bs, replayRollback as bt, renderNestedTemplateTreeDefect as c, findSilentDropProperties as ca, nullPrototypeRecord as cc, malformedExportNamesWarning as ci, exportAliasCollisionScrubWarning as cn, isUncertifiedBaselineMaskPosition as co, reEnableInstanceApiTermination as cr, buildDenyExternalAccessPolicy as cs, displacedOpClause as ct, conditionInputsFrom as d, NO_CC_HANDLERS_REASON as da, describeFileReadFailure as dc, malformedLocalResourceEntriesWarning as di, secretSafeKeyDisplay as dn, recordNestedStackParameterExpressions as do, IntrinsicFunctionResolver as dr, describeDockerCapturedOutput as ds, getNestedRevertRun as dt, repairMalformedResourceEntriesForReadOnly as ea, canonicalizeRegion as ec, deployRefusesOrphanRowsReason as ei, isFinalSnapshotError as en, errorCauseChain as eo, withIndeterminateGuard as er, assertAssetBucketRegion as es, deleteJournaledOrphans as et, parentSuppliedValues as f, hasNoCloudControlHandlers as fa, displayAssemblyPath as fc, malformedLocalResourcesWarning as fi, exportNameSecretExposure as fn, recoverMaskedOutput as fo, classifyReplaySecretRegion as fr, describeDockerExecFailure as fs, nestedChildStackName as ft, mergeNoChangeOutputs as g, isStatefulRecreateTargetForReplace as ga, resolveBucketRegion as gc, malformedOrphansRefusalMessage as gi, collectPublishedOutputNames as gn, recordMaskOnlyValue as go, assertFlagRoleArn as gr, formatDockerLoginError as gs, withNestedRevertRun as gt, keptWholeReasonText as h, MULTI_REGION_RECREATE_BLOCKED_TYPES as ha, clearBucketRegionCache as hc, malformedOrphanRowsKeptWarning as hi, collectDeclaredOutputNames as hn, provenPublicValue as ho, applyRoleArnIfSet as hr, finchSecretArgvRefusal as hs, revertedNestedRowIds as ht, childTemplateLoader as i, unreadableOrphanRecords as ia, processStackMessages as ic, hasReadableResources as ii, DeploymentEventsStore as in, redactSecretsForState as io, ec2InstanceProtectionSite as ir, parseBootstrapMarker as is, sameJournaledOrphans as it, resolveDynamoDbDeleteBudgetMs as j, requireConfigArray as ja, refuseMalformedOrphans as ji, DBPROXY_TAGS_WHAT as jn, splitImportedOps as jo, coerceParameterTypedValue as jr, synthesisStatusMessage as js, replacementNeverSwapped as jt, deleteBudgetKey as k, readConfigString as ka, refuseMalformedOrphanRecords as ki, withCreateTokenLedger as kn, S3StateBackend as ko, s3BucketRegionalDomainName as kr, getDockerImageBySourceHash as ks, planFailedOps as kt, templateIdentity as l, unwrittenCreateOnlyReplacement as la, ownValue as lc, malformedExportSourceWarning as li, secretBearing as ln, pathCrossesDottedKey as lo, DiffCalculator as lr, buildDockerImage as ls, displacedPhysicalIdShown as lt, isSecretBearingReferenceString as m, shownType as ma, resolveAssemblyPath as mc, malformedOrphanRecordsWarning as mi, noEchoParameterValueSeed as mn, carriesSecretMask as mo, regionLessSecretName as mr, dockerSpawnEnvWithSensitive as ms, revertNestedChildFromJournal as mt, IMPLICIT_DELETE_DEPENDENCIES as n, repairMalformedResourcesForReadOnly as na, AssemblyReader as nc, hasReadableOrphans as ni, unsupportedFinalSnapshotError as nn, maskSecretsInText as no, markWaitAbandoned as nr, getBootstrapMarkerKey as ns, journaledOrphanLines as nt, isAbsoluteAssetPath as o, withheldAccountClause as oa, hasOwnKey as oc, isReadableResourceEntry as oi, WITHHELD_NAME_DISPLAY as on, DYNAMIC_REFERENCE_TOKEN_SCAN as oo, observeThenDisableInstanceApiTermination as or, validateAssetBucketName as os, planOrphanAdoption as ot, readRecordedConditionVerdicts as p, findReplacedReadersOfRecreateTargets as pa, renderAssemblyPathEscape as pc, malformedOrphanRecordsRefusalMessage as pi, isWholeDynamicReferenceValue as pn, identityKeyFor as po, producerRegionsFromState as pr, describeDockerFailure as ps, recordDisplacedSkips as pt, green as q, literalSplitDelimitersOf as qa, refuseMalformedResourcesForDeploy as qi, CloudControlProvider as qn, WorkGraph as qo, passedParameterClassesOf as qr, MIGRATE_TMP_PREFIX as qs, stateSecretNameNeedles as qt, computeImplicitDeleteEdges as r, unpreviewableOrphanRecords as ra, StageLoadError as rc, hasReadableOutputs as ri, DeploymentEventsReader as rn, markSameGenerationBag as ro, disableInstanceApiTermination as rr, isCrossRegionRedirect as rs, loadJournaledOrphans as rt, listNestedTemplateRows as s, findActionableSilentDrops as sa, hasPlainPrototype$1 as sc, malformedDriftResourcePropertiesWarning as si, displayTextOrWithheld as sn, dynamicReferenceTokens as so, reDisableInstanceApiTermination as sr, validateContainerRepoName as ss, NESTED_PENDING_PARENT_REASON as st, DeployEngine as t, repairMalformedResourcePropertiesForReadOnly as ta, derivePartitionAndUrlSuffix as tc, displayLogicalId as ti, refusesFinalSnapshot as tn, maskSecretsInError as to, isWaitAbandonedError as tr, ensureAssetStorage as ts, isHandledOrphan as tt, conditionFingerprint as u, withoutSilentDropProperties as ua, absoluteAssemblyPathEscape as uc, malformedLocalOutputsWarning as ui, secretBearingStateKeyWarning as un, inheritNestedStackParameterAssociations as uo, INTRINSIC_KEYS as ur, resolveDockerContextDirectory as us, dropSettledNestedJournals as ut, withResourceDeadline as v, renderStatefulReason as va, malformedOutputsRefusalMessage as vi, bindingSkippedOutputs as vn, recordNoEchoAttributeValues as vo, explicitRoleArnOrThrow as vr, isDockerClientEnvKey as vs, withNestedStackContext as vt, readProtection as w, coerceCfnBoolean as wa, malformedScrubResourceEntriesRefusalMessage as wi, formatDestructiveChange as wn, TEMPLATE_SOURCED_RULES as wo, envCredentialsAreAssumedRole as wr, runDockerStreaming as ws, withStackRecords as wt, PROTECTION_PROPERTY_BY_TYPE as x, isWarmThroughputDecrease as xa, malformedResourceEntriesWarning as xi, maskingRetryLogger as xn, STATE_SOURCED_BASELINE_RULES as xo, AWS_CREDENTIAL_ENV_KEYS as xr, redactDockerArgvValues as xs, awaitInFlightSibling as xt, recordedProtectionEvidence as y, WARM_THROUGHPUT_MEMBERS as ya, malformedOutputsWarning as yi, DEFAULT_RESOURCE_TIMEOUT_MS as yn, recordProvenPublicExpression as yo, isIamRoleArn as yr, isMalformedEnvKey as ys, replayFailedOperations as yt, isTruthyCfnBoolean as z, lambdaFunctionNameForMask as za, refuseMalformedResourceEntriesForDestroy as zi, stringifyIfAssigned as zn, importableOutputs as zo, keepsSecretReferenceToken as zr, resolveStateBucketWithDefault as zs, redactedDeleteAddressSkip as zt };
+//# sourceMappingURL=deploy-engine-B-oaHd2t.js.map